Privacy Policy

1. Who we are

1.1. TakeTurn is operated by RETROBOND TEKNOLOJİ BİLİŞİM LİMİTED ŞİRKETİ, a limited liability company established in Turkey, with its registered address at Cumhuriyet Mah. Fatih Sultan Mehmet Blv. Cadde 224 No: 41 A/A, Nilüfer, Bursa, Türkiye (MERSİS No. 0734276305800001). In this Policy, "TakeTurn", "we", "us" and "our" mean this company.

1.2. We are the controller of your personal data. This means we decide why and how it is used. Under some laws we are called the "data controller" (EU, UK, Turkey), "data fiduciary" (India) or "personal information handling business operator" (Japan).

1.3. This Privacy Policy applies to the TakeTurn apps for iOS and Android, the website at taketurn.co and related services (together, the "Service").

1.4. Key term. A "Take" is a photo captured with the TakeTurn in-app camera and sent through the Service, together with its caption.

1.5. Contact. Section 19 explains how to contact us about anything in this Policy.

1.6. This Privacy Policy should be read together with our Terms of Service, Community Guidelines and Safety Center. Section 16 is also our cookie notice (/cookies/). Our Law Enforcement Guidelines explain how we handle requests from authorities.

2. What we collect

2.1. Information you give us

2.2. Information created when you use TakeTurn

2.3. Information collected automatically

2.4. Information stored only on your phone

Your chats list (the order and look of your conversations) and your Activity history are stored on your phone, not on our servers. They are stored encrypted on your phone (AES-256, with a key kept in the iOS Keychain or the Android Keystore, for that phone only), and so are your profile numbers (such as streaks and catches), the last copy of your Friends tab (friend requests, friends and suggestions, so the tab opens at once) and any reports you wrote that have not been sent yet. Your sign-in session is kept in the iOS Keychain or Android Keystore of that phone. Your "Blur potentially sensitive Takes" setting, and whether you chose View or Close on a sensitive Take, stay on your phone and are never sent to us. A photo you chose during sign-up may be kept on your phone until sign-up is finished. These phone copies are not included in your phone's cloud or computer backups. Activity items clear automatically after 2 weeks, and everything listed here is cleared from your phone when you log out or uninstall the app. On a new phone you start with an empty Activity, except for notices from TakeTurn (see below).

To deliver Takes, our servers do process what is needed for each conversation: who sent a Take to whom, its timers and whether it was opened, caught, missed or unsent ("Take delivery status", Section 2.2). We do not keep a chats list or an order of your conversations. An Activity item stays on our servers only until your phone has received it, and is then deleted; items your phone never received are deleted after 2 weeks. The one exception is notices from TakeTurn itself, such as warnings, limits, and report and appeal results: these are kept on our servers for their normal period (Section 10), so they appear again in the TakeTurn chat and in Activity when you sign in on a new phone.

2.5. What we do not collect

• We do not upload or access your contacts.
• We do not collect your precise location (GPS).
• We do not use your microphone. TakeTurn is photos only.
• We do not access your photo gallery for Takes. Takes are captured live.
• We use your camera only when you open it in the app.
• We do not use advertising identifiers, ad tracking, or third-party advertising tools.
• We do not create face templates, faceprints or any other biometric identifiers.

3. How Takes work, and when they are deleted

3.1. Sending. When you send a Take, it is uploaded, encrypted, to temporary storage on Cloudflare R2.

3.2. Catching and viewing. Recipients see a blurred version and the caption. If they reply with their own Take, they can view yours once, for up to 15 seconds. The app does not save Takes, and users cannot save other people's Takes in the app.

3.3. Deletion from our servers. We delete a Take from our servers when:

• it has been viewed;
• its catch time (5 minutes to 12 hours) runs out and it is missed; or
• you unsend it (possible until your friend starts replying).

3.4. Safety copy (up to 24 hours). To let people report harmful content after it disappears, we keep each Take a user received, encrypted, for up to 24 hours after it is delivered, and then delete it. Nobody looks at it unless it is reported. If it is reported, it is kept with the report for the period in Section 10.

3.5. Reported Takes. If a Take is reported, the report covers the Takes that person sent the reporter in the last 24 hours. We keep the reported content only as long as needed to review it, handle any appeal, and meet our legal obligations. Then we delete it.

3.6. Child sexual abuse material (CSAM). If reported or discovered content appears to be CSAM, or shows apparent child sex trafficking or online enticement of a child, US law (18 U.S.C. § 2258A) requires us to report it to the National Center for Missing & Exploited Children (NCMEC) and to preserve it, together with related account information, for the period the law requires (currently one year), or longer if law enforcement asks us to.

3.7. What we cannot control. The app blocks screenshots and screen recordings while a Take is on screen, and where your phone tells the app about an attempt to capture, record or mirror the screen, we notify the person whose Take was on screen (on some older Android versions the phone does not tell the app, so no notification is sent, but the Take is still protected). No app can stop every capture: for example, someone could photograph the screen with another phone, or a rare system error could let a capture through. Once content is captured outside TakeTurn, we cannot delete it.

3.8. Intimate images shared without consent. If someone asks us to remove an intimate image of them that was shared without their consent, we remove it within 48 hours of a valid request (24 hours in India) and make reasonable efforts to remove identical copies on TakeTurn (see our Safety Center). We keep the request and a record of what we did to show that we complied with the law, for the period in Section 10.

3.9. No automatic scanning of Takes for CSAM. We do not automatically scan Takes for child sexual abuse material, on our servers or anywhere else. (The only automatic check of Takes is the sensitive-content check on the phones described in Section 3.10: it uploads nothing and only produces a yes/no "may be sensitive" mark.) If someone reports content, or we otherwise learn of apparent child sexual abuse material (CSAM), a person on our team reviews it. We remove apparent CSAM, permanently ban the account (never restored), and report it to the National Center for Missing & Exploited Children (NCMEC) or the competent authority as the law requires; this is the only case in which we share such content. We keep the reported content for the period the law requires (in the US, one year after the report). If we add automated matching later, we will tell you here before it starts. See our Child Safety Standards.

3.10. Sensitive-content check on the phones. Before a Take is sent, the sender's phone checks the photo with a classifier that is part of the app. It looks only for nudity and sexual content (not for other things, such as violence). If it thinks the photo may be sensitive, only a yes/no mark ("may contain sensitive content") travels with the Take. The recipient's phone checks the photo again right before it opens. The photo is never sent anywhere for these checks, the result is not stored on our servers beyond that yes/no mark, and the sender sees nothing. If "Blur potentially sensitive Takes" is on (Settings > Sensitive content; it is on by default), the recipient sees a warning first and chooses Close or View. When the recipient's own check (not the sender's mark) leads to the warning, their phone tells our server only that a warning is on screen, so screenshots and recordings during the warning are still reported to the sender as for any other Take (Section 3.7); this is kept with the exchange only until the Take is gone, and the sender is never told that a warning was shown. Profile photos you choose are checked the same way on your phone (or, when you join on our website, in your browser) before they are used: a photo that may contain sensitive content, or that could not be checked, cannot be used, and nothing about that check is sent to us. In the app, your phone also checks that a profile photo shows a face (a face detector that is part of the app and runs on the phone, the same on iPhone and Android; it only finds whether there is a face and how big it is, never who it is); this happens only on your phone, the photo is not uploaded for it, and no face data is kept. The check can be wrong in both directions: it may miss a sensitive photo or blur an ordinary one. It does not decide anything about your account; only reports reviewed by a person do. Nobody at TakeTurn sees a Take because of this check; the only way our team sees Takes is a report, which sends the Takes that person sent the reporter in the last 24 hours (Section 3.5).

4. Verification and age-check selfies

4.1. Why we ask. We ask for a selfie when you join the waiting list, and when you choose to verify your profile. It helps us confirm that a real person who matches the profile photo is behind each account. This keeps fake accounts and impersonation off TakeTurn.

Age-check selfie. If we have reason to believe an account may belong to someone under 18, we put it under review and may ask for a selfie to verify the person's age ("Verify your age"). A person on our team looks at it only to decide whether the account holder is 18 or older. The same rules as below apply: it is never shown to other users, never used for facial recognition, and deleted right after the decision.

4.2. How it is checked. A human moderator on our team compares the selfie with your profile photo (or, for an age check, looks at whether you appear to be 18 or older). There is no automated face matching or age estimation.

4.3. What we never do. We never show your selfie to other users. We do not use it for facial recognition. We do not create a face template, faceprint, face geometry or any other biometric identifier from it.

4.4. Deletion. We delete the selfie right after the verification decision. We keep only the result (for example, approved or rejected), the date, and the number of attempts. If 5 attempts are rejected within a week, you cannot try again for a week.

4.5. Withdrawing your application. You can withdraw your waiting-list application at any time: while you are on the waiting list, while it is being reviewed, and after it was not approved ("Withdraw application"). When you withdraw, we delete your selfie (if we still have it), release your username and cancel any pending references, and your sign-up goes back to the start.

5. How and why we use your information

Under the EU and UK General Data Protection Regulation (GDPR, Article 6) and similar laws, we must have a legal reason ("legal basis") for each use of your data. The table below explains what we use, why, and on what basis.

Legitimate interests. Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for more information about this balancing, and you have the right to object (see Section 11).

If you do not provide information. Some information is needed to run TakeTurn (for example, your birthday, first name, username and profile photo). Without it, we cannot create your account.

No advertising, no profiling for ads. We do not use your data for advertising, and we do not build advertising profiles. When you delete your account, we delete the link between your account and its random code; the statistics that were already counted can then no longer be tied to you. Our usage statistics are made on our own servers, are not shared with anyone, are not linked to other apps or websites, and are not used to track you for advertising. They are only counted as totals (for example, how many people were active on a day) and as how many people of a group came back after a number of days.

Special categories of data. We do not ask for sensitive information such as health, religion or sexual orientation. Photos can sometimes reveal such things. We do not try to infer sensitive information from photos, and we process Takes only to deliver them and, if reported, to review them.

6. Automated decisions

6.1. Every report is reviewed by a person.

6.2. To protect against misuse of reporting, only reports from verified accounts count toward automated thresholds. When enough different verified users report the same account within a short time (fewer are needed for child-safety reports), the account is automatically limited (see our Terms of Service, Section 11.3) until a person reviews it. A threshold never suspends, removes or bans an account.

6.3. We do not make final decisions that have legal or similarly significant effects on you, such as suspending or removing your account, by automated means alone. A person always makes those decisions. You can always ask for a human review and appeal (see our Terms of Service, Section 11).

7. Who can see your information

7.1. Other TakeTurn users can see:

• your first name, username, profile photo, card color and verification badge (if you have one);
• your friends count, streak and catches (people who are not your friends see a limited version of your profile);
• mutual friends;
• Takes and captions you send them;
• that they may know you, through "People you may know" suggestions (see Section 7.4); and
• a green dot on your photo if you opened TakeTurn in the last 48 hours ("activity status"). Only your friends can see it; people who are not your friends never see it (not in suggestions, search, requests, Activity or on your profile), and neither do people you blocked or who blocked you. It never shows a time. If you turn off Settings > Privacy > Show my activity status, nobody sees your dot, and you no longer see anyone else's.

7.2. Other users never see your birthday, email address, verification selfie, IP address, or who reported them.

7.3. Notifications on your lock screen never show the photo or caption of a Take.

7.4. "People you may know". We suggest people mainly through your friend network: people connected to you through your friends, and through their friends, with closer people and more friends in common first ("People you may know"), people who recently joined your friend network ("New in your circle") and people with many friends in your network ("Popular in your circle"). When your network gives few suggestions, for example right after you join, we may also suggest people in your country (or nearby countries): people who joined recently ("New on TakeTurn") and, to fill "People you may know", people who are very active (they opened TakeTurn in the last 3 days; those with the most catches come first), then other recent joiners. This activity is used only on our servers, to choose and order these suggestions. It is never shown to anyone: suggestions never show when someone last opened the app or how many catches they have. We estimate your country from your IP address; it is never shown to anyone, and other users never see why someone was suggested. We do this on the basis of our legitimate interest in helping people find friends. You can object at any time. There is no switch for this in the app: write to us in the app (Settings > Report an issue > Privacy request or a copy of my data), through the form at taketurn.co/support, or by email to support@taketurn.co (Section 11.3). We will then stop suggesting you to others, so your country and your activity are no longer used to suggest you to anyone, and stop using your country for your suggestions, so you no longer get the country-based suggestions described above (suggestions through your friend network continue).

8. Who we share information with

We do not sell your personal information. We do not share it for targeted or cross-context behavioral advertising. We share information only as described below.

8.1. Service providers (processors)

We use a small number of service providers that process data on our behalf, under contracts that require them to protect it and use it only to provide services to us.

Apple and Google may also process information when you download the app from their app stores. That is covered by their own privacy policies.

8.2. Legal and safety reasons

We may share information:

• with NCMEC, when we report apparent child sexual abuse material as US law requires. NCMEC may share reports with law enforcement in the US and other countries;
• with law enforcement, courts or other authorities, when we believe in good faith that the law requires it (for example, a valid court order or subpoena), or to respond to a lawful request from an EU Member State authority under the Digital Services Act;
• with authorities, when we believe in good faith that sharing is needed to prevent death or serious physical harm, or when we suspect a criminal offense that threatens someone's life or safety; and
• to establish, exercise or defend legal claims, or to protect the rights, property or safety of TakeTurn, our users or the public.

Where the law allows and it is safe to do so, we will tell you before we share your information in response to a legal request. Our Law Enforcement Guidelines explain what legal process we require.

8.3. Business changes

If we are involved in a merger, acquisition, financing, reorganization or sale of assets, your information may be transferred as part of that deal. The new owner must continue to protect it under this Privacy Policy, or tell you about any changes and your choices.

8.4. With your permission

We may share information for other reasons if you ask us to or agree to it.

9. International transfers

9.1. TakeTurn is run from Turkey, where our company is established. Our data is stored and processed on our service providers' servers, mainly in the United States and in other countries where they operate (Cloudflare runs a worldwide network). Our team may access it from Turkey.

9.2. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to countries that do not have an adequacy decision, we use appropriate safeguards. These include the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and, where a provider is certified, the EU-US Data Privacy Framework and its UK and Swiss extensions. We also use technical measures such as encryption.

9.3. For transfers from Turkey, we rely on the safeguards allowed under Article 9 of the Turkish Personal Data Protection Law (KVKK), such as standard contracts notified to the Turkish Personal Data Protection Authority as required, or other lawful grounds.

9.4. For transfers from Brazil, we rely on the mechanisms permitted under the LGPD, such as standard contractual clauses approved by the ANPD.

9.5. For transfers from Japan, see Section 12.7.

9.6. You can ask us for a copy of the safeguards we use (Section 19).

9.7. Turkey, Cloudflare and Google. Your data is processed on Cloudflare's servers, which are not in Turkey, and, once crash reporting is switched on (Section 2.3), crash data goes to Google (Crashlytics). We therefore treat this as a transfer abroad under Article 9 of the KVKK. Our basis is the safeguards in Article 9 (standard contract signed with the recipient and notified to the Personal Data Protection Authority within the legal period), not your explicit consent. See the Turkish notice (KVKK aydınlatma metni).

10. How long we keep information

We keep information only as long as we need it for the purposes in this Policy. Here is how long:

We may keep information longer if we are legally required to (for example, a court order or legal hold), or to establish, exercise or defend legal claims. When we no longer need information, we delete it or make sure it can no longer be linked to you.

11. Your rights and choices

11.1. Choices in the app

• Notifications: choose which categories you receive in Settings. Account and safety notices are always on. You can also turn off notifications in your phone's settings.
• Camera: you can turn off camera access in your phone's settings at any time (but you will not be able to take Takes).
• Friends and blocking: remove friends, block people, and cancel friend requests at any time.
• Pause: hide your account from search and stop friends from sending you Takes. Come back by signing in.
• Activity status: turn off Settings > Privacy > Show my activity status to hide your green dot (you then no longer see others' dots).
• Sensitive content: choose in Settings > Sensitive content whether Takes that may be sensitive are blurred first. This choice stays on your phone.
• Waiting list: withdraw your application at any time (Section 4.5).
• Delete: delete your account in Settings (see Section 13).

11.2. Your privacy rights

Depending on where you live, you may have the right to:

• access your personal data and get a copy of it;
• correct inaccurate or incomplete data;
• delete your data;
• receive your data in a portable format and, where possible, have it sent to another service;
• object to processing based on legitimate interests;
• restrict how we use your data in certain cases;
• withdraw consent at any time, where we rely on consent (this does not affect processing before you withdrew it);
• not be subject to decisions made solely by automated means that significantly affect you;
• appeal a decision we make about your request; and
• complain to a data protection authority.

We will not treat you differently for using your rights.

Section 12 explains the rights that apply in specific places. We honor the core rights of access, correction, deletion and portability for all users, wherever they live.

11.3. How to use your rights

• In the app: go to Settings > Report an issue and choose privacy, or use the account settings to change or delete your data.
• On the web or by email: use the form at taketurn.co/support or email us (Section 19) from the email linked to your account, or tell us your username.

Verifying your identity. To protect your account, we must confirm that the request comes from you. Usually, a request sent from inside the app while you are signed in, or from the email linked to your account, is enough. We may ask for more information if needed. We will never ask for your password (we do not have one). Whoever asks, we send a copy of your data only to the email address of your Apple or Google sign-in.

Authorized agents. Where the law allows, you can ask someone to make a request for you. We may ask for proof that they are authorized and may ask you to confirm your identity directly.

Response times. We respond within one month (EU/UK), 45 days (US states), 15 days (Brazil), 30 days (Turkey), 15 days (India; we acknowledge grievances within 24 hours), without delay and within 14 days (Japan), 10 days (South Korea), 30 days (Switzerland, Australia, Canada), or any shorter period the law requires. If we need more time, where the law allows, we will tell you why. Requests are free, unless they are clearly unfounded or excessive.

Limits. In some cases we may not be able to fully meet a request, for example if we must keep information to comply with the law, to handle an open safety report, or to prevent ban evasion. If so, we will explain why.

12. Rights in specific regions

12.1. European Economic Area, United Kingdom and Switzerland

You have the rights listed in Section 11.2, under the GDPR, UK GDPR or Swiss Federal Act on Data Protection.

Right to object. You can object at any time to processing based on our legitimate interests. We will stop unless we have compelling legitimate grounds that override your interests, or we need the data for legal claims.

Complaints. You can complain to the data protection authority in the country where you live or work, or where an alleged breach happened. In the UK, this is the Information Commissioner's Office (ICO). In Switzerland, it is the Federal Data Protection and Information Commissioner (FDPIC). We would appreciate the chance to address your concern first (Section 19).

Contacting us from the EU, EEA, UK or Switzerland. Please contact us directly at support@taketurn.co or by post to the operator named in Section 1.1 (Section 19). Data protection authorities can use the same contact details.

12.2. California

This section applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA).

We do not sell or share your personal information. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16. Because we do not sell or share, there is no need to opt out.

Categories we collect (in the past 12 months), with sources and purposes described in Sections 2 and 5:

We may also disclose any category to authorities or NCMEC where the law requires (Section 8.2).

We do not collect precise geolocation, contacts, financial information, government identification numbers, biometric information or account passwords.

Sensitive personal information. We use the content of Takes only to provide the Service, to keep it safe, and for other purposes permitted under the CCPA regulations. We do not use or disclose it to infer characteristics about you. So the right to limit the use of sensitive personal information does not apply.

Retention. See Section 10.

Notice at collection. Sections 2, 5, 8 and 10 are our notice at collection: they list the categories of personal information we collect, why we use them, whether we sell or share them (we do not) and how long we keep them.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes.

Do Not Track and Global Privacy Control. Because we do not track you across other sites and apps, and do not sell or share personal information, there is nothing for these signals to turn off. If we ever change this, we will honor Global Privacy Control signals as an opt-out request.

Your California rights. You have the right to:

• know what personal information we collect, use and disclose, and to get a copy;
• delete your personal information;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information (we do not sell or share);
• limit the use of sensitive personal information (does not apply, see above); and
• not be discriminated against for using your rights.

Use your rights as described in Section 11.3. You may use an authorized agent.

12.3. Other US states

Residents of states with comprehensive privacy laws (such as Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia) may have the right to:

• confirm whether we process their personal data, and access it;
• correct inaccuracies;
• delete their personal data;
• get a portable copy of their data; and
• opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects.

We do not engage in targeted advertising, we do not sell personal data, and we do not use profiling to make decisions that produce legal or similarly significant effects.

Sensitive data. We do not process sensitive data as defined in these laws (such as precise location, health information or biometric data used to identify a person). Takes are processed only to deliver them and keep the Service safe.

Appeals. If we decline your request, you can appeal by replying to our decision or contacting us (Section 19) with the subject "Privacy appeal". We will respond within the time required by your state's law (usually 45 or 60 days). If you are not satisfied with the outcome, you can contact your state's Attorney General.

Biometric privacy laws. Because we do not collect biometric identifiers or biometric information (we do not scan face geometry or create face templates), laws such as the Illinois Biometric Information Privacy Act and the Texas and Washington biometric laws do not apply to our selfie review. People, not machines, compare the selfie with the profile photo, and the selfie is deleted right after.

12.4. Brazil

Under the Lei Geral de Proteção de Dados (LGPD), our legal bases are the ones described in Section 5 (performance of a contract, legitimate interests, compliance with a legal or regulatory obligation, and consent where applicable). You have the right to:

• confirm whether we process your data, and access it;
• correct incomplete, inaccurate or outdated data;
• request de-identification, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
• data portability;
• deletion of data processed with your consent;
• information about who we share your data with;
• information about the possibility of not giving consent, and its consequences;
• withdraw consent; and
• request a review of decisions made solely by automated means.

You can also file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD). Our contact for data protection matters (encarregado) can be reached through the contact details in Section 19.

12.5. Turkey (KVKK)

A fuller Turkish notice (KVKK aydınlatma metni), the Law 5651 notice and the country-specific notices for every other launch country are published next to this Policy and in the app (Settings > About) for people in those countries.

This section is our information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK).

Data controller: the company named in Section 1.1 (RETROBOND TEKNOLOJİ BİLİŞİM LİMİTED ŞİRKETİ, Cumhuriyet Mah. Fatih Sultan Mehmet Blv. Cadde 224 No: 41 A/A, Nilüfer, Bursa, Türkiye).

Data, purposes and legal grounds. The data we process and why are described in Sections 2 and 5. Under Article 5 of the KVKK, we rely on: processing being necessary for the establishment or performance of a contract; compliance with a legal obligation; our legitimate interests, provided they do not harm your fundamental rights and freedoms; the establishment, exercise or protection of a right; and your explicit consent where required.

Method of collection. We collect data electronically, through the app, the website, your phone and our service providers.

Transfers. We share data with the recipients in Section 8, including service providers located outside Turkey (mainly in the United States). Transfers abroad are made under Article 9 of the KVKK (see Section 9.3).

Your rights (Article 11). You have the right to:

• learn whether your personal data is processed;
• request information about the processing;
• learn the purpose of processing and whether data is used for that purpose;
• know the third parties in Turkey or abroad to whom your data is transferred;
• request correction of incomplete or inaccurate data;
• request deletion or destruction of your data under the conditions of Article 7;
• request that third parties to whom data was transferred be notified of correction or deletion;
• object to a result against you arising from analysis of your data exclusively by automated systems; and
• claim compensation for damage caused by unlawful processing.

How to apply. Send your request by email (Section 19) from the email address registered in our system, or in writing to our postal address, or by any other method allowed under the Communiqué on the Procedures and Principles of Application to the Data Controller. We will respond free of charge within 30 days at the latest. If the request requires a separate cost, we may charge the fee set by the Personal Data Protection Board. If your request is rejected or you are not satisfied with our answer, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

12.6. India

Under the Digital Personal Data Protection Act, 2023 and its Rules, you have the right to:

• get a summary of the personal data we process and the processing activities;
• know who we have shared your data with;
• correct, complete or update your data;
• erase your data, where it is no longer needed for the purpose it was collected for and the law does not require us to keep it;
• withdraw consent, where we rely on consent, as easily as you gave it;
• nominate another person to exercise your rights if you die or become unable to do so; and
• have your grievances addressed.

Grievances. Contact our grievance contact through the contact details in Section 19 (subject: "Grievance: India"). We acknowledge your grievance within 24 hours and resolve it within 15 days. If you are not satisfied, you may complain to the Data Protection Board of India.

Children. TakeTurn is for people aged 18 or older only. We do not knowingly process the personal data of children (people under 18) and do not seek parental consent, because children may not use TakeTurn.

12.7. Japan

This section applies under Japan's Act on the Protection of Personal Information (APPI).

• Business operator: the company named in Section 1.1 (RETROBOND TEKNOLOJİ BİLİŞİM LİMİTED ŞİRKETİ, Cumhuriyet Mah. Fatih Sultan Mehmet Blv. Cadde 224 No: 41 A/A, Nilüfer, Bursa, Türkiye). Representative: Mertcan Şimşek.
• Information sent from your phone (Telecommunications Business Act, external transmission): the app sends information from your phone only to: our servers on Cloudflare (to run the Service: your account, Takes, requests, device type, app version and language); Apple or Google (sign-in, push notifications, the country of your app store account, and the genuine-app check: App Attest on iPhone, Play Integrity on Android); and, once switched on, Firebase Crashlytics (crash reports). The purposes are described in Sections 5 and 8.1. The app has no advertising tools and no analytics tools of its own.
• Purposes of use: described in Section 5. We use personal information only within the scope of those purposes, unless the law permits otherwise.
• Provision to third parties: we do not provide personal data to third parties without your consent, except as permitted by law (for example, when required by law, or to protect a person's life, body or property). Sharing with service providers (Section 8.1) is an entrustment of processing, and we supervise them.
• Foreign transfers: your data is transferred to and stored in the United States. The United States does not have a single comprehensive federal privacy law equivalent to the APPI; privacy is protected by a combination of federal and state laws, including the CCPA and other state privacy laws, and by the Federal Trade Commission's enforcement against unfair or deceptive practices. Our service providers are bound by contracts that require measures equivalent to those required of a business operator under the APPI.
• Security control measures: we have rules for handling personal data; we limit access to those who need it; we train our team; we use encryption, access controls and monitoring; and we understand the foreign environment where data is stored (see Sections 9 and 14).
• Your requests: you can ask us to disclose, correct, add to, delete, stop using or stop providing to third parties your retained personal data, and to disclose records of third-party provision. Use the methods in Section 11.3.

12.8. Other countries

If you live elsewhere, you may have similar rights under your local law. Contact us (Section 19) and we will respond in line with the law that applies to you.

13. Pausing and deleting your account

13.1. Pause. While your account is paused, you are hidden from search and friends cannot send you Takes. Your data stays stored so you can come back by signing in.

13.2. Delete. You can delete your account in the app under Settings. You can also request deletion without the app on our web deletion page at taketurn.co/delete-account, or by contacting us (Section 19).

13.3. What happens:

• deletion starts right away, and other users no longer see your account from then on;
• after 90 days, deletion is complete: we permanently delete your account and the personal data linked to it, unless you sign back in during that time;
• if you sign back in within 90 days, your account is fully restored; and
• if you want us to delete your data sooner, contact us (Section 19) and we will do so, unless we must keep certain data for a reason listed below.

13.4. What we keep after deletion:

• a minimal record of your username and a hashed (scrambled, one-way) account identifier, so nobody else can take your username and so people we have banned cannot get around the ban;
• moderation records and reported content for the periods in Section 10, if there is an open report or a legal obligation;
• information we must keep by law (for example, CSAM reports); and
• information on other people's phones, such as their chats list and Activity items, which we do not control.

13.5. Accounts restricted, removed or banned for violations.

• Logging out never deletes anything. It only ends your session on that phone.
• During a limit or suspension, you can delete your account in the usual way (Section 13.3). If you sign back in within 90 days, the limit or suspension continues for the time that was left.
• After a removal or permanent ban, we keep the account's data for 6 months, the time you have to appeal, and then delete it automatically. You can choose Delete my account for good to have it deleted right away, with no 90-day restore period; you then can no longer appeal. After a removal, Create a new account also deletes the old account right away.
• The username of a removed or banned account stays reserved. For a permanent ban, we also keep an encrypted one-way code (hash) of the Apple or Google account used to sign up, so it cannot be used on TakeTurn again.
• You can request a copy of your data, including from the removal or ban screen. We email it to the email address of your Apple or Google sign-in within the time the law where you live requires (Section 11.3), and never later than 30 days. The app sends one copy every 30 days; if you need another one sooner, write to us (Section 11.3).
• Before anything is deleted, the app shows you exactly what will be lost and asks you to confirm.

13.6. Backups. Deleted data may remain in our providers' encrypted backups for a short period until those backups are overwritten in the normal cycle. Backups are not used to restore deleted accounts.

14. How we protect your information

14.1. We use technical and organizational measures designed to protect your information, including:

• encryption in transit (TLS) and encryption at rest for stored data, including Takes and selfies;
• on your phone, encryption of your chats list, Activity, the last copy of your Friends tab, profile numbers and unsent reports, with a key that stays in the iOS Keychain or Android Keystore of that phone;
• sign-in only through Apple or Google, so we never store passwords;
• strict access controls, so only team members who need access can see data, and only for their role;
• moderators can see Takes only when they have been reported, and selfies only during verification review;
• short retention periods, so there is less data to protect; and
• monitoring for security incidents and abuse.

14.2. No system is perfectly secure. If a data breach affects your personal data, we will notify you and the relevant authorities where the law requires.

15. Children

15.1. TakeTurn is only for people who are 18 or older. The Service is not directed to children, and we do not knowingly collect personal information from anyone under 18, including children under 13 as defined by the US Children's Online Privacy Protection Act (COPPA).

15.2. We ask for your birthday at sign-up to check your age, and our team also looks for signs of under-age users when reviewing profiles, selfies and reports. If we learn that an account belongs to someone under 18, we remove it and delete its data, except for information we must keep to prevent re-registration or meet legal obligations. If we learn that we have collected personal information from a child under 13, we delete it promptly.

15.3. Age signals. Where Apple (Declared Age Range) or Google (Play Age Signals) offer it for your phone and country, the app may ask for your age range. We use only that range, to apply the 18+ rule; if it says you are under 18, sign-up stops and the account made when you signed in is deleted at once, as in Section 15.4. We do not receive your birthday, name or any other detail from it, and we do not use it for anything else.

15.4. If you enter a birthday under 18. Sign-up stops and the account made when you signed in is deleted at once (we never keep the birthday itself). So that the same Apple or Google account cannot simply try again, we keep a one-way code (hash) of that sign-in account and the date you turn 18 according to that birthday, and nothing else about you. The code cannot be turned back into your account. Once that date has passed, the record is deleted (Section 10). The same record is kept if an age signal says you are under 18.

15.5. If you believe a person under 18 is using TakeTurn, report their account in the app or through taketurn.co/support. Parents and guardians can also ask us to delete any information about their child (Section 19). See our Child Safety Standards.

16. Notifications, cookies and similar technologies

16.1. Push notifications. We send notifications through Apple and Google. They never show a Take's photo or caption on your lock screen. You control categories in Settings, except account and safety notices.

16.2. In the app. We do not use advertising cookies, advertising identifiers, analytics tools or tracking technologies in the app, and the app does not send us any usage report of its own (such as how long it is open or what you tap). We use storage on your phone only for what the app needs to work: to keep you signed in, to keep the encrypted phone copies in Section 2.4, and to remember your settings. Section 12.7 lists everything the app sends from your phone and to whom.

16.3. On our website. taketurn.co uses only cookies or similar technologies that are strictly necessary for the site to work, such as keeping a support or deletion request form secure. We do not use analytics, advertising or social media cookies, so we do not show a cookie banner. If we ever add other cookies, we will ask for your consent where the law requires it and update this notice.

16.4. This Section 16 is our cookie notice, also available at /cookies/.

17. Links and third-party services

Our Service may link to other websites or services, such as app stores or support resources. Their privacy practices are their own. Please read their policies.

18. Changes to this Privacy Policy

18.1. We may update this Privacy Policy from time to time. The "Last updated" date at the top shows when it last changed.

18.2. If we make a material change, we will tell you in the app (for example, in the "TakeTurn" chat) before it takes effect. Where the law requires your consent to a change, we will ask for it.

19. Contact us

For anything (privacy, safety, legal or general), write to support@taketurn.co, use Settings > Report an issue in the app, or the form at taketurn.co/support.

Post: RETROBOND TEKNOLOJİ BİLİŞİM LİMİTED ŞİRKETİ, Cumhuriyet Mah. Fatih Sultan Mehmet Blv. Cadde 224 No: 41 A/A, Nilüfer, Bursa, Türkiye.

People and data protection authorities in the EU, the EEA, the UK, Switzerland and Japan can contact us directly at support@taketurn.co or at the postal address above, about any privacy matter. This does not affect your right to complain to a supervisory authority (Section 12).

Change history

1. November 2, 2026

   The controller is now RETROBOND TEKNOLOJİ BİLİŞİM LİMİTED ŞİRKETİ, a company established in Turkey (with its address); TakeTurn is run from Turkey. There is no longer a planned handover to a future company.

2. October 31, 2026

   Sections 5, 8.1 and 9.7 now also say that crash reporting (Firebase Crashlytics) is not switched on yet, as Section 2.3 already did.

3. October 31, 2026

   Small corrections: the copy of your Friends tab kept on your phone is now also listed among the data we encrypt there (Section 14.1); the age range row now points to Section 15.3; activity status is described as showing your friends that you are active on TakeTurn; and in India you can have your data erased once it is no longer needed for its purpose and the law does not require us to keep it (Section 12.6). The caption limit is 100 characters; an earlier change note wrongly said 120.

4. October 30, 2026

   Explained exactly how "People you may know" works when you have few friends: people in your country (or nearby countries) who joined recently or are very active (opened TakeTurn in the last 3 days). Activity is used only to choose and order suggestions and is never shown; if you object, your country and activity are no longer used.

5. October 30, 2026

   Updated our contact details: people and authorities in the EU, EEA, UK, Switzerland and Japan contact us directly at support@taketurn.co or by post. Your right to complain to a supervisory authority is unchanged.

6. October 25, 2026

   Before launch: the app no longer reports how long it is open; usage statistics come only from actions on our servers. We now list everything kept on your phone, activity status, app integrity checks, consent records and waiting-list withdrawal, say who provides TakeTurn until our company exists, and explain screenshot protection and the sensitive-content check more precisely. The green activity dot is shown to your friends only.

7. October 19, 2026

   In the app, your phone also checks that a profile photo shows a face. It only detects whether there is a face, never who it is; the photo is not uploaded for this and no face data is kept.

8. October 18, 2026

   Connection records (IP address, time, account; never content) are kept for 1 year when your account is in Turkey or when you use TakeTurn from Turkey. A profile photo chosen on our website is checked for sensitive content in your browser, the same way as in the app; nothing about that check is sent to us.

9. October 18, 2026

   Profile photos are checked on your phone for sensitive content too, and nothing about that check is sent to us. When your own phone shows the sensitive-content warning, it tells our server only to keep the screenshot alert open while the warning is on screen; the sender is never told.

10. October 18, 2026

    Explained the new order: the birthday is asked right after you sign in with Apple or Google. If you are under 18, the account made at sign-in is deleted at once and we keep only a one-way code (hash) of the sign-in account and the date you turn 18.

11. October 18, 2026

    Explains the privacy-safe usage statistics we keep (which steps and actions happen, never what is in a Take, a caption or a name) for 25 months so we can run and improve the app, with no outside analytics and no ad tracking, and that when you delete your account the statistics can no longer be tied to you, that for accounts in Turkey we keep connection records (IP address, time, account) for 1 year as Turkish law requires; for everyone else they stay up to 90 days.

12. October 18, 2026

    Says plainly that a first check for sensitive content runs on the phones and nothing is uploaded for it, that Takes are not scanned automatically for child sexual abuse material (reports are reviewed by a person and reported as the law requires), that Apple or Google may tell us only your age range, that Firebase Crashlytics reports app crashes, and that if you enter a birthday under 18 we keep only a one-way code (hash) of your sign-in account and the date you turn 18. Caption limit corrected to 120 characters. Country-specific notices added (see Section 12).

13. October 13, 2026

    Explained that your chats list, Activity, profile numbers and unsent reports are stored encrypted on your phone, what stays on our servers (an Activity item only until your phone has received it; notices from TakeTurn for their normal period), and that there is no switch for "People you may know" but you can object by writing to us.

14. October 13, 2026

    Clarified that the safety copy is the received Take itself, kept encrypted for up to 24 hours.

15. October 13, 2026

    Explained how "People you may know" works and how to object, the birthday step before sign-in, screen sharing alerts, notice language, and how long reported content, safety copies attached to reports and messages to our team are kept.

16. October 12, 2026

    Updated our service providers (Cloudflare runs our servers and database), added the age-check selfie, explained what stays on your phone, and added India's 24-hour removal of intimate images.

17. October 12, 2026

    First version.