Privacy Policy

1. Data Controller

Personal data collected within the FirFir application is processed by FirFir as the data controller, in accordance with the Turkish Personal Data Protection Law No. 6698 (KVKK).

The app is intended for users aged 18 and over; we do not knowingly collect data from anyone under 18.

2. Data We Collect

While you use the app, we collect the following data:

• Account information: your email address and password (passwords are stored as irreversible hashes). If you sign in with Google or Apple, the email address and account ID that provider shares with us.
• Profile information: name, date of birth, height, weight, gender, job, education, about text and interests.
• Photos: your profile and gallery photos; the photo you choose for your BFF.
• Profile verification: if you choose to verify your profile, a selfie taken with a requested pose and the record of your consent. A one-way fingerprint (hash) of your photos and selfie is kept to detect copies; it cannot be turned back into an image.
• Invitations: the invite code you share or use, who invited you and which invited friends verified their profiles.
• Usage purpose and preferences: why you use the app (friendship, travel, sports, etc.), your match filters and your account settings.
• Location data: your current location while the app is open, if you have granted location permission.
• Messages and posts: your direct messages, what you write in event and category chats, and the events you create.
• AI companion (BFF) data: your conversations with your BFFs and the notes derived from them. These notes may include health-related information such as medication, sleep and mood (see Section 5).
• Purchase information: your premium plan, store transaction ID, purchase and expiry dates. Payment and card details are handled by the App Store / Google Play and never reach us.
• Report and block records: reports you make and reports made about you, and the users you block.
• Device and technical information: notification token, platform and app language; IP address and request time in server logs kept for security.
• Usage statistics: how much time you spend in each part of the app, how often you open it, the app version and platform, and your steps around Premium offers and the Premium screen (an offer being shown, the screen being opened, purchase or restore attempts and their outcome, and where you came from). These statistics are linked to your account and grouped by the gender in your profile; no message content or location is collected for this.
• Crash reports: when the app crashes or an unexpected error occurs, the error log, device model, operating system and app version. These reports are not linked to your identity.

3. Why We Process Your Data

We process your data only for the following purposes:

• Creating your account, verifying your email address and managing your account,
• Verifying, at your request, that your profile photos belong to you (manual review of a posed selfie) and showing the blue check; running the invite program and granting its free premium rewards,
• Suggesting matches that fit your usage purpose and preferences,
• Showing nearby users and events,
• Running messaging, event and chat room features,
• Providing the BFF AI companion (generating replies, sending reminders and follow-up messages),
• Verifying and managing your premium subscription,
• Sending match, message and reminder notifications,
• Improving the app: measuring how its parts are used and how Premium offers perform, and finding and fixing errors,
• Reviewing reports, blocking objectionable content, keeping the app secure and preventing abuse.

Your data is never sold to third parties. Non-Premium accounts see ads inside the app; the data processed for ads is described in section 7.

4. Location Data

If you have granted location permission, your location is sent to our servers at regular intervals while the app is open. It is used to calculate distances in Discover and to show nearby events. Your location is not collected while the app is closed or in the background.

You appear on the map only when you turn on map (market) mode; other users then see your approximate distance and map position. No location history is kept; only your last known location is stored.

To stop sending your location, revoke the app's location permission in your device settings.

5. AI Companion (BFF)

Your BFF is not a real person but an AI-powered chat companion; it does not give medical, legal or financial advice. We ask for your explicit consent before you use BFF for the first time. If you do not consent, you cannot use BFF; the rest of the app is not affected.

• Replies are generated by AI models, which may run on our own servers or at contracted AI service providers; your messages are processed for this purpose.
• So that your BFF can remember you, notes are derived from your conversations (e.g. medication times, sleep patterns, mood, goals, important events). Such health-related information may qualify as special category personal data under KVKK; it is processed only with your explicit consent and stored encrypted.
• When you ask about something current, such as a match result, the weather or exchange rates, a short search query derived from your message is sent to a search service provider. Your full conversation, your name and your account details are not sent.
• In voice chat, your speech is converted to text by your device's speech recognition service (Apple on iOS, Google on Android); your voice recording is never sent to or stored on our servers.
• For safety, report handling and service quality, BFF conversations may be reviewed by our authorized team, who may step into a conversation when necessary.

You can view notes in the Notes section of the BFF screen and delete them one by one. To have all of your BFF data deleted, write to us at the contact address below or delete your account.

6. Data Security

Your personal data is stored encrypted at the field (column) level in our databases using AES-256-GCM. Even in the event of unauthorized database access, your personal data remains unreadable.

All data transmission happens over encrypted connections (TLS/HTTPS). Your passwords are never stored in plain text.

7. Data Sharing and International Transfers

Your personal data is never shared with third parties for marketing and is never sold. To provide the service, data is shared only with the following service providers, and only as far as necessary:

• Hosting: all of your data is stored and processed on our servers in Hetzner Online GmbH's data center in Finland (European Union).
• Google Firebase (Google LLC): your device notification token for push notifications; your email address and account ID to authenticate Google or Apple sign-in.
• Firebase Crashlytics (Google LLC): crash reports (error log, device model, operating system and app version); not linked to your identity.
• Sign in with Apple and Google: when you use these methods, your identity is verified by the respective provider.
• AI and search service providers: your messages, to generate BFF replies, and search queries derived from current-information questions in BFF (Section 5).
• App Store (Apple) and Google Play (Google): purchases are processed by the store; transaction information is shared with the store to verify your subscription.
• Email delivery service: your email address, to deliver your verification code.
• OpenStreetMap: map images are downloaded by your device directly from OpenStreetMap Foundation servers; your IP address and the map area you view are sent to those servers in the process.
• Google AdMob (Google LLC): for ads shown to non-Premium accounts, your device's advertising identifier, IP address, device and app information and approximate location are sent to Google. Ads are shown without personalisation; you can reset your advertising identifier in your device settings or remove ads entirely by going Premium. In the European Economic Area, the United Kingdom and Switzerland your consent is requested through Google's consent form before any ads are shown (a legally required notice is also shown in applicable US states); you can change your choice at any time under Profile → Account Settings → Ad privacy options.
• If a legal obligation arises, data may be shared with competent public authorities, limited strictly to what is requested.

Because these providers' servers are located outside Türkiye (in the European Union, the United Kingdom and the USA), your data is transferred abroad. Such transfers are carried out in accordance with Article 9 of KVKK.

8. Retention and Deletion

Your data is kept for as long as your account remains active. You can permanently delete your account under Profile → Account Settings → Delete Account. Your profile information, photos, location, matches, messages, events, BFF conversations and notes, and subscription records are then deleted from all of our systems; if you signed in with Apple, your Sign in with Apple authorization is also revoked.

Server security logs (IP address, request time) are deleted after a limited period. Usage statistics are deleted after 100 days; crash reports are kept in Firebase Crashlytics for 90 days. Store purchase records are kept by Apple and Google under their own policies.

Your verification selfie is used only for the review: it is deleted once the review is finished, and a selfie that is never submitted is deleted within 24 hours. Only its one-way hash is kept for copy detection, and it is deleted together with your account.

9. Your Rights Under KVKK

Under Article 11 of KVKK, you have the right to:

• Learn whether your personal data is being processed,
• Request information about such processing,
• Learn the purpose of processing and whether data is used accordingly,
• Request correction of incomplete or inaccurate data,
• Request deletion or destruction of your data,
• Object to a result against you arising from the analysis of your processed data exclusively through automated systems,
• Claim compensation for damages caused by unlawful processing.

To exercise these rights, contact us at the address below.

10. Contact

For any privacy-related questions or requests:

info@firfirapp.com

Requests are answered within 30 days at the latest.

11. Changes to This Policy

This privacy policy may be updated from time to time. You will be notified in the app of significant changes. The current version is always available on this page.