Qoniva Privacy Policy

Who we are

This policy explains how Qoniva (the "app") handles personal data. The app is developed and published by Ibrahim Akcay, independent app developer based in Türkiye, trading as WXW Labs ("we", "us"). We are the controller of the personal data described here.

At a glance

This summary matches the app's privacy label on the App Store and its Data safety section on Google Play.

We do not track you across apps or websites owned by other companies, and we do not sell your personal data.

Data that stays on your device

The following is stored only on your device. We cannot see or access it:

• Private encryption keys for friend chats never leave your device.

You can delete this data in the app or by deleting the app. If you back up your device, Apple or Google may include app data in your device backup under their own terms; we have no access to these backups.

What we collect and how

We collect the data listed above:

• directly from you when you create an account, fill in your profile or use the app's features;
• automatically from your device while you use the app (for example identifiers and diagnostics);
• from Apple or Google when you choose to sign in with them (your name and e-mail address, which Apple lets you hide).
• from Apple when you make a purchase (a verified transaction confirmation, never your payment details).

Signing in: Sign in with Apple, Google, e-mail, phone number.

Device permissions

The app asks for these permissions only when you use the related feature. You can allow or deny them, and change your choice at any time in your device settings (on iPhone and iPad: Settings > Privacy & Security). Denying a permission only disables the related feature.

Why we use data and our legal bases

Providing account data is required to use features that need an account; without it we cannot provide them.

Artificial intelligence

Automated moderation that classifies messages, images and profile fields in random rooms and public areas before delivery.

Content posted in random rooms and profile fields is sent to the AI provider solely for classification. End-to-end encrypted friend chats are never sent. Provider: OpenAI API (OpenAI, L.L.C. (USA) / OpenAI Ireland Ltd).

Your content is not used to train AI models.

Automated moderation can make mistakes. Moderation decisions can be appealed in the app.

The AI does not make decisions that produce legal or similarly significant effects on you.

Purchases

Purchases are processed by Apple through the App Store and, on Android, by Google through Google Play. We never receive your card or payment details. For in-app purchases we receive a verified confirmation of the transaction (product and status) so that we can deliver what you bought.

Content you share with others

Messages, images and profiles shared with other users in rooms and friend chats.

Public areas are screened automatically before delivery; reports are reviewed by moderators; abusive users are muted, banned or removed.

End-to-end encryption: Messages and images between mutual friends are encrypted on the sender's device. Our servers store only ciphertext and the metadata needed to deliver it (sender, recipient, time, type, size).

Service providers

We share personal data only with these providers, which process it on our behalf or provide the platform services the app relies on. They are bound by contracts and their own privacy commitments that offer the same level of protection as this policy:

We do not sell or rent personal data. We may disclose data to authorities when the law requires it.

International transfers

Some providers process data outside Türkiye and the European Economic Area, for example in the United States. Transfers rely on adequacy decisions, the EU–US Data Privacy Framework where the provider is certified, or standard contractual clauses (GDPR Chapter V), and on the appropriate safeguards of KVKK Art. 9.

How long we keep data

Account data is kept while your account is active. On deletion personal data is deleted or anonymised, except de-identified safety records.

You can delete your account at any time: see how.

Security

Data is encrypted in transit, stored with reputable cloud providers and accessible only to people and systems that need it. No system is perfectly secure; tell us right away if you suspect a problem.

Children and minors

Qoniva is only for people aged 18 or older. If we learn that an account belongs to someone younger, we suspend it and delete the data as the law requires.

Automated decisions and profiling

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects (GDPR Art. 22), and we do not build profiles of you for advertising or to sell to others. You keep the right under KVKK Art. 11(1)(g) to object to any result against you arising exclusively from automated analysis.

If something goes wrong

If a security incident affects personal data we hold, we take immediate steps to contain it, notify the Personal Data Protection Board within 72 hours of becoming aware of it (KVKK Art. 12(5)) and, where required, the competent EU supervisory authority (GDPR Art. 33), and inform the people affected as soon as possible with what happened and what they can do.

Support requests

When you contact us through a support form, we store the details you enter (subject, message, category, the app concerned and, if you provide them, your name, e-mail address, app version and device model), the conversation that follows, the language of the page and the time. We use them only to answer and resolve your request, on the basis of our contract with you or our legitimate interest in providing support (GDPR Art. 6(1)(b) and (f); KVKK Art. 5(2)(c) and (f)).

Requests are stored in Google Cloud Firestore in the European Union (multi-region eur3). Each request has a private link that only you receive; anyone who has the link can read the conversation, so keep it to yourself. We keep requests for at most 24 months after they are closed and delete them earlier when you ask.

Your rights

Depending on where you live, you can ask us to give you access to your personal data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. Where we rely on your consent, you can withdraw it at any time without affecting earlier processing.

To exercise a right, contact us as described below. We answer within one month (GDPR) and at the latest within 30 days (KVKK), free of charge. If you are in the EU or EEA, you may also complain to your local data protection authority; in Türkiye, to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). E-mail emirhan@wxwlabs.com, or open a request through our support form.

Information notice under Turkish law (KVKK Art. 10)

Under the Turkish Personal Data Protection Law No. 6698 (KVKK), the data controller is Ibrahim Akcay, independent app developer based in Türkiye, trading as WXW Labs.

• Purposes: providing Qoniva and its features; account and information security, prevention of fraud and abuse; delivering purchases and fulfilling legal obligations; answering support requests.
• Recipients: Firebase Authentication (Google Ireland Limited / Google LLC (USA)); Cloud Firestore (Google Ireland Limited / Google LLC (USA)); Cloud Storage for Firebase (Google Ireland Limited / Google LLC (USA)); Firebase Realtime Database (Google Ireland Limited / Google LLC (USA)); Cloud Functions for Firebase (Google Ireland Limited / Google LLC (USA)); Firebase Cloud Messaging (Google Ireland Limited / Google LLC (USA)); Apple Push Notification service (Apple Inc. (USA)); Firebase Crashlytics (Google Ireland Limited / Google LLC (USA)); Firebase Remote Config (Google Ireland Limited / Google LLC (USA)); Firebase App Check (Apple App Attest / DeviceCheck) (Google Ireland Limited / Google LLC (USA); Apple Inc. (USA)); Sign in with Apple (Apple Distribution International Ltd. (Ireland) / Apple Inc. (USA)); Google Sign-In (Google Ireland Limited / Google LLC (USA)); App Store and in-app purchases (Apple Distribution International Ltd. (Ireland) / Apple Inc. (USA)); OpenAI API (OpenAI, L.L.C. (USA) / OpenAI Ireland Ltd); and competent authorities where the law requires.
• Method and legal basis: Data is collected electronically through the app, our servers and our support forms. Personal data is processed because it is necessary for the performance of the contract with you (Art. 5(2)(c)), for our legitimate interests provided your fundamental rights are not harmed (Art. 5(2)(f)), to fulfil legal obligations (Art. 5(2)(ç)) and, where required, on the basis of your explicit consent (Art. 5(1)).
• Transfers abroad: where a service provider listed above is located outside Türkiye, data is transferred only on one of the grounds set out in KVKK Art. 9 as amended by Law No. 7499: an adequacy decision, appropriate safeguards such as standard contracts, or, for occasional transfers, the exceptions in Art. 9(6), including transfers necessary for the performance of the contract with you.
• Your rights (Art. 11): to learn whether your data is processed and request information about it; to learn the purpose and whether it is used accordingly; to know the third parties in Türkiye or abroad to whom it is transferred; to request correction of incomplete or inaccurate data and its deletion or destruction, and notification of these to recipients; to object to results against you arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.
• How to apply: in writing, or by e-mail from the address registered with us, to emirhan@wxwlabs.com, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. Applications are answered free of charge within 30 days at the latest.

Notice for US residents

We do not sell personal information or share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act and similar US state laws, and we do not use sensitive personal information to infer characteristics about you. You may exercise the rights those laws give you by contacting us; we will not discriminate against you for doing so.

Apple

Apple processes data related to downloading the app, purchases and, if you have chosen to share analytics with app developers, crash reports and aggregated statistics, under Apple's own privacy policy. These reports never include the content you create in the app. Apple Privacy Policy

Google Play

On Android, Google processes data related to downloading the app from Google Play, purchases and, if you have chosen to share usage and diagnostics with developers, crash reports and aggregated statistics, under Google's own privacy policy. These reports never include the content you create in the app. Google Privacy Policy

Changes to this policy

We update this document when our apps or the law change. The date at the top shows the latest version. If a change materially affects you, we will tell you in the app or on this website before it takes effect.

This document is published in English and Turkish. For users in Türkiye, the Turkish version prevails if the two differ.

Contact

Ibrahim Akcay, independent app developer based in Türkiye, trading as WXW Labs. E-mail emirhan@wxwlabs.com, or open a request through our support form.