Veridia Privacy Policy

Who we are

This policy explains how Veridia (the "app") handles personal data. The app is developed and published by Ibrahim Akcay, independent app developer based in Türkiye, trading as WXW Labs ("we", "us"). We are the controller of the personal data described here.

At a glance

This summary matches the app's privacy label on the App Store and its Data safety section on Google Play.

We do not track you across apps or websites owned by other companies, and we do not sell your personal data.

Data that stays on your device

The following is stored only on your device. We cannot see or access it:

• Story chats, story summaries and the memory index used to recall earlier scenes — we keep no copy of them on our servers.
• Voice narration, produced by the speech voices installed on your device.
• Your language and voice-narration settings.

You can delete this data in the app or by deleting the app. If you back up your device, Apple or Google may include app data in your device backup under their own terms; we have no access to these backups.

What we collect and how

We collect the data listed above:

• directly from you when you create an account, fill in your profile or use the app's features;
• automatically from your device while you use the app (for example identifiers and diagnostics);
• from Apple or Google when you choose to sign in with them (your name and e-mail address, which Apple lets you hide).
• from Apple when you make a purchase (a verified transaction confirmation, never your payment details).

Signing in: Sign in with Apple, Google, e-mail, guest (anonymous) account.

Device permissions

The app asks for these permissions only when you use the related feature. You can allow or deny them, and change your choice at any time in your device settings (on iPhone and iPad: Settings > Privacy & Security). Denying a permission only disables the related feature.

Why we use data and our legal bases

Providing account data is required to use features that need an account; without it we cannot provide them.

Artificial intelligence

An AI narrator writes each scene in response to your move, keeps a running summary of the story and suggests choices. AI text embeddings help the app recall earlier scenes.

For each move: the text you typed or dictated, recent story turns, the story's rules, the current game state and the story summary. For memory: short passages of your story. These go through our Cloud Functions server to OpenAI. Your name, e-mail address and account ID are not sent to OpenAI. Provider: OpenAI API (OpenAI, L.L.C. (USA) / OpenAI Ireland Ltd).

Your content is not used to train AI models.

The narration is fiction produced by an AI model. It can be inconsistent, inaccurate or unexpected, and it is not advice. Mission progress and wins are checked by our server rather than left to the model alone.

The AI does not make decisions that produce legal or similarly significant effects on you.

Advertising

Veridia shows optional rewarded ads through Google AdMob. We request non-personalised ads only. The app does not ask for permission to track you and does not access your device's advertising identifier. Google may still process device and usage information, such as your IP address and ad interactions, to deliver, cap and measure ads and to prevent fraud.

Where the law requires (for example in the EEA and UK), a consent message from Google's User Messaging Platform appears first, and you can change your choice in the app.

Purchases

Purchases are processed by Apple through the App Store and, on Android, by Google through Google Play. We never receive your card or payment details. For in-app purchases we receive a verified confirmation of the transaction (product and status) so that we can deliver what you bought.

Service providers

We share personal data only with these providers, which process it on our behalf or provide the platform services the app relies on. They are bound by contracts and their own privacy commitments that offer the same level of protection as this policy:

We do not sell or rent personal data. We may disclose data to authorities when the law requires it.

International transfers

Some providers process data outside Türkiye and the European Economic Area, for example in the United States. Transfers rely on adequacy decisions, the EU–US Data Privacy Framework where the provider is certified, or standard contractual clauses (GDPR Chapter V), and on the appropriate safeguards of KVKK Art. 9.

How long we keep data

We keep your account data — profile, Echo balance, Nova, wins, ranking entries, mission progress records and purchase records — for as long as your account exists, and delete it when you delete your account (except the purchase records described above). Story chats stay on your device until you delete your account in the app or remove the app.

You can delete your account at any time: see how.

Security

Data is encrypted in transit, stored with reputable cloud providers and accessible only to people and systems that need it. No system is perfectly secure; tell us right away if you suspect a problem.

Children and minors

Made for teens and adults. Stories can include mild horror and fantasy violence, and the monthly rankings are a contest for Echo rewards.

Children under 13 (or the higher age of digital consent in their country, up to 16 in the EU) may use features that process personal data only with the consent of a parent or guardian. In Türkiye, minors should use the app with the involvement of a parent or guardian. If you believe a child gave us data without that consent, contact us and we will delete it.

Automated decisions and profiling

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects (GDPR Art. 22), and we do not build profiles of you for advertising or to sell to others; the ads in the app are non-personalised unless you consent. You keep the right under KVKK Art. 11(1)(g) to object to any result against you arising exclusively from automated analysis.

If something goes wrong

If a security incident affects personal data we hold, we take immediate steps to contain it, notify the Personal Data Protection Board within 72 hours of becoming aware of it (KVKK Art. 12(5)) and, where required, the competent EU supervisory authority (GDPR Art. 33), and inform the people affected as soon as possible with what happened and what they can do.

Support requests

When you contact us through a support form, we store the details you enter (subject, message, category, the app concerned and, if you provide them, your name, e-mail address, app version and device model), the conversation that follows, the language of the page and the time. We use them only to answer and resolve your request, on the basis of our contract with you or our legitimate interest in providing support (GDPR Art. 6(1)(b) and (f); KVKK Art. 5(2)(c) and (f)).

Requests are stored in Google Cloud Firestore in the European Union (multi-region eur3). Each request has a private link that only you receive; anyone who has the link can read the conversation, so keep it to yourself. We keep requests for at most 24 months after they are closed and delete them earlier when you ask.

Your rights

Depending on where you live, you can ask us to give you access to your personal data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. Where we rely on your consent, you can withdraw it at any time without affecting earlier processing.

To exercise a right, contact us as described below. We answer within one month (GDPR) and at the latest within 30 days (KVKK), free of charge. If you are in the EU or EEA, you may also complain to your local data protection authority; in Türkiye, to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). E-mail emirhan@wxwlabs.com, or open a request through our support form.

Information notice under Turkish law (KVKK Art. 10)

Under the Turkish Personal Data Protection Law No. 6698 (KVKK), the data controller is Ibrahim Akcay, independent app developer based in Türkiye, trading as WXW Labs.

• Purposes: providing Veridia and its features; account and information security, prevention of fraud and abuse; delivering purchases and fulfilling legal obligations; answering support requests.
• Recipients: Firebase Authentication (Google Ireland Limited / Google LLC (USA)); Cloud Firestore (Google Ireland Limited / Google LLC (USA)); Cloud Functions for Firebase (Google Ireland Limited / Google LLC (USA)); Cloud Storage for Firebase (Google Ireland Limited / Google LLC (USA)); Sign in with Apple (Apple Distribution International Ltd. (Ireland) / Apple Inc. (USA)); Google Sign-In (Google Ireland Limited / Google LLC (USA)); App Store and in-app purchases (Apple Distribution International Ltd. (Ireland) / Apple Inc. (USA)); OpenAI API (OpenAI, L.L.C. (USA) / OpenAI Ireland Ltd); Google AdMob (Google Ireland Limited / Google LLC (USA)); Google User Messaging Platform (Google Ireland Limited / Google LLC (USA)); Apple Speech Recognition (Apple Inc. (USA)); and competent authorities where the law requires.
• Method and legal basis: Data is collected electronically through the app, our servers and our support forms. Personal data is processed because it is necessary for the performance of the contract with you (Art. 5(2)(c)), for our legitimate interests provided your fundamental rights are not harmed (Art. 5(2)(f)), to fulfil legal obligations (Art. 5(2)(ç)) and, where required, on the basis of your explicit consent (Art. 5(1)).
• Transfers abroad: where a service provider listed above is located outside Türkiye, data is transferred only on one of the grounds set out in KVKK Art. 9 as amended by Law No. 7499: an adequacy decision, appropriate safeguards such as standard contracts, or, for occasional transfers, the exceptions in Art. 9(6), including transfers necessary for the performance of the contract with you.
• Your rights (Art. 11): to learn whether your data is processed and request information about it; to learn the purpose and whether it is used accordingly; to know the third parties in Türkiye or abroad to whom it is transferred; to request correction of incomplete or inaccurate data and its deletion or destruction, and notification of these to recipients; to object to results against you arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.
• How to apply: in writing, or by e-mail from the address registered with us, to emirhan@wxwlabs.com, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. Applications are answered free of charge within 30 days at the latest.

Notice for US residents

We do not sell personal information or share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act and similar US state laws, and we do not use sensitive personal information to infer characteristics about you. You may exercise the rights those laws give you by contacting us; we will not discriminate against you for doing so.

Apple

Apple processes data related to downloading the app, purchases and, if you have chosen to share analytics with app developers, crash reports and aggregated statistics, under Apple's own privacy policy. These reports never include the content you create in the app. Apple Privacy Policy

Google Play

On Android, Google processes data related to downloading the app from Google Play, purchases and, if you have chosen to share usage and diagnostics with developers, crash reports and aggregated statistics, under Google's own privacy policy. These reports never include the content you create in the app. Google Privacy Policy

More details

Public rankings. Your display name, Nova score and number of wins appear on the world and monthly rankings, which anyone can view. If you don't choose a hero name, the name from your Apple or Google account is used; you can change it at any time in Profile. Your e-mail address is never shown.

Voice input. Dictation uses Apple's speech recognition. Apple may process the audio on its servers under its own privacy policy; we receive only the text that ends up in your move.

Rewarded ads. Ads appear only when you choose to watch one to earn Echo. Veridia always requests non-personalised ads and never asks for permission to track you. Where the law requires it (for example in the EEA and the UK), Google's consent form is shown first, and Profile → Ad privacy options lets you change your choice. To confirm a reward, Google receives your account ID and a one-time code and reports them back to our server.

Purchases. Apple processes every payment. Our server receives Apple's signed confirmation of each purchase to credit Echo to the right account; we never see your card or payment details.

Changes to this policy

We update this document when our apps or the law change. The date at the top shows the latest version. If a change materially affects you, we will tell you in the app or on this website before it takes effect.

This document is published in English and Turkish. For users in Türkiye, the Turkish version prevails if the two differ.

Contact

Ibrahim Akcay, independent app developer based in Türkiye, trading as WXW Labs. E-mail emirhan@wxwlabs.com, or open a request through our support form.