Privacy Policy

Last updated: June 15, 2026

1. Data Controller

This Privacy Policy describes how HairTry ("App", "we", "us", "our") collects, uses, stores, and protects your personal data when you use our mobile application. This policy is prepared in accordance with Turkey's Personal Data Protection Law No. 6698 ("KVKK"), the General Data Protection Regulation ("GDPR") where applicable, and Apple's App Store Review Guidelines.

By downloading, installing, or using HairTry, you acknowledge that you have read and understood this Privacy Policy.

2. Categories of Personal Data and Processing

We process personal data under specific lawful bases as outlined below. We follow the principles of data minimization and purpose limitation.

3. Data We Do NOT Collect

• We do not collect your name, email address, phone number, or physical address.
• We do not collect location data (GPS, IP-based geolocation).
• We do not collect contacts or address book data.
• We do not use cookies or web tracking technologies.
• We do not collect advertising identifiers (IDFA/GAID).
• We do not use your photos for AI model training.
• We do not collect biometric data, perform facial recognition, or create faceprints, face templates, or face geometry. The photos you upload are processed only as ordinary images to change your hairstyle.

4. How Your Photos Are Processed

Transparency about photo processing is important to us:

• Upload: When you select a hairstyle, your photo is uploaded to our secure server (Firebase Storage, encrypted in transit via HTTPS/TLS).
• AI Processing: Your photo is sent to a third-party AI service (Google Gemini or OpenAI GPT Image) along with the hairstyle description to generate a preview. The photo is used solely for this single generation request.
• Storage: Your uploaded photos and generated results are stored in Firebase Storage, associated with your anonymous user ID.
• No Training: Under these providers' paid API data-processing terms, your photos are not used to train their AI models, and we never use them for advertising, profiling, or any purpose other than delivering your requested hairstyle preview.
• Limited Sharing: Your photos are never sold, used for advertising, or made publicly accessible. They are shared only with the AI providers named above (Google Gemini or OpenAI) — and only to generate the hairstyle result you requested.

5. Third-Party Services

We use the following third-party services that may process your data in the course of providing the App:

We do not sell, trade, or otherwise transfer your personal data to any third parties except the service providers listed above, which are necessary for the operation of the App.

6. International Data Transfers

Your data may be transferred to and processed in:

• European Union: Firebase services (region: europe-west3, Frankfurt, Germany) — primary data storage
• United States: AI processing services (Google Gemini, OpenAI), RevenueCat, Firebase Analytics

These transfers are conducted in compliance with KVKK Article 9 and, where applicable, GDPR Chapter V. The third-party providers listed above act as data processors on our behalf and are contractually required (through their data processing agreements and Standard Contractual Clauses) to provide the same or equal level of protection for your personal data as set out in this Privacy Policy and as required by applicable law.

7. Data Security

We implement technical and administrative measures to protect your personal data:

• All data transmission uses HTTPS/TLS encryption.
• Firebase Storage and Firestore are secured with server-side authentication rules — users can only access their own data.
• Server-side operations use Firebase Admin SDK with restricted permissions (principle of least privilege).
• No payment card data ever touches our servers — all payments are processed by Apple App Store and Google Play Store.
• Access to production systems is restricted and monitored.

8. Data Retention and Deletion

• Active accounts: Data is retained as long as you actively use the App.
• Inactive accounts: Accounts with no activity for 90 days may be flagged for deletion. Data associated with inactive accounts is deleted within 30 days of the flagging.
• Account deletion: You may request deletion of your account and all associated data at any time by contacting us at sberk.bilgic@gmail.com. We will process your request within 30 days.
• Transaction records: Subscription transaction records are retained as required by applicable tax and commercial law.

9. Your Rights Under KVKK (Article 11)

As a data subject, you have the following rights regarding your personal data:

• a) Learn whether your personal data is being processed;
• b) Request information about the processing if your data has been processed;
• c) Learn the purpose of the processing and whether your data is used in accordance with its purpose;
• d) Know the third parties to whom your personal data is transferred, domestically or abroad;
• e) Request rectification of your personal data if it is incomplete or inaccurate;
• f) Request deletion or destruction of your personal data under the conditions set forth in Article 7 of KVKK;
• g) Request notification of rectification, deletion, or destruction to third parties to whom your data has been transferred;
• h) Object to any result that is to your detriment arising from the analysis of your processed data exclusively by automated systems;
• i) Claim compensation for damages arising from the unlawful processing of your personal data.

To exercise any of these rights, please contact us at sberk.bilgic@gmail.com with your request. Your request must be explicit and understandable, and must contain identity information so that we can verify your identity. We will respond within 30 days of receiving your request, free of charge. If the request requires additional costs, we may charge a fee in accordance with the tariff determined by the Personal Data Protection Board.

10. Your Rights Under GDPR (Where Applicable)

If you are located in the European Economic Area (EEA), you additionally have the right to:

• Access a copy of your personal data;
• Request data portability in a machine-readable format;
• Withdraw your consent at any time (without affecting the lawfulness of processing based on consent before its withdrawal);
• Lodge a complaint with a supervisory authority.

11. Children's Privacy

HairTry is not directed at children under 13 (or under 16 in the EEA). We do not knowingly collect personal data from children under these ages. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it within 48 hours.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the "Last updated" date at the top of this page. We encourage you to review this page periodically. Continued use of the App after changes constitutes acceptance of the updated policy.

13. Contact Us