KVKK Privacy Notice
Version: 5 · Date: October 24, 2026
This notice explains, under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK"), how your personal data is processed when you use the Koza mobile app.
1. Data Controller
KOZA LLC — 30 N GOULD ST STE 53021, Sheridan, Wyoming 82801, USA
Email: team@koza.social · Web: https://koza.social
2. Data We Process and How It Is Collected
All data is collected electronically through in-app forms, device permissions (camera, microphone, photo library, notifications) and automatic logs, by fully or partly automated means.
| Category | Data | Source |
|---|---|---|
| Identity & contact | Name, email, username, birth date, gender (optional) | Sign-up form; Apple/Google identity provider |
| Profile | Photos (1-6), figure choice, "about", school/major, education level, grade, goal (YKS/KPSS/ALES/Language), track, study preferences, interests, "what you are looking for" | Onboarding and profile editing |
| Location (province/district) | The province and district you choose. No GPS/location permission; no exact location or distance | Onboarding, Edit profile, Settings > Location |
| Preferences | Per-type notification preferences, account deletion request date and the leaving reason you pick | Settings |
| Content | Messages, community messages, posts, comments, tasks/notes, photo and file attachments | Content you create |
| Voice/video rooms | Live audio/video stream. Never recorded or stored | Camera/microphone permission |
| Subscription | App Store transaction id, subscription status and plan. Card details never reach us | Apple / RevenueCat |
| Device & usage | Device model, OS, app version, push token, crash logs, screen/tap interactions, masked screen session recordings, IP address | Automatic |
| Ad measurement | Advertising identifier (IDFA) — only with App Tracking Transparency permission | ATT prompt |
| Safety & moderation | Reports, blocks, automated content-screening results, warning/suspension history | In-app report/block; automated screening |
| Invites | Invite code entered at sign-up and the inviting account | Invite link |
3. Purposes and Legal Bases (KVKK Art. 5)
| Purpose | Legal basis |
|---|---|
| Account, sign-in, profile; matching and Find suggestions; study rooms; messaging and communities; task sync; events; Koza Plus subscription | Performance of a contract (Art. 5/2-c) |
| Filtering objectionable content, handling reports within 24 hours, account security, fraud and abuse prevention | Legitimate interest (Art. 5/2-f) and legal obligation (Art. 5/2-ç) |
| Debugging, performance and usage analytics to improve the product | Legitimate interest (Art. 5/2-f) |
| Responding to legal requests and record keeping | Legal obligation (Art. 5/2-ç) |
| Membership of the communities you join (automatic community membership is currently not applied) | Performance of a contract (Art. 5/2-c) — you can leave at any time |
| Ad campaign measurement (IDFA) | Explicit consent (ATT prompt) |
| Campaign and announcement emails/notifications | Explicit consent — withdrawable at any time |
4. Recipients and Transfers (KVKK Art. 8-9)
Other users: Your Find card and profile show your username, photos, school, grade, goal, study preferences and only your province; your email, birth date and district are never shown. Your district appears only as the meeting area ("district, province") of an in-person event you create.
Processors: Amazon Web Services (hosting, storage, photo screening — USA/EU); Turso (database — EU/USA); Cloudflare (audio/video relay, CDN — global); Anthropic (automated content screening and match suggestions — USA); Apple and Google (sign-in, push, payments — USA); RevenueCat (subscription validation — USA); Resend (email — USA); Sentry (error tracking — USA); PostHog (analytics and masked session recording — USA); AppsFlyer (ad measurement; advertising identifier (IDFA) only with ATT consent — USA/EU); TikTok (ad measurement, only with ATT consent — USA/EU); Expo (push delivery — USA).
Authorities: Lawful requests from courts, prosecutors and regulators.
International transfer: The controller is established in the USA and servers are located in the USA and EU. Your data is transferred abroad with your explicit consent under KVKK Art. 9. Because the service runs entirely on this infrastructure, withdrawing consent means closing your account, which you can do under Settings > Delete account.
5. Retention
- Account and profile data: while your account is open. "Delete account" hides your account right away; sign in within 14 days to bring it back, after 14 days it is permanently deleted or anonymised.
- Messages and content: until you delete them or your account is deleted.
- Moderation and report records: 2 years after account closure (to prevent repeat abuse).
- Error and usage logs: up to 12 months.
- Subscription and billing records: for the period required by law.
6. Your Rights (KVKK Art. 11)
To learn whether your data is processed; to request information; to learn the purpose and whether it is used accordingly; to know the third parties it is transferred to; to request correction, deletion or destruction; to have these notified to recipients; to object to a result against you produced by automated analysis; to claim compensation for unlawful processing.
7. How to Apply
- In the app: Settings > Help > Data protection request (KVKK) (opens the request form, or a pre-filled email)
- Email: team@koza.social (subject: "KVKK Request")
- You can view and edit your own data in the app and delete it entirely under Settings > Delete account.
Requests are answered free of charge within 30 days. If unsatisfied, you may complain to the Personal Data Protection Board (https://www.kvkk.gov.tr).
8. Children
The app is not for children under 14; the birth year is verified at sign-up. Users aged 14-18 are under parental/guardian responsibility.
9. Changes
When this notice changes, its version number increases and you are asked to re-confirm at launch. The current version is always available under Settings > Privacy > Privacy consents.
Questions about this document? Support