This is a translation for convenience. In case of any conflict, the Turkish version prevails.
This Privacy Policy explains how personal data is processed in connection with the NOA mobile app, the noamatch.com website and related services (together "NOA" or the "Service"), on which legal grounds, and what your rights are. Detailed information under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") is in the KVKK Information Notice, and consent-based processing is described in the Explicit Consent Text.
Data controller and service provider: Hakan Şahbaz (owner and operator of the NOA app) · General contact: destek@noamatch.com · Privacy requests: gizlilik@noamatch.com · How to apply: KVKK Information Notice
| Category | Data |
|---|---|
| Account and sign-in | Phone number (for account security and recovery; may be verified by SMS code), optional email, password (stored only in irreversible form by the authentication provider), name and email shared by Apple or Google if you sign in with them, referral code. |
| Profile | Name, date of birth (only your age is shown), job, city/country, bio, prompts, interests, relationship goal, communication style, social life, weekends, lifestyle (drinking, smoking, exercise, pets, education, children, height, zodiac), music and TV taste, compatibility quiz answers. |
| Special category data | Your gender identity and who you want to meet ("Show me"); as these may be considered data concerning sex life under KVKK Art. 6, they are processed only with your explicit consent and only for matching. You can hide your gender on your profile. |
| Photos | Profile photos (at least 2, at most 6), crop data and moderation result. |
| Verification (blue tick) | Optional live selfie, compared with your profile photos by eye by our team; no facial recognition, biometric templates or automated biometric processing. The selfie is deleted once a decision is made; only the result is kept. |
| Location | Device location rounded to about 1 km, from which city/country is derived. Others only see your city and a rounded distance. Location is not tracked continuously; it is taken only when you update it. |
| Communications and interactions | Likes, passes, matches, messages (text, voice notes, stickers, photos — including whether a photo is view-once or kept and whether it was taken with the camera or chosen from the gallery), reactions, icebreaker answers, date plans and post-date feedback. |
| Voice calls | Who took part, when and for how long, and the decisions made at the end. Audio is not recorded or stored. |
| Purchases | Subscription and credit transactions (product, date, store, transaction ID, price). Card and payment details are handled by Apple/Google and never reach us. |
| Device and technical | Push token, app language, time zone, OS and app version; device identifier (on Android the device's app-specific ID, on iOS a random ID the app creates and stores on the device; it contains no name or contact details); IP address, request logs and troubleshooting events sent by the app (e.g. whether a photo opened; no message or photo content). |
| App usage days | The days on which you open the app in the foreground; only the date is stored (no time, location, screen or content information). |
| Account deletion feedback | The reason for leaving you optionally select, and any note you write, when deleting your account. |
| Install source | Which channel you installed the app from (advertising, store search, invite link or other). Android only, taken as a category from Google Play's install referrer; ad click identifiers and device identifiers are not stored and nothing is shared with advertising networks. |
| Safety and moderation | Reports, blocks, moderation decisions, restriction and violation records (e.g. the unanswered-message rule), an irreversible hash of the phone number of accounts closed for violations, administrator access logs. |
| Support | Emails you send us and their attachments. |
| Purpose | Legal basis |
|---|---|
| Creating your account, sign-in, providing the Service (profile, Discover, matches, messaging, voice calls, Blind Call) | Performance of contract (KVKK Art. 5/2-c; GDPR Art. 6/1-b) |
| Up to 3 account notices by email and push notification to accounts that confirmed their email but did not finish their profile (no offers or promotions; you can turn them off with the link in the email or in your device settings) | Formation or performance of a contract (Art. 5/2-c), legitimate interest (Art. 5/2-f) |
| Matching by gender identity and preference | Explicit consent (KVKK Art. 6/2; GDPR Art. 9/2-a) |
| Compatibility score, ranking and suggestions | Performance of contract, legitimate interest |
| AI-assisted explanations and analyses | Explicit consent |
| Fighting fake accounts, fraud, harassment and abuse; moderation; safety records; preventing banned numbers from re-registering; preventing multiple accounts on one device and re-registration from devices restricted for Community Guidelines violations (device identifier); blocking sign-ups with disposable email addresses; detecting app errors | Legitimate interest; establishment, exercise or defence of legal claims |
| Managing subscriptions, credits and rewards | Performance of contract, legal obligation |
| Service notifications (matches, messages, safety, deadlines) | Performance of contract |
| Notifications about offers and plans | Sent only with your consent to commercial electronic messages: tapping "Yes, let me know" on the separate consent screen shown after sign-up, or turning on "Plan and credit offers" in Settings → Notifications. The date of your consent is recorded; you can withdraw it at any time in the same place |
| Measuring the effectiveness of our promotion and advertising in aggregate (which channels new profiles come from; aggregate counts only, not individual level) | Legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6/1-f) |
| Improving the service: measuring how many users come back to the app (e.g. the next day, day 7) and why accounts are deleted. Results are reviewed internally; they are not used for ad targeting or profiling and are not shared with third parties. | Legitimate interest (KVKK Art. 5/2-f) |
| Legal obligations, requests of competent authorities, evidence in disputes | Legal obligation; legal claims |
Severe decisions such as account closure are made by a human. To object to the result of automated processing, email gizlilik@noamatch.com; a person will review it.
If you give explicit consent, your profile information (excluding your name, email, phone number and photos) and, for communication analysis, your match messages only if both of you consented, are sent to the AI service of Anthropic PBC (USA) to generate compatibility explanations, profile tips, Compatibility Assistant results and communication analyses. The provider does not use this data to train its models. You can withdraw consent in Settings at any time. AI output is a suggestion, not professional, psychological or legal advice.
Other users see your name, age, approved photos, city/country and approximate distance, verification status, profile details you chose to show and your prompts. Only your match sees your messages. Your phone, email, exact location, private quiz answers and (if hidden) your gender are never shown.
Service providers (only to provide the Service, under contract): Supabase (database, auth, storage — Frankfurt, Germany); Hetzner Online (hosting, voice infrastructure on our own LiveKit server — Germany); İleti Merkezi (SMS codes — Türkiye); Apple and Google (sign-in, in-app purchases, push delivery — USA and other countries); RevenueCat (purchase records — USA); Expo / 650 Industries (push delivery — USA); Anthropic (AI, only with consent — USA); our email provider (sign-in, verification, password reset and support emails — EU/USA); OpenStreetMap Nominatim (city lookup from rounded coordinates — EU); Cloudflare (DNS; and, on NOA Web only, security verification against fake/automated signups — USA).
Authorities: competent public bodies and courts, upon a lawful request and to the extent required by law. Business transfer: in case of a transfer of NOA to a company, merger or sale, data may be transferred with the safeguards of this policy; we will inform you in advance. Aggregated statistics that cannot identify you may be shared.
Some providers are outside Türkiye. Transfers are made under KVKK Art. 9 with appropriate safeguards (such as the standard contracts published by the Turkish Data Protection Authority) and, where this is not possible, based on your explicit consent. For users in the EU/UK, transfers outside the EEA/UK rely on adequacy decisions or standard contractual clauses. The AI transfer relies solely on your explicit consent.
| Data | Period |
|---|---|
| Account and profile data | While your account is open |
| When you delete your account | Your profile, photos, messages and matches are removed from the app immediately. To prevent harassment, fraud and similar violations from being hidden by deleting an account, a safety record (profile summary, phone number, conversations, reports and related files) is kept for 90 days, accessible only to the authorised safety team, then permanently deleted. |
| Account deletion reason and note | Kept with the deleted account's safety record for 90 days. During that time only the authorised team may review the reason and note together with the profile summary in that record (gender, age, country/city, plan, number of photos and conversations, how long the account was open) to improve the service; it is then permanently deleted. The reason you selected (not the note) may be kept longer as anonymous aggregate statistics, not linked to your identity and only together with general country, plan, account age and match count ranges; small groups are merged so no individual can be singled out. |
| App usage days | While your account is open; deleted when you delete your account |
| Messages removed with "delete for everyone", view-once photos after opening | Removed for the other person immediately; kept for 90 days for report reviews, accessible only to the safety team. Content subject to an open report may be kept until the review ends. Content confirmed in a child sexual exploitation report is kept securely and separately for 1 year after it is reported to the authorities (longer if they ask in writing) and is shared with no one else. |
| Verification selfie | Deleted once reviewed (only the result is kept) |
| Phone number of accounts closed for violations | Only as an irreversible hash, until the ban is lifted |
| Install source | While your account is open; deleted when you delete your account |
| Purchase and commercial records | For the period required by law |
| Security and access logs | 1 year as required by Turkish Law No. 5651, then deleted |
| Device identifier | While your account is open; deleted immediately if you delete your account. Identifiers of devices restricted for Community Guidelines violations are kept until the restriction is lifted. |
| Troubleshooting events | Up to 1 year |
| Support correspondence | Up to 2 years after the request is resolved |
Data is encrypted in transit (HTTPS/TLS). Photos and voice notes are kept in private storage and shown only through short-lived links. Chat photos are protected against screenshots on phones (technically limited in browsers). Administrator access is restricted and logged. No system is risk-free; if we detect a breach, we will notify the Authority and affected people as required by law.
Under KVKK Art. 11 you may learn whether your data is processed and request information about it, learn the purpose and whether it is used accordingly, know the third parties it is transferred to in Türkiye or abroad, request correction or deletion/destruction, request notification of these to third parties, object to a result against you arising from exclusively automated analysis, and claim compensation for damage caused by unlawful processing. Users in the EU/EEA/UK also have the rights of access, rectification, erasure, restriction, objection, data portability and withdrawal of consent, and may lodge a complaint with their local supervisory authority.
In the app you can get a copy of your data (Settings → Download a copy of my data), edit your profile, withdraw AI consent and delete your account. Requests: email gizlilik@noamatch.com from the email registered to your account or stating your registered phone number, or, to apply by signed letter, ask us at the same email address for our postal address. Requests are answered free of charge within 30 days. You may complain to the Turkish Personal Data Protection Board.
NOA is only for people aged 18 or over. Accounts we identify or that are reported as belonging to minors are closed and their data deleted.
noamatch.com uses no advertising or analytics cookies or trackers. On NOA Web's signup and account-recovery screens, we use Cloudflare Turnstile to block fake/automated signups, which may place a strictly necessary/technical cookie in your browser; it is never used for advertising, profiling or tracking (details: Cookie Policy). The app uses only essential local storage to keep you signed in and remember settings such as language.
We may update this policy as the Service or the law changes. Material changes are announced in the app; the current version is always on this page. We will ask for your consent separately for any new consent-based processing.