Privacy Policy

Data we collect

• Account details: email address, first name, last name, optional phone number and communication language. Your password is stored only in an irreversible form (Argon2id hash).
• Optional profile details: your date of birth and gender (female / male), if you choose to add them at sign-up or in your profile. You can leave these fields empty and change or remove them at any time.
• Optional profile photo: a photo you upload from the app is re-encoded on our server into a 480-pixel WebP image; all metadata, including location (GPS) and EXIF data, is removed, and only this small image is stored.
• When you sign in with Google or Apple: the email address verified by the provider, your name and your account identifier at the provider. For Sign in with Apple, the refresh token Apple issues is stored encrypted so that the Apple authorization can be revoked when your account is deleted.
• Appointments: the salon, branch, services, staff member, date and time you choose, and the optional note you write for the salon (up to 500 characters; we recommend not including sensitive information such as health details).
• Your favorite salons and the ratings and reviews you write.
• For notifications: your device’s push notification token and device platform (iOS / Android).
• Account deletion request: if you make one, the date of the request.
• Security records: for sign-in attempts, the email address, IP address and outcome; only hashes of session tokens and verification codes.

Location and search

Your location is used only when you tap “Nearby” and grant permission. Before it is sent to the server, your location is rounded on the device to about 110 metres (on Android the app only requests approximate location permission), and it is used only for that search. The server does not store your location, and location data is masked in log files. Location is never used in the background.

Filtering salons by service name or by availability at a date and time you choose does not require your location or any additional personal data.

Device calendar

If you choose to add an appointment to your calendar, the app writes only to the calendar on your device. Your calendar contents are not sent to the server.

Who can see your profile details

Your date of birth, gender and profile photo are shown only to you in the app. They are not shared with salons, not transferred to salons’ customer records, and not shown in the platform administrators’ panel.

Your profile photo is private: it has no public link and is served only to requests authenticated with your account’s session.

Purposes and legal bases

• Creating your account, verifying your sign-in and providing the booking service — conclusion and performance of a contract (GDPR Art. 6(1)(b)).
• Sending appointment reminders and status notifications — performance of a contract (GDPR Art. 6(1)(b)); notification permission is controlled in your device settings.
• Showing your optional date of birth, gender and profile photo to you in your profile — your explicit consent, given by providing them voluntarily (GDPR Art. 6(1)(a)). You can withdraw your consent at any time by removing them from your profile; this does not affect the lawfulness of processing before the withdrawal.
• Protecting your account against abuse and blocking fraudulent sign-ins and excessive requests — legitimate interest and data security obligation (GDPR Art. 6(1)(f) and Art. 32).
• Calculating salon ratings from reviews and moderating inappropriate content — legitimate interest (GDPR Art. 6(1)(f)).
• Reviewing and completing your account deletion requests and recording the outcome — legal obligation (GDPR Art. 6(1)(c) and Art. 17).

Sharing with salons

When you book with a salon, your first name, last name, email address, phone number, communication language and booking note are transferred to that salon’s customer and appointment records so that it can manage your appointment. The salon may use these details to send you email or WhatsApp notifications about your appointment. The salon is separately responsible for these records under its own obligations. Your reviews may be published on the salon page with your first name and the initial of your last name (e.g. “Ayşe Y.”).

Your date of birth, gender and profile photo are not shared with salons.

Platform administrators

To review account deletion requests and operate the platform, the platform’s authorized administrators can see your first and last name, email address, phone number, sign-in methods, email verification status, account creation and last sign-in dates, the number of salons you are registered with, and the date of any pending deletion request. To answer support requests, handle abuse, moderate content and process your account requests (such as deletion), they can also see your booking history (date, salon, branch, services, staff member, status and whether the booking was made in the app or by the salon), the salons you are linked with, your favorite salons and your reviews. They cannot see your date of birth, gender or profile photo. Each time an administrator views a customer account, it is recorded in the audit log.

Service providers and international transfers

• Push notifications are delivered through Expo (Expo Push Service) and your device’s notification infrastructure (Apple Push Notification service, Firebase Cloud Messaging); these services may be located abroad.
• If you choose Google or Apple sign-in, authentication is performed by that provider.
• Verification and information emails are sent through an email service provider.
• Web traffic may pass through a content delivery and security network (Cloudflare).
• International transfers are carried out in accordance with the conditions of the TRNC Law No. 89/2007 and, where the GDPR applies, the transfer rules of Chapter V of the GDPR.

Retention

• Your account details, optional profile details (date of birth, gender, profile photo), favorites and reviews are kept while your account is open and are deleted when your account is deleted. You can also remove the optional details yourself at any time before that.
• When you replace your profile photo, the previous photo is deleted from the server; when you remove it, the current photo is deleted.
• If you request account deletion, your account and data are kept until the request is reviewed and are permanently deleted when it is approved. A pending request can be withdrawn.
• The fact that a deletion request was approved or rejected is kept in the audit log; this record contains only the internal account identifier, not your personal data.
• Sign-in attempts, expired sessions, used codes and unused notification tokens are deleted automatically after 30 days.
• Deleted data may remain in routine database backups until the backup retention period ends (at most 30 days); backups are used only for recovery.
• Salons keep their customer and appointment records under their own legal and accounting obligations.

Security

Data is transmitted over encrypted connections (HTTPS). Passwords and session tokens are stored as irreversible hashes, and the Apple refresh token is stored encrypted. The type of an uploaded profile photo is verified from the file contents, and the image is re-encoded with its metadata removed. Access is restricted by authorization, and important actions are written to an audit log.

Your rights

Under the TRNC Law No. 89/2007 you have the right to learn whether your personal data is processed, to request information, to learn the purpose of processing and whether it is used accordingly, to learn the third parties it is transferred to, to request correction or deletion, to object, and to claim compensation for damages.

Where the GDPR applies, under Articles 15–22 of the GDPR you also have the rights of access, rectification, erasure, restriction of processing, data portability, objection, and rights relating to decisions based solely on automated processing. Where processing is based on consent, you can withdraw your consent at any time (GDPR Art. 7(3)).

You can correct or remove your first and last name, phone number, communication language, date of birth, gender and profile photo inside the app. You can request deletion of your account in the app under Profile → Privacy & legal → “Request account deletion”; your account is deleted once the platform reviews and approves the request (see the Account deletion page for details). For other requests, use the data controller contact details below.

You have the right to complain to the TRNC Personal Data Protection Board. Where the GDPR applies, you can also lodge a complaint with the supervisory authority of the EU / EEA member state of your habitual residence, place of work or place of the alleged infringement (GDPR Art. 77).

Children

The app is not designed for people under 18, and we do not knowingly collect data from children.

Changes

If this policy changes, the current version is published on this page with its “Last updated” date.