Effective and last updated: November 7, 2026

1. Controller and scope

This policy explains personal-data processing in Omo and its related services, provided by Ayşenur Güven. Support, privacy and rights requests: omodestek@mobilapps.com.tr. The application/package identifier is com.appomo. Omo is intended only for people aged 18 or over.

Operator: Ayşenur Güven. Postal address: Bostancık Mahallesi 1590 Sokak No: 1-7, Mamak, Ankara 06100, Türkiye. Telephone: +90 552 209 25 07. Support and privacy: omodestek@mobilapps.com.tr. Website: https://omo.mobilapps.com.tr/ .

Apple, Google and other users are independently responsible for their own services or devices under their policies. This is a privacy notice: reading it or granting a device permission does not constitute unlimited consent to every processing purpose.

2. Account and profile information

• Apple/Google sign-in may provide a provider user identifier, Firebase user identifier and the email address or display name shared by the provider. An Apple private relay address may replace your personal email address. We do not receive your provider password.
• We process username, date of birth, stated gender, country/language codes, profile photograph, badge status and profile creation/update times. Other users see your age, not your full date of birth.
• Country and language may be derived from device region/language settings. These are not GPS coordinates or verification of your physical whereabouts. We do not request precise-location or contact-book access.
• Other users may see your username, age, photograph, gender, country/language, badges and recent online activity within the service.

3. Invitations, calls and messages

We process invitation participants, timing, acceptance/decline/end status, call identifiers and messaging records. Message contents, sender/recipient identifiers, timestamps and read receipts are stored on our servers and are accessible to the recipient and authorised personnel as needed to operate and secure the service.

Live audio and video travel through LiveKit software running on the server we operate during calls. Room access information and technical connection data are processed. We do not keep a continuous audio/video recording or archive of live calls. This does not mean we can prevent another user recording on their device. We do not promise absolute call confidentiality or end-to-end encryption.

4. Usage rights and the invitation queue

We may process invitation counts, subscription status and related transaction records to administer free-use and Premium rights. Queue entries, target profiles, creation/expiry times and delivery status may also be stored. These records help check entitlements and prevent duplicate deliveries.

5. Safety, reports and moderation

We may process profile photographs, usernames, report reasons, blocks, enforcement decisions and safety-review records. Still-image samples from calls may be checked on the device for inappropriate content; periodic or suspicious samples may be sent to the safety API. If server-side screening is enabled, the relevant samples may also be reviewed by that service. Flagged frames, scores and call/user identifiers may be retained for review. This processing is not limited to occasions when a user presses the report button.

Current features do not provide official-ID checking, biometric face identification or automated identity verification using a live selfie. If such a feature is added, its scope, legal basis and any required separate explicit consent will be explained. Automated screening can make mistakes; contact us about review or an appeal where applicable.

Publication of iOS profile photos is subject to manual approval. Inappropriate-content scores and reports assist human review; a score alone is not conclusive proof of a violation or identity.

6. Device, session and notification information

Firebase session information and application preferences may be stored on your device. Push notifications may use FCM/APNs tokens and notification-service installation identifiers associated with an app/device installation, together with platform, language and update time. These are not advertising hardware serial numbers, IMEI or IDFA.

Notifications may concern messages, video invitations, invitation acceptance and Omo announcements. A preview may show a username and a short message excerpt on your lock screen. Manage notification categories in the application and permission in system settings. Technical logs may include timestamps, errors, request paths, connection/IP information and data needed for service security.

The Android version includes a Meta App Events integration. When enabled, Meta may process installation/activation, completed registration and automatic in-app purchase events, technical app/device information and connection/IP information for advertising measurement and analytics. When advertising-ID collection is enabled, the available Android advertising ID may also be included. We do not send message contents, profile photographs or live-call audio/video to this integration. The mobile SDK is not initialized before the integration is configured.

On iOS, when the integration is enabled and Apple App Tracking Transparency (ATT) permission is granted, the Meta SDK may send first-open/activation, completed registration and server-verified new purchase events to Meta for advertising measurement. Product ID, amount, currency and technical app/device and connection/IP information may be processed. IDFA is used only when advertising-ID collection is also enabled and ATT permission is valid. Without permission, the SDK is not initialized and these events are not sent to Meta. Refusing permission does not restrict account creation or purchased entitlements. Automatic iOS purchase logging is disabled; restored purchases are not counted as new sales. Local hashes may be retained on the device to prevent duplicate events; account and transaction identifiers are not sent to Meta for this purpose. Messages, photos and live-call content are not included in this measurement.

Website language routing uses the browser region/language. The website account-deletion tool prepares an email draft in your browser; it does not itself submit the form details to a server. If you choose to send the email, we process the support request. Website hosting may produce technical access logs such as IP addresses and request times.

7. Permissions

Camera access supports calls and taking a profile photograph; microphone access supports live-call audio; the gallery/photo picker supplies photographs you select; notification permission allows alerts. Camera preview may start when opening the call/matching screen. You may refuse or revoke system permissions; dependent features may not work. We do not request location or contact-book access. The Android advertising ID may be processed when Meta advertising measurement is enabled and the identifier is available; manage the identifier through your device privacy/advertising settings. ATT permission is requested separately for iOS advertising measurement. Accepting this policy or the terms does not replace ATT permission. You may revoke permission in iOS Settings → Privacy & Security → Tracking.

8. Purposes and legal bases

We process data to create accounts, display profiles and communications, deliver messages/invitations, provide calls, administer introductory use and Premium rights, prevent abuse, handle support and meet legal obligations.

Where applicable, legal bases include processing necessary to enter into or perform a contract, legal obligations, establishing/exercising/defending rights and legitimate interests balanced against your fundamental rights. If a purpose requires separate consent, we request it separately and explain withdrawal. Operating-system permissions do not alone provide a legal basis for all processing. Applicable EEA/UK data-protection requirements are also considered where relevant.

9. Sharing and service providers

• Other users receive the profile information, messages and live media you share with them.
• Meta Platforms: the ATT-authorized iOS measurement described above and Android App Events, when enabled, for application events, installation/advertising measurement and analytics, including the available Android advertising ID when its collection is enabled. Meta may also process relevant information under its own privacy policy and service terms: https://www.facebook.com/privacy/policy/
• Google/Firebase provides Firebase Authentication, Google sign-in and Firebase Cloud Messaging for identity, session and notification services.
• Apple provides Apple sign-in and iOS store purchases; Google Play provides Android store purchases.
• LiveKit infrastructure handles live-media connections, room access and call operation.
• Service server/database and file-storage infrastructure hosts profile, message, invitation, image and safety records, with access limited by role.
• Authorised support/safety personnel and, where necessary, legal advisers access information needed for support, reports or legal proceedings.

Necessary and proportionate disclosures may occur for legal obligations, valid official requests, prevention of imminent harm or a business transfer. The disclosed advertising-measurement transfer to Meta may qualify as advertising-related sharing or tracking under applicable law. We do not use messages, profile photographs or call contents to train public advertising/face-recognition models. We update this notice when a new provider materially changes processing purposes or transfers.

10. Purchases

The relevant store processes payments. We may process product/plan identifiers; transaction, original-transaction and order identifiers; purchase or verification tokens; an Omo account-binding identifier; platform; purchase, verification and expiry times; renewal, cancellation and refund status; store-reported amount/currency where available; and test/live environment information. These records support entitlements, restoration, order tracking and abuse prevention. Apple/Google verification services and store server notifications may update subscription status. We do not receive your full card number. Apple App Store or Google Play terms and mandatory consumer rights govern subscriptions, cancellation and refunds. Deleting your account does not automatically cancel a store subscription.

11. Retention

• Accounts/profiles, photographs, messages, invitation history, blocks and introductory-use records are retained as necessary for the account or service; account deletion initiates removal of active records.
• Live media is not retained as a continuous call archive.
• Reports and flagged safety frames are retained as needed for investigation, appeals, rights or legal requirements; the ordinary retention target is up to 24 months. Longer retention requires a separate legal need or ongoing dispute.
• Expired invitation/queue records are no longer used for delivery; historical and safety records may remain associated with the account. A current queue entry is valid for 24 hours.
• Notification tokens remain while valid and associated with the account, and are updated/removed following sign-out, removal or invalidation as applicable.
• Transaction records remain as necessary for entitlement checks, accounting, disputes and legal obligations.
• Technical logs target a short operational period, from days to a few weeks unless security or legal needs require otherwise.

Deletion does not override legally required retention or a provider's independent obligations. Backup remnants may remain with restricted access subject to deletion/rotation processes and are not used to restore an ordinarily deleted account to active service.

12. Account deletion and your rights

Use Profile → Settings → Delete my account. Reauthentication may be required. The process covers removal of the profile, username record, associated active messages/invitations/blocks and introductory records, profile files and the application's Firebase sign-in account, subject to technical deletion procedures and legally required retention. Merely uninstalling the application does not delete your account. Cancel store subscriptions separately.

Under applicable KVKK, GDPR, UK GDPR and other laws, you may have rights to learn whether your data is processed, obtain access/information/copies, request correction or erasure, restrict or object to certain processing, obtain portability where applicable and complain to a supervisory authority. To withdraw consent for consent-based processing or make a data request, email omodestek@mobilapps.com.tr. Withdrawal does not retrospectively affect the lawfulness of earlier processing. Manage device permissions in system settings and notification preferences in the application/system settings. Send other rights requests to the same address. Reasonable identity checks may be required to prevent unauthorised disclosure. We handle requests within applicable legal time limits, subject to statutory exceptions.

13. Children

Omo is not intended for under-18s. If we learn of a minor using the service, we may restrict access, investigate the account/data and take necessary deletion or reporting measures. Report concerns through the application or our support address.

14. International transfers and security

Data may be processed across borders because of users outside Türkiye, identity/notification providers or infrastructure. Transfers must use the mechanisms and safeguards required by applicable law; simply reading this notice does not authorise unrestricted transfers. We do not commit that all data is stored only in Türkiye; identity, notification and infrastructure providers may process information in their service regions.

We use authenticated access, restricted file addresses and role-based management tools. Technical and organisational measures address unauthorised access; no system can be guaranteed completely secure. Contact us if you suspect account compromise. Enabled use of Android Meta App Events and advertising-ID processing is described in sections 6, 7 and 9. iOS Meta measurement and IDFA use require valid ATT permission.

15. Language, changes and contact

The application opens Turkish legal documents when the primary device region is Türkiye (TR), and English for other or unknown regions. This is not physical-location detection. We appropriately notify material processing changes and request new consent separately where required. Operator/controller: Ayşenur Güven. Contact: omodestek@mobilapps.com.tr.