Privacy Policy

Version 2026-09-30 · Effective 30 September 2026

Aura reads a colour from a photograph and matches people by that colour. Doing so means processing a picture of your face — this page says exactly what we process, why, and for how long. We have aimed for accurate rather than short.

1. Who is responsible

Data controller: MATE APP STUDIO YAZILIM BİLİŞİM LİMİTED ŞİRKETİ (Mate App Studio Software and IT Limited Company)

Address: Kırmızıtoprak Mahallesi, Porsuk Bulvarı, Nilay Sokak, Emin Apt. No: 11B, Odunpazarı, Eskişehir, Türkiye

Company email: info@mateappstudio.com

App and personal data requests: support@auramatchapp.com

The party named above is the data controller under the General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK).

2. What we process

The table below is the complete set of fields the application actually stores. If it is not listed here, we do not collect it.

Category	Data	Source
Account	Email address, a hash of your password, name, date of birth	From you, at sign-up
Profile	Gender, who you are interested in, what you are looking for, your love language, bio, work, education, height, drinking and smoking habits	From you, optional
Location	The name of your city, and a coordinate rounded to about a kilometre	From your device's location: the city name is derived on the device itself, and the coordinate is rounded before it is sent
Birth details	Your birthplace (a city and that city's coordinate), your time of birth if you give it, and the sun, moon and rising signs worked out from them. Other people see only your sun sign	From you, at sign-up; our server works out the signs
Photographs	The pictures you upload, their dimensions, a perceptual hash, and the moderation outcome	From you
Aura reading	Three colour values, four numeric traits (energy, warmth, depth, clarity) and the archetype they match; your answers to the four questions at sign-up and the colour you picked	Computed on your phone; the result is sent to us. The answers and the colour come from you
Activity	Likes and passes, matches, messages	From using the app
Device	Operating system, app version, language, notification token, last seen	From the app
Safety	Reports you file and reports about you, blocks, your verification selfie	From you and from other users
Purchases	Subscription plan and status, boost and Super Like purchases, store transaction ids	From Apple or Google; a copy of App Store purchases also goes to RevenueCat (section 6)
Usage events	Which step you took in the app and when — where a sign-up stopped, the subscription screen opening, a purchase starting: the event's name and time, the app version, the language and a random number for this installation. No message content, photographs or location	From the app; kept on our own server. If you allow it, the same events also go to Google Analytics (section 6)
Consent records	Which version of which document you agreed to, and when	From the app

What we do not collect

Your precise location. Your exact coordinates never reach us. The conversion to a city name happens on the device, and the coordinate is rounded to two decimal places — about a kilometre — before it is sent, then rounded again on our side. We use that coarse point only to work out how far apart two people are; it is never shown to anybody, on any screen or in any response.
Your IP address. There is no field anywhere in the application's database that stores one.
Your contacts, calendar or other apps. We never ask for access.
Your advertising identifier. The app contains no advertising network and never shows iOS's tracking permission prompt, so your advertising identifier (IDFA) is open neither to us nor to our partners. Google Analytics runs only if you allow it, and you can withdraw that at any time under Settings → Analytics.

3. Special category data and consent

Some data carries additional protection under GDPR Art. 9 and KVKK Art. 6. In Aura that means:

Data concerning sexual orientation. In a dating app, the answer to "who are you interested in" falls into this category.
Photographs of your face. We do not process them biometrically for identification — no face recognition, no face templates — but the picture itself is sensitive and we treat it that way.

This data is processed on the basis of your explicit consent alone (GDPR Art. 9(2)(a); KVKK Art. 6(2)). You can withdraw that consent at any time from inside the app: Settings → Privacy and my data. Withdrawal takes effect going forward and does not make lawful processing already carried out unlawful.

We record consent together with the version of the text. "The user agreed" is not a defence; "the user agreed to this text, on this date" is. You can see every consent you have given, and when, under Settings → Privacy and my data.

4. Why we process it, and on what basis

Purpose	GDPR basis	KVKK basis
Creating and running your account	Art. 6(1)(b) — contract	Art. 5(2)(c)
Reading your aura and ranking who you are shown	Art. 9(2)(a) — explicit consent	Art. 6(2)
Screening photographs before they appear	Art. 6(1)(f) — legitimate interest in user safety	Art. 5(2)(f)
Reviewing reports and preventing abuse	Art. 6(1)(f) — legitimate interest	Art. 5(2)(f)
Enforcing the age limit	Art. 6(1)(c) — legal obligation	Art. 5(2)(ç)
Sending notifications	Art. 6(1)(a) — consent	Art. 5(1)
Running your subscription and purchases	Art. 6(1)(b) — contract	Art. 5(2)(c)
Measuring how the app is used (usage events on our own server)	Art. 6(1)(f) — legitimate interest	Art. 5(2)(f)
Usage analysis with Google Analytics	Art. 6(1)(a) — consent (Settings → Analytics)	Art. 5(1)
Tracking purchases and testing which plans the subscription screen shows (RevenueCat)	Art. 6(1)(f) — legitimate interest	Art. 5(2)(f)
Seeing errors and keeping the service working	Art. 6(1)(f) — legitimate interest	Art. 5(2)(f)

Automated processing

There are two automated steps and we name both:

The aura reading and match ordering. The algorithm that extracts colour from your photograph runs on your phone; the picture is not sent to our server for it. The result affects the order in which people appear to you. It is not a decision producing legal effects concerning you.
Photo screening. Photographs you upload pass through models running on our own server's processor. A model can refuse a photograph. You can contest that outcome and ask for a human review: support@auramatchapp.com.

5. What happens to your photographs

This is the question we are asked most, so it gets its own section:

When you take your aura photograph, the colour analysis happens on your phone. What reaches us is three colour codes and four numbers — not the picture.
Your profile photographs are uploaded and held in private storage. They have no public address; the app displays them through short-lived signed links.
Every uploaded photograph is screened by models running on our own server. Your photographs are never sent to any third party or any AI service for this.
If a photograph is refused, a perceptual hash of it is kept so that the same picture is refused again on re-upload.
When you delete your account, your photographs are deleted from storage.

6. Who we share it with

We do not sell your data and we share none of it for advertising. The processors we use to run the service are:

Who	For what	Where
Hetzner Online GmbH	Server and database	Germany
Cloudflare, Inc.	Photograph and backup storage (R2)	EU / US
Resend, Inc.	Verification and service email	US
Google (Firebase)	Delivering notifications (Cloud Messaging); crash reports — the technical detail of the crash, the last few app log lines before it, device model, operating system and app version (Crashlytics); usage analysis only if you allow it (Google Analytics)	EU / US
Functional Software, Inc. (Sentry)	Error reports only — no session replay, tracing or profiling	EU / US
Grafana Labs	Application logs — which request was made when, and how it ended. Kept 14 days; email, location, message content and credentials are masked before anything is sent	EU
RevenueCat, Inc.	Tracking App Store purchases and subscriptions; testing which plans the subscription screen shows. Receives your random account number, your purchase records and basic device details (operating system, app version, store country) — never your name, email, photographs or messages	US
Apple, Google	Sign-in providers and payment, if you buy something	Global

Beyond these, we may share data with public authorities where we are legally required to. When such a request arrives we will tell you, unless the law forbids it.

International transfers

Our servers are in Germany; some providers are based in the United States. Transfers outside the EEA rely on the European Commission's Standard Contractual Clauses. Under KVKK Art. 9, transfers abroad are subject to the standard contract / undertaking process, to be completed.

7. How long we keep it

Data	Retention
Account and profile	For as long as your account exists
Photographs and aura records	Deleted immediately when the account is deleted
Birth details and your sign-up answers	Deleted immediately when the account is deleted
Devices and sessions	Deleted immediately when the account is deleted
Usage events	180 days, then deleted
Reports	2 years after the report is closed
Blocks	Indefinitely — a block protects the other person and survives deletion
Purchase records	Kept after deletion — so the same purchase cannot be spent again on another account, and refunds can be followed; no longer tied to your name or email
Consent records	5 years after deletion, to evidence that consent was given
Audit log	3 years
Database backups	14 days on the server, 30 days in remote storage

Exactly what deletion does

You delete your account from inside the app: Settings → Delete my account. Then:

Your photographs, aura records, birth details, sign-up answers, a verification selfie still waiting for review, your devices and your Apple or Google sign-in link are deleted.
Your name, email, password, date of birth, gender and who you are interested in, bio, city and every other profile field are erased.
All of your sessions are revoked.
You disappear from the apps of the people you matched with, and your conversation leaves their list too.
What remains, and why: a record consisting of your account's identifier, so that reports and blocks keep their integrity. Reports about you and by you remain, or an abuse record could be erased by deleting the account. Your consent records remain. The text of messages you sent remains in the database with the author removed. Your purchase records remain, so the same purchase cannot be spent again on a new account; RevenueCat's copy remains too, and holds neither your name nor your email. Usage events are deleted when their 180 days are up.

8. Your rights

Under GDPR Art. 15–22 and KVKK Art. 11 you have the right to:

Access your personal data and learn whether it is being processed
Have inaccurate or incomplete data corrected
Have your data erased — account deletion is available to you directly in the app
Have processing restricted
Receive your data in a portable form
Object to processing
Withdraw your consent
Seek compensation for damage caused by unlawful processing

Write to support@auramatchapp.com. We answer GDPR requests within one month and KVKK requests within 30 days.

If our answer does not satisfy you, you may complain to the data protection authority of your country of residence in the EU, or to the Turkish Personal Data Protection Board.

9. Security

All traffic between the app and the server is encrypted with TLS.
Passwords are hashed with Argon2; no plaintext password is stored anywhere.
Photograph storage is private; there is no public address for anybody's face.
The database is reachable only from the application's own network and is not exposed to the internet.
Access to the staff panel is permission-based, and every action taken in it is written, with its author, to an append-only log.

In the event of a personal data breach we will notify the relevant supervisory authority and affected users within the periods the law requires.

10. Children

Aura is for people aged 18 and over. The age check runs both in the app and on the server. If we learn that an account belongs to someone under 18 we close it and delete the data. If you become aware of such an account, please tell us.

11. Changes

When we update this text the version at the top changes. For significant changes we notify you in the app and ask for your consent again where it is needed — because consent records are tied to a version, agreement to a new version is a separate record.