Yuva Hat Privacy Policy and Information Notice

1. Data controller

This notice has been prepared by ESER TEKNOLOJİK PAZARLAMA ANONİM ŞİRKETİ (İsmet Kaptan Mah. Şair Eşref Bulv. No:18/82 Konak, İzmir, Türkiye) under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, to the extent applicable, the European Union General Data Protection Regulation (GDPR).

Requests and contact: info@mekanapp.com.

2. Account and identity

Yuva Hat does not ask for your name, e-mail address or phone number, and does not create an account. A phone joins a family by scanning the code shown on another family member's phone; the same pictures appear on both screens, and the parents approve the new member.

When the app is first opened, it creates encryption keys on the phone. These keys are protected in the phone's secure hardware and never leave the phone. The names of family members and the family list are kept only on the family's phones; they never reach us.

3. Data processed

Messages, calls, photos, videos, documents, voice notes, push-to-talk recordings, location and polls are end-to-end encrypted: they can be opened only on your family's phones. We cannot see or process this content.

The following technical data is processed for the app to work:

• IP address: Visible when your phone connects to the Mailbox (see section 6). It is processed only while serving the request and to limit abuse (a per-minute request limit); it is not stored and no logs are kept.
• Encrypted envelopes and encrypted files: When a family member is offline, the messages and attachments you send wait in the Mailbox in encrypted form, and we cannot see their content. The size and time of an envelope are visible. Envelopes are kept under random mailbox numbers that change every day; they cannot be linked to a person.
• Ring registration: To notify your locked phone of an incoming family call or message, the device notification token issued by your phone's operating system provider and a random handle are stored encrypted in the Mailbox. The ring carries no content.
• Reports: When you report something from within the app, the reason you choose, the note you write, the name of the reported person as saved on your phone and, only if you choose to attach it, the text of that single message reach us; we can read this. A report is linked to your family's random number, kept for 30 days, and used only to review abuse and, where necessary, to notify the competent authorities.
• Invitation chain: Yuva Hat is joined by invitation; each family can invite five families. To prevent abuse, the following is kept in the Mailbox: a random family number assigned to your family, the number of the family that invited you, the public keys of the phones in your family (the public half of the encryption key, which cannot decrypt messages), an irreversible digest of the invitation codes you create, their expiry and whether they have been used. The family name, the names of members and the name of the family you invite are kept only on phones; the "inviting family" information sent with an invitation code is encrypted with the code and cannot be read by the Mailbox.

4. Data not processed

We do not collect names, phone numbers, e-mail addresses, contacts, advertising identifiers, message content, family names and member lists, photos or location. The app contains no advertising, tracking, analytics or crash reporting software. No face or fingerprint data is processed; face and fingerprint checks are performed on the phone itself.

5. Purposes and legal basis

Data is processed only to provide the service: to deliver an encrypted message to an offline family member, to ring a locked phone for an incoming call, and to keep the service secure.

Legal bases (KVKK art. 5/2): processing of encrypted envelopes and ring registrations is necessary for the conclusion and performance of the contract (subparagraph c); processing of the IP address while serving a request and the request limit are based on our legitimate interest in keeping the service secure (subparagraph f). Under the GDPR, the corresponding bases are Art. 6(1)(b) and Art. 6(1)(f).

6. Service providers and international transfers

• Mailbox — Cloudflare, Inc.: The service that holds an encrypted message while someone is offline; United States (requests are processed in the Cloudflare data center nearest to you). IP addresses and encrypted envelopes are processed.
• Your phone's operating system provider's notification service: To wake your phone with "your family wrote to you / is calling you" and to ring a locked phone for an incoming call, used only as a wake-up without carrying any content; United States. The payload sent to this service contains no message, name or number; only a content-free wake-up (a random ring tag and a time). The service provider sees your phone's notification token and the time of the wake-up. It is not used in directly installed versions; there the app works in the background over its own connection.
• Map services: When a map is displayed, your phone's operating system provider's map service or an open map server (OpenFreeMap) sees which area of the map is requested and your IP address. The shared location itself is sent end-to-end encrypted; map providers do not know whose location it is or with whom it is shared.
• Direct connection network: Phones find each other over an open peer-to-peer network (HyperDHT) and connect directly where possible. Other computers on this network may see your phone's IP address; they cannot see which family you belong to or any content.
• Application marketplaces: distribution of the app; their own privacy policies apply.

The basis for transfers outside Türkiye under KVKK art. 9 is the standard contract to be signed with the recipients and notified to the Turkish Personal Data Protection Authority.

Fully serverless mode: If you turn on this mode in the app's Settings, the Mailbox is not used at all; messages wait on your phone until the other phone comes online, and no processing abroad takes place through the Mailbox.

7. Retention periods

• Encrypted envelopes and files: deleted once delivered; if not delivered, kept for at most 7 days.
• IP address: not stored.
• Reports: 30 days; a report whose review is complete is deleted earlier.
• Invitation chain records: as long as your family uses Yuva Hat. The public key of a phone that leaves the family is removed from the chain automatically; an unused invitation code becomes invalid when it expires (7 days). You can request deletion of your family number at info@mekanapp.com.
• Ring registration: until your phone renews it, leaves the family, or deletes it with "Delete Yuva on this phone". When someone leaves your family, the registration is renewed automatically.
• Messages and family information on your phone: until you delete them or a disappearing message expires. There is no cloud backup; they are not included in the phone's own cloud backup either.

8. Your rights

Under KVKK art. 11 and the GDPR, you have the right to learn whether your data is processed, to request information, to learn the purpose of processing and whether data is used accordingly, to know the third parties to whom it is transferred, and to request rectification, erasure, objection to automated processing and compensation for damage caused by unlawful processing.

Since we hold no record that links you to your identity, you can use Settings → "Delete Yuva on this phone" in the app for all data on your phone; this also deletes your ring registration in the Mailbox. For other requests: info@mekanapp.com. Requests are handled free of charge within 30 days at the latest.

9. Phone permissions

Permissions are requested only when you first use the related feature.

10. Children

Yuva Hat may also be used within the family by children added by their parents; parents approve a child joining the family. No one outside the family can write to or call children. No additional data is collected from children.

11. Security

Content is end-to-end encrypted; communication between phones and the Mailbox is additionally encrypted with HTTPS. Keys are protected in the phone's secure hardware. You can turn on an optional app lock (PIN or your phone's lock: face, fingerprint or passcode); locked chats do not appear in the list, in search or in notifications, and are opened with your phone's lock. If a phone is lost, the parents in the family can remove that phone from the family and have its data deleted.

12. Changes

If this notice changes, this page is updated; significant changes are announced in the app. Effective date: the day the app is first published in the store. Last updated: 22 October 2026. In case of any discrepancy, the Turkish version prevails.