Last updated: September 29, 2026 · Effective date: September 29, 2026 · Version: v1.0
This Privacy Policy explains how Lunest — Muhammet Ali Topakkaya ("Lunest", "we", "us") collects, uses, shares, and protects your personal information when you use the Lunest mobile app and related services at lunestapp.com (the "Service").
Contact: [email protected] (privacy requests) · [email protected] (general support)
1. Summary (Highlights)
- No ads. No sale of personal data. No behavioral tracking. We do not sell your data, share it with ad networks, or embed third-party analytics SDKs.
- Messages are NOT end-to-end encrypted. Transit is TLS-encrypted, but message content is stored as readable text on our servers.
- Location metadata (EXIF/GPS) is technically stripped from photos before upload.
- Face effects run on your device. Facial landmarks never leave your phone; no biometric data is sent to or stored on our servers.
- Stories are deleted 24 hours after posting. Posts persist (until you delete them or your account).
- Your data is stored abroad (Supabase / Cloudflare / Expo infrastructure, primarily in the US and on a global CDN). See Section 6.
- You can delete your account and data in-app: Settings → Account Management → Delete My Account.
2. Information We Collect
2.1 Information you provide
| Category | Data items |
|---|---|
| Account data | Email address, password (stored hashed only — we never see plaintext), full name, username, date of birth, consent records (acceptance timestamp + terms version) |
| Profile content | Avatar photo, banner image, bio, relationship status (optional) |
| Sign-in provider data | Google: account ID, email, name, profile photo · Apple: user ID, email/name if you share them |
| Content | Posts (photos, carousel images, text baked into images and its raw text, poll questions/options/votes, song metadata), stories (rear-camera + selfie images, text, mentions), comments, likes, saves, profile edits |
| Messages | DM texts, shared post/profile cards, group chat and community messages, message requests, unsend/delete actions |
| Social graph | Friendships, friend requests (send/accept/decline/cancel history), users you block |
| Reports | Post/story/comment/user reports, the reason you select, your free-text description |
| Support | Anything you email us |
2.2 Information collected automatically
| Category | Data items |
|---|---|
| Device/notifications | Expo push token, platform (iOS/Android), token registration time |
| Timezone | Your device timezone (e.g., America/New_York) — used for the daily feed midnight reset. We do not collect GPS or location data. |
| Usage/interactions | Story views (who viewed, when — visible to the story owner), read receipts in messages, online status and typing indicators, likes/saves/votes, notification read status |
| Session data | Sign-in times (for security verification), email verification status |
2.3 What we do NOT collect
- Precise location (GPS) — not collected; EXIF/location metadata is stripped on upload.
- Microphone recordings — the app does not request mic permission.
- Contacts/address book — not accessed; friend recommendations use only the in-app social graph.
- Biometric data — facial landmarks are processed on-device only, never stored or transmitted.
- Advertising identifiers (IDFA/GAID) — not used; we do not request App Tracking Transparency.
- Analytics/crash SDKs — no third-party analytics or crash-reporting SDK is embedded in the app.
3. Permissions
| Permission | Purpose | Required? |
|---|---|---|
| Camera | Take photos for posts/stories | Only when capturing; gallery picks don't need it |
| Photo library (select) | Choose images to share | Only for gallery sharing |
| Photo library (save) | Save edited images to your gallery | Only when you choose to save |
| Notifications | Message, friend request, community notifications | Optional; controllable in system settings |
You can revoke permissions anytime in device settings; some features may stop working but your account is unaffected.
4. How We Use Information
- Providing and operating the Service: account creation/verification, content hosting and sharing, messaging, friendships/search/recommendations, the daily feed reset.
- Safety and integrity: authentication, abuse/spam prevention, report handling, enforcing the Terms.
- Notifications: messages, friend requests/acceptances, community events (via push tokens).
- Legal compliance: responding to lawful requests from authorities, defending legal claims.
- Product improvement: debugging and performance (via operational logs only — no analytics SDK).
Automated decisions: Friend recommendations are generated from in-app signals such as mutual connections. We do not make automated decisions with legal or similarly significant effects on you.
5. How We Share Information
We never sell your personal information and do not share it with ad networks. Sharing happens only as follows:
5.1 With other users (based on your choices)
- Public posts are visible to all users; "friends" posts and all stories are visible only to your friends.
- Your profile (username, name, avatar, banner, bio, relationship status, friend count) is visible to other users and searchable.
- Online status and typing indicators may be visible to other users.
- Story viewers are shown to the story owner; read receipts are shown to message senders.
- Poll votes are not shown to other users; only aggregate results are visible.
- Your email, date of birth, and consent records are never shown to other users.
5.2 With service providers (processors)
| Provider | Role | Data shared | Location |
|---|---|---|---|
| Supabase, Inc. | Database, authentication, server functions | All account/content/message data | United States |
| Cloudflare, Inc. (R2) | Media storage & CDN | Photos, avatars, stories, uploaded files | Global (US-based) |
| Expo (Exponent, Inc.) | Push notification infrastructure | Push token, notification title (sender/group name), and a message preview of up to 160 characters for DM/group notifications; community mention notifications may include a short content excerpt | United States |
| "Sign in with Google" | OAuth identity data, email, name, photo | US/global | |
| Apple | "Sign in with Apple" + token revocation on account deletion | Identity token, email (if shared) | US/global |
| Apple Music API | Song search/metadata | Search terms and region code (your account data is NOT sent) | United States |
| ui-avatars.com | Initials-based avatar for profiles without a photo | Name/username initials | United States |
5.3 Legal and other disclosures
- In response to lawful requests: court orders, law enforcement, Türkiye Law No. 5651 or equivalent regimes.
- In a merger, acquisition, or asset sale (with notice to you).
- With your explicit consent.
6. International Data Transfers
Your data is primarily stored and processed in the United States; Cloudflare CDN content may be cached at global edge locations. This means your data is transferred outside your country of residence.
- Türkiye (KVKK Art. 9): Ongoing cloud transfers rely primarily on the Board's standard contract signed with providers (and notified to the Turkish Data Protection Authority within 5 business days of signing). Your explicit consent is additionally collected at registration as a supplementary basis (see the Cross-Border Transfer Information & Consent Text). You may withdraw consent anytime; withdrawal does not by itself end transfers grounded in the standard contract, but you can delete your account to have your data fully removed.
- Transfers are protected by TLS encryption in transit and contractual data-protection safeguards with providers.
- For EEA/UK visitors (where GDPR applies): transfers rely on adequacy or standard contractual clauses with providers, as applicable.
7. Data Retention
| Data | Retention |
|---|---|
| Account/profile data | While the account is active |
| Posts | Until you delete them or close the account (the daily feed "midnight reset" is a visibility filter, not deletion) |
| Stories | Automatically deleted 24 hours after posting |
| Community messages | Maximum 7 days (rolling cleanup) |
| DMs | Until you unsend the message, delete the conversation, or delete your account. "Delete for me" only removes your own view; the other party's copy may remain. On account deletion, messages you sent are deleted; messages sent to you and shared content cards may remain in recipients' views |
| Report records | Up to 12 months after resolution; moderation action logs up to 24 months (for safety and repeat-violation analysis) |
| Push records | Deactivated on sign-out; removed on account deletion |
| Backups | Up to ~90 days per provider backup cycles |
| After account deletion | All personal data permanently deleted; only legal-hold data or anonymized statistics may remain |
8. Your Rights & Choices
United States — State Privacy Rights (CCPA/CPRA and similar)
Subject to your state of residence: the right to know/access your data, correct, delete, data portability, opt out of sale/sharing (we don't sell or share for cross-context behavioral advertising), opt out of targeted advertising (we don't do it), and non-discrimination. Submit requests to [email protected]. We may verify your identity via your account email. Authorized agents may submit on your behalf.
Türkiye (KVKK Art. 11)
Rights to learn whether data is processed, request information, question purposes, learn third-party recipients, request correction, deletion/destruction, notification of corrections/deletions to recipients, object to adverse automated outcomes, and claim damages. Apply via [email protected] or in-app; responses within 30 days maximum.
EEA/UK (GDPR, where applicable)
Access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with your supervisory authority.
In-app controls
- Deletion: Settings → Account Management → Delete My Account (permanent, end-to-end).
- Correction: Profile → Edit.
- Content control: delete posts/stories/messages/comments; block users; DM privacy setting; per-post visibility.
9. Children's Privacy
- The Service is not directed at children under 13, and we do not knowingly collect their data (COPPA). Date of birth is required at registration; under-13 accounts are rejected.
- If we discover an under-13 account, we terminate it and delete its data. Report one to [email protected].
- Users aged 13–17 must have parental/guardian consent (see Terms §2).
10. Security
Key measures: TLS encryption in transit; row-level security (RLS) and authorization-checked server functions; short-lived signed URLs for private media; mandatory email verification; session tokens stored in the device secure enclave area (SecureStore/Keychain); re-authentication for account deletion and password changes; column-level access restrictions on sensitive fields.
No system is 100% secure — notify us immediately of any suspicious account activity.
Data breach notification: If a personal-data breach occurs, we notify the Turkish Personal Data Protection Board within 72 hours of becoming aware and affected individuals as soon as reasonably possible; for U.S. residents we follow applicable state breach-notification timelines.
11. Cookies & Local Storage
The mobile app does not use cookies; sessions and preferences live in secure device storage and local storage. For website cookies, see our Cookie Policy.
12. Third-Party Links
The Service may contain links to third-party sites/services (e.g., Apple Music, user-shared links). We are not responsible for their privacy practices.
13. Changes to This Policy
We may update this policy; material changes are announced in-app and, where required, re-consented. The "Last updated" date is above.
14. Contact Us
- Data controller: Lunest — Muhammet Ali Topakkaya — Nevşehir, Türkiye
- All requests (privacy, support, safety reports): [email protected]