MUTURIO · 6 OCTOBER 2026
Privacy policy
Effective date: 6 October 2026. Version: muturio-2026-10-06-v1. Privacy contact: [email protected].
1. Scope and contact
Muturio is operated by Kubilay Bayraktar in his own name. Kubilay Bayraktar is the controller of personal data processed for the Muturio website and application. Contact [email protected] about privacy, account ownership and your rights. This notice applies to the service, including its Android application.
2. Information processed
Processed information may include account email/identifiers, profile, interests, matching signals, posts, drafts, images, private/community messages, saves and interest selections, connections, safety and support records. In addition to the country/city you choose for your profile, Cloudflare may derive an approximate country and city from the IP address of an application request; this is recorded privately for Crew. It is not GPS or precise device location and does not change your declared profile location. The current record retains the first observation rather than creating a new location history on every request. Your age and terms confirmation records the accepted policy version, at-least-16 declaration, language and acceptance time; it does not request a full date of birth or identity document.
3. Social sign-in
Social sign-in providers supply account identifiers, email and basic profile information for authentication and account recognition. Your Google password is not shared with Muturio; Gmail, Drive and contacts access are not requested for sign-in. The provider’s own privacy terms also apply.
4. Purposes and legal bases
We process account and authentication data to provide the service you request; profile, interests, matching signals, content and selected interactions to deliver discovery, drafting and connections; and support, security and moderation records to respond to requests and prevent abuse. Depending on the activity and applicable law, processing relies on performance of the service contract, legal obligations, proportionate legitimate interests in security and service operation, or consent where required. Before using member features, we request a separate affirmative confirmation explaining server-side AI processing, including private text/image safety checks, and approximate IP location. You can decline and still access support and account deletion. Do not include sensitive personal data about yourself or others unless necessary and you have the right to share it.
5. Providers and AI
Supabase supports accounts and application data, Cloudflare supports the web and API infrastructure, and Resend delivers email. The OpenAI API is used for semantic processing of matching signals, post drafts and safety checks. Draft requests may include language, topic, angle, your written perspective, source title/publisher and an account-derived security identifier. Supported submission and editing flows may also send private messages, community text and images to OpenAI for safety checks. Private content means it is not public to other members; it does not mean processing stays on your device or that messages are end-to-end encrypted. Personal information included in free text or images may be processed. The production Supabase database is hosted in Frankfurt, Germany. These providers may process requests, support information, security logs or backups in other countries under their own service arrangements. Consequently, using Muturio can involve international transfers. Contact [email protected] for current provider and transfer information; provider-specific documentation is under review and this notice will be revised when verified details change. This notice does not claim that a particular Turkish standard contract has been signed or notified.
6. Visibility and sharing
Profile visibility, published posts and mutual connections may expose information to different audiences according to your selected features. Private drafts are separate from published posts. Review personal or sensitive information before sharing it.
7. Retention and device storage
We retain account, profile, content and interaction records while needed to provide your account and selected features. Confirmed in-app account deletion removes the authentication account and associated profile, personal content, messages and activity records from the active application database. Shared source metadata may remain without your attribution. Support correspondence and case records, limited security/moderation audit history, provider logs/backups and payment-provider records may remain where needed to resolve a request, investigate abuse, establish or defend a claim or meet legal duties. These exceptions depend on the case and provider; we do not promise an immediate purge of every independent copy or a universal 30-day deletion period. Retained support/audit records are not subject to a fixed automatic expiry in the current service; contact support to request review of continued retention or deletion. Session and language preferences may remain on your device until sign-out or clearing site data.
8. Rights and transfers
You may request information about processing, access to your data, correction, deletion and other rights available under applicable law, including objections to qualifying automated decisions and requests to notify recipients of corrections or deletion. Email [email protected] from your account address or use our Contact page; we may securely verify ownership before acting. KVKK requests are handled as soon as possible and within the applicable maximum of 30 days; other statutory deadlines apply where relevant. A refusal or retention exception will be explained. You may complain to the competent data protection authority. Withdrawal of consent affects future consent-based processing and does not by itself delete an account or cancel a subscription.