Privacy
Privacy Policy
The short version
This version of the app. The current version of Theysay has no in-app purchases, no Sign in with Apple, no notifications and no invite links, so we collect none of the data that goes with them. Rows marked Not yet available describe those features; they apply only once the features are released, and we will update the effective date when that happens.
| What we collect | Your photo; your own answers to five questions (and optionally your gender); the guesses you make about others; an anonymous account ID and device signals used to stop bots; purchase records and a push token (not yet available); crash and usage data without advertising identifiers. |
| Why | To run the game: show your photo to other users, collect their guesses, show you the result, and keep the Service safe and fair. Nothing else. |
| Who sees your photo | Other users, inside the app, one question at a time, without your name. The developer, only when a photo is reported or flagged. An automated safety service, for a few seconds, before anyone sees it. |
| What we never do | Sell your data. Show ads. Track you across other apps or websites. Identify you from your face. Infer your ethnicity, race or origin. Keep your photo after you delete it. |
| How long | Your photo stays until you delete it, then leaves our storage within 24 hours. Full retention table in Section 9. |
| Your controls | Delete your photo, delete your account and turn questions off from the app; ask for a copy of your data by email. |
| Where | Data is stored in the United States. The developer is located in Türkiye. |
| Contact | baran.gngr@gmail.com |
1. Who we are
Theysay is developed and operated by Baran Güngör, an individual developer based in Türkiye ("Theysay", "we", "us"). We are the data controller for the personal data described here. Contact: baran.gngr@gmail.com.
This policy applies to the Theysay iOS app and to the website at theysay.pages.dev. It is written for the United States, where the app is offered, and includes a notice under Türkiye's data protection law (Section 14) because that is where we are based.
2. What Theysay does with your face, in one paragraph
You upload a photo of yourself. Before anyone sees it, an automated service checks it for nudity and other prohibited content, counts the faces in it, and estimates an age range, so that we can keep minors and prohibited content out. Then other users see the photo inside the app, one question at a time, and guess. Their guesses are combined into a result that only you see. No software, ours or anyone's, is used to identify you, to recognise your face, to match it to any other photo or person, or to guess anything about your nationality, ethnicity, ancestry or origin. The country guesses in your result are impressions of anonymous people looking at a whole picture; they are opinions, not information about you.
3. Data we collect
Things you give us
| Data | Details |
|---|---|
| Photo | One photo at a time, cropped by you. We strip all metadata (EXIF, location, device) on upload and keep only the image. |
| Your own answers | Your age, the country you are from, your field of work, your music taste, one word for yourself, and optionally your gender. Used to build the "You said … The world says …" sentence and, in aggregate, to show how different groups of voters guess. Each question can be turned off. |
| Guesses you make | Your vote on each card you see, with the time of the vote. Used to build other people's results. |
| Consents | Which version of the Terms and this policy you accepted, your 18+ confirmation, your photo confirmation, and when. Kept as evidence that you agreed. |
| Reports and blocks | The reason you gave when reporting a photo, and the photos you blocked. |
| Support messages | Anything you send to baran.gngr@gmail.com. |
Things collected automatically
| Data | Details |
|---|---|
| Account ID | A random identifier created on first launch. There is no username, email or password. |
| Device signals | Apple App Attest and DeviceCheck tokens and a per-device identifier, used to prove the app is genuine, enforce limits, and keep banned devices out. Not usable to identify you personally. |
| Apple ID link | Not yet available. Only if you sign in with Apple (needed to buy or restore purchases): the stable user identifier Apple gives us for our app. We do not receive your name or email unless you choose to share them, and we do not use them for marketing. |
| Purchases | Not yet available. Product, price, time and Apple transaction identifiers, via RevenueCat. Never your card details, which only Apple sees. |
| Push token | Not yet available. If you allow notifications, the token Apple gives us to deliver "your first result is in". |
| Usage and crash data | Which screens are used and app errors, through TelemetryDeck (privacy-preserving analytics, no advertising ID) and Sentry (crash reports). No advertising identifier is ever read; we do not ask for App Tracking Transparency permission because we do not track. |
| Logs | Server logs with IP address, timestamps and request details, used for security and rate limiting. Kept 30 days. |
| Upload IP address | The IP address your photo was uploaded from, kept 30 days and used only if we must report illegal content to authorities (for example NCMEC). |
| Card records | Which photo cards were shown to you and whether you voted, skipped or reported, used to stop repeat or automated voting. Kept 30 days. |
| Invite links | Not yet available. If you share an invite, the code, how many times it was opened and installed. Never who opened it. |
4. Why we use it and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Run the game: show your photo to voters, collect guesses, compute and show your result | Photo, answers, guesses, account ID | Performance of our agreement with you (the Terms) |
| Keep minors and prohibited content out; review reports | Photo, safety-check outputs, reports, device signals | Our legitimate interest in safety and legal compliance; your consent on the age screen |
| Stop bots, fraud and abuse; enforce limits | Device signals, logs, vote timing | Legitimate interest |
| Not yet available. Sell and deliver unlocks and boosts | Purchase records, Apple ID link | Performance of our agreement; legal obligations (tax, accounting) |
| Not yet available. Send "your first result is in" | Push token | Your consent (iOS notification permission) |
| Fix crashes and understand usage | Usage and crash data | Legitimate interest |
| Respond to legal requests and protect rights | Any, as needed | Legal obligation; legitimate interest |
We do not use your data for advertising, profiling for marketing, or any automated decision that has a legal or similarly significant effect on you. The only automated decision is the safety check in Section 5, which can be reviewed by a person: if your photo is rejected and you believe that is wrong, write to baran.gngr@gmail.com.
5. The automated photo check (notice about facial analysis)
This section is written to satisfy laws that regulate the analysis of faces, including the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, and the Washington My Health My Data Act, whether or not those laws apply to us.
What happens. When you upload a photo, we send the image to Amazon Web Services' Rekognition service (US East region) for two operations: a content-moderation scan (nudity, sexual content, violence, hate symbols, visually disturbing content) and a face-detection call that returns the number of faces and an estimated age range. We request only those outputs. We do not request, and the service does not return to us, any gender, emotion, or other facial attribute, and we do not use any face-matching, face-search, face-recognition or identification feature.
What we keep. The face count, the age range, and the moderation labels with their confidence scores. We do not keep the service's raw response, any face template, any measurements of your face, or anything that could be used to identify you. The outputs are stored with your photo and deleted with it.
What the provider keeps. Rekognition processes the image transiently and does not store it. We have opted out of allowing AWS to use our content to improve its services.
Purpose. Solely to keep nudity and prohibited content out of the Service and to keep photos of people under 18 out of the Service. The outputs are never used for any other purpose, never shared with anyone else, and never sold, leased or traded.
Retention and destruction schedule. The safety-check outputs are destroyed when the photo is deleted (within 24 hours of your deletion request) or, at the latest, when your account is deleted. In every case they are destroyed within one year of the initial purpose being satisfied, which is the moment your photo passes or fails the check. We do not retain anything from the check after that beyond a cryptographic hash of a rejected image, which cannot be reversed into the image and is kept for one year to block re-uploads.
Your consent. You consent to this check when you confirm that you are 18 or older and accept the Terms and this policy on the age screen, where the check is described in plain words. If you do not consent, do not upload a photo; the rest of the app (voting) works without one. You can withdraw consent at any time by deleting your photo.
Security. The outputs are stored in the same protected database as your other data, with access restricted to the developer, and are transmitted only over encrypted connections.
6. Who sees your photo and your data
| Who | What | When |
|---|---|---|
| Other users | Your photo, without your name, with one question at a time. Never your answers, never other voters' guesses, never your result. | While your photo is live in the voting queue. |
| The developer (a single person) | Your photo, through a time-limited link in an administration tool. | Only when the photo is reported, flagged by the automated check, or needed to handle a legal request. Never for curiosity, never for training anything. |
| Automated safety service | Your photo, transiently. | Once, on upload (Section 5). |
| Anyone you share with | The share cards you create. Depending on the style you choose, a card may include your photo. | Only when you share it. Invite web pages never include your photo. |
| Law enforcement and authorities | What the law requires. | Only on a valid legal request, or where we are required to report content (for example suspected child sexual abuse material, which we are obliged to report to NCMEC in the United States). |
We never show your photo on the public web, never put it in search engines, and never give it to anyone else.
7. Service providers
These companies process data on our behalf, under contracts that restrict them to our instructions. We do not sell or share personal data for advertising with anyone.
| Provider | Purpose | Location |
|---|---|---|
| Supabase (hosting on AWS) | Database, authentication, file storage, server functions | United States (us-east-1) |
| Amazon Web Services | Photo safety check (Section 5); underlying infrastructure | United States |
| Apple | App distribution, in-app purchases, Sign in with Apple, push notifications, App Attest and DeviceCheck | United States |
| RevenueCat | Not yet available. Purchase records and entitlements | United States |
| Sentry | Crash reports | United States |
| TelemetryDeck | Privacy-preserving usage analytics (no advertising ID, no cross-app tracking) | European Union |
| Cloudflare | Web pages, edge protection and bot filtering for theysay.pages.dev and the API | Global edge; data at rest in the United States |
8. Your choices and rights
All of these are available in the app, under Profile, without contacting us:
- Delete your photo. It leaves the queue immediately and our storage within 24 hours.
- Replace your photo. The old file is deleted on the same schedule; the numbers from its result are kept, without the image, under your account until you delete the account.
- Delete your account. Everything in Section 9 marked "with account" is deleted; votes you cast are kept without any link to you; purchase records are kept in de-identified form for tax law; if you signed in with Apple, your Apple sign-in token is revoked.
- Get a copy of your data. Email us (Profile → Download my data shows the address) and we send your photo, answers, results, votes and consents as a file within 30 days. An in-app download will come in a later version.
- Turn a question off. Each of the five questions can be switched off for your photo.
- Notifications. Not yet available. Once available, revoke in iOS Settings.
- Arbitration opt-out. See Section 14.8 of the Terms.
If you live in a US state with a consumer privacy law (such as California, Colorado, Connecticut, Virginia, Texas, Oregon or Washington), you may have rights to access, correct, delete and port your data, to opt out of sale, sharing, targeted advertising and profiling, and not to be discriminated against for exercising them. We do not sell or share personal data, do no targeted advertising, and do no profiling with legal effects, so there is nothing to opt out of. We honor access, correction, deletion and portability requests for everyone, regardless of where they live, through the app or at baran.gngr@gmail.com. We will verify a request by asking you to make it from the app or the Apple ID on the account. You may appeal a decision by replying to our response; we will answer within 45 days.
People who are not users. If a photo of you is in the Service and you did not upload it, write to baran.gngr@gmail.com or follow the steps at theysay.pages.dev/remove. We remove it within 48 hours of a valid request (see Terms, Section 16).
9. How long we keep things
| Data | Retention |
|---|---|
| Photo file | Until you delete it, then removed from storage within 24 hours. Database backups that may contain references to it expire within 7 days. |
| Safety-check outputs (face count, age range, moderation labels) | With the photo; destroyed with it. Never more than one year after the check. |
| Hash of a rejected or removed photo | 1 year, to block re-uploads. Cannot be reversed into the image. |
| Your own answers | With account. |
| Numeric result of a replaced photo (no image) | With account. |
| Votes you cast | Linked to you while your account exists; kept without any link to you after deletion. |
| Card records (which cards you were shown) | 30 days. |
| Upload IP address | 30 days. |
| Aggregated statistics | Indefinitely; they do not identify anyone. |
| Consents | With account, or longer if a legal retention period requires. |
| Reports about you | 1 year after account deletion, without your identity, for safety. |
| Purchase records | As long as tax law requires (up to 7 years), de-identified after account deletion. |
| Push token | Until revoked or invalid. |
| Device ban record | Hash only, for as long as the ban lasts. |
| Data export file | 24 hours. |
| Server logs | 30 days. |
| Support emails | 1 year after the case is closed. |
10. Security
Data is encrypted in transit and at rest. Photos are stored in private buckets and served only through short-lived signed links. Access to production data is limited to the developer, protected by multi-factor authentication, and logged. The app proves it is genuine on every launch (App Attest), and every write is rate-limited. No system is perfectly secure; if we learn of a breach that affects you, we will notify you as the law requires.
11. Children
The Service is for adults only. We do not knowingly collect data from anyone under 18. If you believe a minor's photo is in the Service, report it from the voting card or write to baran.gngr@gmail.com; we remove such photos immediately and close the account.
12. International transfers
The Service is hosted in the United States. The developer is in Türkiye and accesses data from there for moderation and support. By using the Service you understand that your data is stored and processed in the United States and may be accessed from Türkiye.
13. Changes
We will post changes here and update the effective date. If a change materially affects how we use your photo or your data, the app will show the change and ask you to accept it before you continue.
14. Notice under Türkiye's Personal Data Protection Law (KVKK, Law No. 6698)
Because the data controller is established in Türkiye, this notice is provided under Article 10 of Law No. 6698.
- Data controller: Baran Güngör, Türkiye, baran.gngr@gmail.com.
- Personal data processed, purposes and legal basis: as described in Sections 3 to 5. Your photo and answers are processed on the basis of your explicit consent (Article 5(1)) and, for the operation of the Service, because processing is necessary for the performance of a contract to which you are a party (Article 5(2)(c)). Safety, fraud prevention and record keeping rely on our legitimate interests (Article 5(2)(f)) and legal obligations (Article 5(2)(ç)). The automated check in Section 5 does not create data enabling your identification and is therefore not processed as biometric data within the meaning of Article 6; to the extent an authority considers otherwise, it is processed on the basis of your explicit consent given on the age screen.
- Recipients: the service providers in Section 7 (which involves transfer abroad, to the United States and the European Union, on the basis of your explicit consent and the contractual safeguards in place with each provider), other users as described in Section 6, and authorities where legally required.
- Method of collection: electronically, through the app and the website.
- Your rights under Article 11: to learn whether your data is processed, to request information, to learn the purpose and whether it is used accordingly, to know the recipients at home and abroad, to request correction, deletion or destruction, to request notification of those actions to recipients, to object to a result arising from automated analysis, and to claim compensation for damage caused by unlawful processing. You may exercise these rights through the app or by writing to baran.gngr@gmail.com; we respond within 30 days.
15. Contact
Baran Güngör
Türkiye
baran.gngr@gmail.com