Privacy Policy

Your personal data is processed by Altunox LLC (30 N Gould St Ste N, Sheridan, WY 82801, United States) as the data controller. Altunox LLC operates biri.chat and is referred to as “we” in this policy.

For privacy questions and requests: support@biri.chat (or hello@altunox.com).

• You sign in with an email code or Google to get matched and chat. Your email is never shown to other users; in random chats the other person only sees your chat code, unless you choose to show your profile.
• We don't read your messages. Only when a chat is reported to us do we look at its last messages to review it. At that moment the whole reported chat is copied to an encrypted evidence store; that copy is not visible in the admin panel and is opened only on a lawful request from a competent authority, by the holder of the key.
• Chats are deleted from the server when they end. Your profile and posts are public, and you can delete them whenever you like. Your stories delete themselves after 24 hours.
• Your IP address and device ID are used for security only as irreversible hashes. The traffic data required by law is kept encrypted and opened only at the request of the competent authorities.
• We use no advertising or tracking cookies. We never sell your data or send it to any AI.

Your account:

• Your email address and, if you sign in with Google, the account number Google gives you (sub).
• Your language, when your account was created and last seen, and when you confirmed that you are over 18.
• A hash of the device and network you last used your account from (if the account is banned, the ban also applies to that device).
• If you are a VIP member: when your membership ends and how you used your boosts (when you were boosted, which post you featured).

Matching and chats:

• Your matching picks: your language, interests, what you're looking for, personality picks and character colour. The other person only sees the interests you share.
• Whether your profile is shown in random matches (by default it isn't; only your chat code is shown).
• Your chat messages and the photos you send, the code made for you in that chat (like biri12345678), and read receipts.
• Your personal link (biri.chat/i/…) and the chats started with it.
• Reports and blocks: who reported or blocked whom (as hashes, never by name).

Profiles, posts and private messages:

• Your public profile: username, display name, bio, interests and profile photo.
• Optional profile details, if you fill them in: your gender, age, country and, in Türkiye, your province. Your age is stored as a birth year (so it goes up by itself every year). Everyone can see them on your profile and VIP members can filter Discover by them. You can clear them at any time.
• If you appealed a ban: what you wrote and the outcome; the appeal is deleted 30 days after it is decided.
• Your posts and stories (with their photos), your likes and the posts and stories you report (reporters are never shown).
• The stories you watch while signed in: the story's owner sees you in its viewer list (with your name and photo if you have a profile, otherwise only as a count), but not when you watched. Stories can't be answered anonymously. These records are deleted when the story is deleted or its 24 hours are up.
• When you reply to a post or story in a message, the start of its text stays in your message as a quote; it stays in the chat even after the story is deleted (its photo no longer opens).
• Private messages you write to profiles or receive, the state of message requests and, if you wrote about a post or story, a short quote of it.

Created automatically while you use the service:

• Your IP address and a random device ID given to your browser. In security records both are kept only as keyed, irreversible hashes.
• Traffic data required by Turkish Law No. 5651: your IP address, the time of the connection, its type (for example signing in, joining a chat, sharing a post) and your session ID. This record is encrypted and contains no message content.
• The country you connect from (derived from your IP address, as a two-letter country code only): kept with your account for at most one day to count daily access from Türkiye, then only as a total per day and country.
• Technical signals read in your browser by Cloudflare Turnstile for the bot check (IP address, browser and connection properties).
• Technical error and performance logs (no message content).

Kept only on your device (never sent to us): your chat transcripts, the nicknames you give people, and your theme and notification preferences.

Profile, post and chat photos are redrawn in your browser before upload, which removes location, device and date details (EXIF). The server checks every uploaded image again.

Your data is collected electronically from what you enter (your picks, email, profile, messages, posts) and from what is created automatically while you use the service (cookies, connection details).

We process your data only for the purposes below, on the legal bases given. We don't rely on consent for any processing.

• Providing the service (matching you with someone, delivering your messages, running your account, profile, posts and private messages): necessary to perform our contract with you (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).
• Security and preventing abuse (bot checks, rate limits, bans, not matching the same people twice): our legitimate interest in protecting our users from harassment, fraud and attacks (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
• Reviewing reports and complaints, removing content and protecting rights in possible disputes: establishing, exercising or defending a right and our legitimate interest (KVKK Art. 5(2)(e) and (f); GDPR Art. 6(1)(f)).
• Keeping traffic data and answering lawful requests from the competent authorities: required by law and our legal obligation (KVKK Art. 5(2)(a) and (ç); Turkish Law No. 5651 Art. 5; GDPR Art. 6(1)(c)).

We don't ask for special categories of data (such as health, religion or political views). If you share them yourself in a message or post, they are processed only to deliver them to the other person or to show them publicly.

An account, meaning an email address or Google account, is required to get matched, chat and share. Without one you can still read the Feed, Discover and profiles.

The only decision made about you automatically is a temporary ban when several different people report you within a short time. You can contact us to have a person review it.

• Cloudflare, Inc. (USA): the infrastructure the service runs on. The database, file storage, sending sign-in code emails, the bot check (Turnstile) and technical logs are processed by Cloudflare on our behalf and on our instructions (processor).
• Google LLC (USA): only if you sign in with Google. Google verifies your identity and passes us only your email address and account number.
• The person you talk to, and everyone: your messages go to the person you're talking to; your profile and posts are public.
• Competent authorities: only the information requested, at the lawful request of courts, prosecutors and authorities empowered by law.

We never sell or rent your data, and we don't share it with advertising or marketing companies.

Altunox LLC is established in the United States and the service runs on Cloudflare's global network. Your data is therefore processed outside Türkiye and the EU, mainly in the United States and in the countries where Cloudflare has data centres.

Cloudflare protects data under the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. This section will be updated when the standard contract process under Article 9 of the KVKK is completed.

• Chat messages and photos: while the chat goes on (so the other person gets them even if they're offline). They are deleted at most 1 hour after the chat ends, and a chat nobody writes in for 30 days closes and is deleted.
• The last 20 messages of a reported chat (not photos), in the admin panel: 30 days.
• The encrypted evidence copy of a reported chat (messages, recent photos, account IDs): 1 year; not visible in the admin panel, opened only on a lawful request from a competent authority, by the holder of the key. The deleted photo of a reported post (even if the account is deleted) and a profile photo removed by a moderator: 30 days after deletion, for review only.
• Chat codes and device and network hashes (to look into abuse complaints): deleted 30 days after the chat was last used.
• The record that stops you being matched with the same person again: 30 days. Personal blocks: 30 days; the network hash of someone you block: 7 days.
• Abuse bans: for the length of the ban; a ban on a network lasts at most 24 hours.
• Sign-in codes: 10 minutes (only a hash of the code is kept).
• Your account, profile, posts and likes: until you delete them. Stories are deleted with their photos and their viewer records after 24 hours; a reported story is kept only for review until a moderator decides (30 days at most). Uploaded photos that are never added to a post are deleted within a day.
• Traffic data: 365 days (encrypted), then deleted automatically.
• The country you connect from: with your account for at most 1 day; afterwards only as a total per day and country.
• Technical error and performance logs: at most 7 days.

Data is deleted automatically when its period ends. If a dispute or a request from the authorities requires it, the data concerned may be kept until that process ends.

We only use first-party cookies that are strictly necessary for the service to work and stay secure. These cookies need no consent. There are no advertising, analytics or tracking cookies.

• __Host-session: your session and matching picks (signed). 30 days, extended while the site is open.
• __Host-device: a random device ID given to your browser to prevent abuse. 400 days.
• biri_locale: the language you chose. 1 year.
• A short-lived security cookie when signing in with Google, which confirms the sign-in request came from you. 10 minutes.

Your browser's local storage (never sent to us) holds your chat transcripts, nicknames, theme and notification preferences, and the random ID of the visitor counter, which is not linked to your session.

Cloudflare Turnstile does not use cookies; it processes the technical signals described above for the bot check.

If you sign in with Google, we only ask Google for the “openid” and “email” permissions. We receive your verified email address and your Google account number. We have no access to your name, photo, contacts or any other Google data.

We use this data only to recognise you and sign you in, and keep it for as long as your account exists. We never share it, use it for advertising or sell it. You can remove the permission at any time in the third-party apps section of your Google account's security settings; to delete your account, see below.

• All connections are encrypted (HTTPS). Session cookies are signed and cannot be read by scripts in the browser.
• In security records, IP addresses and device IDs are kept as keyed, irreversible hashes. Traffic data is encrypted with a separate key.
• Sign-in codes are single-use, short-lived and limited in the number of attempts.
• Only authorised people can enter the admin panel, with separate authentication. Account email addresses are visible to them in the panel for support, safety and legal requests. The panel does not show the content of chats (except the last messages of reported chats).

Under Article 11 of the KVKK you have the right to:

• learn whether your personal data is processed and, if so, request information about it;
• learn the purpose of the processing and whether the data is used for that purpose;
• know the third parties in Türkiye or abroad to whom it is transferred;
• ask for incomplete or inaccurate data to be corrected;
• ask for it to be deleted or destroyed under the conditions of Article 7 of the KVKK;
• ask for corrections, deletions and destructions to be passed on to the third parties the data was transferred to;
• object to a result against you that comes solely from automated analysis;
• claim compensation if you suffer damage from unlawful processing.

If you are in the European Union, under the GDPR you also have the right to access, rectify and erase your data, to restrict or object to its processing, and to receive it in a portable format.

Send your request from the email address registered to your account to support@biri.chat, or in writing. Include your name, contact details and what you are asking for; add your username if you have an account, or the chat code if it is about an anonymous chat. We answer within 30 days, free of charge.

If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu); if you are in the European Union, you can complain to the data protection authority of your country.

You can delete your account at any time in Settings → Account → Delete account. Your account, profile, profile photo, posts and their photos, likes and reports are deleted immediately, and all your sessions are signed out.

Messages you have already sent stay in the other people's chats until those chats are deleted on the schedule above. Report records and the traffic data that must be kept by law are deleted when their own periods end.

biri.chat is for people aged 18 and over only. We don't knowingly process the data of anyone under 18; when we learn of such an account or content, we delete it.

We may update this policy when the service or the law changes. The current version is always on this page, with its date at the top. We announce important changes on the site.