Privacy & cookie policy
Last updated: 2 October 2026
This policy explains what personal data Fisfis (fisfis.app, app.fisfis.app and the mobile apps) processes, why, who we share it with and what your rights are. The Turkish version (Gizlilik) is the notice under Turkey's Personal Data Protection Law (KVKK) and prevails in case of conflict.
1. Controller
Fisfis is the data controller. Contact: iletisim@fisfis.app.
2. Data we process
| Data | When | Why |
|---|---|---|
| Name, username, email, password (one-way hash only) | When you sign up | Your account, sign-in, email verification, password reset |
| Google or Apple account ID and email | When you sign in with them | Linking your account to that provider |
| Profile photo, bio, location (optional) | When you edit your profile | Showing your profile to the community |
| Votes, reviews, lists, collection, scent journal, follows | As you use the app | Providing the service, community statistics, recommendations |
| Game and lesson results, points, level, badges, streak | When you play or learn | Points, badges and the leaderboard |
| IP address, browser/device info, error logs | On every request | Security, abuse prevention, debugging |
Your name, username, level, badges, reviews and public lists are visible to other members. If you make your profileprivate, this is visible only to you; your reviews still appear on perfume pages.
3. Legal bases
Performing our contract with you, legal obligations, establishing and defending legal claims, and our legitimate interests (security, improving the service). Analytics and personalised advertising cookies are used only with yourconsent.
4. Cookies and browser storage
| Type | Examples | Consent |
|---|---|---|
| Essential | Session key, theme and language, your cookie choice (browser local storage) | Not required |
| Analytics | Google Analytics, Microsoft Clarity: anonymous usage measurement | Required |
| Advertising | Google AdSense, Meta Pixel: serving and measuring ads | Required for personalisation |
We ask on your first visit; change your choice any time via Cookie preferences at the bottom of the app. Without consent to personalisation, ads are chosen only from the page content. How Google uses data:policies.google.com/technologies/partner-sites.
5. Who we share data with
- Hosting provider running the site and database.
- Email delivery for verification and password-reset messages.
- Google and Apple, only if you sign in with them.
- Google, Microsoft, Meta, only for the analytics and advertising you consent to.
- Authorities, only where legally required.
Some providers are located outside Turkey; such transfers rely on your consent and applicable safeguards. We never sell your data.
6. Retention
Account data is kept while your account is open. When your account is deleted, your profile, votes, reviews, lists and points are deleted. Security logs are kept for up to one year, records with statutory retention for that period.
7. Security
HTTPS everywhere, passwords stored as bcrypt hashes, admin access limited to authorised staff with every action logged.
8. Your rights
You may request access to, correction or deletion of your data, object to processing, and complain to the data protection authority. Edit your profile in Profile settings; for anything else, including account deletion, email iletisim@fisfis.app. We reply within 30 days.
9. Children
Fisfis is not intended for children under 13 and we do not knowingly create accounts for them.
10. Changes
We will update the date above when this policy changes and announce significant changes in the app.