Last updated: 9 October 2026 · App: Puffy
Privacy Policy
This policy explains which data is processed when you use Puffy, on what legal basis, who it is shared with and how long it is kept. Instead of general statements, we list the fields we actually store.
1. Data controller
DRG Dijital Teknoloji Hizmetleri Limited Şirketi
Göktaşlı Mah. 1301 Sk. No: 45 İç Kapı No: 5, 45060 Şehzadeler/Manisa, Türkiye
Tax office: Mesir · Tax ID: 3131538255
[email protected]
The company acts as data controller under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, for users in the European Economic Area, the General Data Protection Regulation ("GDPR").
2. Personal data we process
Account and profile
When you sign up we collect your email address or phone number, depending on the sign-in method you choose (with Google sign-in, the email address of your Google account). Your profile holds: nickname, user number, profile photo and, if any, profile video, cover image, life photos, short bio, gender, date of birth, country and preferred language. You can hide your age and country from other users; when hidden, these fields are not sent to others.
Content and activity
Messages you send, room chats, moments and short videos you share, comments, likes, follows and friendships, rooms you enter, seats you take, photos and videos you share in rooms and private messages, gifts you send, and a log of voice/video calls (with whom, when and for how long) are recorded. The content of voice chats and calls is not recorded; audio and video are only transmitted in real time.
Location
Your location is only collected when you tap the send-location option in a private message: your current location is sent to the other person with that message and stored with it. The app does not collect GPS location in the background.
For security and fraud prevention, an approximate location (country/city) is derived from your connection IP address. It is determined when you open the app and is not a precise location or address. The raw IP address is not stored in this record; only a masked form (for example 85.105.*.*) is kept, visible only to authorised administrators for security reviews.
Device and technical data
Device identifier, device name and platform, push token used for notifications, IP address, last-seen time, app version and crash logs.
Payment data
Coin purchases are made through Google Play; your card details never reach us. We store the purchase record and receipt token, your wallet balance and coin transactions.
Identity verification and withdrawals
Only users who want to withdraw earnings from the platform are asked, as required by law, for identity details: full name, date of birth, address and national ID number. The ID number is stored encrypted in the database. IBAN and payment receipts are also stored. This information is used only for payment and tax obligations and is never shown to other users.
3. Purposes of processing
| Purpose | Data |
|---|---|
| Creating and managing your account | Email, profile fields |
| Providing the service (rooms, messages, gifts) | Content and activity data |
| Security, abuse and fraud prevention | Device identifier, IP, approximate location from IP (country/city), report and moderation records |
| Sending notifications | Push token |
| Finding bugs, measuring performance | Crash logs, usage statistics |
| Payment and tax obligations | Purchase records, identity details, IBAN |
We do not sell your personal data to third parties for advertising.
4. Legal bases
Your data is processed on the basis of: performance of a contract (providing the service), compliance with legal obligations (tax and retention duties), legitimate interests (security of the service, preventing abuse), and your explicit consent where required by law (KVKK Article 5; GDPR Article 6).
5. Service providers and international transfers
We use a limited number of service providers to run the service:
- Supabase (AWS Frankfurt, Germany) — database, file storage and session management. Your data is stored in the EU region.
- ZEGOCLOUD (Singapore) — real-time transmission of voice chat. The audio stream passes through these servers and is not recorded.
- Google (Firebase) — notifications, crash reports and usage statistics.
- Google Play — in-app purchases and receipt verification.
- IP geolocation service — deriving an approximate country/city from the connection IP. Only the IP address is sent to the service.
- Competent authorities — where required by law or court order.
For transfers outside Türkiye and the EEA, the safeguards required by KVKK Article 9 and GDPR Chapter V are applied.
6. Analytics and cookies
Puffy is a mobile app and does not use web cookies. The app uses Firebase Analytics (usage statistics) and Firebase Crashlytics (crash reports) to find bugs and improve the app; they are not used for ad targeting and are not shared with ad networks.
7. Retention
Your data is kept while your account is open. When you delete your account, a 14-day undo period starts; at the end of it your personal and social data is permanently deleted. See Account deletion for details.
| Data | Period |
|---|---|
| Account, profile, messages, content and social connections | While the account is open; permanently deleted 14 days after deletion |
| Purchases, coin transactions, withdrawal records | 10 years (Turkish Tax Procedure Law) |
| Identity verification (KYC) and IBAN details | 10 years (financial regulations) |
| Report and moderation records | Kept as part of the moderation history |
| Platform and device bans | While the ban lasts |
| Approximate location records from IP (country/city, masked IP) | Last 30 connections per person; deleted when the account is deleted |
| Child-safety records | As required by the applicable law |
None of the records kept after deletion remain linked to a profile; no name, photo or identity is visible behind them.
8. Your rights
Under KVKK Article 11 and the GDPR you have the right to: learn whether your data is processed and request information about it; learn the purpose of processing; know to whom it is transferred in Türkiye or abroad; request correction of incomplete or inaccurate data; request erasure; request that those corrections or erasures be notified to recipients; object to a result against you arising from automated analysis; obtain your data in a portable format (GDPR); restrict or object to processing (GDPR); withdraw consent at any time; and claim compensation for damage caused by unlawful processing.
You can edit most profile information directly in the app and delete your account in the app or via the account deletion page. For other requests write to [email protected]; requests are handled within 30 days at the latest. You also have the right to lodge a complaint with the Turkish Personal Data Protection Authority or, if you are in the EEA, with your local data protection authority.
9. Child safety
Puffy is only for users aged 18 and over. We do not knowingly collect data from anyone under 18. We have zero tolerance for child exploitation content; see our Child Safety Standards.
10. Security
Data is encrypted in transit and at rest. The database is protected by row-level access rules; a user can only access the rows they are authorised to see. Sensitive fields such as the national ID number are additionally stored encrypted.
11. Changes
We may update this policy from time to time. We announce significant changes in the app; the date at the top of this page always shows the version in force.