Privacy

This Privacy Policy explains how PickMe ("PickMe", "we", "us") collects, uses and protects your personal data when you use the PickMe mobile app and related services (the "Service").

1. Who is responsible for your data

The data controller for the Service is:

Kaan Sönmez, operating under the Vandly brand
Address: [ADDRESS]
Email: privacy@vandly.ai

For general support questions, contact support@vandly.ai.

2. What data we collect

Account data. When you create an account we collect your email address and a password. Passwords are handled by our authentication provider and are never stored by us in readable form. We also store your username, display name and, if you choose to add one, a profile photo.

Content you create. Questions (polls) you post, including their text, category, answer options and any images you attach; your votes; comments and discussion posts; predictions and points; and notes you create in the app.

Messages. Direct messages you send and receive. Direct messages are deleted automatically 48 hours after they are sent, unless you or the other participant choose to save a message (up to 10 saved messages per conversation).

Safety and moderation data. Reports you submit about content or users (including the reason and any details you add), reports submitted about your content, and the list of accounts you have blocked.

Onboarding and preferences. Categories you choose during onboarding and in-app settings such as theme. Some of these are stored only on your device.

Technical data. Basic technical information needed to operate the Service securely, such as device type, operating system version, app version, IP address and error logs. We use this to keep the Service running, prevent abuse and fix bugs.

We do not collect your precise location, contacts or health data. We do not knowingly collect special categories of personal data. Please do not include sensitive personal information in public questions or comments.

3. Camera and photo library access

If you allow it, PickMe accesses your camera or photo library only when you choose to take or select a photo (for example, for your profile photo or a question image). We only upload the images you select. You can change these permissions at any time in your device settings.

4. How we use your data

We use your data to:

• create and manage your account and let you sign in;
• publish your questions, show votes and results, and deliver messages;
• show you a feed of questions, including by category and recency;
• keep the Service safe: review reports, remove content that breaks our Terms, enforce blocks, and prevent spam, fraud and vote manipulation;
• respond to your support and privacy requests;
• maintain, secure and improve the Service.

We do not sell your personal data. We do not use your content to train AI models.

5. Legal bases

Where the EU/UK General Data Protection Regulation (GDPR) or the Turkish Personal Data Protection Law No. 6698 (KVKK) applies, we rely on:

• performance of a contract, to provide the Service you signed up for (account, posting, voting, messaging);
• legitimate interests, to keep the Service safe and secure, moderate content, prevent abuse and improve the Service;
• legal obligations, where we must keep or disclose data by law;
• consent, where required (for example, device permissions such as camera and photo library). You can withdraw consent at any time.

6. What other users can see

Your username, display name, profile photo, the questions you post, the images you attach and your comments are visible to other PickMe users. Vote results are shown in aggregate. Direct messages are visible only to the participants of the conversation. Reports and your block list are not visible to other users.

7. Service providers

We use a small number of trusted providers who process data on our behalf, under contracts that require them to protect it:

• Supabase — database, authentication and file storage. Data is hosted in the European Union (Frankfurt, Germany).
• Apple — app distribution and, where you use them, platform services such as push notifications.
• Google Workspace — handling support and privacy emails you send us.
• Cloudflare — hosting of our website (vandly.ai).

We may disclose data if required by law, to respond to valid legal requests, or to protect the rights, safety and property of our users or others.

8. International transfers

Our main data store is in the European Union. If you use the Service from outside the EU, including from Turkey, your data will be transferred to and processed in the EU. Where a transfer requires safeguards under applicable law (including Article 9 of KVKK), we rely on the mechanisms provided by that law, such as standard contractual clauses.

9. How long we keep your data

• Account and profile data: for as long as your account exists.
• Questions, votes and comments: until you delete them or delete your account.
• Direct messages: deleted automatically after 48 hours, except messages saved by a participant, which are kept until unsaved, deleted or the account is deleted.
• Images: deleted from storage when you delete the related question or your account.
• Reports and moderation records: up to 12 months after the report is closed, or longer if needed to handle repeated abuse or legal claims.
• Technical logs: for a limited period, normally no longer than 90 days.

When you delete your account, we delete or anonymise your personal data within 30 days, except where we must keep it longer by law. Residual copies may remain in backups for a short period before being overwritten.

10. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you and get a copy;
• correct inaccurate data;
• delete your data;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent where processing is based on consent;
• lodge a complaint with a data protection authority (for example, your local EU authority, or the Turkish Personal Data Protection Authority, KVKK).

If you are in Turkey, you also have the rights listed in Article 11 of KVKK, including the right to learn whether your data is processed, the purpose of processing, the third parties to whom it is transferred, and to request compensation for damages caused by unlawful processing.

You can delete your account at any time from Settings in the app. For any other request, email privacy@vandly.ai. We will respond within 30 days. We may need to verify your identity before acting on a request.

11. Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS/TLS), access controls at the database level, and secure storage of sign-in sessions on your device. No system is completely secure, but we work to protect your data and will notify you and the relevant authorities of a data breach where required by law.

12. Children

PickMe is not intended for anyone under 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has created an account, contact privacy@vandly.ai and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you in the app or by email before they take effect. The "Last updated" date above shows when this policy was last changed.

14. Contact

Kaan Sönmez (Vandly)
[ADDRESS]
privacy@vandly.ai