Privacy policy
Last updated:
This policy explains how the Sayfa apps (iPhone, Apple Watch, Android, Wear OS) and the sayfa.app website handle your data. We kept it short without leaving anything out. The Turkish version is the reference text.
In short
- You do not need an account to browse and search.
- Your location is used only while you use the app. We never track your location in the background.
- Photos sent for photo search are not stored.
- No ads. We use no third-party advertising or analytics (tracking) SDKs. We do not sell your data.
- This website uses no cookies. We measure visits and page speed only with Cloudflare Web Analytics, without cookies and without identifying you.
- Technical access logs, including IP addresses, are kept for security and deleted automatically (see “Infrastructure”).
Location
We use your device’s location to show nearby businesses and distances. We ask for the operating system’s “While Using the App” permission; we never ask for “Always”.
Your location is sent to our server as part of a search request and is used only to compute that request’s results. We do not store it with your account. (See “Infrastructure” below for technical access logs.) Without location permission you can still use the app; results are then shown for a default area.
Photo search
When you search by photo, the photo is sent to our server, turned into a numeric similarity vector by a model running on our own servers, and the results are found. The photo is not stored, not sent to any third-party AI service and not linked to your account.
For businesses, product name and description suggestions from a photo are made on the device; that photo does not leave the device for this.
If you create an account
Following, price alerts and managing a business require an account. You sign in with a passkey, Sign in with Apple or Google. We keep:
| Data | Why |
|---|---|
| Display name; the email address Apple or Google shares (if any) | To identify your account and reach you when needed |
| Your account id at the sign-in provider; your passkey’s public key | So you can sign in. Your password or the private part of your passkey never reaches us |
| Sessions: device name, platform, last used time | To keep your sessions safe |
| Businesses you follow, prices you watch and your target prices | To provide these features and send notifications |
| Your “price is wrong” reports (reason, the price you saw, your note) | So the business can correct the price |
Notifications
If you allow notifications we store your device’s push token (APNs or FCM), platform, app version, language and time zone, plus the tokens for Live Activities. Notifications are delivered through Apple Push Notification service and Firebase Cloud Messaging. You can turn them off in your device settings at any time.
What stays on your device
Favorites, recent searches and the summaries your widgets show are stored only on your device.
Businesses
If you register a business, its name, category, description, address, location, phone, website, opening hours, photos, products, prices and announcements are stored and shown publicly. Price history is public as well.
The tax number or document image sent for verification is not public and is used only for verification.
Infrastructure
We run our own servers. Traffic to the website and the API passes through Cloudflare, which processes connection data such as IP addresses. Images are stored in and served from Cloudflare R2. This website runs Cloudflare Web Analytics, which measures page views and load times in aggregate without cookies or device identifiers. The reverse proxy in front of our servers keeps technical access logs: IP address, country, browser or app information and the request URL. For nearby searches that URL includes coordinates. These logs are used only for security and debugging, are not linked to your account, and are rotated so that old entries are deleted automatically.
Retention and deletion
Account data is kept while your account exists. You can delete your account inside the app at any time: tap the account icon at the top right of the Following or My Business tab, choose Delete account and confirm. Deletion happens immediately and permanently; there is no grace period and it cannot be undone. Together with your account we delete your sessions, passkeys, Apple and Google links, devices and push tokens, follows, price alerts, the “price is wrong” reports you sent, the businesses you own (with their products, full price history and announcements) and every image you uploaded. Details are on the account deletion page. If you cannot reach the app, write to [email protected] from the email address linked to your account.
Your rights
You have the right to access your data, ask for it to be corrected or deleted, and object to its processing, including under Turkey’s Personal Data Protection Law No. 6698. For any question or request: [email protected].
Changes
If we change this policy we update the date above and announce significant changes in the app and on the blog.