Last updated: October 14, 2026
This policy explains which personal data InshaLove processes, why, who receives it, how long we keep it and which rights you have. It covers the InshaLove app for iOS and Android, the web app at app.insha.love and the website insha.love.
InshaLove is operated by Mustafa Fatih Gaygisiz, trading as InshaLove (in the App Store the seller appears as MFG Software), Narince Sokak 17, 38090 Kayseri, Türkiye. He is the controller for your data.
We have not appointed a data protection officer, because the law does not require one in our case. If you are in the EU or the European Economic Area, the General Data Protection Regulation (GDPR) applies because we offer our service to you there (Art. 3(2) GDPR). As a controller established in Türkiye we are also bound by the Turkish Personal Data Protection Law No. 6698 (KVKK).
We process only what the service needs. Data is stored with our hosting provider on servers in the EU.
| Data | Purpose | Legal basis |
|---|---|---|
| Sign-in details: e-mail address and password, or your Google or Apple sign-in (from which we receive your e-mail address, your first name and, with Google, a link to your profile picture) | Creating and securing your account | Contract, Art. 6(1)(b); account security, Art. 6(1)(f) |
| Profile: name, date of birth, gender, city and country, at least one photo, an optional voice note, an optional profile video, and the optional details you add about your religion, blood type, origin, languages, lifestyle, marriage intentions, education, work and interests | Showing your profile to other members and showing you theirs | Contract, Art. 6(1)(b); for the special categories see section 3 |
| Location: your city and country, an approximate position used to show other members their distance to you, and the exact position at the moment you use the location button, which we keep internally and no member can see | Distance and place of residence; the internal record only for fraud prevention, safety investigations and legal requests | Contract, Art. 6(1)(b); internal record, Art. 6(1)(f) |
| Bluetooth radar: a temporary random identifier your device broadcasts while the radar is open, the contact requests you send, and the last 50 members the radar has shown you (so that you can still open their profiles later; other members' lists can likewise include you) | Finding members near you, according to your visibility settings | Contract, Art. 6(1)(b) |
| Activity: likes, matches, profile visits, reactions, boosts, blocks, reports and the counters for your plan | Running the service and protecting members | Contract, Art. 6(1)(b); blocks and reports, Art. 6(1)(f) |
| Chat: your messages, the photos, videos, voice messages, GIFs and stickers you send, the emoji reactions you and your chat partner give to messages (the emoji and who gave it), read and delivery status, a notice to the other person when you take a screenshot on iPhone, the state of the games you play in a chat, and your device's notification token | Messaging and notifications | Contract, Art. 6(1)(b) |
| Community feed: your feed username, posts, comments, voice replies, votes and saved items; a post you mark anonymous shows no username to other members but stays linked to your account for us | Running the feed | Contract, Art. 6(1)(b) |
| Wali mode: the name and e-mail address of the person you name, and a log of the summaries sent | Sending the weekly chat summary you asked for | Your consent, Art. 6(1)(a); for your chat partners' messages, Art. 6(1)(f) |
| Verification: your verification video, or your ID document and a selfie with it | Granting the verification badges; when we require a verification after reports or a review by our team (section 4), protecting members from fake profiles and abuse | Your consent, Art. 6(1)(a), for a voluntary verification; for a required one, our and our members' legitimate interest in their safety, Art. 6(1)(f) |
| Purchases: product, price, currency and transaction references from the app stores, each linked to your account, which we also pass to our purchase provider, plus your points, referral code and redeemed rewards | Providing memberships, purchases and rewards | Contract, Art. 6(1)(b); retention, Art. 6(1)(c) |
| Advertising: your advertising identifier, the ad interactions Google records, and your account identifier when a rewarded video is credited | Showing ads and crediting rewarded videos. If you allow personalised ads, Google may combine your advertising identifier and your ad and app interactions with data from other apps and websites to select ads, which is the tracking the iOS prompt asks about; you can change or withdraw the choice at any time under Settings, "Ad settings" | Your consent, Art. 6(1)(a) |
| Usage statistics and crash reports (off by default): which features are used, and the error details, device model and operating system after a crash | Finding errors and improving the app | Your consent, Art. 6(1)(a) |
| Support and feedback: your message, app version, platform, device model and technical details | Answering your request and fixing errors | Contract, Art. 6(1)(b); Art. 6(1)(f) |
To open an account we need sign-in details, your gender, name, date of birth, place of residence and at least one photo; without them we cannot provide the service (Art. 13(2)(e) GDPR). Everything else is optional, except a verification we require after reports or a review by our team; until it is approved, the account cannot be used.
What other members see: the profile details, photos and badges you make visible, your distance, your presence on the radar according to your settings, and the actions you direct at them. Photos you have not blurred, your voice note, your profile video, and the images, videos and voice replies you post in the feed, are visible to other members and can be saved or passed on outside the app; in the app you can switch on blurred photos, which shows the originals only to the people you share them with in a chat. Your profile video is reviewed by our team before other members see it; it is then shown wherever your profile is shown, on the radar only if the radar shows your full name and photo, and it is never blurred, also not when you blur your photos. Photos and videos you send in a chat can be saved and passed on by the person who receives them, and a copy cannot be taken back. When a member hides an anonymous person in a feed post, only that person's anonymous content in that post is hidden for them; this does not tell them who is behind it, and the person is not notified.
Messages are stored on our servers in readable form. Every connection is encrypted, but there is no end-to-end encryption. Deleted messages are hidden immediately and remain stored for safety investigations and legal obligations until your account is deleted or a related report is resolved (Art. 6(1)(f), and Art. 6(1)(c) where law obliges us). An emoji reaction is deleted as soon as you or your chat partner removes it or the message it belongs to is deleted; the remaining reactions are deleted with the chat history (section 7).
Profile photos and feed images are checked automatically before they are stored (section 4). In the app for iOS and Android, videos you choose from your gallery for your profile or the feed are converted on your device before they are uploaded, which removes metadata such as the place where they were recorded. Notifications are delivered through Google's and Apple's push services and can contain the sender's name and a preview of the message.
The Wali summary is a weekly e-mail containing the text of your chat messages of that week, including your chat partners' messages, with names and times; media are replaced by placeholders. It goes to the person you name. Your chat partners see a shield icon while it is active. For your chat partners' messages our legitimate interest, and theirs, is that members can get to know each other in a chaperoned way, which the shield icon makes visible before they write (Art. 6(1)(f) GDPR). If a member has named you as their Wali, we received your name and e-mail address from that member, use them only to send the weekly summary and to keep a delivery log on the same legitimate interest, and delete them when the member removes the Wali or deletes their account; the rights in section 8 apply to you in the same way, including objection at privacy@insha.love (Art. 21(1) GDPR) and a complaint to a supervisory authority (Art. 77 GDPR).
Religion, blood type (health data) and origin and languages (ethnic origin) are special categories of data under Art. 9 GDPR. All of these fields are optional. We process and show them only with your explicit consent (Art. 9(2)(a) GDPR): before the first of these fields is saved, the app asks you to confirm that you agree to it being stored and shown to other members, and without that confirmation the field stays empty. You can change or remove them at any time in the profile editor, which withdraws your consent for that field; processing before the withdrawal remains lawful. Because the service only matches men with women, other members can also infer a heterosexual orientation from your account.
Some decisions are made automatically, because they are necessary to run the service for you and for other members under our Terms of Service (Art. 22(2)(a) GDPR). You can always ask a person to review such a decision, state your view and contest it at support@insha.love or safety@insha.love (Art. 22(3) GDPR).
Which profiles you see, and in which order, is also decided automatically. Your filters, your gender, blocks and every member's privacy settings always apply. Within them, a member with an active Boost, a paid feature, is shown in the first places to members in their region while it lasts. After that we show members who used the app recently and members near you first, and we also take into account how recently a member used the app (never the online status), whether the profile is verified and filled in, the distance, whether the member joined recently and how often the profile has already been shown, plus a small random part so that not everyone sees the same members first. Your plan, religion, prayer, origin, languages and blood type are never used for this order; they only have an effect through filters you set yourself. This is profiling under Art. 4(4) GDPR; it has no legal or similarly significant effect on you. For the factors beyond your filters, location and use of the app we rely on our legitimate interest in showing useful suggestions (Art. 6(1)(f) GDPR); you can object at privacy@insha.love (Art. 21(1) GDPR). The compatibility and profile scores are information only and are not used for this order.
Each company below works for us under a written contract, receives only what its task requires, is bound to protect your data to the same standard as this policy, and may not use it for its own purposes unless stated. For providers outside the EU the last column names the safeguard (section 6). As with any online service, our providers record your IP address, the time and the request in their server logs, which we and they use to run and secure the service (Art. 6(1)(f) GDPR).
| Provider | What for | Where | Safeguard |
|---|---|---|---|
| Supabase Pte. Ltd. | Hosting of our database, sign-in and file storage | Servers in the EU; contracting entity in Singapore | EU Standard Contractual Clauses |
| Google LLC; Google Ireland Ltd. for EEA users | Push notifications; usage statistics and crash reports (with consent); advertising, including rewarded videos, and the ad consent form (with consent); Google Sign-In and Google Play purchases if you use them; address lookup on Android; font and web delivery; hosting of this website | USA; Ireland for EEA users | EU Standard Contractual Clauses; EU-US Data Privacy Framework |
| Apple Inc.; Apple Distribution International | Sign in with Apple and App Store purchases if you use them; push notifications; address lookup on iOS; the tracking prompt | USA; Ireland for EEA users | EU Standard Contractual Clauses |
| RevenueCat, Inc. | Processing purchases and membership status | USA | EU Standard Contractual Clauses |
| Sightengine SAS | Automated image screening; deletes each image right after the check | France (EU) | Established in the EU |
| Klipy | GIF and sticker search and delivery in chats | USA | Receives no account data: we forward only the search term, and your device loads the media directly from Klipy while the picker is open, so Klipy sees your device's IP address and processes it under its own privacy terms |
| Resend, Inc. | Sending the Wali e-mails and account notices | USA | EU Standard Contractual Clauses; EU-US Data Privacy Framework |
No other analytics, tracking or advertising software is built into the app. Beyond these providers, data reaches other members as described in section 2, the Wali you name, and courts or authorities where a lawful request obliges us to disclose it (Art. 6(1)(c), otherwise Art. 6(1)(f) GDPR).
Your data is stored in the EU. We access it from Türkiye to run the service, review verification submissions, handle reports and answer your requests; the European Commission has not issued an adequacy decision for Türkiye, and because we collect the data ourselves and do not pass it to a separate company there, this access is not a transfer to a third party under Chapter V of the GDPR. Google, Apple, RevenueCat and Resend receive data under the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), and Google and Resend are additionally certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Klipy receives no account data; we forward only the search term, and your device contacts Klipy directly while the picker is open, which Klipy processes under its own privacy terms. Write to privacy@insha.love for a free copy of the clauses agreed with a particular provider, or to ask which ground under Art. 9 KVKK we rely on for a transfer abroad.
We keep your data while your account exists. When you delete your account in the settings, it is hidden at once and a 30-day grace period starts, during which logging in restores it. During that period your existing chat partners still see your name and photo in the chat, and your matches can still open your profile. After 30 days your profile data, photos, profile video and verification files are deleted and the account is anonymised, while your chat conversations remain for your former chat partners. After 60 days the chat history and everything else linked to the account are deleted permanently. If you have no access to the app, write to privacy@insha.love and we start the same process within 7 business days of verifying your identity.
Right to object: where we rely on legitimate interests (section 2), you can object at any time for reasons arising from your particular situation, and we then stop unless we can show compelling grounds that override your interests (Art. 21(1) GDPR).
You also have the right to access your data and receive a copy (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction (Art. 18), to portability (Art. 20), to withdraw any consent at any time without affecting earlier processing (Art. 7(3)), to human review of the decisions in section 4 (Art. 22(3)), and to complain to a supervisory authority, in particular in the EU member state where you live (Art. 77 GDPR). If you are in Türkiye, you have the rights in Article 11 KVKK and can complain to the Personal Data Protection Authority.
There is no self-service export in the app yet; on request we send your data by e-mail in a machine-readable format. Write to privacy@insha.love, ideally from your account address. We verify that a request really comes from you and answer within one month (Art. 12(3) GDPR).
In the app you can edit or remove any profile field, delete photos, switch on blurred photos, use incognito mode, hide your online status, hide your profile visits and switch off read receipts (both Ultimate), set what the radar shows of you, switch notifications and the Wali mode on or off, withdraw the consent for usage statistics, change your ad settings, block and report members, and pause or delete your account.
Connections are encrypted in transit, stored data is encrypted by our hosting provider, and access is restricted to what each account and each member of our team needs. Chat media, verification files and the originals of blurred photos are stored privately and delivered only to the people entitled to see them. On your device you can switch on the app lock and the disguise icon. Messages are not end-to-end encrypted.
InshaLove is for adults only (18+). We ask for your date of birth at registration and do not accept an age under 18. If we learn that an account belongs to a minor, we remove it. Tell us at safety@insha.love if you know of such an account. Our child-safety standards are at insha.love/child-safety.html.
The website is hosted on Firebase Hosting (Google), whose servers process the usual log data for delivery and security: IP address, time, requested page, browser and referring page (Art. 6(1)(f) GDPR). Fonts and the page engine are loaded from Google's servers, so Google sees your IP address for those requests. The website sets no cookies and uses no analytics, tracking or advertising, and there is no contact form, only e-mail links.
We update this policy when our processing changes; the current version is always at insha.love/privacy-policy.html and the date at the top shows when it last changed.
Mustafa Fatih Gaygisiz (InshaLove)
Narince Sokak 17, 38090 Kayseri, Türkiye
Privacy: privacy@insha.love · Support: support@insha.love · Safety: safety@insha.love
Phone: +90 537 407 30 58 · Legal notice: insha.love/impressum.html