1. Scope

This Policy applies to account creation, sign-in, profile, posts, messaging, notifications, live streaming, and all similar Platform features.

By using the Platform, you are deemed to have read and understood this Policy. If you do not wish to read it, you should not use the service.

2. Data controller

The data controller for your personal data is Orbly. For privacy-related requests, contact: info@orbly.social.

3. Data we collect

The following categories of data may be processed on the Platform:

• Identity and account: username, display name, email address, password (stored only as a hash), profile photo, and bio.
• Content: posts, replies, likes, bookmarks, messages, live-stream metadata, and media files.
• Usage: session information, device type, app version, error logs, and security logs.
• Communication: support requests and notification preferences.
• Third-party sign-in: identity information shared by the provider when you sign in with Google or Apple (email, name, etc.).

4. Purposes of use

Your data is processed for the following purposes:

• Account creation, authentication, and session management.
• Providing social features (feed, follow, notifications, messaging).
• Security, abuse prevention, and service continuity.
• Fulfilling legal obligations.
• Product improvement and support, based on your explicit consent or legitimate interest.

5. Legal basis

Under KVKK (Turkey's Personal Data Protection Law No. 6698), your personal data is processed on the legal grounds of the establishment or performance of a contract, legal obligation, legitimate interest, and, where required, your explicit consent.

6. Sharing and transfer

Your data may be shared with hosting (e.g., cloud infrastructure), email delivery, authentication (OAuth), and analytics service providers, only to the extent necessary to provide the service.

Where data is transferred abroad, the safeguards required under KVKK Art. 9 (explicit consent, an adequacy decision, or a written undertaking) are applied.

Data may be shared with competent authorities where legally required.

7. Retention period

Your data is retained for as long as your account remains active. When you request account deletion, your data is deleted or anonymized within a reasonable period, except where legal retention obligations apply.

Security and audit logs may be retained for the periods required by law.

8. Security

We apply encryption, access control, secure communication (HTTPS/TLS), and regular security assessments to protect your data. No system is 100% secure; we work to reasonably reduce risk.

9. Your rights

Under KVKK Art. 11, you have the right to learn whether your personal data is processed, to request information, to request correction or deletion, to object, and to request compensation for damages.

You may submit your requests to info@orbly.social; we may need to verify your identity.

10. Children

The Platform is not directed to children under the age of 13. We do not knowingly collect data from anyone under 13. If such a case is identified, the account is closed and the data is deleted.

11. Changes

This Policy may be updated. Material changes may be announced through the Platform or by email. The update date appears at the top of the page.