PRIVACY POLICY

1. INTRODUCTION & CONTROLLER INFORMATION

Jinxly (“the App,” “Service,” or “Platform”) is a mobile social journal application developed and operated by Eraslan Medya (“we,” “us,” or “the Company”). This Privacy Policy (“Policy”) explains in detail how we collect, use, disclose, transfer, store, and protect your personal information when you access or use the Jinxly mobile application, website at jinxly.app, and any associated services.

By creating an account or using Jinxly, you acknowledge that you have read, understood, and consent to the data practices described in this Policy. If you do not agree with any part of this Policy, you must discontinue use of the Service immediately.

For data protection inquiries, please contact us at: privacy@jinxly.app

2. INFORMATION WE COLLECT

We collect only the minimum personal data necessary to operate and improve the Service. The categories of information we collect include:

2.1 Account & Profile Information

• Email address (used for authentication, account recovery, and critical service communications)
• Username, display name, and optional biography text that you choose to provide
• Profile avatar (either a pre-set icon or a photo you upload from your device gallery)
• Optional social media handles (Instagram, TikTok, Snapchat) that you voluntarily add to your profile
• Optional demographic fields including date of birth, location text, and phone number — all entirely optional and editable at any time

2.2 User-Generated Content (Jinxes)

• Misfortune log entries (“Jinxes”): title, description text, severity classification (Low, Moderate, High, Critical), and timestamp
• Privacy designation of each entry: Private Vault (visible only to you) or Public Feed (visible to all users)
• Comments and reactions (Oof!, F) that you post on other users' public Jinxes

2.3 Location Data

• Precise GPS coordinates (latitude and longitude) collected only when you explicitly opt in by tapping the “Add GPS Location” button while logging a public Jinx
• A human-readable location label (e.g., city or neighborhood) that you may optionally enter manually
• Location data is used exclusively to pin public Jinxes on the Map of Misery feature and is never collected passively or in the background

2.4 Push Notification Tokens

• When you grant notification permission, we store an Expo Push Notification token linked to your account to deliver in-app event alerts (reactions, comments, new followers, badge achievements)
• You may revoke notification permissions at any time through your device's system settings

2.5 Technical & Usage Data

• Authentication session tokens stored securely using device-level Secure Store (iOS Keychain)
• Standard server-side request logs (IP address, device OS version, request timestamps) retained for a maximum of 30 days for security and abuse prevention purposes

3. HOW WE USE YOUR INFORMATION

We process your personal data only for the following specific and legitimate purposes:

• Service Delivery: Authenticating your identity, managing account sessions, and enabling all core platform features
• Gamification Engine: Calculating your daily Misery Meter score, bad luck streaks, karma points, leaderboard rankings, and unlocking Anti-Badge achievements
• Social Feed: Displaying your public Jinxes to the community, processing reactions and comments, and managing follow relationships
• Map of Misery: Rendering consented public location pins on the interactive disaster map (PRO feature)
• Push Notifications: Delivering real-time alerts for social interactions (reactions, comments, follows, badge unlocks) respecting your in-app notification preferences
• Safety & Moderation: Detecting violations of Community Guidelines, investigating abuse reports, and enforcing account suspensions
• Service Improvement: Analysing aggregated, anonymised usage patterns to improve app performance, stability, and feature design. Individual user behaviour is never sold or used for targeted advertising
• Legal Compliance: Fulfilling obligations under applicable law, responding to lawful requests from authorities, and enforcing our Terms of Use

4. DATA STORAGE, SECURITY & RETENTION

All personal data is stored on Supabase (PostgreSQL) infrastructure, which is hosted on AWS data centers with SOC 2 Type II compliance. We enforce database-level Row Level Security (RLS) policies ensuring that Private Vault entries are strictly inaccessible to any other user or third party, and that users may only access their own account data.

Authentication credentials and session tokens are stored exclusively in the device-level iOS Secure Enclave (Keychain) and are never transmitted in plain text.

Data Retention: We retain your personal data for as long as your account remains active. Upon account deletion, all profile information, private Jinx logs, reactions, comments, follow relationships, badges, and notification records are permanently and irreversibly purged from all our systems within 30 days. Anonymised, aggregated statistical data (e.g., total app-wide Jinx counts) may be retained indefinitely as it cannot be linked to any individual.

5. THIRD-PARTY SERVICES & DATA SHARING

We do not sell, rent, or trade your personal information to third parties for commercial or marketing purposes. Data is disclosed only in the following limited circumstances:

• Infrastructure Providers: Supabase Inc. (database, authentication, and file storage hosting). Supabase processes data under a Data Processing Agreement (DPA) and does not use your data for its own commercial purposes.
• Push Notification Delivery: Expo Application Services (EAS) and Apple Push Notification Service (APNS) are used solely to route push notifications to your device. Only your anonymised push token is transmitted — no personal profile data is shared.
• AI Oracle Feature: Mishap descriptions you voluntarily submit to the Jinxie AI Oracle are processed transiently by a third-party Large Language Model API provider to generate sarcastic roasts and karma predictions. These inputs are not retained by the AI provider beyond the immediate API request lifecycle and are not used to train AI models.
• Apple App Store / Google Play Store: Payment and subscription transactions are handled exclusively by Apple and Google. We receive only a confirmation of subscription status and do not process or store your payment card details.
• Legal Obligations: We may disclose data to competent government authorities when required to do so by law, court order, or to protect the safety and rights of our users and the public.

6. CHILDREN'S PRIVACY

Jinxly is not directed at or intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@jinxly.app. We will take prompt steps to delete that information from our systems.

7. YOUR RIGHTS & CHOICES

In accordance with applicable privacy regulations including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), you have the following rights regarding your personal data:

• Right of Access: You may request a copy of all personal data we hold about you at any time
• Right to Rectification: You may correct or update inaccurate profile information directly via the Edit Profile screen in the app at any time
• Right to Erasure (“Right to be Forgotten”): You may permanently delete your account and all associated data through the Settings › Delete Account option within the app, or via our online account deletion portal
• Right to Restrict Processing: You may make your public Jinxes private at any time, removing them from public view without permanent deletion
• Right to Data Portability: Upon written request to privacy@jinxly.app, we will provide an export of your personal data in a machine-readable format within 30 days
• Right to Object: You may object to certain processing of your data by contacting us. We will assess and respond within 30 days
• Notification Preferences: You may manage push notification categories (reactions, comments, follows, badges) within the app Settings › Alerts Setup screen, or disable all notifications via your device's system settings
• Location Permissions: You may revoke GPS permission at any time via your device's privacy settings. Revoking permission does not affect previously submitted location data; contact us to remove existing location records

8. INTERNATIONAL DATA TRANSFERS

Jinxly is a globally accessible application. Your data may be stored and processed in countries other than your country of residence, including the United States, where our infrastructure providers operate data centres. By using the Service, you consent to the transfer of your data to these jurisdictions. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses approved by the European Commission) to ensure your data receives an adequate level of protection.

9. CHANGES TO THIS POLICY

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or service features. Material changes will be communicated via in-app notification and/or email at least 14 days before taking effect. We encourage you to review this page periodically. The “Last Updated” date at the top of this page indicates when changes were last made. Continued use of Jinxly after any changes constitutes your acceptance of the updated Policy.

10. CONTACT & DATA PROTECTION OFFICER

For any questions, requests, or concerns regarding this Privacy Policy or our data handling practices, please contact us through any of the following channels:

• Email: privacy@jinxly.app
• Support Portal: jinxly.app/support
• Company: Eraslan Medya
• Website: jinxly.app

We aim to respond to all privacy-related inquiries within 5 business days. If you are located in the European Economic Area and believe your rights under GDPR have been violated, you also have the right to lodge a complaint with the relevant supervisory authority in your country of residence.