Privacy Policy

Last updated: September 14, 2026 · Version 5

This Privacy Policy describes how Islam Bayram, a sole proprietor in Türkiye (hereinafter "we", "us" or "Operator"), collects, uses and protects personal data of users of the "Are You OK?" mobile application (hereinafter "Application").

This Policy applies to users residing outside the Russian Federation. They are served by Islam Bayram, a sole proprietor in Türkiye. Users in Russia are covered by the other Privacy Policy.

1. Data We Collect

When using the Application, we may collect the following data:

• Phone number — for SMS or WhatsApp sign-in and delivery of codes and notifications
• Telegram account identifier — to link your Telegram account to your Application account when you choose Telegram sign-in
• Sign-in information — interface language, IP address and country inferred from it, request times, delivery and verification results, and any confirmation you provide about being outside Russia; used to offer available sign-in methods and prevent abuse
• User name — for identification within the family group
• Geolocation — only when pressing the SOS button to send location to relatives
• Device identifier — for sending push notifications
• Check-in history — information about "I'm OK" and "SOS" button presses
• Subscription data — information about subscription plan and payments

2. How We Use Data

Collected data is used exclusively for:

• Providing core Application features (status notifications, SOS alerts)
• Signing you in, maintaining your session, delivering verification codes, and preventing repeated or abusive requests
• Sending notifications to family members
• Processing payments and managing subscriptions
• Technical support
• Service quality improvement

Sign-in methods

The available sign-in methods are shown in the Application and may depend on interface language and the country inferred from your IP address. We determine that country using a local database, without sending your IP address to an external geolocation service.

• SMS: we send your phone number and a message containing a verification code to our SMS delivery provider, SigmaSMS.
• WhatsApp: our server uses our messaging gateway to check whether your number is registered with WhatsApp. If it is, we send a verification code through WhatsApp. WhatsApp processes the number and message to deliver the code. If the number is not registered with WhatsApp and is a supported Russian number, the Application may switch to SMS. An unavailable check does not mean that WhatsApp is absent.
• Telegram: you open our bot with a temporary sign-in token. The bot receives your Telegram account identifier and links it to your Application account. This sign-in flow does not copy your Telegram phone number, profile name, username or photo into your Application profile. You provide your Application name separately.

WhatsApp and Telegram also process data under their own privacy policies:WhatsAppand Telegram.

3. Geolocation

We request location access only when the SOS button is pressed. Location is not tracked in the background. When location is provided with an SOS check-in, it is stored as part of the check-in history solely so family administrators can review that history. SOS location and check-in history are retained for 180 days and then permanently deleted. We do not use this data for advertising, profiling, or sale. You can revoke location access in your device settings at any time.

4. Data Storage and Protection

We take necessary measures to protect your data:

• All data is transmitted via secure HTTPS protocol
• Personal data is stored encrypted (AES-256)
• Only authorized personnel have access to data
• Servers are located in secure data centers

Sign-in records and retention

SMS and WhatsApp verification codes are valid for five minutes. Expiration prevents sign-in with that code; it does not automatically erase all records of the message. Our WhatsApp verification database stores a cryptographic check value instead of the readable code. The readable message may remain in our delivery gateway's message history and delivery queue, and in the messaging service.

• WhatsApp request records are scheduled for automatic deletion 24 hours after creation. Protected IP identifiers used for rate limits are scheduled for deletion 24 hours after the latest counted request, and phone verification records 25 hours after the latest request. Cleanup runs periodically, so deletion is not instantaneous at those deadlines.
• Temporary Telegram sign-in requests expire after five minutes and are scheduled for automatic cleanup; they are removed earlier when sign-in is completed. The Telegram identifier linked to your account remains in your profile while the account exists.
• SMS verification records include the phone number, code and expiration time. They are removed when verification succeeds or a replacement code is requested. In the current implementation, expiration alone does not delete an unused SMS record, and SMS sending logs have no automatic age-based deletion schedule.
• Message history in our WhatsApp gateway is limited by message count rather than a fixed number of days. Code expiration and account deletion do not automatically delete delivery history or queued messages. The delivery queue has no application-defined age-based deletion schedule.

Session tokens are stored on your device to keep you signed in. Our server stores a cryptographic check value for the token used to renew the session, linked to your account. On sign-out, the Application removes tokens from your device and requests revocation of the session-renewal token on the server. Account deletion revokes session-renewal tokens for all your devices. To request deletion of sign-in or delivery records, contact privacy@youokapp.online; deleting your Application account does not itself erase these separate records or messages held by WhatsApp, Telegram or your SMS provider.

Check-in history, including SOS location when provided, is retained for 180 days solely to make family history available to family administrators and is permanently deleted after that period. You may request earlier deletion of your personal data at any time through the in-app support chat or by contacting us at privacy@youokapp.online.

Before raw check-in records are deleted, we may convert them into pseudonymized analytics records. Each record contains a protected analytics identifier derived from the user's internal identifier using a keyed cryptographic function, together with the date, hour, day of the week, check-in type, whether location was provided, and the number of events. These records contain no name, phone number, family, contact or device identifier, source check-in ID, or coordinates. Pseudonymized analytics are retained for up to three years solely for product analytics and forecasting general usage patterns. They are deleted earlier when the user deletes their account or requests deletion through support.

When an account is deleted, its profile, including the phone number and Telegram identifier stored in that profile, device data, family membership, check-in history, and pseudonymized analytics are removed immediately. For deletion-control purposes, we retain a minimal record containing only the internal account ID, role, last four phone digits, account creation date, deletion date, and scheduled purge date. It contains no name, full phone number, family, region, settings, device identifier, or check-in data. An authorized administrator may erase this record earlier, and it is automatically and permanently deleted no later than 30 days after account deletion. Instructions for deleting your account are available on the account deletion page.

5. Data Sharing with Third Parties

We may share data with the following categories of recipients:

• Your family members — as part of Application functionality (status, SOS location)
• Payment systems — for payment processing (App Store, Google Play)
• SMS delivery provider (SigmaSMS) — phone number and message text for verification codes and SMS notifications
• WhatsApp and Telegram — the sign-in and delivery information described above, when you use those methods
• Push services — Firebase Cloud Messaging (Google), Apple Push Notification Service

We do not sell your personal data or provide it to advertisers.We disclose data to the recipients described in this Policy to provide the service, and when required by applicable law.

6. Your Rights

You have the right to:

• Access information about your stored personal data
• Correct inaccurate data
• Delete your data before the end of the retention period (right to be forgotten)
• Withdraw consent to data processing
• Export your data

To exercise these rights, contact us through the in-app support chat or atprivacy@youokapp.online.

7. Children

The Application is not intended for children under 14 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, please contact us.

8. Cookies

The mobile application does not use cookies. On our website, we only use technically necessary cookies for proper site functionality.

9. Policy Changes

We may update this Privacy Policy. We will notify you of significant changes through the Application or by email. Continued use of the Application after changes constitutes your acceptance of the revised Policy.

10. Contact Information