Legal

Privacy Policy

Effective: 3 November 2026 · Version 1.0 · Applies to the Eroviya Touch app (Android and iOS), the touchapi.eroviya.com server and this website. The eroviya.com store has its own privacy policy. In case of conflict, the Turkish version prevails.

1. In short

For an account we only ask for an e-mail address, a display name and a password. E-mail and name are stored encrypted on the server; only a hash of the password is kept.
We record who took part in a remote control session, with which device and when; the commands sent during a session are relayed in real time and not stored.
Your mixes, patterns, app lock PIN and motion sensor data stay on your phone; they are never sent to the server.
We do not collect location, contacts or advertising identifiers. There is no analytics, advertising or crash-reporting SDK.
We do not sell your data. Sharing is limited to the providers that run the service (hosting, push notifications) and to legal obligations.
You can have your account deleted at any time: Delete your account.

2. Data controller

EROVİYA E-TİCARET LİMİTED ŞİRKETİ, Kanal Mah. 4755 Sk. İsmail Zurnacı Apt. No: 8 İç Kapı No: 2, Kepez / Antalya, Türkiye. MERSİS 0368055992300001. Contact: hello@eroviya.com.

3. What we collect

Data	Source	Purpose	Retention
Account: e-mail address, display name, password hash, account creation and last-seen time, e-mail verification status	Sign-up form	Creating the account, signing in, e-mail verification, support	While the account exists; at most 30 days after a deletion request
Push token: Firebase Cloud Messaging (Android) or Apple Push (iOS) token, platform	The app, if you allow notifications	Control request and connection notifications	Until you sign out or uninstall; invalid tokens are purged
Connections and invites: invite code hash, the accounts you are linked to, who used an invite and when	The app	Linking with a partner, remote control	While the connection exists; expired invites 12 months
Remote control sessions: controlling and receiving account, the device profile chosen by the receiver, the maximum level (cap), start and end time, status	The app	Setting up the session, documenting consent, investigating abuse reports	12 months
Blocks and reports: accounts you blocked; report reason, optional note (encrypted), related session	The app	Safety, moderation	Blocks until removed; reports 12 months after resolution, then anonymised
Technical logs: IP address, request time and path, error logs, app version	Server	Security, debugging, serving updates	30 days

Commands sent during remote control (level, pattern, mix, dice, reaction) are relayed through the server to the other phone in real time; their contents are not written to the database.

4. Data that stays on your phone

The following are stored only on your device and never sent to the server: your mixes and patterns, Surprise settings, Shake and Tilt sensitivities, the app lock PIN, motion sensor (accelerometer, gyroscope) readings, your drawings, the selected device profile. They are deleted when you uninstall the app; you can back up mixes to a JSON file from Settings.

Bluetooth. The app broadcasts commands to your device; it does not read data from the device and does not scan for nearby Bluetooth devices. That is why it never asks for location permission.

5. What we do not collect

Location, contacts, photos, messages, advertising identifiers, device serial numbers, usage analytics. The app contains no advertising, analytics or crash-reporting SDK; the only third-party component is the push notification infrastructure (Firebase Cloud Messaging / Apple Push).

6. Purposes and legal bases

Performance of a contract (Turkish Data Protection Law "KVKK" art. 5/2-c; GDPR art. 6(1)(b)): account, sign-in, connections, remote control sessions, updates.
Legitimate interest (KVKK art. 5/2-f; GDPR art. 6(1)(f)): security, debugging, abuse prevention, handling reports, technical logs.
Legal obligation (KVKK art. 5/2-ç; GDPR art. 6(1)(c)): responding to lawful requests from authorities, keeping records of requests.
Consent (KVKK art. 5/1 and art. 9; GDPR art. 6(1)(a)): device permission for notifications; transfer of data to providers outside Türkiye (below).

7. Who we share with

Recipient	Purpose	Location
Hetzner Online GmbH	Server and database hosting	Germany (EU)
Google LLC — Firebase Cloud Messaging	Android notifications (token and notification title only)	USA / global
Apple Inc. — Apple Push Notification service	iOS notifications	USA / global
Cloudflare, Inc.	Domain name resolution and network protection	Global
E-mail delivery provider	Verification and account e-mails	To be named here once the provider is chosen
Public authorities	Only where legally required	Türkiye

Providers process data only on our instructions and only to deliver the service. We do not sell data, share it for advertising or build profiles. Because the servers are located outside Türkiye, personal data is transferred abroad under KVKK art. 9; by accepting this policy at sign-up you consent to that transfer.

8. Retention and deletion

Data is deleted or anonymised once the periods in the table above expire. When you have your account deleted, account data, push tokens, connections, invites and your identity in session records are removed within 30 days at the latest; backups roll over within 30 days. Report records may be kept with identities anonymised to combat abuse. Details: Delete your account.

9. Security

All connections are encrypted with TLS.
E-mail address and display name are stored in the database encrypted with AES-256-GCM; the password is kept only as a one-way hash.
Server access is key-based; the admin panel sits behind separate authentication.
App updates are accepted only if signed with Eroviya's release key.
The Bluetooth LE broadcast has no device-side authentication; use your device in a trusted environment. See the Terms of Use.

10. Your rights

Under KVKK art. 11 you may learn whether your data is processed, request information, have it corrected or deleted, object to processing and claim compensation for damage caused by unlawful processing. Send your request from your registered e-mail address to hello@eroviya.com or in writing to the company address; we reply within 30 days. If you are not satisfied, you may complain to the Turkish Personal Data Protection Board. If you are in the European Union, your GDPR rights of access, portability and objection are exercised through the same address.

11. Age limit

Eroviya Touch is for people aged 18 and over only. If we learn that an account belongs to someone under 18, we close it and delete its data.

12. Changes

When this policy changes we publish the new version here and announce significant changes inside the app. The version number and effective date are at the top of the page.

13. Contact

For any privacy question: hello@eroviya.com. Other legal texts: Turkish Data Protection (KVKK) Notice, Terms of Use, Delete your account.