Privacy Policy
Please note: this document applies to the Aybuke app from its release on the App Store and may be updated before then.
Last updated: 14 October 2026
Privacy at a glance
- Aybuke is designed with teens in mind, so everyone gets high-privacy defaults: no tracking, no profiling and no public profiles or feeds.
- Free members see a few ads from Google AdMob: a short ad you can choose to watch for 1 credit when you're out of credits (a few a day), and now and then an ad after you save. Ads are never personalised and never use your photos. Pro has no ads, and there are none under 13.
- We don't ask for your name, email address or a password. Your account is an anonymous, random ID.
- Your library stays on your iPhone. Background removal and manual adjustments never leave your device.
- Photos and prompts go to the cloud only after you opt in, and only to create the result you asked for. We don't store them, and results are deleted from the cloud within 1 hour.
- We never use your photos, prompts or results to train AI models, and we never sell them or use them for advertising or marketing.
- You can switch off cloud AI processing or delete your data and account in the app at any time. If you're under 18, start with section 3.
1. Who we are
Okan Berk Manavoğlu (individual developer) ("we", "us" or "our") develops and operates the Aybuke iOS app and its online services (the "Service"). We are the controller responsible for your personal data (under Türkiye's KVKK, the veri sorumlusu).
- Address: Istanbul, Türkiye, Türkiye
- Trade registry / MERSİS number: None (individual developer)
- Privacy contact: hello@buaze.com
- Representative in the EU (Art. 27 GDPR): None appointed. Contact hello@buaze.com for any request.
- Representative in the UK (Art. 27 UK GDPR): None appointed. Contact hello@buaze.com for any request.
For any privacy question, including anything you would raise with a data protection officer, email us at hello@buaze.com.
This policy covers the Service. It doesn't cover third-party services you use together with Aybuke, such as Apple's App Store or the apps you share to (for example Instagram), which have their own privacy policies. If you're in Türkiye, please also read our KVKK Information Notice. Our Terms of Use and Acceptable Use & AI Content Policy explain the rules for using Aybuke.
2. Designed with teens in mind
Aybuke is designed with teen users in mind. That's why we apply high-privacy defaults to everyone who uses it, whatever their age:
- Few ads, never personalised. Pro members and anyone under 13 see no ads, and neither does the Mac app. Free members see ads from Google AdMob in two places only: a short ad they can choose to watch for 1 credit when they're out of credits (a few a day, as the app shows), and now and then an ad after they save or share a finished creation (never in the first day, at most 3 a day). Ads are never personalised and never use your photos, prompts or results, and teens and anyone whose age we don't know get only ads suitable for a general audience (section 5).
- No tracking. We don't track you across other companies' apps or websites. The app never asks for permission to track you and doesn't access your device's advertising identifier (IDFA). The only third-party analytics SDK is RevenueCat's subscription analytics, which starts only once you make a purchase, and Google's ad SDK starts only when an ad may be shown to a free member (section 5).
- No profiling. We don't build profiles about you, and we don't make decisions about you with legal or similarly significant effects based on automated processing.
- No public profiles or feeds. Nothing about you is public in Aybuke. Your creations are shared only if you choose to share them.
- No sharing for marketing. We don't sell personal information or share it for personalised (cross-context behavioural) advertising or for marketing, and we don't work with data brokers. We don't send you marketing messages.
- Your library stays on your device. The creations you keep are stored only on your iPhone.
- Cloud processing only after you opt in. Nothing leaves your device for one of our cloud AI features until you agree. Apple's Image Playground has its own notice (section 6).
- No AI training. We never use your photos, prompts or results to train AI models, and we use only AI provider plans whose terms don't allow training on customer content without our permission, which we never give.
- No face recognition. We don't perform face recognition, create biometric templates or face embeddings, or try to identify the people in your photos.
We follow the standards of the UK Age Appropriate Design Code (the "Children's Code") for all users. Section 18 explains how.
3. If you're under 18
This section is for you if you're under 18. The rest of this policy applies to you too, but these are the most important points in plain words.
- What we know about you. Very little. We don't have your name, email address, phone number, password or location. Your account is just a random ID.
- Your photos. Your creations stay on your phone. If you use a cloud AI feature, the photo and text you choose are sent to our servers and AI partners only to make your image. We don't keep them, and the result is deleted from the cloud within an hour at the latest. We never use your photos to train AI, sell them or use them for ads.
- Ask first. Talk to your parent or guardian before you switch on cloud AI processing or buy anything. In some places they must give or approve consent for cloud AI processing: in the EU and EEA if you're under the age of digital consent in your country (between 13 and 16, depending on the country), and in Türkiye if you're under 18.
- Your age range. When you start, the app asks for your age range: from Apple, if your device offers it and you choose to share it, or with a month-and-year question. It keeps only the range (under 13, 13 to 15, 16 to 17, or 18 and over), where it came from and when it was set, on your device. Your birthday is never kept or sent to us. Under 18, the paywall never opens by itself. If you're under 13, you can use the free tools that run on your device, and the app sends nothing to us.
- A parent or guardian step. If you're 13 to 15, or under the age of digital consent where you live, the cloud AI consent screen asks you to read it with a parent or guardian and to confirm that they said yes. We can't check this answer, so please be honest.
- Purchases. Purchases are charged to the Apple Account on your device. If you have a child account in Family Sharing, your parent or guardian may need to approve purchases with "Ask to Buy".
- Ads. If you don't have Pro, you may see a few ads from Google: a short ad you can choose to watch for 1 credit when you've run out (a few a day, as the app shows), and sometimes one after you save. They're never personalised, they're limited to ads suitable for everyone, and Google doesn't get your photos, prompts or name. You never have to watch one. Under 13 there are no ads.
- Other people's photos. Only upload photos of other people if they've said yes. For younger children, their parent or guardian has to say yes.
- You're in control. You can switch off cloud AI processing in Settings at any time, and delete your data and account with Settings → Delete my data & account.
- Questions or worries? Talk to a trusted adult. You, your parent or your guardian can email us at hello@buaze.com.
4. Data that stays on your iPhone
Much of Aybuke works without sending anything to us. The following data is stored only on your device, and we can't access it:
- Your library ("My Works"): the images you keep, with their title, the type of edit, the text prompt you used (for Create from text and Magic Edit), whether you marked them as a favourite, and timestamps. The library is stored in the app's private storage and protected by iOS Data Protection. When you delete a creation, it stays in Recently deleted for 30 days, where you can restore it or delete it for good; after that, it's removed.
- App settings (stored in iOS UserDefaults): whether you've completed onboarding; the interests you picked (for example "Selfie glow-ups" or "Shots for my shop"), which are used only to order the home screen on your device; your age range (under 13, 13 to 15, 16 to 17, or 18 and over), whether it came from Apple's Declared Age Range or the app's own question, and when it was set (never your birth date); your cloud AI consent choice, when you made it, which version of the consent screen and which processors it named (so we can ask again when they change) and, where asked, your answer to "A parent or guardian said yes"; your appearance preference; your notification choices; the last 10 prompts you made pictures with in Create and the text you're still writing there (you can clear the list in Create); a small count of happy moments (saving, sharing or hearting a creation) and when the app last asked, used only to time Apple's rating prompt; for ads, when you first opened the app, how many creations you've saved, when you last saw an ad and how many you saw today (used only to keep ads rare, section 5) and whether you've asked for an ad on this device; Google's record of your ad consent choices, if you made them (kept on your device by Google's consent tool); and, only in offline or demo mode, a local credit balance.
- Session tokens for your anonymous account, stored in the iOS Keychain.
- Reminders: notifications are off until you allow them and switch them on. The app then schedules them locally on your device: a reminder before the cancel-by time of a free trial (at least 26 hours before it ends, earlier if that would fall at night or in school hours); "your edit is ready" when a creation finishes while you're in another app (skipped at night and in school hours; it never quotes your prompt); "your free credits are back" (only after you run out); and, if you choose, a look of the week. Reminders are never sent between 9 pm and 9 am, or during school hours (8 am to 3 pm) on weekdays. No push server or device token is involved.
- Widgets and Live Activity: to show your credits, your latest creation and its progress on the Home Screen, the Lock Screen and in the Dynamic Island, the app shares a small snapshot (credit balance, the title and a small thumbnail of your latest creation, and how many creations you have) with its widgets through a container on your device. It never leaves your iPhone.
On-device features. Remove background (using Apple's Vision framework, including picking which subject to keep, new backgrounds and stickers), Hide faces, Adjust, Effects (including the Digicam '04 look offered during onboarding), Retro Cam and Photo Booth process your photos entirely on your iPhone.
On-device face checks. These features look at faces, only on your iPhone, with Apple's Vision framework: Best shot ranks the selfies you pick by light, focus and how clearly the face shows; the kindness reminder counts how many people are in a photo; the likeness check compares an AI edit with your original photo (face proportions and skin lightness) so it can offer a free retry if the result drifted; Hide faces finds where faces are so you can blur or cover other people's faces before you share; and the Cover star and Photo strip share designs and Photo Booth prints find where the face is so the crop keeps it in frame. Nothing is stored or sent to us, nobody is identified or recognised, and nothing rates anyone's looks.
On-device writing help. On devices with Apple Intelligence, the idea and prompt suggestions in Create ("Inspire me" and "Make it magic") may be written by Apple's on-device language model. Your text and the suggestions stay on your device and are not sent to us or to Apple.
On-device video captions. In the video editor, Captions turns what's said in your video into captions with Apple's speech recognition, on your device. From iOS 26 it uses Apple's on-device speech models; each language's model is downloaded once from Apple, and no audio or text is sent with that download. Otherwise it uses Apple's speech recognizer only for languages your device can recognise without the internet, and iOS first asks for your permission to use speech recognition. The sound of your video and the caption text stay on your device and are not sent to us or to Apple. Captions are kept only while you edit and in the videos you save or share.
Photo access. You pick photos with Apple's system photo picker, so Aybuke can see only the photos you choose, not your whole library. To save results to your Photos library, the app asks for add-only permission, which lets it add images but not read your library.
Camera access. Retro Cam and Photo Booth use your camera only while they're open, after you allow camera access. The live preview and the effects run on your iPhone, and your shots stay on your device until you save or share them.
Backups. Data stored by the app may be included in your device backups (for example iCloud Backup), depending on your settings. Apple handles backups under its own terms.
You can delete your library, including Recently deleted, in Settings → Delete all creations. It's also deleted when you delete your account or the app.
5. Data we process on our servers
Anonymous account
When you first use a cloud AI feature or make a purchase, the app creates an anonymous account with our backend provider (Supabase). The account is identified by a random user ID. We don't collect your name, email address, phone number or password.
Optional account (Sign in with Apple)
Signing in is optional, and not every version of the app offers it. If you sign in with Sign in with Apple where the app offers it (so your credits follow you to another device; an active subscription stays with the Apple Account that bought it), Apple confirms your identity and our backend provider receives a stable Apple user identifier and, if you choose to share it, your email address, which can be a private relay address that forwards to you. We don't ask for your name and never see your Apple ID password. The anonymous account you used on that iPhone is merged into your account: paid credits, subscription records, job records and reports move over, and the anonymous account is deleted. We also keep a token from Apple so that, when you delete your account, we can revoke Aybuke's access to your Apple ID, as Apple requires. Your photos and library are not synced and stay on each iPhone.
Content you send to cloud AI features
When you use Magic Edit, Styles, AI Enhance, Erase or Create from text, the app sends the content needed for that request to our backend, which forwards it to our AI provider. This means your photo, the mask you brushed (for Erase) and your text prompt (for Create from text and Magic Edit). Section 6 explains what happens to it.
Job records
For each cloud AI job, we keep a record with: a job ID, your anonymous user ID, the type of operation, the template ID, the name of the AI model endpoint, the credit cost, the status, any error code and message, retry flags, the provider's request ID and timestamps. Job records also note whether free credits paid for the job, an estimate of what the AI provider charges for it and the hash of your App Store download (below), or, without a verified download, a salted hash of your network address. Job records don't contain the photo you sent or your prompt. Until you download them, they hold your results, which are deleted within 1 hour. We also use them to apply limits on how many jobs an account can start per minute, hour and day.
Credits
Your credit wallet (purchased credits), your subscription's credits with their period dates (kept with the subscription's entitlement record, below) and your credit ledger (holds and refunds for each job; credit pack grants with the Apple transaction ID; credits earned by watching an ad, with the ad's transaction ID; and credits taken back after Apple refunds a credit pack, or returned if Apple reverses that refund, with the pack's Apple transaction ID).
Your App Store download (free credits)
Free daily credits belong to your download of Aybuke from the App Store, not to an anonymous account, so they can't be collected by making new accounts. When you use a cloud AI feature, read your credit balance, buy a credit pack or ask for a rewarded ad, the app sends our server the app transaction that Apple signs for your download (Apple's "AppTransaction": it includes Apple's app transaction ID, the app's bundle ID and version, and the date of your first download). Apple gives each Apple Account one app transaction ID for Aybuke, the same on all its devices and after reinstalling. Our server checks Apple's signature and keeps only:
- a one-way, salted hash of the app transaction ID (never the ID itself or the signed app transaction);
- that day's free daily credits, including credits earned by watching ads;
- the App Store environment (App Store, or TestFlight and App Review) and when the hash was first and last used; and
- if our safety filters blocked several of your requests or results, those blocks and any resulting pause (section 9).
While your account exists, your job records, credit ledger and ad reward records point to this hash. When you delete your account, those links go, and the hash with its counts stays, no longer linked to any account, for the periods in section 14, only to prevent abuse of free credits and of our safety system. If Apple's confirmation isn't available, free credits can't be used, but purchased and subscription credits still work.
Ads for free members
If you don't have Pro and you're 13 or over, Aybuke shows ads from Google AdMob (Google LLC) on iPhone and iPad, in two places only:
- Rewarded ads, always optional. When you're out of credits, you can choose to watch a short ad for 1 credit, a limited number of times a day (the app shows how many; the limit counts per account and per App Store download). Before the ad, the app asks our server for a single-use reward code, linked to your anonymous user ID and valid for 30 minutes. The app passes only this code to Google, never your user ID. When the ad has played to the end, Google sends our server a signed confirmation with the code, the ad unit, the reward, a transaction ID and the time, and we add the credit to your download's free daily credits. We keep a record of each confirmed reward (transaction ID, user ID, the hash of your App Store download, ad unit, reward and date) to give each reward only once and to apply the daily limit.
- An occasional ad after you save. Now and then, an ad may appear after you save or share a finished creation: never in your first day with the app or before your third save, never while you're editing, at most one every 4 minutes, 3 a day, and none within 4 minutes of a rewarded ad. The app keeps these counts on your device (section 4).
What Google receives. When an ad is requested or shown, Google's ad software in the app sends Google information about your device and the app (such as the device model, operating system and app version, language and screen size), your IP address (from which Google estimates a general location, such as your country or city), identifiers that Google's software uses only within this app (not your device's advertising identifier, which the app never accesses), and how you interact with the ads (such as which ads were shown, taps, and how much of a video played), together with performance data. For rewarded ads it also receives the single-use reward code. Google never receives your photos, prompts, results, name, email address or user ID from us.
How we limit it. Every ad request is non-personalised: no interest-based or remarketing ads, and Google's restricted data processing is switched on. If you're under 18, or we don't know your age, requests are tagged for users under the age of consent and only ads suitable for a general audience are shown; adults can see ads rated up to "parental guidance". Google's ad software starts only when an ad may be shown, never for Pro members or anyone under 13, and never on a Mac.
Consent in the EEA, the UK and Switzerland. Before the first ad, adults there see Google's consent form, which explains Google's use of information stored on your device and lets you accept or decline. If you're under the age of consent, or we don't know your age, you aren't asked and get only limited, non-personalised ads. You can change your choice at any time in Settings → Ad privacy choices.
Google processes this information to show and measure ads and to prevent fraud and abuse, partly as an independent controller under Google's Privacy Policy. How Google uses information from apps that use its services explains more. Credits earned from ads have no cash value, can't be exchanged or transferred, and, like the free daily credits, are spent first and expire at the end of the day (00:00 UTC).
Purchases and subscriptions
Apple processes all payments. We never receive your card details, your name or your Apple Account email address.
To verify purchases, we receive Apple-signed transaction data, including transaction IDs, the product ID, purchase and expiry dates, the environment (sandbox or production) and an app account token that equals your anonymous user ID. Apple keeps this token with its purchase records under Apple's own privacy policy.
For subscriptions, we keep an entitlement record: the Apple original transaction ID, the product ID, the expiry date, a revoked flag (set when Apple refunds or revokes the subscription), the environment, whether the current period is a free trial, and the subscription's credit balance with its period dates, linked to your anonymous user ID.
Refunds and revocations. Apple sends our server signed notifications about Aybuke purchases (App Store Server Notifications), including when Apple refunds a purchase, revokes it (for example when Family Sharing access to it ends) or reverses a refund. Each notification contains Apple-signed transaction data like the data described above. Our server checks Apple's signature and uses the transaction IDs to find the matching record: a refunded or revoked subscription is marked as revoked, so Pro ends; a refunded credit pack's unused credits are taken back; and a reversed refund undoes the change. Other notifications change nothing. So that each notification counts only once, we keep only its notification ID, its type and subtype, the App Store environment, the product ID, what it changed and when it arrived, with no transaction ID or user ID (section 14).
To understand how our subscriptions perform (trials, renewals, cancellations, refunds), once you make a purchase (or if your Apple Account already has purchases with us) the app also shares the same purchase records with our subscription analytics provider, RevenueCat, together with your anonymous user ID and basic device and app information (app version, iOS version, country and language). RevenueCat never receives your photos, prompts or results.
Reports
If you use "Report this image", we receive the reason you select, any details you choose to add, the related job ID, your anonymous user ID and timestamps.
Server and security logs
Our hosting provider records technical logs when the app connects to our servers, such as IP address, request metadata and timestamps. To limit abuse across accounts, our server also counts cloud AI requests per network address for each hour, using a one-way, salted hash of the IP address instead of the address itself; these counts are deleted after a day.
When you contact us
If you email us, we receive your email address, the content of your message and anything you attach.
6. How cloud AI processing works
- Your consent comes first. Before any photo or prompt leaves your device for one of our cloud AI features, the app shows an opt-in screen that names the companies that process it. Nothing is sent until you agree. If you're under the age required by law, a parent or guardian must give or approve this consent (sections 3, 17 and 19). You can withdraw consent at any time in Settings → Cloud AI processing, and on-device features keep working.
- Upload. The app sends your input over an encrypted connection to our backend (Supabase Edge Functions; hosting region: EU (Frankfurt)).
- Safety checks. Your prompt is checked by our safety filters before the request is processed (section 9).
- AI processing. Our backend passes your input to our AI inference provider for that request only. By default, this is xAI (X.AI LLC and its affiliates, USA), which runs its Grok Imagine image models. If we change providers, jobs may instead go to fal.ai (Features & Labels, Inc., USA), which runs third-party models (where fal.ai uses a model developer's own service to run a model, for example Google for its Gemini image models, that developer also processes the request), or directly to Google (Gemini API) or OpenAI (Images API). The current list is in section 12.
- No storage of inputs. We don't store your photo, mask or prompt. We use xAI's Zero Data Retention option, under which xAI deletes requests and results within 1 hour and keeps no stored copies. When fal.ai is used, we instruct it not to keep request history, which means no storage of inputs or outputs.
- Delivery. The result is checked by automated safety filters and held temporarily in our database or on the provider's content delivery network, only so the app can download it. It is deleted as soon as the app confirms the download, and after 1 hour at the latest.
- On your device. If you keep the result, it's saved to your library on your iPhone.
We use only provider plans whose terms don't allow using customer content to train their models without our permission, and we never give that permission. We never use your photos, prompts or results to train AI models, sell them, or use them for advertising, marketing or data mining.
Create with Image Playground (Apple). On devices that support it, Create also offers Create with Image Playground, Apple's own image maker. It's Apple's feature, not one of our cloud AI features, so our consent screen and credits don't apply. Your description goes to Apple's Image Playground, which makes the image on your device or, from iOS 27, on Apple's Private Cloud Compute servers, under Apple's terms and with Apple's own usage limits; on those versions the app tells you before the first use. The app allows only Apple's illustration styles and turns off the option to use people from your photo library. Aybuke receives only the finished image, which is kept in your library on your device and is never sent to us.
7. Why we use your data and our legal bases
The GDPR and the UK GDPR require us to tell you the legal basis for each purpose. The corresponding conditions under Türkiye's KVKK are in section 19 and in our KVKK Information Notice.
- Running your anonymous account (creating your user ID and keeping you signed in). Data: anonymous user ID, session data. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
- Cloud AI features (sending your photo, mask and prompt to our AI providers, and generating and delivering the result, including Likeness Lock retries). Data: photos, masks, prompts, results. Legal basis: your consent (Art. 6(1)(a) GDPR), given on the opt-in screen and withdrawable at any time. Where a photo reveals special category data, we rely on your explicit consent (Art. 9(2)(a) GDPR); see section 8. If you're under the age of digital consent in your EU or EEA country, this consent must be given or authorised by a parent or guardian (Art. 8 GDPR).
- Job records, credits, purchases and subscriptions (tracking jobs, charging and refunding credits, verifying Apple purchases, providing Pro benefits and credit packs, and keeping them correct when Apple refunds or revokes a purchase). Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
- Rewarded ads (giving you the credit you chose to watch an ad for, once, within the daily limit). Data: reward code, reward record, anonymous user ID. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
- Ads for free members (showing a few non-personalised ads that keep the free tier free, and keeping them rare). Data: the device, app and ad-interaction data described in section 5, processed by Google, and the ad counts kept on your device. Legal basis: our legitimate interest in funding a free tier with a small number of non-personalised ads (Art. 6(1)(f) GDPR). Where the law requires consent for storing or reading information on your device, as in the EEA, the UK and Switzerland, Google's consent form asks for it (Art. 6(1)(a) GDPR and the ePrivacy rules); users under the age of consent aren't asked and get only limited ads.
- Safety and abuse prevention (prompt filters, provider safety settings, automated checks of outputs, rate limits, preventing misuse of free credits with the hashed App Store download and network address counts, pausing cloud AI after repeated blocks, reviewing reports and enforcing our AUP). Legal basis: our legitimate interests in keeping Aybuke safe and lawful and in protecting our users, especially young users, and the people shown in images (Art. 6(1)(f) GDPR); and compliance with legal obligations where the law requires us to act, for example to report child sexual abuse material (Art. 6(1)(c) GDPR).
- Security and reliability (server logs and investigating errors and attacks). Legal basis: our legitimate interests in running a secure and reliable service (Art. 6(1)(f) GDPR).
- Images of other people shown in your photos. Legal basis: our legitimate interest in performing the edit our user requested (Art. 6(1)(f) GDPR). The processing is short-lived, limited to the edit and never used to identify anyone, and users must have the consent of the people they photograph.
- Support (answering your messages). Legal basis: performance of our contract where your message concerns the Service; otherwise our legitimate interest in responding to you (Art. 6(1)(b) or (f) GDPR).
- Legal compliance and your rights (handling privacy requests, keeping records the law requires and responding to lawful requests from authorities). Legal basis: compliance with legal obligations (Art. 6(1)(c) GDPR).
- Legal claims (establishing, exercising or defending legal claims). Legal basis: our legitimate interests (Art. 6(1)(f) GDPR).
Where we rely on legitimate interests, you can object (section 16). Our legitimate interests never override the interests of young users in having their data protected.
You don't have to give us any personal data. Without consent to cloud processing, cloud AI features won't work, but on-device features will. Without purchase data, we can't provide paid features.
8. Sensitive information and people in your photos
We don't intend to process special categories of personal data, such as information about health, religious beliefs or racial or ethnic origin. Photos can sometimes reveal such information. We process photos only to perform the edit you request, never to identify anyone or to infer characteristics about them. To the extent a photo reveals special category data, we process it on the basis of the explicit consent given on the cloud AI opt-in screen (Art. 9(2)(a) GDPR; Article 6 KVKK).
We don't create biometric data: we don't perform face recognition or create face templates or embeddings.
Please don't upload photos or prompts containing sensitive information you don't want processed.
Other people in your photos. Your photos may show other people. We process their images in the same way as yours: only to perform the edit, briefly, and never to identify them. Only upload photos of other people with their consent, and photos of children only if you're their parent or guardian or have their parent's or guardian's permission. If you appear in a photo someone else edited with Aybuke, you can contact us at hello@buaze.com.
9. Safety filters and automated decisions
To keep Aybuke safe, we use automated safety measures:
- prompt filters in the app and on our servers that block, for example, nudity and sexual content, "undressing" or nudification requests, and any sexual content involving minors;
- our AI providers' safety settings; and
- an automated check of every output for nudity or sexual content, and, where we switch it on, a second automated check of the photo and the results by our AI provider's vision model.
If a filter blocks a request or a result, you aren't charged, and any credits are refunded. We record that it happened (the filter's category and the time, never the content), linked to your anonymous account and the hash of your App Store download (or, without a verified download, a salted hash of your network address). If our servers' filters block 3 of your requests or results within 24 hours, cloud AI pauses for 24 hours for that account and download; after 3 pauses within 30 days, we switch cloud AI off for that download until a human has reviewed it. On-device features keep working.
These filters and pauses are the only automated decisions we make about your requests. They affect only access to cloud AI features for a limited time, don't have legal or similarly significant effects on you within the meaning of Article 22 GDPR, and we don't profile you. If you think a filter blocked something by mistake, or a pause shouldn't apply to you, contact us at hello@buaze.com and a human will review it.
10. AI transparency
- Every image you export that was created or edited with AI contains machine-readable provenance metadata (the IPTC "Digital Source Type" field in XMP), as required by Article 50(2) of the EU AI Act. AI providers may also add invisible watermarks, for example Google's SynthID.
- Images you have only adjusted manually carry no AI label.
- When you share AI content publicly, you may need to disclose that it was made or altered with AI. See our Terms of Use and AUP.
11. Who we share data with
We share personal data only as described below. We require every service provider that receives your data to protect it at least as well as described in this policy, under written contracts (data processing agreements) that allow them to use your data only to provide services to us.
- Service providers (processors): our backend and hosting provider and our AI inference providers, listed in section 12. They process data only on our instructions.
- Google (AdMob): if you're a free member aged 13 or over, Google receives the device, app and ad-interaction data described in section 5 to show and measure ads and to prevent fraud. Google processes some of it as an independent controller under Google's Privacy Policy. Google never receives your photos, prompts, results or user ID from us.
- Apple: Apple processes your payments and subscriptions as the seller and as an independent controller, under Apple's Privacy Policy. We don't send your content to Apple, except your description when you choose Create with Image Playground (section 6). We receive Apple-signed transaction data to verify purchases, and Apple's signed notifications when Apple refunds or revokes a purchase or reverses a refund (section 5). If you sign in with Apple, Apple verifies your sign-in, and we contact Apple to revoke that sign-in when you delete your account.
- Authorities: we disclose data to courts, law enforcement or other authorities where the law requires it, for example in response to a valid legal order, or where necessary to protect someone's safety. We report child sexual abuse material to the competent authorities (such as NCMEC in the United States) where the law requires it.
- Business transfers: if we're involved in a merger, acquisition or sale of all or part of our business, personal data may be transferred to the new owner, who must continue to protect it in line with this policy. We'll inform you where the law requires it.
- Services you choose to share with: when you share a result through the share sheet, Instagram or another app, you send it to that service yourself, and its own terms and privacy policy apply.
We don't sell your data or rent it. Apart from the non-personalised ads free members see (section 5), we don't share it with anyone for advertising or marketing.
12. Sub-processors
These companies process personal data on our behalf. We keep this list up to date. If we add or replace an AI provider, we'll update this list and the cloud AI consent screen before the change takes effect, and ask for your consent again where required.
- Supabase Inc. (USA): backend hosting, database, anonymous authentication and Sign in with Apple where the app offers it, server functions and server logs. Hosting region: EU (Frankfurt). Data: anonymous user ID or account (Apple user identifier, email or relay address if shared), session data, job records, credits, entitlements, App Store notification records, reports and server logs. Your inputs pass through in transit only.
- xAI (X.AI LLC and its affiliates) (USA): AI inference, meaning it runs the Grok Imagine models for cloud AI features and checks their results with its own moderation. Data: photos, masks, prompts and results, for the duration of the request. Zero Data Retention is on: requests and results are deleted within 1 hour, and nothing is used to train models.
- Features & Labels, Inc. (fal.ai) (USA): the automated output safety check where we use it, and an alternative AI provider. Data: results (and, if we route jobs to fal.ai, photos, masks and prompts), for the duration of the request. Request history is disabled, and results are deleted within 1 hour.
- Developers of the models that fal.ai runs, for example Google LLC (USA) for Gemini image models: where fal.ai uses the developer's own service to run a model, that developer processes the inputs and results of the request on fal.ai's behalf.
- RevenueCat, Inc. (USA): subscription analytics. Data: anonymous user ID, purchase and subscription records (product, price, dates, status, transaction IDs) and basic device and app information. No photos, prompts or results.
- Google LLC (AdMob) (USA): the ads free members see and the confirmation of rewarded ads. Data: device and app information, IP address (general location), identifiers used only within this app, ad interactions and the single-use reward code. No photos, prompts, results or user ID. Google also acts as an independent controller for part of this processing (section 11).
- Google LLC (USA), Gemini API: alternative AI provider, used only if we route jobs directly to Google.
- OpenAI (USA), Images API: alternative AI provider, used only if we route jobs directly to OpenAI.
- Our email service provider: receives and stores the emails you send us.
13. International data transfers
We're based in Türkiye. Our backend is hosted in EU (Frankfurt). Our AI providers and Google, which provides the ads free members see, are based in the United States and may process data there or in other countries where they or their sub-processors operate. This means your data may be processed outside your country, including in countries that don't offer the same level of data protection.
From the EEA, the UK and Switzerland
When you use Aybuke, you provide your data directly to us. Where we or our providers transfer it to a country without an adequacy decision, we rely on:
- the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework, where the recipient is certified (you can check certifications at dataprivacyframework.gov);
- otherwise, the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum (or the UK International Data Transfer Agreement) and the adaptations needed for Switzerland; and
- supplementary measures where needed, such as encryption in transit and strict data minimisation (we don't store your inputs).
From Türkiye
Under Article 9 of KVKK, as amended by Law No. 7499, we transfer personal data abroad on the basis of appropriate safeguards: the standard contracts published by the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). We sign these with the recipients and notify them to the Personal Data Protection Authority within five business days of signing.
Our regular transfers don't rely on your explicit consent. Only in exceptional, incidental (arızi) cases where no adequacy decision or appropriate safeguard is available may we rely on one of the conditions in Article 9(6) KVKK, such as your explicit consent after you've been informed of the possible risks.
You can ask for a copy of the safeguards we use by emailing hello@buaze.com.
14. How long we keep data
- Photos, masks and prompts sent to cloud AI features: not stored by us. They are passed to the AI provider for that request only.
- Generated results in the cloud: only until the app confirms the download, and at most 1 hour, in our database or on the provider's content delivery network. Then they are deleted.
- Job records: 30 days, then deleted.
- Credit wallet and credit ledger: as long as your account exists. Deleted when you delete your account.
- Entitlement records: as long as your account exists. Deleted when you delete your account.
- App Store notifications (the notification ID, its type and subtype, the App Store environment, the product ID, what it changed and when it arrived; no transaction ID or user ID): 30 days, then deleted. They aren't linked to your account, so deleting your account doesn't change this.
- Anonymous account (user ID): as long as your account exists. Deleted when you delete your account, or when it's merged into your account after Sign in with Apple.
- Account (Apple user identifier, email or relay address, Apple token): as long as your account exists. When you delete your account, the token is revoked with Apple and everything is deleted.
- Subscription analytics records at RevenueCat: as long as your account exists. When you delete your account, we ask RevenueCat to delete them, including the records of anonymous user IDs merged into your account; RevenueCat completes the deletion shortly after. If RevenueCat can't take the request at that moment, we keep only the random user IDs concerned in a deletion queue and retry until RevenueCat confirms.
- Reports: up to 12 months, for safety review and to improve our filters. Then deleted, or earlier if you delete your account.
- Rewarded ads: single-use reward codes are valid for 30 minutes and deleted a day after they expire; records of confirmed rewards are kept for 30 days, then deleted, or earlier if you delete your account. Google keeps the ad data it receives under its own policies (section 11).
- Hashed App Store download (the hash with the day's free credits, the environment and dates): deleted 30 days after the app last used it, unless cloud AI is switched off for that download (below).
- Safety records (blocked requests and results, as category and time; pauses): deleted after 30 days. A switch-off after repeated pauses is kept until we lift it, and at most 12 months.
- Hashed network address counts: deleted after a day. Without a verified App Store download, job and safety records use a salted hash of your network address in place of the download hash, for the periods above.
- The last three are kept even after you delete your account, only to prevent abuse of free credits and of our safety system. After deletion they aren't linked to any account.
- Server and security logs: a short period, typically no more than 90 days, for security and abuse prevention. They are deleted on this schedule even after you delete your account.
- Emails and privacy requests: as long as needed to handle your request and to document how we handled it, unless we must keep them longer to establish, exercise or defend legal claims.
- Data on your device: until you delete it, delete your account or delete the app.
We may keep data for longer where the law requires it or where it's needed for legal claims, for example information we must preserve when we report illegal content to the authorities.
15. How we protect your data
- Encryption in transit (TLS) for connections between the app, our servers and our providers.
- Row-level security in our database, so that each account can read only its own records, with all changes made by our server functions.
- Session tokens stored in the iOS Keychain, and your library protected by iOS Data Protection.
- AI provider keys and other secrets kept only on our servers, never in the app.
- Least-privilege access to our systems and data.
- Data minimisation: we don't store your inputs, and we delete results from the cloud within an hour.
No system is completely secure. If a personal data breach occurs, we'll notify the authorities and you where the law requires it.
16. Your choices and rights
Controls in the app
- Cloud AI processing: switch it off at any time in Settings → Cloud AI processing to withdraw your consent. Withdrawal doesn't affect processing that has already happened.
- Delete all creations: removes your library from your device.
- Delete my data & account: in Settings. Deletes your server account and all server-side records linked to it (credit wallet, credit ledger, job records, entitlement records, ad reward records and reports), asks RevenueCat to delete its subscription analytics records about you, and resets the app on your device: your library, settings, recent prompts, reminders, AI consent, ad counts and Google's record of your ad consent choices. Apple subscriptions must be cancelled separately in your Apple Account settings. The hashed App Store download, safety and network address records (section 14) aren't linked to your account after deletion and stay for those periods, so deleting doesn't reset free credits or a safety pause.
- Ads: watching an ad for a credit is always optional, and Pro has no ads. In the EEA, the UK and Switzerland, once you've made a choice in Google's consent form, Settings → Ad privacy choices opens it again, so you can change or withdraw your consent at any time.
- Camera, photos, speech recognition and notifications: manage these permissions in your device's Settings (System Settings on a Mac). Speech recognition is only asked for when you make video captions on iOS versions before 26.
Your rights
Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, withdraw consent, and not be subject to decisions based solely on automated processing that significantly affect you. We honour these requests from all users wherever the law allows, and we won't treat you differently for exercising your rights. Sections 17 to 20 explain region-specific rights.
How to make a request
- For immediate deletion, use Settings → Delete my data & account.
- For anything else, email hello@buaze.com. Users in Türkiye can also use the methods in section 19.
- Parents and guardians can make requests on behalf of their child. We may ask for reasonable confirmation that you're the child's parent or guardian.
Because your account is anonymous, we may need information that lets us find your data before we can act on a request, for example the Order ID shown on your Apple receipt for a Aybuke purchase. If we can't link a request to any data we hold, we'll tell you. We may ask for information to verify your request, and we'll use it only for that purpose.
We respond within one month under the GDPR and UK GDPR (extendable by two further months for complex requests), within 30 days under KVKK, and within 45 days under the CCPA (extendable once by a further 45 days). Requests are free of charge, except where the law allows a fee, for example for manifestly unfounded or excessive requests or, under KVKK, where a request involves additional costs.
17. EEA, UK and Switzerland
If the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies to you, you have the right to:
- access your personal data and receive a copy (Art. 15);
- rectification of inaccurate data (Art. 16);
- erasure (Art. 17);
- restriction of processing (Art. 18);
- data portability (Art. 20);
- object to processing based on legitimate interests (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7(3)); and
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Art. 22).
Young users and consent (Art. 8 GDPR). Where we rely on consent, as we do for cloud AI processing, and you're under the age of digital consent in your country, your parent or guardian must give or authorise that consent. This age is between 13 and 16 in the EU and EEA, depending on the country, and 13 in the UK. Where the law requires it, we may take steps to check that a parent or guardian has given or authorised consent.
Complaints. You can lodge a complaint with a supervisory authority. Because we don't have an establishment in the EU, there is no lead supervisory authority for us. You can contact the authority in the EU or EEA country where you live or work, or where an alleged infringement took place (list of authorities). In the UK, you can contact the Information Commissioner's Office (ico.org.uk). In Switzerland, you can contact the Federal Data Protection and Information Commissioner (edoeb.admin.ch). We'd appreciate the chance to address your concerns first.
Representatives. Our EU representative is None appointed. Contact hello@buaze.com for any request.. Our UK representative is None appointed. Contact hello@buaze.com for any request.. You can contact them instead of us on any data protection matter.
18. How we apply the UK Children's Code
The UK Age Appropriate Design Code (the "Children's Code") sets 15 standards for online services likely to be used by under-18s. We apply them to all users, wherever they live:
- Best interests of the child. We put the best interests of young users first when we design features. For example, we block sexual content for everyone, we don't offer body-reshaping or skin-lightening features, and we have no public profiles or feeds.
- Data protection impact assessments. We assess the risks our features pose to young users, including through data protection impact assessments, before we launch them.
- Age-appropriate application. We ask for an age range, never a birth date: from Apple's Declared Age Range where it's available, otherwise with a neutral month-and-year question. The range stays on your device. Under 13, only the free on-device tools are available. Under 18, the paywall never opens by itself, and where the law asks for it the consent screen includes a parent or guardian step. Beyond what Apple shares, we don't verify ages, so we also give every user the protections described in this section, whatever their age.
- Transparency. Each of our documents starts with a short summary, this policy has a plain-language section for under-18s (section 3), and the cloud AI consent screen explains in plain words what's sent and to whom before anything is sent.
- Detrimental use of data. We don't use personal data for profiling, personalised advertising or engagement-based recommendations. Free members see a few ads, which are never personalised; teens and anyone whose age we don't know get Google's protections for users under the age of consent and only general-audience ads, and there are no ads at all under 13 or for Pro members (section 5). The only personalisation is the order of the home screen, based on interests you pick yourself, and it happens on your device.
- Policies and community standards. We enforce our Terms of Use and AUP, using safety filters, reporting and human review of appeals.
- Default settings. High privacy is the default: cloud AI processing is off until you opt in, your library stays on your device, nothing is public, ads are non-personalised, and the app sends notifications only if you allow them.
- Data minimisation. We collect only what each feature you use needs. We don't ask for your name, email address, phone number, contacts or location.
- Data sharing. We disclose personal data only to the service providers that run the features you request, to Google for the non-personalised ads free members see, and where the law requires it (section 11).
- Geolocation. We don't collect or use your location. For free members, Google's ad software estimates a general location (such as the country or city) from the IP address to serve ads (section 5); it never uses your device's location services.
- Parental controls. Aybuke has no tools that let parents or anyone else monitor your activity or location. Parents can use Apple's Family Sharing and Screen Time, which are provided by Apple.
- Profiling. We don't profile users, and ads are never personalised.
- Nudge techniques. We don't use design tricks to get you to share more data or to switch off privacy protections. You can choose "Not now" on the cloud AI consent screen and keep using on-device features. Watching an ad for a credit is always your choice, offered only when you're out of credits and a few times a day at most, and ads after saving are kept rare.
- Connected toys and devices. Not applicable: Aybuke isn't a connected toy or device.
- Online tools. You can delete your data in the app at any time and make any other request by email (section 16).
19. Türkiye (KVKK)
We process personal data in accordance with the Law on the Protection of Personal Data No. 6698 ("KVKK"). We are the data controller (veri sorumlusu), and our service providers act as data processors (veri işleyen). Our KVKK Information Notice (Aydınlatma Metni) sets out the full details in Turkish.
Processing conditions. Under KVKK, we rely on:
- the establishment or performance of a contract with you (Article 5(2)(c)) for your account, credits (including credits from rewarded ads), purchases and support;
- your explicit consent (açık rıza, Article 5(1)), given on the cloud AI opt-in screen, for cloud AI processing, and Article 6(3)(a) where a photo reveals special category data;
- our legitimate interests (Article 5(2)(f)) for safety, abuse prevention, security logs, processing the images of other people shown in your photos and the few non-personalised ads free members see; and
- compliance with legal obligations (Article 5(2)(ç)) and the establishment, exercise or protection of a right (Article 5(2)(e)).
Users under 18. Under the Turkish Civil Code, people under 18 have limited legal capacity. Where explicit consent is required, for example for cloud AI processing, the consent of a user under 18 must be given or approved by their parent or guardian (veli or vasi) where the law requires it. Parents and guardians can also apply to us on behalf of their child.
Your rights (Article 11 KVKK). You have the right to:
- learn whether your personal data is processed;
- request information about the processing;
- learn the purpose of the processing and whether your data is used in line with it;
- know the third parties in Türkiye or abroad to whom your data is transferred;
- request correction if your data is incomplete or inaccurate;
- request erasure or destruction of your data under the conditions of Article 7;
- request that third parties to whom your data was transferred are notified of a correction, erasure or destruction;
- object to a result that is against you and arises exclusively from the analysis of your data by automated systems; and
- claim compensation if you suffer damage because your data was processed unlawfully.
How to apply. Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can apply:
- in writing, to Istanbul, Türkiye, Türkiye;
- by email signed with a secure electronic signature or mobile signature, to hello@buaze.com; or
- by email to hello@buaze.com from an email address you have previously notified to us and that is registered in our systems.
Your application must include your name and surname (and your signature for a written application), your Turkish ID number (or, if you're not a Turkish citizen, your nationality and passport or ID number), the address for notifications, your email address, telephone or fax number if any, and the subject of your request. For erasure, you can also use Settings → Delete my data & account in the app.
We respond free of charge as soon as possible and within 30 days at the latest. If responding involves an additional cost, we may charge the fee set by the Personal Data Protection Board.
If we reject your application, you find our response insufficient or we don't respond in time, you can complain to the Personal Data Protection Board within 30 days of learning of our response, and in any case within 60 days of your application (kvkk.gov.tr).
Transfers abroad. See section 13.
20. United States
California (CCPA/CPRA)
This section applies to California residents and supplements the rest of this policy. It also serves as our notice at collection.
Categories of personal information we have collected in the last 12 months:
- Identifiers: collected. Anonymous user ID, Apple transaction IDs and app account token, a one-way hash of Apple's app transaction ID for your download, AI provider request IDs, ad reward transaction IDs and IP address (and a one-way hash of it for rate limits); for free members, Google's ad software also uses identifiers that work only within this app (never the device's advertising identifier).
- Personal information described in Cal. Civ. Code § 1798.80(e): collected only to a limited extent: the physical characteristics visible in photos you submit (processed briefly, not stored) and your name, if you include it in an email to us.
- Characteristics of protected classifications: not collected intentionally. Photos may incidentally show characteristics such as apparent age or sex, but we don't infer, record or use them.
- Commercial information: collected. Records of your in-app purchases and subscriptions (product, dates and status), credit balances, credit usage, credits earned by watching ads, and refunds and revocations of your purchases.
- Biometric information: not collected. We don't extract face geometry or identify anyone.
- Internet or other electronic network activity: collected. Server logs (IP address, request metadata and timestamps), job records (feature used, status and timestamps) and, for free members, interactions with ads (which ads were shown, taps and completed rewarded ads). We don't collect browsing history.
- Geolocation data: not collected by us. Server logs contain IP addresses, but we don't use them to determine your location. For free members, Google's ad software estimates a general location (such as the country or city) from the IP address to serve ads; no precise geolocation is collected.
- Audio, electronic, visual or similar information: collected. Photos, masks and generated images you process with cloud AI features. We don't store them, and results are held for at most 1 hour.
- Professional, employment or education information: not collected.
- Inferences used to create a profile: not collected. We don't build profiles.
- Other personal information: text prompts (not stored on our servers), report details and the content of emails you send us.
Sensitive personal information. This covers the security tokens that keep your anonymous account signed in and any sensitive information a photo may reveal. We use sensitive personal information only for purposes permitted under the CCPA regulations, namely to provide the Service you request and to keep it secure, and never to infer characteristics about you. So we don't need to offer a "Limit the use of my sensitive personal information" option.
Sources: you (directly and through your device), Apple (purchase data, and notifications about refunds and revocations), Google (confirmations of rewarded ads) and our own systems (IDs and logs).
Purposes: providing and maintaining the Service, carrying out your requests, verifying purchases, giving rewards for ads and showing a few non-personalised ads to free members, security and integrity, preventing abuse, debugging and complying with the law, as described in section 7.
Disclosures for a business purpose: identifiers, commercial information, network activity, visual information and other personal information to the service providers and contractors listed in section 12; for free members, device, network and ad-interaction information to Google to show and measure non-personalised ads, with Google's restricted data processing switched on; purchase-related data exchanged with Apple; and information to authorities where the law requires it.
Sale and sharing: we don't sell personal information or share it for cross-context behavioural advertising: the ads free members see are never personalised. We haven't done so in the last 12 months.
Retention: see section 14.
Your rights: the right to know (the categories and the specific pieces of personal information we have collected), the right to delete, the right to correct, the right to opt out of sale or sharing (we don't sell or share), the right to limit the use of sensitive personal information (we use it only for permitted purposes) and the right not to be discriminated against for exercising your rights.
How to exercise them: use in-app deletion or email hello@buaze.com. We'll confirm receipt within 10 business days and respond within 45 days, which we may extend once by 45 days with notice. We verify requests by matching the information you give us with the information we hold (section 16). You can use an authorised agent; we may ask for proof of the agent's authority and ask you to verify your request directly with us.
Shine the Light: we don't disclose personal information to third parties for their own direct marketing purposes.
Other US states
Residents of states with comprehensive privacy laws, such as Virginia, Colorado, Connecticut, Utah, Texas and Oregon, may have the right to confirm whether we process their personal data; to access, correct and delete it; to get a portable copy; and to opt out of targeted advertising, the sale of personal data and profiling that has legal or similarly significant effects. We don't engage in targeted advertising, sales of personal data or such profiling. Where these laws treat information revealed in photos as sensitive data, we process it only with the consent given on the cloud AI opt-in screen.
Appeals. If we decline to act on your request, you can appeal by replying to our decision or by emailing hello@buaze.com with "Privacy appeal" in the subject line. We'll respond within the period your state's law requires, generally 45 to 60 days. If we deny your appeal, you can contact your state's Attorney General.
Nevada. We don't sell covered information as defined by Nevada law.
Teens
Because we don't sell or share anyone's personal information, we never sell or share the personal information of consumers under 16, which the CCPA would allow only with opt-in consent.
A growing number of US states, for example California, Connecticut, Colorado, Maryland and New York, give extra protection to minors' personal data. These protections include limits on targeted advertising, the sale of personal data, profiling and the collection of precise geolocation, and requirements to process minors' data only where it's needed. We don't use anyone's data for targeted advertising, sale or profiling, we don't collect precise geolocation, and we process teens' personal data only as needed to provide the features they ask for and to show them a few non-personalised, general-audience ads if they don't have Pro.
21. Children under 13
Aybuke is designed for teens and adults aged 13 and over. Its cloud AI features, accounts and purchases are only for people aged 13 and over. If the age step shows that someone is under 13, the app offers only the free tools that run on the device (effects, Adjust, Cut out, Crop, Best shot and the video editor). In that mode it sends nothing to us or to our providers: it creates no account and makes no cloud AI, purchase, analytics or ad requests, and Google's ad software never starts. We don't knowingly collect personal information from children under 13, including under the US Children's Online Privacy Protection Act (COPPA).
If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we'll delete it. If you believe a child under 13 has used Aybuke, please contact us at hello@buaze.com. A parent or guardian can also delete the data immediately with Settings → Delete my data & account on the child's device.
22. Do Not Track and Global Privacy Control
We don't track you across third-party websites or apps, so we don't respond differently to Do Not Track signals. Because we don't sell or share personal information, Global Privacy Control signals don't change how we process your data. If that ever changes, we'll honour these signals as the law requires.
23. Changes to this policy
We'll update this policy when our practices or the law change. If a change is material, we'll notify you in the app before it takes effect and ask for your consent again where required. The "Last updated" date at the top shows the current version.
24. Contact us
- Controller: Okan Berk Manavoğlu (individual developer), Istanbul, Türkiye, Türkiye
- Privacy requests (including from parents and guardians): hello@buaze.com
- General contact: hello@buaze.com
- EU representative: None appointed. Contact hello@buaze.com for any request.
- UK representative: None appointed. Contact hello@buaze.com for any request.
Questions? Email hello@buaze.com.