Privacy Policy
Last updated: 10 October 2026
PurpleBee helps groups of friends plan events and trips together. We only process the data this planning needs.
Summary
- We don't sell your data or use it for advertising.
- We don't store phone numbers in readable form; we keep a "fingerprint" made from the number with a secret key (HMAC-SHA256) and its last two digits. This is pseudonymised personal data.
- What happens in an event (items, tasks, chat, expenses, photos) is visible only to that event's members.
- Chat messages are deleted automatically 90 days after the event's last day.
- You can permanently delete your account at any time in the app (Profile → Delete account).
Data controller and contact
- Under Turkish Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR), the data controller is: Yusuf Yılmaz.
- Contact email: ekipce.app@gmail.com. We reply to requests within 30 days at the latest.
What data we process
- Email address (signing in with an email code or Google) · Guest account (joining by link, no email) · Name / nickname, profile photo, language.
- Phone number fingerprint and last 2 digits: to recognise you when you join; once entered, also kept privately with your account so you don't retype it (nobody can see it) · The name an organizer saved for you (visible only to that event's organizers) · People an organizer hid from their "past team" list (private to them).
- Event content: items, tasks, comments, chat messages and reactions, photos (profile, cover, album, proof, receipts), expenses and payments, the event song link. Photos are re-encoded on your phone before upload, which removes their metadata including GPS location.
- Notification settings and your device's push address · Technical logs (our infrastructure providers' sign-in and error logs) · Wrong-number attempts (for the 24-hour limit; deleted after 2 days) · Reports and blocks: when you report content or a person, a copy of the reported content and the reason are kept for review (deleted 6 months after it is handled); the list of people you blocked is visible only to you and kept until you unblock them or delete your account.
- On your browser / phone: sign-in cookies, language and theme, a few convenience settings (e.g. chat bubble position, chosen country code) and offline copies of screens you opened (deleted when you sign out). We use no analytics, advertising or tracking tools.
- We don't process: your phone number itself, other people in your contacts (only the people you pick are added), your location, or bank / card details. Payments happen outside PurpleBee.
Purposes and legal grounds
- Accounts, creating and joining events; items, tasks, chat, expenses and settling up: forming and performing a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
- The organizer's invite list (name + number fingerprint): legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).
- Security, preventing abuse, debugging: legitimate interest. Legal obligations: legal obligation.
- We don't ask for special categories of data (health, beliefs and so on); please don't write such information into an event.
Who we share data with, and transfers abroad
- We don't sell your data. To run the app we share it only with these providers, only as much as needed: Supabase (database, sign-in, photos; Frankfurt, EU), Vercel (serving the app; Frankfurt, EU), Google / Apple / Mozilla push services, Google (only if you sign in with Google).
- Their servers are outside Turkey, so this is a transfer abroad under KVKK Art. 9.
- Event song: our server fetches the title and cover of a YouTube / Spotify link from those services (no personal data sent). The player loads from that service only when you press ▶; for YouTube the no-cookie version is used. Exchange rates come from open.er-api.com (no personal data sent).
- When you send invitations by WhatsApp or SMS, the message goes from the app on your own phone; PurpleBee sends nothing to those services.
- When you join an event, your name, photo and your contributions there are visible to its members.
How long we keep data
- Chat messages are deleted 90 days after the event's last day. Event content is kept until the event is deleted. Your account is kept until you delete it.
- When you delete your account, your profile, photo, sign-in, saved number fingerprint, memberships, chat messages, comments and album photos are deleted. From expense and payment records only the amounts needed to keep other members' balances correct remain, without your name ("Deleted user").
- People an organizer added who never joined are deleted automatically (name and number fingerprint) 30 days after the event ends.
- Our infrastructure provider's backups may keep deleted data for up to 7 more days.
Your rights
- Under KVKK Art. 11 and the GDPR you can ask whether your data is processed, have it corrected or deleted, object, and receive your data (portability).
- Change your name and photo in Profile, and delete your account permanently with Profile → Delete account. For anything else, email ekipce.app@gmail.com. You can also complain to the Turkish Personal Data Protection Board (or, in the EU, your country's data protection authority).
Security and changes
- Connections are encrypted; only an event's members can see its content; photos are shown through short-lived private links.
- We may update this policy; for important changes we tell you in the app.