Privacy Policy

1. Categories of data processed

• Account and identity data: user ID, email, username, display name, date of birth, sign-in provider and account status.
• Profile and location data: profile photo, biography, and your selected country and region/city. Precise GPS location is not requested.
• Content and social data: photos, videos, audio, descriptions, categories, comments, likes/INDEX, saves, shares, follows and blocks.
• Usage and technical data: device/app information, session and security logs, IP/network information, error logs, watch time, advertising and performance events.
• Support and security data: support messages, complaints, moderation records, copyright reports and accepted legal document versions.
• Notification data: device push token and delivery information. Notification permission is managed through operating system settings.

2. Processing purposes and legal bases

• Providing membership, sign-in, profile, sharing, social interaction, content delivery and ranking services: entering into or performing a contract.
• Account and service security, abuse/fraud prevention, troubleshooting and system integrity: legitimate interests and legal obligations where necessary.
• Managing complaints, copyright, moderation, requests from legal authorities and disputes: legal obligations and the establishment, exercise or protection of rights.
• Measuring and improving the service, anonymous or aggregate analysis: legitimate interests that do not harm your fundamental rights.
• Ad personalization and access to device information requiring consent: the choice offered on the ad consent screen identifying the relevant purpose and provider. Camera, microphone, photo and notification permissions are managed through the operating system; a device permission is not explicit consent for all processing. You can withdraw consent; withdrawal does not affect the lawfulness of past processing based on earlier consent.

3. How data is collected

Data is collected electronically through automated or partly automated means from information you enter in the app, uploaded content, interactions, device and app technical logs, and your chosen sign-in provider such as Google.

4. Service providers and international transfers

Only as necessary for the stated purposes, data may be shared with providers such as Supabase for cloud/database and authentication (current database region: Frankfurt, Germany), Bunny.net for media storage/delivery, Google/Apple for sign-in and stores, Expo, Firebase Cloud Messaging and Apple Push Notification service for notifications, and Google AdMob/UMP for ads and consent management. A provider is involved only for the feature you use. Public legal web pages are hosted on Sites; web servers may process IP and technical request logs for connectivity and security.

Content, username, profile photo and your selected region are disclosed to other users according to visibility settings. Private content is not shown in the public feed.

Service providers may process data outside your country of residence. Where applicable law requires, transfers need an adequacy decision, approved contractual safeguards or another lawful transfer basis. GDPR/UK GDPR and KVKK article 9 requirements additionally apply to relevant users. Reading this policy or accepting general service terms does not grant transfer consent. Contact us to request information about the recipient, country and basis of a particular transfer and a copy of applicable safeguards.

Necessary information may be disclosed to competent authorities in response to valid legal requests. Selling personal information for money is not our business model. Some disclosures to advertising providers may qualify as “sharing” or “targeted advertising” under local law; relevant choices are managed through advertising privacy preferences. You may also send applicable objections or opt-out requests to support.

5. Retention periods

• Account and profile data: while the account is open; after deletion, until removed from active systems unless legal or security needs require retention.
• Content: until you delete it, the account is deleted or moderation removes it; temporary copies may remain during a limited backup cycle.
• Security, transaction and agreement acceptance records: as necessary to assess security incidents or disputes and meet relevant legal retention and limitation periods. The data category, ongoing requests and mandatory legal duties are considered; indefinite retention merely because data might be useful is not intended.
• Complaint, support and moderation records: only for the period necessary for review, appeal and protection of a right. Deleting a reported post does not automatically delete the report ID, reason, decision and necessary limited text record; deleted media is not retained in that record. You may separately request deletion of unnecessary identity information and descriptions.
• At the end of the retention period, data is deleted, destroyed or irreversibly anonymized.

6. Security

Access controls, row-level authorization, encryption in transit, keeping secret keys out of the client, logging/monitoring and least-privilege principles are applied. No system can guarantee absolute security; report any suspected breach to support immediately.

7. Your privacy rights

• Subject to applicable legal conditions, you may request access, information, correction, deletion, a portable copy of your data and restriction of processing.
• You may object to processing based on legitimate interests, withdraw permission for consent-based processing and, where applicable, opt out of targeted advertising or data sharing.
• You will not face unlawful discrimination for exercising your rights. Authorized-agent requests, review of decisions and complaints to a supervisory authority are available as provided by applicable law.

8. How to make a request

Email index.app@outlook.com with the subject “Privacy Request”. We request only information necessary to verify the request and your identity. Response and extension periods follow applicable law: ordinarily one month under GDPR/UK GDPR, no later than 30 days under KVKK, and ordinarily 45 days under applicable US state laws. We explain any valid extension or refusal and available appeal route. Requests are generally free; fees or refusals apply only where the law permits.

You can edit your profile in the app, delete individual posts and delete your account in Settings.

9. Feed recommendations and information stored on the device

The For You feed uses your selected content languages, content language/category, watch time, completions and likes. Random diversity is also used to discover new content. These data rank the INDEX feed; your complete viewing history or account email address is not sent to AdMob.

Viewed video/photo IDs, the current round and language preferences are stored locally on the device. This prevents automatic repetition of the same post before available content runs out. These records are separated by user; clearing app data or uninstalling may reset local preferences. Content deliberately selected through search or profiles may be opened again.

10. Advertising and changing consent

Google AdMob ads may appear in the feed with an Ad label. Google may process IP addresses, device/app information, advertising identifiers and ad impression/click events for ad delivery, fraud prevention and measurement. Personalization and access to device information depend on necessary consent and applicable regional requirements.

Where required, Google's consent message is shown before the first ad request. Declining consent does not disable your account or core sharing features; depending on your situation, limited/non-personalized ads may be served or no ads shown. You can reopen Google's choice screen through Settings > Ad privacy preferences. You can also manage advertising and app permissions in your operating system.

Details of Google's data processing are at https://policies.google.com/privacy. No advertising, tracking pixels or analytics cookies have been added to INDEX's legal web pages.

11. Additional regional rights

EEA and United Kingdom: in addition to GDPR/UK GDPR rights, you may complain to the relevant supervisory authority. Türkiye: under KVKK article 11 you may request processing purposes and recipients, notification of corrections/deletions to recipients, review of solely automated assessments and redress for unlawful processing, and complain to the Board. US states and other regions: where the relevant law applies to INDEX, rights to know, correct, delete, obtain a copy, appeal, opt out and use an authorized agent are honored. This policy does not reduce local rights.

Not providing required registration fields such as date of birth, country and region may prevent completion of some account features. Declining ad personalization does not prevent membership. Feed scores or rankings are not presented as automated decisions with legal effects; you can request human review of moderation decisions.

12. Children and changes

Applicable age and parental permission rules are followed for children's data. If we learn that required permission is missing, we may restrict the account and delete data.

This notice may be updated when processing activities change. Material changes are announced in the app. A new agreement version may require fresh acceptance; a change to an optional processing purpose requires separate new consent. Acceptance or consent is not requested for the information notice.