Legal
This Privacy Policy explains how Fırat Erol, an individual developer ("we," "us"), collects, uses, and protects personal data through the NailInspo mobile application (the "App").
The App uses artificial intelligence to visualize nail art designs on photos of your own hands. It therefore processes your photographs directly. Please read this policy carefully.
For the purposes of applicable data protection law, including Turkish Personal Data Protection Law No. 6698 ("KVKK"), the data controller is Fırat Erol.
The App collects the data listed below. We do not use any data for purposes other than those stated in this policy.
| Category | Data collected | When collected |
|---|---|---|
| Device data | Device identifier, client/user-agent string | Automatically, the first time you open the App |
| Profile | A random identifier and secret key the App creates for you, your nickname, and the profile picture you choose. There is no sign-up: we do not ask for your name, email address, phone number or a password. Accounts created in earlier versions of the App may still hold the email address and phone number given then. | Automatically the first time you open the App; nickname and picture when you change them |
| Account security | Your secret key (stored only as an irreversible SHA-256 hash), IP address | The first time you open the App and with each request |
| Images | Four photos of your hands and the AI-generated design images produced from them | When you upload hand photos and generate designs |
| Usage data | Designs you like, favorite themes, generation history, free-text design requests you write | While you use the App |
| Subscription data | Subscription status, product ID, purchase and expiration dates, store information | When you purchase a subscription |
Your hand photos are processed solely so that nail art can be rendered on your nails. They are never used for identity verification, person recognition, or biometric matching. They are never shown to other users, never used for advertising, and never sold or shared for training AI models.
Processing of your hand photos is based on your explicit consent, which you may withdraw at any time.
So that your profile follows you to a new iPhone, the App also keeps your identifier, secret key and nickname in your own iCloud account (iCloud Keychain and iCloud key-value storage), under the Apple ID you are signed in with. This copy is stored by Apple, not by us, and we cannot access it. If iCloud is turned off, the App works the same way but a new iPhone starts with a new profile.
| Purpose | Data used | Legal basis (KVKK Art. 5) |
|---|---|---|
| Create your account and keep you signed in | Device data, identity and contact, account security | Necessary for the performance of a contract (Art. 5/2-c) |
| Generate nail art designs using AI | Hand photos, color/style/theme selections, free-text requests | Explicit consent (Art. 5/1) |
| Store the designs you create and display them to you | Generated images, generation history | Performance of a contract (Art. 5/2-c) |
| Show designs you have made public to other users | Generated image, nickname, profile picture, like count | Performance of a contract (Art. 5/2-c) — only if you turn visibility on |
| Manage your subscription and unlock paid features | Subscription data, user identifier | Performance of a contract (Art. 5/2-c) |
| Prevent abuse, fraud, and attacks | IP address, request counters | Legitimate interests (Art. 5/2-f) |
| Verify that an uploaded image is genuinely a hand and contains no unsafe content | Hand photos | Legitimate interests (Art. 5/2-f) and explicit consent |
In order to generate designs, your hand photos, any text design requests you write and the reference design you pick are transmitted to fal.ai (Features & Labels, Inc.), which generates the image. Your hand photos are also sent to the Google Gemini API operated by Google LLC to check that an uploaded photo shows a hand, and reference designs are sent to it to be described in text. Both are technically necessary for the App to function.
This transfer takes place only with your explicit consent. The App asks for your permission separately and in context, before the first transmission. If you decline, AI generation features are unavailable, but you can continue to use the rest of the App.
We share data with the following service providers:
| Recipient | Data shared | Purpose | Location |
|---|---|---|---|
| Features & Labels, Inc. (fal.ai) |
Hand photos, text design requests, reference design and theme images | AI image generation | United States |
| Google LLC (Gemini API) |
Hand photos, reference design images | Checking that an upload shows a hand; describing reference designs | United States |
| 650 Industries, Inc. (Expo) |
Push notification token, notification content | Delivering push notifications you have allowed | United States |
| RevenueCat, Inc. | User identifier (uniqueId), subscription and purchase data | Subscription validation and management | United States |
| Apple Inc. | Payment and purchase data | Subscription sales and billing | United States / Ireland |
| Hetzner Online GmbH | All application data (hosting) | Server and database hosting | Finland (EU) |
Some of the recipients listed above are located outside of Türkiye. Under KVKK Article 9, such transfers are carried out on the basis of your explicit consent and/or appropriate safeguards such as standard contractual clauses notified to the Turkish Data Protection Authority. If you withdraw your consent, AI features become unavailable.
We never sell, rent, or share your personal data with third parties for advertising purposes.
| Data | Retention period |
|---|---|
| Profile (identifier, nickname, profile picture) and, for accounts from earlier versions, email address and phone number | For as long as your account is active; deleted within 30 days of a deletion request |
| Hand photos | Until you delete them or close your account. On account deletion they are erased immediately and permanently |
| Generated design images | For as long as your account is active |
| Session tokens (earlier versions of the App only) | 30 days (they expire automatically) |
| Security logs (IP address) | Rate-limit records 60 seconds, then deleted automatically |
Despite these measures, no transmission over the internet is 100% secure. In the event of a breach affecting your data, we will notify you and the competent supervisory authority without undue delay, as required by law.
Under KVKK Article 11, you have the right to:
To exercise these rights, use our Data Subject Request Form or write to info@firat-erol.com.tr. We respond free of charge within 30 days.
You can delete your account and all of your data directly in the App: Profile → Settings → Delete My Account. See our Account Deletion page for details.
The App is not designed for anyone under 18, and we do not knowingly collect data from people under 18. If we learn that we have collected data from a person under 18, we delete it immediately. If you believe your child has provided us with data, please contact info@firat-erol.com.tr.
You may withdraw consent for any processing that relies on it, at any time:
Withdrawal is not retroactive; processing carried out before withdrawal remains lawful. After you withdraw consent, your hand photos are deleted and AI generation features become unavailable.
We may update this policy from time to time. We will notify you of material changes through an in-app notice or by email. The "Effective" date at the top of this page reflects the most recent revision.
If you believe your request has not been handled properly, you have the right to lodge a complaint with the Turkish Personal Data Protection Authority at kvkk.gov.tr.