Privacy Policy

Last updated: October 26, 2026

This Privacy Policy explains what information we collect when you use Descall ("we", "us"), how we use it, who we share it with, and what rights you have over your data. By creating an account or using the Service, you agree to the practices described in this policy.

Data controller

For the Turkish Personal Data Protection Law (KVKK, Law No. 6698) and, where it applies, the EU General Data Protection Regulation (GDPR), the data controller is Demir Sarp Kurtlar. Contact: [email protected].

1. Information We Collect

Account information: Your username, a securely hashed (bcrypt) form of your password, your optional email address, your profile photo, and any display name you choose when creating your account or editing your profile.

Communication content: The direct messages (DMs) and group messages you send, media/files you share, message pins, and reactions (emoji). This content is processed and stored so it can be shown to the participants of the relevant conversation.

Call metadata: Voice/video call duration, participant count, connection quality indicators (for adaptive bitrate), and screen-share session information. Calls are not recorded: the audio, video, and screen content of a call is never recorded or stored.

Activity and DesCoin data: To ensure the DesCoin earning system operates fairly and without cheating, we collect server-verified activity data such as your time spent actively present in voice chat, your messaging frequency, and your screen-sharing activity, along with your DesCoin balance and transaction history (ledger).

Technical and device information: IP address, browser/operating system type, device identifier, app version, session tokens, and device registration information for push notifications (FCM/Web Push tokens; in the iOS app, Apple Push Notification service (APNs) device tokens: an alert token for message notifications and a VoIP token for incoming calls). iOS device tokens and the notification language are used only to deliver notifications and incoming calls to that device, and are deleted when you log out, turn notifications off, or Apple reports the token as invalid.

We do not collect payment or financial information: Descall does not accept real-money payments; all shop purchases are made with DesCoin, so no credit card or similar financial information is collected or stored.

Usage analytics: To understand how the app is used, we collect in-app events with PostHog (for example sign-up, login, pages opened, and feature usage) and unexpected error events. When you are signed in, these events are linked to your account ID, username, and (if set) email address. Session recording (screen/session replay) is turned off; your screen and what you type are not recorded. PostHog analytics is not used to build advertising profiles and is never sold. On the website and the desktop app, after you accept, the Google Ads conversion tag only measures sign-ups that come from ads. That tag is not loaded in the iOS app. No advertising or analytics tag loads before you accept. Accounts under 16 are excluded from analytics and ad measurement even if they accept.

Local storage and cookies: We use your browser's local storage (localStorage) and first-party cookies to keep you signed in, remember your language and theme preferences, and for PostHog analytics. The iOS app does not use advertising or tracking tools. On the website and the desktop app only, and only after you accept, the Google Ads conversion tag (gtag) may be loaded to measure sign-ups that come from ads, and it may use cookies.

2. How We Use Information

To provide the Service: operating messaging, voice/video calling, screen sharing, friends, group management, and profile customization features.

Account security: to authenticate you, deliver 2FA and email verification codes, detect suspicious sessions, and prevent unauthorized access.

Anti-cheat and integrity: we analyze activity data to keep the DesCoin earning system fair and to detect bot/automation use, multi-accounting, and manipulation.

Communication: to send transactional notifications by email or push, such as verification codes, security alerts, friend requests, and important service updates.

Improvement: to analyze and improve the Service's performance, reliability, and user experience (e.g., connection quality diagnostics, error logs).

We never sell your personal data to third parties. Apart from the website sign-up conversion measurement described in section 4, we do not share it for advertising purposes.

3. Legal Basis for Processing

We rely on the following legal bases when processing your data: (a) necessity for the performance of our service agreement (core features like messaging and calling), (b) our legitimate interests in maintaining account security and preventing cheating/abuse, (c) your consent when you create an account and when you turn on optional features (push notifications, Google Sign-In, analytics and ad measurement, and the product-update list), and (d) compliance with legal obligations. Analytics and advertising cookies are processed only with your consent, which you can change later in Settings → Privacy.

We share your data with trusted service providers (data processors) who help us operate the Service and act under our instructions: Supabase for database, file storage, and authentication; Resend for transactional email delivery; Firebase Cloud Messaging (Google) for mobile push notifications; Apple Push Notification service (APNs, Apple) to deliver notifications and incoming calls in the iOS app; Render for server hosting; Vercel for website hosting and cookieless aggregate visit statistics (website only); LiveKit for routing audio/video streams in server voice channels and TURN relay servers for connecting calls (streams are only relayed, never recorded); and PostHog (EU data region) for product analytics. Only the data necessary to provide the Service is shared with these providers.

Third parties tied to features you choose to use: when you search for GIFs, your search text and IP address are sent directly to GIPHY (GIPHY, Inc.); when you sign in with Google or Apple, we receive only the information needed for authentication from Google or Apple. On the website and the desktop app only, and only after you accept, the Google Ads conversion tag (Google) is used to measure sign-ups from ad campaigns; it is not loaded in the iOS app and it is not loaded before consent.

Crash and error reports: when the app, the website, the desktop app or our servers run into an error, a technical report is sent to our error-monitoring provider Sentry (Functional Software, Inc.). A report contains the error message, the stack trace, the page or API address where the error happened, and device, operating system, browser and app version details. Reports are configured not to include your name, email address, message contents or IP address, and sign-in tokens are stripped from them. These reports are stored in Sentry's European Union (EU) data region and are used only to find and fix bugs.

Messages and media you send are shown only to your chosen recipients (the other party in a DM or group members); Descall staff may only access content when necessary for security investigations, reviewing user reports, or fulfilling legal obligations.

We do not share your personal data with law enforcement or other third parties except where required by a legal obligation (court order, legal request), where necessary to protect our rights, or where necessary to protect user safety.

5. Cookies and Local Storage

The iOS app does not use advertising or tracking cookies or tools. On the website and the desktop app, the only advertising tool is the Google Ads conversion tag that measures sign-ups from ads after you accept (section 4). PostHog analytics uses a first-party cookie and local storage. We use your browser's local storage (localStorage) to store your session token, language preference, theme settings, and similar UI preferences. You may clear this information from your browser settings at any time, though doing so may end your session.

6. Data Security

Your password is stored as an irreversible hash using the bcrypt algorithm; we never view or store your password in plain text.

We offer two-factor authentication (2FA) and email verification to add extra protection to your account. Session management also lets you individually terminate suspicious or old sessions.

Your data is hosted on infrastructure providers that use industry-standard encryption (TLS/HTTPS in transit). No system can be 100% secure; in the event of a suspected security breach, we act promptly and notify affected users where required.

7. Data Retention

We retain your data for as long as your account is active and as necessary to provide the Service. When you close your account, deletion is requested and, after a 14-day period, your personal data, including message history, DesCoin balance, and shop inventory, is deleted or anonymized, except where we have a legal obligation to retain it. Analytics data is kept until you withdraw consent. An email on the product-update list is kept until you unsubscribe.

Security logs and activity records kept for cheat detection purposes may be retained for a limited additional period for the purpose of investigating abuse.

For DesCoin cheat detection we do not store your IP address or device identifier in readable form: the IP address is reduced to its network block (/24 for IPv4, /64 for IPv6) and, like device information, kept only as an irreversible keyed hash. These hashes and the account links derived from them are kept for at most 90 days and then deleted automatically; message-similarity fingerprints (without the message text) are deleted after 7 days.

8. Children's Privacy

Descall does not knowingly collect personal data from children under 13. If we learn that an account holder is under 13, we close the account and start deletion (14-day deletion period). Accounts under 16 are not included in analytics or advertising measurement, even if they accept. If you are a parent or guardian and believe a child under 13 has provided us with personal data, email [email protected].

9. Your Rights

Under KVKK Article 11 you may learn whether your personal data is processed, request information if it is, learn the purpose of processing and whether it is used for that purpose, know the third parties it is transferred to in Turkey or abroad, request correction if it is incomplete or inaccurate, request deletion or destruction, request that corrections and deletions be notified to those third parties, object to a result against you that is produced solely by automated analysis, and request compensation if you suffer damage.

Where the GDPR applies you also have the rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You can use most of these from the in-app profile and settings (edit your profile, delete your account, change the analytics choice under Privacy).

Email requests to [email protected]. We review them within a reasonable time. You may complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) under the KVKK, or to the supervisory authority in the EU member state where you live where the GDPR applies.

10. International Data Transfers

Our service providers (Supabase, Resend, Firebase, Apple, Render, Vercel, LiveKit, PostHog, Sentry, GIPHY, and Google Ads) may process your data on servers located in countries other than the one you reside in. PostHog and Sentry are kept in the European Union region. Transfers use safeguards such as standard contractual clauses or an adequacy decision.

11. Marketing Communications

Descall does not send you marketing emails without your consent. Account emails are limited to transactional messages such as verification, 2FA codes, security alerts, and account closure. We do not send gift or DesCoin marketing emails. The optional product-update list is double opt-in, and every email includes an unsubscribe link.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When material changes are made, you will be notified through an in-Service notice or, if applicable, to your registered email address. Continuing to use the Service after an updated policy is published constitutes your acceptance of the updates.

13. Contact Us

Questions about this Privacy Policy or the processing of your personal data: the data controller is Demir Sarp Kurtlar, [email protected]. Complaints under the KVKK go to the Turkish Personal Data Protection Board. Where the GDPR applies, you may complain to the supervisory authority in the EU member state where you live.

Contact

For privacy requests, email: [email protected] · Demir Sarp Kurtlar (Türkiye)