Last updated: October 17, 2026 · Effective immediately · Version 2.2
Plain-language summary. Picsaris helps you find yourself in photos from events you organize or attend. To do this we collect a selfie and the photos uploaded to events, and we use Amazon Web Services (AWS) Rekognition to match faces. We never sell your data, we do not show ads inside the app, we do not send marketing emails, and you can delete everything from inside the app at any time. To improve the app and to measure our own marketing, we use product analytics (PostHog), crash reporting (Sentry), website analytics (Google Analytics) and Meta advertising measurement. None of these services ever receive your selfie, your photos, your face data, your name, or your email address. This page explains the full details required by Apple's App Store, the EU GDPR, the UK GDPR, Türkiye's KVKK (Law No. 6698), and the California CCPA / CPRA. See also our Terms of Service.
Picsaris is operated by ThinkAway Studio ("Picsaris", "we", "us", "our"), an individual sole-proprietor developer based in Türkiye (Apple Developer Team ID: 272G8P4977; iOS bundle identifier: com.thinkawaystudio.picsaris). For the purposes of GDPR and KVKK we act as the data controller (veri sorumlusu) for the personal data described below.
Under KVKK (Law No. 6698) Article 6, biometric data is "özel nitelikli kişisel veri" (special-category personal data) and requires explicit consent. We have grouped every piece of data we collect into the following categories for full transparency:
| Category | What's included | Source |
|---|---|---|
| Identity | Full name, account UUID | You (sign-up form); Apple/Google during OAuth |
| Contact | Email address (incl. Apple "Hide My Email" private relay aliases) | You; Apple/Google during OAuth |
| Credentials | Password hashed with bcrypt (cost factor 10) when you use email/password; OAuth subject identifiers (sub) when you use Apple/Google | You; sign-in providers |
| Biometric (special category) | A single selfie photo and the numeric face template AWS Rekognition derives from it | You — only if you opt in |
| User content | Event photos you upload, event name, description, cover image, your event roles (organizer / photographer / guest) | You; other event members |
| Purchase | App Store transaction identifier, purchased product ID, entitlement state, package quotas remaining | Apple App Store via RevenueCat (we never see your payment card) |
| Consent | The date and version of the Privacy Policy you accepted | You (by checking the consent box) |
| Usage & diagnostics | Screens you view and key actions in the app (for example: signed up, created an event, joined an event, viewed plans, started / completed / cancelled a purchase), app version, device model, OS version, and crash or error reports. Linked only to your account UUID — never to your name, email, selfie or photos. | Automatic, via PostHog (analytics) and Sentry (crash reporting) |
| Advertising measurement | App install, app open and purchase events (product and price), a Meta anonymous app ID, and — on iOS only if you allow tracking in the App Tracking Transparency prompt — your device's advertising identifier (IDFA). On Android, the Google advertising ID unless you have turned it off in your device settings. | Automatic, via the Meta SDK and RevenueCat's server-to-server connection to Meta |
| Website analytics | Pages visited on picsaris.app, referrer, approximate location derived from IP, browser and device type | Automatic, via Google Analytics and PostHog on our website |
| Technical & risk | IP address, user-agent, request path, status code, response time (server access logs) | Automatic during HTTP requests; used only for debugging, abuse detection, and security |
Under GDPR Article 6 and KVKK Article 5, the legal basis for each processing activity is shown below:
Because face matching is the heart of Picsaris, we explain it in detail. Face templates are special-category personal data under GDPR Article 9 and özel nitelikli kişisel veri under KVKK Article 6. We process them only on the basis of your explicit, freely given, specific, informed, and unambiguous consent.
DeleteFaces API.Picsaris does not build a cross-event facial-recognition database. Each event has its own isolated Rekognition collection, and templates are never reused across events or shared with any party other than AWS for the purpose of completing the match.
Picsaris has three role types within an event. Here is exactly what each role can see and do with your data:
When you join an event as a guest you are giving the event organizer reasonable, customary permission to display you in event photos uploaded by other attendees. If you want to be removed from a specific event's matches you can leave that event from the events list at any time.
We share the minimum data necessary with the following processors. Each is bound by either Standard Contractual Clauses (SCCs), the EU–US Data Privacy Framework, a data-processing addendum, or all of the above:
We never sell personal data and we do not share it with data brokers. The only data shared with an advertising platform is the limited advertising-measurement data described in Section 2, shared with Meta to measure our own ads.
For transparency, here is the list of native or third-party SDKs that are part of the Picsaris iOS app binary and what they do:
expo-apple-authentication — wraps Apple's AuthenticationServices for Sign in with Apple.@react-native-google-signin/google-signin — wraps Google's GoogleSignIn-iOS SDK for Sign in with Google.react-native-purchases (RevenueCat) — receipt validation for in-app purchases.expo-camera — used only when you scan an event QR code or capture a selfie. Camera frames are never sent to any third party from the SDK itself.expo-image-picker — used when you choose photos from your library to upload. The picker is sandboxed; we only receive the photos you select.expo-media-library — used when you save event photos to your photo library.expo-secure-store — stores your JWT access token in the iOS Keychain.expo-updates — checks for OTA JS updates on app launch.react-native-fbsdk-next (Meta SDK) — measures app installs and app opens for our Meta ad campaigns. Purchase events are sent to Meta from RevenueCat's servers, not from the app.expo-tracking-transparency — shows Apple's App Tracking Transparency prompt on iOS.posthog-react-native (PostHog) — product analytics (screens viewed and the key actions listed in Section 2), together with expo-application and expo-device for app version and device model.@sentry/react-native (Sentry) — crash and error reporting.Only the Meta SDK is used for advertising measurement. PostHog and Sentry are used only to improve the app and are not used for advertising.
Our website picsaris.app uses two analytics tools: Google Analytics (cookies such as _ga) and PostHog (a first-party cookie / local storage entry starting with ph_). They tell us which pages are visited and where visitors come from. We don't use advertising cookies on the website. The pages also load fonts from fonts.googleapis.com, which sends your IP address to Google to serve the font file.
You can block or delete these cookies in your browser settings, use Google's Analytics opt-out add-on The website still works if you do.
We do not send marketing emails, promotional push notifications, or SMS. The only emails you may receive from us are: (a) password-reset emails (if you trigger one), (b) account-deletion confirmations, and (c) urgent service notices (security incidents, breaking-change announcements). You cannot opt into marketing because we don't have any.
| Data | Retention |
|---|---|
| Account record (name, email, OAuth IDs, password hash) | Until you delete your account; 30-day grace for accidental deletion is not currently offered — deletion is immediate and irreversible. |
| Selfie photo (Cloudflare R2) | Until you remove the selfie or delete your account. |
| Face template (AWS Rekognition) | Until you remove the selfie or delete your account. |
| Event photos (Cloudflare R2) | Until the organizer deletes the photo or the entire event; for paid plans, photos may be removed after the plan's 1-year validity window ends. |
| Match records (database rows) | Deleted via cascade when you delete your account or when an event is deleted. |
| Purchase records (IAP transactions) | 10 years to satisfy Türkiye's Vergi Usul Kanunu Md. 253 (Tax Procedural Law). Email address is detached from the record on account deletion; only the transaction ID and amount remain. |
| Product analytics (PostHog) | Up to 1 year, then deleted. |
| Crash and error reports (Sentry) | 30 days, then deleted. |
| Website analytics (Google Analytics) | Up to 14 months, then deleted. |
| Advertising measurement data (Meta) | Kept by Meta under its own data policy. |
| Server access logs (IP, path, status) | 30 days, then permanently deleted. |
| Consent records (privacy acceptance timestamp) | For the lifetime of the account, plus 3 years thereafter (proof of consent under GDPR Art. 7(1)). |
Depending on where you live, you have some or all of the following rights:
To exercise any right that is not already built into the app, email privacy@picsaris.app. We respond within 30 days. We may ask you to verify your identity (typically by signing in with the same account or replying from the email on file).
Strict-Transport-Security with a one-year max-age plus includeSubDomains.bcrypt (cost factor 10). We never store plain-text passwords.token_version mechanism that immediately invalidates every existing token on account deletion, password change, or selfie-state change.X-Content-Type-Options: nosniff, X-Frame-Options: DENY, and Referrer-Policy: no-referrer.Picsaris is not directed at children under 13 (under 16 in the EEA where local law applies the higher GDPR age, under 14 in Türkiye per the KVKK Kurul's interpretation of explicit consent capacity). We do not knowingly collect personal data from children below the applicable age. If you are a parent or guardian and believe your child has provided us with personal data, please email privacy@picsaris.app and we will delete the account immediately.
Apple's App Store Age Rating for Picsaris is 12+ (chosen based on user-generated photo content).
Our primary infrastructure is in the European Union (Frankfurt and Ireland). However, some sub-processors (Apple, Google, RevenueCat, Cloudflare, Expo, Meta, PostHog) may transfer personal data to the United States or other jurisdictions outside the EEA/UK/Türkiye. We rely on the EU Standard Contractual Clauses (and the UK Addendum where applicable), on each provider's certification under the EU–US Data Privacy Framework, and on equivalent safeguards under KVKK Article 9, as the legal mechanisms for these transfers. The list of sub-processors and their locations is kept current in Section 6.
If we change this policy in a way that materially affects your rights, we will: (a) update the "Last updated" date and version number at the top, (b) increment the PRIVACY_VERSION stored in our backend, and (c) require you to re-accept inside the app before continuing to use it. Minor editorial changes (typo fixes, link updates) are made without a version bump.
A complete version history is available on request from privacy@picsaris.app.
For any privacy question, request, or complaint:
272G8P4977com.thinkawaystudio.picsaris