Privacy

Privacy Policy and KVKK Notice

Last updated: 30 October 2026. Effective: 30 October 2026. Read this together with the Terms of Use, the Legal Information page and, for closed-beta testers, the Beta Participation Note.

Personal data is processed by Lodos Eğlence ve Teknoloji Limited Şirketi (“Lodos”, “Sweet Spot”, “we”) as data controller, under Law No. 6698 on the Protection of Personal Data (“KVKK”) and, where it applies, the EU General Data Protection Regulation (“GDPR”). Sweet Spot is Lodos’s conversation-game product for couples and friends.

• Privacy policy
• Data
• Your choices
• Purposes
• Third parties
• International transfers
• Retention
• Deletion
• Cookies
• KVKK notice
• Legal bases
• Rights
• How to apply

Privacy Policy

1. Who this covers

This policy applies to the marketing site at sweetspot.red and its paths, the waitlist form, the on-site typing teaser, This or That and First Bite experiences, and the Sweet Spot mobile app. The in-app Settings screen links here as the privacy document. Store data-safety / account-deletion forms also point at this page.

The policy describes processing where Lodos is the controller. Apple App Store, Google Play and similar stores follow their own notices. Payment card numbers are not stored on Sweet Spot servers.

Sweet Spot is for people 13 and over. If the birth date you enter when setting up the app shows you are under 13, the app cannot be used: we don't save your age, and we don't send game, analytics, research or crash data (other than the anonymous technical ID created when the app starts). If a birth date saved earlier shows an age under 13, the app locks, no new data is sent, and the “Delete my data” button stays available. If you are 13–18, you can use the app: adult content (sex, kissing and touching tasks, alcohol) is not shown to you and cannot be turned on in Settings, and usage statistics and the research profile are neither offered to you nor sent. If we learn that we have collected data from someone under 13, we delete it; you can also ask for deletion with the “Delete my data” button in the app or by writing to hello@sweetspot.red.

2. What data we collect

The waitlist “are you in a relationship” field is not used for matching, dating or introductions. It only helps us understand whether we are talking about a couple table or a friends’ table.

What never reaches our servers, with any consent. If we ask about your sexual orientation, it stays on your device. Your answers to cards about sex, health and the body, political and philosophical views (ideology, morality), religion and belief, taboo and trauma, and the IDs of those cards, are never sent to our servers, analytics or research; aggregate counts only include a “sensitive card seen” tally. Free text you share with your partner (messages, notes, memories) is stored only to provide the service; it is not analysed or used for research. We do not collect the advertising ID, and the app does not ask for location permission.

What stays only on your device.

• Voice notes: Microphone permission is asked only when you want to record a voice note. The recording stays on your device as a file; it is not sent to our servers or to your partner.
• Install source and invite code: If you installed the app from Google Play using your partner’s invite link, the app reads Play’s install information (install referrer) once at first launch and keeps only the pairing code in it, on your device. The code is used for pairing only if you confirm the pairing. The code in the invite link (sweetspot.red/e#…) sits in the # part of the address; it never reaches our site’s server or logs.
• Notifications: Reminders are scheduled on your device; no device token (push token) is sent to a server for notifications.
• In-app update: The check for a new version and the update screen are run by Google Play; no data reaches Lodos during this. Google’s own processing is subject to Google Play’s terms.
• Game progress, the local session archive, preferences and the queue of records not yet sent.

3. Your choices in the app

• Usage statistics and Research profile are off by default. We ask once, after your first game ends; “Yes” and “No” are equal options.
• You can turn them on or off at any time under Settings > “Privacy & data”. When you withdraw consent, collection stops and the analytics ID on your device is reset.
• In Türkiye and outside the EU, anonymous usage counts do not need consent. In the EU / EEA, UK and Switzerland (based on the country in your device’s region setting; if the country cannot be determined, EU rules apply), anonymous counts are sent only with “Usage statistics” consent, and crash reports only with “Usage statistics” or “Crash reports” consent.
• If you are 13–18, usage statistics and the research profile are neither offered nor sent, and in the EEA no crash reports are collected either. We collect no data from people under 13.

4. Why we process data

• Waitlist: beta news, invites and limited product contact.
• Reducing abuse of the site and form (bots, spam, fake sign-ups).
• Running the mobile game: guess, reveal, couple/party sync, licence gate.
• Finding bugs and keeping the app stable (crash reports).
• With your consent: understanding how the product is used (usage statistics), and de-identified aggregate research and content development (research profile).
• During the closed beta: distributing the test build, finding bugs and fixing the product based on the feedback you send (details in the Beta Participation Note).
• Handling support, complaints, legal requests and disputes.
• Meeting tax, consumer, electronic-communications and KVKK duties.
• Product development, debugging and summary reporting after anonymisation or aggregation that does not identify you.

We may share or license aggregate, de-identified reports (groups of at least 50 people) with partners; no individual or couple can be identified from them. We never sell individual-level data.

Lodos does not sell the waitlist or game data to an ad network. The site does not use an ad pixel, AdMob, or an email marketing automation platform (ESP).

5. Where data lives and how it is protected

The marketing site and waitlist run on Cloudflare (Workers hosting, D1 database, Turnstile bot protection, optional cookieless Web Analytics). The mobile app uses Google Firebase (identity, cloud records, crash reports and, with consent, usage statistics) and RevenueCat plus store accounts for licensing. Traffic is encrypted with HTTPS.

Access is limited to people who need it for the job. No system is perfectly secure. If a breach is likely to affect data subjects, we notify as required by law and within a reasonable time.

6. Third parties we share with

Sharing happens only as far as needed to run the service, with these categories:

• Cloudflare, Inc. — hosting, D1, Turnstile, optional cookieless analytics.
• Google LLC / Google Ireland (Firebase Authentication, Firestore, Realtime Database, Crashlytics, App Check, Google Analytics for Firebase) — service provider (processor). Advertising consent signals are always sent to Google Analytics as denied; the advertising ID is not collected.
• Apple and Google — store account, billing, refunds and licence.
• RevenueCat — subscription-state checks: anonymous user ID, purchase and subscription state, store country (we do not store card data).
• Competent public authorities — where legally required or upon a valid request.

Apart from these providers, waitlist or game data is not shared with marketing companies or data brokers. For aggregate de-identified reports, see section 4.

7. International transfers

Google (Firebase), RevenueCat and Cloudflare servers are outside Türkiye (mainly in the US and the EU). The app depends on these providers to work, so the transfer is structured. Transfers from Türkiye to other countries are made under KVKK article 9 as amended by Law No. 7499, in force since 1 June 2024: where the Board has made no adequacy decision for the destination country, the basis is the standard contract announced by the Personal Data Protection Board, signed with the provider and notified to the Authority within five business days of signing. The app is currently in closed testing; we are completing this contract process with our providers before public release. We do not rely on explicit consent for regular transfers; explicit consent is only an exception provided for incidental (one-off) transfers.

For EU / EEA users, we rely on the European Commission’s Standard Contractual Clauses under GDPR article 46 and, where applicable, the EU-US Data Privacy Framework. You can write to us to find out which provider processes data in which country.

8. Retention

• Waitlist row: until beta closes, the purpose ends, or a deletion / objection request is fulfilled.
• Security digests (ip_hash): short-lived, to reduce abuse; no raw IP trail is kept beyond the rate-limit window.
• Support mail: for closing the request and possible dispute periods; financial records for the minimum periods in tax law (typically 5 years, and up to 10 years for some documents).
• On-device data: bounded by uninstall, local wipe, or the relevant Settings controls.
• Couple / party cloud records: for as long as needed to run the session. On breakup or closure, local copies on the device may be cleared; the server-side shared archive is kept for up to 3 years and then anonymised. That archive is not sold for advertising, and the analytics schema does not write couple or user identifiers.
• Usage statistics and research profile consent: until you turn it off or ask for deletion; once off, no new data is sent.

At the end of the period, data is deleted, destroyed, or anonymised so it can no longer identify you — except where the law requires retention. We apply these periods.

9. Deleting your data

In the app, Settings > “Delete my data” sends a deletion request. You can also send the request by email to hello@sweetspot.red. Within 30 days at the latest, your server-side profile backup, research data and the personal information linked to your account are deleted. As soon as you send the request, your usage statistics and research profile consents are switched off.

• In records shared with your partner, only your own personal information is deleted; what your partner wrote stays with them.
• Payment records that the law requires us to keep are deleted when that period ends.
• Anonymous usage counts and de-identified aggregate tables cannot be linked to a person, so they fall outside a deletion request.
• Your consent record is kept for the consent period + 3 years so that we can prove when you gave or withdrew each consent; it holds only the choice, the text version, region and time.
• If you made a payment, your customer record at RevenueCat is deleted once the statutory financial-record period ends; the purchase record at the store is subject to Apple’s or Google’s own rules.

Deleting an item in the app is not the same as deleting your data. When you delete a record in the shared areas (notes, pins, calendar, memory journal, coupons, time capsule, Our Plans), it disappears from your screen and your partner’s, but it is marked “deleted” on the server and stays in the couple shared archive; that archive is anonymised after at most 3 years. If you also want the personal information in those records deleted from the server, use the “Delete my data” request. Uninstalling the app only deletes the data on your device; it does not delete the records on the server.

10. Cookies and similar technologies

A cookie is a small text file a site writes to your device. The Sweet Spot marketing site does not use marketing or advertising cookies.

• Strictly necessary / technical: mechanisms needed for the form, locale, and security (Cloudflare Turnstile).
• Analytics: if Cloudflare Web Analytics is enabled, it runs without cookies and does not build an advertising profile.

You can delete or restrict cookies in the browser. Turning off necessary technical mechanisms may stop the waitlist form or bot protection from working.

11. Changes

This text may be updated from time to time. The effective date is at the top of this page. Material changes are published on the site and, if you are on the waitlist, may also be sent to the email on file. Continued use of the site or app after a change means you have had a chance to read the new text and, to the extent the law allows, accept it. Your KVKK rights are not waived by that notice.

12. Contact

KVKK notice

This section meets the controller’s information duty under KVKK article 10. It forms one document with the Privacy Policy above.

1. Identity of the controller

Personal data is processed by Lodos Eğlence ve Teknoloji Limited Şirketi as controller. Sweet Spot is a product brand of that company, not a separate legal entity.

Apple, Google and payment infrastructure may act as independent controllers, or in the role set out in their own contracts, for their processing. Lodos is not responsible for those providers’ own policies.

2. Personal data processed

Identity and contact (name, email, support correspondence); relationship status declared on the waitlist (yes / no); transaction security (Turnstile result, IP digest); anonymous user ID; the pairing record and the couple’s shared records (notes, pins, calendar, memory journal, coupons, time capsule, Our Plans, daily question, timeline, Typing result); remote-play and party-room records; technical and game records from app use (on device and, as far as the session needs, in the cloud); feedback and test reports if you send them; crash reports; with your consent, usage statistics and the research profile; consent records; deletion-request record; licence and store-account summaries; if you join the closed beta, the Google account email address on the test list. Special-category personal data (health, sex life, religion and belief, political opinion) is not processed on our servers; sexual orientation stays only on your device. The typing teaser is not a clinical diagnosis or health data. If such data appears because you typed it into a form or deck, it is not processed beyond running the service and keeping it safe.

3. Purposes

• Creating the waitlist, beta invites and product contact.
• Providing the site and app, running the session, checking the licence.
• Security, error detection and preventing fraud or abuse.
• Managing requests, complaints and legal filings.
• Meeting duties that arise from law.
• With your consent, measuring product use, de-identified aggregate research and content development.
• Product development from anonymous or aggregate statistics — in a way that does not reveal you or a partner.

4. Collection method and legal bases

Data is collected electronically, in part automatically, through the waitlist form, the app interface, the support channel and system logs. Web-teaser answers stay in the browser and do not enter server-side processing described here.

Legal bases (KVKK art. 5; art. 6 if special-category data were ever involved):

• Processing that is necessary for entering into or performing a contract (art. 5(2)(c)): app use, pairing, the couple’s shared records, remote play and party rooms, profile backup, licence, support, handling a deletion request; if you joined the closed beta, the test list and the beta Premium gift.
• Compliance with a legal obligation of the controller (financial records, official requests, retention periods, proof of consent records).
• Legitimate interests of the controller that do not override your fundamental rights (art. 5(2)(f)): service security, bot protection, running the product, the couple shared archive; crash reports in Türkiye and outside the EU; technical data generated while anonymous counts are sent; fixing the product with the feedback and test reports you send.
• Explicit consent (art. 5(1)): waitlist contact, usage statistics and the research profile — consent can be withdrawn at any time.

Anonymous usage counts are collected in a way that cannot be linked to a person; because they do not relate to an identified or identifiable person, they are not personal data within the meaning of KVKK art. 3.

Special categories of personal data (KVKK art. 6): we do not knowingly collect data such as health, sex life, religion and belief or political opinion; answers to sensitive cards never leave your device. If you write such information into free text you share with your partner, that text is processed only to show it to you and your partner and to store it; it is not analysed and does not enter research or analytics.

Where GDPR applies (EU / EEA users), the legal bases are: contract for providing the service (art. 6(1)(b)); legal obligation (art. 6(1)(c)); consent (art. 6(1)(a)) for usage statistics, the research profile, anonymous counts and crash reports, together with consent under ePrivacy Directive art. 5(3) for accessing information on your device; legitimate interests (art. 6(1)(f)) for security. The legitimate-interest basis (art. 6(1)(f)) for crash reports and security applies to users in Türkiye and outside the EU.

You keep the right to complain to the data protection authority in your country.

5. Transfers

Personal data may be transferred, limited to the purposes above, to the infrastructure providers in Privacy Policy sections 5 and 6, to store / payment parties, and to public authorities where the law requires it. International transfers follow KVKK article 9 (Privacy Policy section 7). Once you are paired, the couple’s shared records and what you enter during a game are shown to your partner, given the nature of the service; in a party room, your display name and choices are shown to the players in the room.

6. Storage

Personal data is kept for as long as the purpose requires and for the retention periods in the applicable law. Details are in Privacy Policy section 8. At the end of the period we delete, destroy or anonymise.

7. Your rights (KVKK article 11)

Under KVKK article 11 you may apply to the controller to:

1. learn whether your personal data is processed,
2. request information if it is processed,
3. learn the purpose of processing and whether it is used for that purpose,
4. know the third parties to whom it is transferred, in Türkiye or abroad,
5. request correction if it is processed incompletely or inaccurately,
6. request deletion or destruction under the conditions in KVKK article 7,
7. request that correction or deletion be notified to third parties to whom it was transferred,
8. object to a result against you that arises from analysis of the data exclusively by automated systems,
9. claim compensation if you suffer damage because of unlawful processing.

Where GDPR applies, the rights of access, rectification, erasure, restriction, portability and objection (arts. 15–21) and the right to withdraw consent for consent-based processing also remain. A deletion request may be limited for records the law requires us to keep; in records shared with your partner, only your own personal information is deleted and what your partner wrote stays with them. In that case we state the reason. The deletion route is described in Privacy Policy section 9.

The “data deletion” URL on store forms is this page. You can use Settings > “Delete my data” in the app, or write to hello@sweetspot.red or iletisim@lodos.org.

8. How to apply

To exercise these rights, you can send your request by one of the methods listed in the Communiqué on the Procedures and Principles of Applying to the Data Controller:

• in writing and signed, to Kınıklı Mah. Hüseyin Yılmaz Cad. Pamukkale Üniversitesi No: 67 İç Kapı No: 2, Pamukkale / Denizli, Türkiye;
• by email to iletisim@lodos.org, signed with a secure electronic signature or a mobile signature;
• from an email address you have previously given us (for example the address on your waitlist or beta registration), to hello@sweetspot.red;
• for a deletion request, in the app under Settings > “Delete my data”.

Your application must include your name and surname, your Turkish ID number (if you are a Turkish citizen) or your nationality and passport / ID number (if you are a foreign national), your address for notification or your email address, and the subject of your request. Because the app works without an account (with an anonymous ID), it can be hard to link a request received by email to the record in the app; the fastest and most reliable route for deletion is “Delete my data” in the app. If you write by email, we may ask for extra information so that we can find your record. We may also ask for information that confirms your identity. The request is concluded free of charge as soon as possible and in any event within thirty days, depending on its nature. If the action requires an extra cost, the tariff set by the Personal Data Protection Board may be charged. If the application is refused or left unanswered, the complaint path to the Board under KVKK remains open.

This notice should be read as a whole with the Privacy Policy, the Terms of Use, and the Legal Information page.