Privacy Policy & KVKK Information Notice
Last updated: 9 November 2026 · Service address: https://pooduo.com
PooDuo is a mobile app for adults only (18+). You start a 10-minute timer when you visit the bathroom, see and chat with other adults who are in the room at the same moment, and the chat is flushed from the screen when the timer ends. This policy explains what data we process, how long we keep it, which service providers we use (Cloudflare and Firebase), and what we must tell you under Turkish Personal Data Protection Law No. 6698 (KVKK) and the EU GDPR.
1. Data controller and KVKK Article 10 notice
This notice is separate from the Terms of Use. It is shown to you with a "Read and understood" statement before you sign in with Google in the app.
- Data controller / operator: Tekno
- Contact and data requests: teknobus.dev@gmail.com · Site identity: https://pooduo.com/site
- How we collect it: Electronically and automatically, through the Android app and the web deletion page (internet connection, live chat connection, Google sign-in and Google Play Integrity check).
2. Personal data we process, why, and on what legal basis
| Data category and content | Purpose of processing | Legal basis (KVKK Art. 5 / GDPR Art. 6) |
|---|---|---|
| Identity and account data: A random user ID, an irreversible digest derived from your Google identity, your Google ID number encrypted so that it can only be opened with a key kept offline (used only as child-safety evidence), your username, a version of the username used to compare look-alike names, and the time you confirmed your age. Temporary data that is not saved: Date of birth (checked once to confirm you are 18+ and not stored; if you choose under 18, the app locks on the phone and nothing is sent to the server), and the email and name in your Google identity token (seen in memory only during verification, never written to the database). |
Creating your account, signing you in, enforcing the 18+ rule, preventing impersonation, and giving evidence to the authorities in serious child-safety crimes. | Performance of a contract (KVKK Art. 5/2-c, GDPR Art. 6(1)(b)), legal obligation (KVKK Art. 5/2-ç, GDPR Art. 6(1)(c)), legitimate interest (KVKK Art. 5/2-f, GDPR Art. 6(1)(f)). |
| Device and security data: An in-app device ID, a digest of your sign-in refresh key, a push notification key, app version, interface language, an app-specific phone digest derived from the Android device ID (used to stop block, pause and ban evasion), and the Google Play Integrity check at sign-up (confirms the app came from Google Play and was not modified). | Sending notifications, keeping the limit of 3 devices, filtering out bots and repackaged apps, and stopping a blocked or banned person from carrying on with a new account on the same phone. | Performance of a contract (KVKK Art. 5/2-c), establishment and protection of a right (Art. 5/2-e), legitimate interest in safety and abuse prevention (Art. 5/2-f). |
| Sessions, overlap and one-to-one interactions: Session start and end times, your current time zone offset (used only for the live session and the short-lived room ticket, no permanent region is stored), overlap counts per person (totals only, no timestamps, up to 300 people), a pause after a one-to-one request is declined or goes unanswered (kept by user and device digest for 7 days, by day), Duo links and invite codes. | Running the live room list, the poop icon fill level, one-to-one eligibility (at least one 60-second overlap or a mutual Duo) and the pause that prevents harassment. | Performance of a contract (KVKK Art. 5/2-c), legitimate interest (Art. 5/2-f). |
| Chat messages and the message record header: Group and one-to-one message text, quick-phrase IDs, and the record header (session start and end, IP address, connection time, device ID, app version, name cards, the digest derived from your Google identity, the encrypted Google ID number). | Delivering live chat, replaying after short disconnections, the automatic safety filter, scanning one-to-one chats for grooming signals, and human moderation when something is reported. | Performance of a contract (KVKK Art. 5/2-c), legal obligation (Art. 5/2-ç), legitimate interest (Art. 5/2-f), and the explicit consent given at the first one-to-one request or acceptance. |
| Optional streak and recap data: Because how often someone uses the bathroom could be seen as health data, streak counters and monthly/yearly recap data (sessions per month, overlap counts, new people, visible country codes, longest streak) are off by default. | Calculating the toilet-roll streak and the monthly/yearly recap card only when you turn it on, either at the end of your first session (the question has no pre-selected answer) or in Settings. You can stop it with one tap in Settings and it is deleted immediately. | Explicit consent / opt-in (KVKK Art. 5/1 and Art. 6, GDPR Art. 6(1)(a) and Art. 9(2)(a)). |
| Avatar and country flag: Avatar colour set (skin, hair, eye colour; includes fantasy colours, a cosmetic choice and not racial or ethnic origin data). The country code set at sign-up, which you can change once every 30 days, and your choice to the "Show my flag?" question at setup (no pre-selected answer). The app asks for no GPS or precise location permission. | Showing you in the room and showing the anonymous map of countries (to people outside a session, countries with fewer than 3 people are shown as "other"). | Performance of a contract (KVKK Art. 5/2-c) and your own choice. |
| Bathroom Wall and encrypted traffic record: The Wall posts you send, up to 100 characters, your 30-day approval and rejection counters as an author, and, under Turkish Law No. 5651, an encrypted traffic record per Wall post only (author ID and IP address encrypted so that they can only be opened with a key kept offline, plus the time). No traffic record is kept for normal sessions. | Running the pre-approved Bathroom Wall, preventing spam and abuse, and meeting the legal duty to keep a traffic record for lasting user posts. | Performance of a contract (KVKK Art. 5/2-c), legal obligation (Law No. 5651, KVKK Art. 5/2-ç). |
| Reports, moderation and network prefix records: The report copy (only the messages the reporter could see, up to 20 lines plus the reported message), the network prefix on the report record (the first part of an IP address, used to prevent false-report abuse), records of moderation actions, and ban records. | Keeping the community safe, reviewing child-safety cases, stopping coordinated false reports, and handling appeals. | Legal obligation (KVKK Art. 5/2-ç), protection of a right (Art. 5/2-e), legitimate interest (Art. 5/2-f). |
3. Storage on your device and screen protection
Chat messages and one-to-one chats are kept in memory (RAM) only in the app. They are never written to disk or to temporary files, and they are wiped from memory when the session ends, along with the flush animation. During a session the app stops the phone's recent-apps screen from capturing the chat. It does not stop you from taking your own screenshot. So that you can report someone after a session, only the name cards of your one-to-one partners and the latest senders (without message text) are kept for 24 hours.
4. Service providers and transfers abroad (KVKK Art. 9 / GDPR Chapter V)
Plain information on transfers abroad: PooDuo does not sell personal data or share it with advertising networks. The app's technical infrastructure does run on the following two main service providers:
- Cloudflare, Inc. (USA / global and EU data centres): the app server, live room state and message records, the main database (within the European Union jurisdiction), the firewall, and the backup translation model that a moderator runs by clicking (according to Cloudflare's documentation, inputs are not stored or used to train models).
- Google LLC / Google Ireland Limited (Firebase and Google Cloud) (USA / global): Google sign-in, push notification delivery (Firebase Cloud Messaging) and the Android app and device check (Google Play Integrity).
Even though the European Union jurisdiction is selected for the database, having data on Cloudflare and Firebase servers outside Turkey is a transfer of personal data abroad under KVKK Article 9. Under KVKK practice, ongoing cloud hosting cannot rest on explicit consent alone. The operator (Tekno) will make a written request to Cloudflare and Google to sign the Standard Contract announced by the Personal Data Protection Board. If it is signed, it is notified to the Board within 5 business days. In the interest of transparency, we also say here that large cloud providers may not agree to a special signing process on standard accounts.
5. Data retention periods
These retention periods are applied automatically by the nightly cleanup job and the room store's daily cleanup:
| Data | Retention Period (default) |
|---|---|
| Message text | At most 25 hours in the live database. Infrastructure provider recovery history: 30 days for room data, 7 days for the database. Not used in normal operation |
| Message record header (session start and end, IP, connection time, device, version, name cards, the digest derived from your Google identity, the encrypted Google ID number) | Same as the text, at most 25 hours. Copied only into human-confirmed child-safety preservation |
| On the device | Memory only at the application level. Name cards only for 24 hours for reporting |
| Report copy | 90 days after closing; 12 months if action was taken; as long as a legal hold lasts (re-confirmed every 12 months) |
| Session record | 11 minutes after the end |
| Overlap counts | Until deletion or 18 months of inactivity |
| Streak and recap | 14 months if turned on, deleted immediately when stopped, removed with the account or after 18 months of inactivity |
| One-to-one pause | 7 days, by day, deleted when it expires |
| Wall post | Pending 24 hours, live 72 hours from approval, fully deleted when the time is up. If you delete it yourself, the text is emptied immediately |
| Rejected Wall post | Text encrypted and visible only to the moderator for 7 days |
| Wall traffic record (encrypted author, encrypted IP and time) | 1 year, per Wall post only, kept for its full period even if the account is deleted. No traffic record per session |
| Device digest in a block record | Until the block is lifted, the blocker is deleted, or 18 months of inactivity |
| Network prefix in a report record | Same period as the report copy |
| Deletion record (account with a report or restriction) | 30 days |
| Wall author counters | Deleted together with the account |
| Moderation record | 24 months. Ban record and banned device digest: 24 months |
Other technical periods: Released or deleted usernames are held for 90 days to prevent impersonation. Sign-in refresh keys are kept for 60 days. Push notification keys are kept until they stop working or sit unused for 60 days. The session waiting timestamp is cleared in the next daily cleanup (00:10 UTC). The infrastructure provider's operating logs (they contain no request content or keys) are kept for 3 days.
6. Account deletion and the exceptions that stay
You can delete your account at any time in the app (Settings → Delete Account) or on the web (https://pooduo.com/legal/en/delete). If you have an open appeal, deletion waits until the appeal is decided.
When a clean account is deleted, your identity data, profile, devices, your own overlap map, streak and recap data, Wall author counters, and your user ID and your phone-specific digest value in other people's overlap and one-to-one pause records are removed right away. Only the following exceptions stay until their own period ends:
- The 25-hour message record and its header: Message text in the live database and the record header are left to the normal 25-hour purge. If a report about your deleted account arrives in that time, the digest and the encrypted Google ID number are copied from the header into the report and a 30-day deletion record is written.
- The 90-day username hold: The released username is held for 90 days so nobody can take it and impersonate you.
- The infrastructure provider's recovery history: Cloudflare keeps recovery history for 30 days for room data and 7 days for the database. It is not used normally.
- The encrypted traffic record if you posted on the Wall, and rejected Wall posts: One encrypted traffic record per Wall post for 1 year, and a rejected Wall post, encrypted, for 7 days.
- The device digest in the record of the person who blocked you: If another user blocked you, the phone digest in their record stays until they unblock you, delete their account, or are inactive for 18 months.
- The network prefix in report records: Kept for the same time as the report copy (90 days after closing, 12 months if action was taken, or as long as a legal hold lasts).
If an account has a report, a warning, a Wall rejection or a restriction at the time of deletion, a 30-day deletion record is kept. For accounts that were banned or confirmed to be under 18, a ban record and a device digest are kept for 24 months.
7. Your rights (KVKK Art. 11 and GDPR Arts. 15–22)
You have the right to find out whether your personal data is processed, to ask for information and access, to learn the purpose of processing and who receives the data in Turkey or abroad, to ask for correction or erasure, to object to decisions made by automated systems, and to claim compensation for unlawful processing. Send all requests and appeals to teknobus.dev@gmail.com.