1. Data controller and contact details
MemorialEver is the name used in these documents for the service operator and data controller. Because no separate company/legal entity name or postal address has been approved for this version, this document does not claim one. You can contact us at destek@hatirasina.com about privacy, support and personal-data requests.
2. Account and authentication information
When you create an account or sign in, we may process your full name, email address, selected authentication method, provider account identifiers, and session and authentication information.
Email sign-in uses a one-time numeric code sent through Supabase. Sign in with Apple is available on iOS, and Google sign-in is available on iOS and Android. We receive only the information supplied by Apple or Google for the sign-in method you choose.
3. Memorial Page draft information
The following information you enter in the app may first be stored as a draft on your device. After account verification, the current version may transfer it to an unpublished, private Supabase draft that belongs only to you.
•
The deceased person’s first and last name
•
Date or year of birth and death, or an “unknown” selection
•
Place of birth and place of burial
•
Your relationship to the deceased
•
A short tribute and life story
•
Timeline titles, dates and descriptions
•
Visibility, theme and contribution preferences
4. Photos, videos and audio
Photos, videos and audio files you select may be kept on your device together with technical metadata such as file type, size, dimensions, duration, crop information and generated previews.
The current private draft transfer may upload the source file and/or a display-ready derivative to private Supabase storage for editing and retry purposes. These files are not served through public storage URLs. This document must be updated if the production media-processing or retention policy changes.
5. Guest contributions
Guests who arrive through a link or QR code may submit a text memory without creating an account. If they choose to display their name, we may process their full name, optional email address, memory text and limited technical identifiers generated for abuse prevention without retaining the raw IP address.
Guest memories remain private until the owner approves them. The owner may edit, approve or reject a contribution. Guest photo, video and audio uploads are not yet available.
6. Technical data and on-device storage
During authentication and cloud requests, relevant infrastructure providers may process an IP address, request time, limited app/browser and device information, and security and error logs.
The mobile app stores the Memorial Page draft, copies of selected media and session information in app-specific device storage. Web code may use browser local storage for drafts and sessions. The current code does not include an advertising SDK, PostHog, Mixpanel, Firebase Analytics or a similar third-party product-analytics service. Legal pages do not place marketing or analytics cookies.
7. Why we use information
•
To create accounts, verify identity and maintain sessions
•
To create, save and reopen the Memorial Page draft you request
•
To store and process the content and media you select
•
To enforce access controls and show private drafts only to the account owner
•
To protect security, troubleshoot errors and prevent abuse
•
To respond to support requests and meet legal obligations
8. Service providers
Supabase is used for account authentication, session management, the Postgres database and private media storage. The currently connected Supabase project is configured in the eu-central-1 region within the European Union.
Apple and Google provide authentication if you choose the relevant option. Google infrastructure may also support configured email delivery. Expo tools are used to run, develop, build and host the web application.
RevenueCat communicates to the app the product, trial, renewal, expiry and restore status of subscriptions managed by the Apple App Store or Google Play. MemorialEver does not receive or store your full payment-card number.
MapLibre and OpenFreeMap display burial-location maps. Photon provides location suggestions for a place query sent through a Supabase Edge Function. MemorialEver does not retain location-search text as permanent product analytics.
9. Subscription and payment information
Purchases, trials, renewals, cancellations and restores are handled through the Apple App Store or Google Play; RevenueCat helps communicate entitlement status to the app.
MemorialEver does not need to receive your full payment-card number from the store. Limited purchase information such as store-account identifiers, product/purchase identifiers, entitlement status and transaction dates may be processed. Prices are not fixed by this policy and are displayed by the store before confirmation.
10. Sharing and visibility
After an owner explicitly publishes a Memorial Page, it may be offered as Public, Link Only or Password Protected. Public pages may be indexed by search engines; the other two options are marked noindex.
Password-protected pages and private media access are verified on the server. Choosing a visibility preference in a draft does not by itself publish the page. The end of a subscription does not change an existing visibility setting to a more open mode.
11. Retention and deletion
On-device drafts and app media files may remain until app data is deleted, the relevant content is removed in the app, or the device/operating system clears them. A successful cloud transfer does not currently delete the on-device draft automatically.
Cloud account and private draft data are retained for as long as needed to provide the service and meet security or applicable legal obligations. Because final retention periods have not been approved, this policy does not promise a specific number of days or years.
The high-security account-deletion flow under Profile > Account Information stops public access to Memorial Pages you own, removes related private Storage objects and database records, and finally deletes the Supabase Auth account. This action cannot be undone. Infrastructure security backups or store transaction records that must be retained by law may follow their providers’ own limited retention schedules. Contact destek@hatirasina.com with questions. No final policy has yet been approved for long-term media retention or deletion after a subscription ends, so no automatic-deletion promise is made solely on the basis of subscription expiry.
12. Security
We use technical and organisational safeguards including access controls, authentication, row-level authorisation and private file storage. No internet transmission or storage method can, however, provide an absolute guarantee of security.
13. International data transfers
The Supabase project operates in a European Union region outside Türkiye, and global providers such as Apple, Google and Expo may also process information outside Türkiye. We therefore cannot state that all information remains in Türkiye.
Before production, the data controller should confirm with legal counsel the applicable legal basis, appropriate safeguards and any required notices or permissions for international transfers. This policy does not claim that a particular transfer mechanism has been completed.
14. Children and third parties
MemorialEver is not designed as a service for children and the current app has no age gate. Memorial Page content may include photos or information about third parties, including family members and children. Anyone adding content must have the rights and permissions needed to share it and should take particular care with content involving children.
15. Requests under Turkish data-protection law (KVKK)
Where applicable, you may contact destek@hatirasina.com to ask whether your personal data is processed, request information, learn whether it is used for its intended purpose and to whom it has been transferred, request correction, deletion or destruction, and exercise other rights granted by law. We may request proportionate additional information to verify that the request is yours.
A Privacy Policy and a formal KVKK Privacy Notice may serve different legal purposes. This policy does not replace any separate notice, explicit-consent process or other obligation that may be required. Legal review is required before production.
16. Changes to this policy
If the service’s actual data-processing practices or legal requirements change, this policy will be updated and the new date will appear at the top of the page. Significant changes may be announced in the app or through another appropriate channel.