ARWY PRIVACY POLICY
Last updated: November 2, 2026 Operator: ARWY ("we", "us", "our") Contact: info@arwy.life Service: ARWY mobile application and website arwy.life
This Privacy Policy explains what personal data ARWY collects, how it is used, with whom it is shared, and what rights you have. This Policy is an information notice; during sign-up you confirm, with a separate checkbox, that you have read it. You can also read the Personal Data Information Notice.
1. WHO WE ARE AND WHO THIS APPLIES TO
ARWY is a social reading and writing platform available globally. The platform is open to users aged 13 and older. Users aged 13–17 ("minors") are matched only with other minors; users aged 18+ ("adults") are matched only with other adults. This barrier is enforced server-side and cannot be bypassed by any subscription or filter.
2. DATA WE COLLECT
2.1 Account data: - Email, password (encrypted by Firebase Authentication; we never see it in plain text) - First name, last name, username - Date of birth (used to compute age category and to decide whether you can turn on sensitive content; never publicly displayed) - Gender preference (optional) - Profile photo, cover photo, biography, social links (Instagram / X / TikTok / website) - Phone number (optional, only if you choose to add it; SMS verification via Firebase Phone Auth)
2.2 Content you create: - Books and chapters you write - Comments, replies, inline reactions (emoji) - Quotes you share - Posts (text, images, video, audio) and the audience and 18+ mark you choose for each post - Direct messages - Ratings and reading progress
2.3 Behavioral data: - Books you read, chapters opened, time spent, view counts - Matches you receive and conversations you start - Library entries, likes, follows, follow requests - Your account privacy and sensitive content settings - In-app subscription tier (Free / Plus / Premium / Elite / Elite+)
2.4 Device and technical data: - Device model, OS version, app version - IP address: when you sign up, sign in and open the app, our server records the IP address it sees, together with the time, your account and device/app information. It is used for security, preventing abuse and fraud, and meeting legal obligations; it is not used for advertising or profiling and is never shown to other users. - Firebase Cloud Messaging (FCM) token (for push notifications) - Crash logs (via Firebase Crashlytics; release builds only) - Analytics events (via Firebase Analytics)
2.5 Payout details (only if you enter them yourself): - Full name, phone, address and IBAN are stored ONLY to deliver a contest prize, and only if you enter them yourself in the app. - Providing them is ENTIRELY OPTIONAL and is not a precondition for any feature; you can use the app and take part in the contest without them. If you win and we have no details, you are given 14 days to provide them; after that the prize passes to the next participant. - They are used only to pay the prize and ship the book — never for advertising or profiling. They are shared only with the bank executing the transfer and the courier. - Users under 18 are not asked for an IBAN, because cash prizes are for participants aged 18 or over. - They are kept on your account so you do not have to enter them again for each contest. You can update them in the app at any time, ask us to delete them at info@arwy.life, and they are deleted together with your account if you delete it.
2.6 Location (only if you opt-in): - Coarse location (city-level) is requested ONLY when you enable the "proximity filter" in match settings. We never track location passively. The location is stored as a single GeoPoint in your profile and used solely to compute distance to potential matches.
3. WHY WE COLLECT IT (LEGAL BASES)
- To provide the service (contract): account creation, matching, messaging, content delivery - Legitimate interest: spam prevention, abuse moderation, service improvement - Consent: location, marketing-related push notifications, optional phone verification - Legal obligation: tax/audit records for in-app purchases
4. HOW WE USE YOUR DATA
- Authenticate you and protect your account - Match you with other readers of the same book (within your age category and filters) - Show your public profile, books, libraries to other users - Publish your public profile and published books as web pages on arwy.life (these pages may be indexed by search engines — see Section 6.2) - Send push notifications you have not muted - Process in-app subscription purchases via Google Play Billing - Display advertisements (Google AdMob — only for Free tier; paid tiers have NO ads) - Detect abuse, fraud, and policy violations - Generate aggregated, anonymized analytics
5. THIRD-PARTY SERVICES
ARWY uses the following processors, each of which processes data under its own privacy policy:
- Google Firebase (Auth, Firestore, Realtime Database, Cloud Functions, Storage, Cloud Messaging, Crashlytics, Analytics, App Check) - Google AdMob (advertisements for Free-tier users only) - Google Cloud Translation API (when you tap "Translate" on a message or chapter; the source text is sent to Google for translation and cached in our database for up to 30 days) - Google Translate free endpoint (fallback for message and chapter translation; same data flow) - Google Play Billing (in-app subscription purchases) - Google Play Integrity / App Check (anti-abuse, runs silently) - Resend (transactional email: verification codes, password reset) - Google Vertex AI (Gemini), Anthropic and OpenAI (only when you press the "AI spell check" button in the chapter editor; the chapter text is sent to one of these providers for correction and processed under their data policy. Messages you write to ARWY's official support accounts are also sent to Anthropic to generate a reply.) - Google Vertex AI (Gemini) content moderation (posts, comments and messages are scanned automatically for abuse; decisions are always made by a human moderator) - Share targets you choose (Instagram, WhatsApp, X, TikTok, etc. — these receive whatever you explicitly share via the system share sheet)
6. DATA THAT IS PUBLIC
6.1 INSIDE THE APP The following are publicly visible inside the app to other registered users: - Username, first/last name, profile photo, cover photo, biography, social links - Books and chapters you publish (when status = published) - Comments, ratings, public library entries - Your posts, unless your account is private or you shared the post as "Followers only" (see 6.4) - Match presence (other users see "X people are reading this book", but never your exact identity unless you actually match)
6.2 THE OPEN WEB (arwy.life) AND SEARCH ENGINES So that writers can be found, ARWY also publishes public profiles and published books as web pages on arwy.life. These pages are open to everyone: people without an ARWY account can view them, and search engines such as Google may index them.
What may appear on the web: - Username, first/last name, profile photo, biography, the social links you added - Title, cover, description, genre, rating and chapter titles of the books you published
What is NEVER published on the web: - Full chapter text (only a short promotional excerpt may appear) - The content of paid or locked chapters - Books in draft status - Email, phone, date of birth, location, your messages, your reading progress
You stay in control: - To have your public author page removed, write to info@arwy.life and we will take it down. - Setting a book back to draft, or deleting it, also removes its web page. - Deleting your account removes all of your web pages.
IMPORTANT: When a page is removed, it disappears from arwy.life immediately. However, removal from search engines' own indexes and caches typically takes several days to a few weeks, and that timing is outside ARWY's control. ARWY also has no authority over copies previously taken by third-party web archives. On request, ARWY submits an expedited removal notice to search engines.
6.3 NEVER SHOWN — TO USERS OR ON THE WEB
The following are never shown under any circumstances: - Email address, phone number, date of birth, exact location coordinates - Direct messages (only the two participants can read them) - Reading progress, subscription tier, drafts
6.4 PRIVATE ACCOUNT AND POST AUDIENCE
These features are being rolled out gradually. If you do not see them in your app yet, this section applies once they reach your account.
You can make your account private in Settings > Privacy > Private account. While your account is private: - Your posts are visible only to followers you have approved. - People who want to follow you send a follow request, which you can approve or delete. When you delete a request, the person is not notified. You can also remove a follower at any time; the person you remove is not notified either. - When you switch to private, your existing followers stay. All of your posts, including archived ones, become visible to followers only, and other people's reposts of those posts are removed. - When you switch back to public, pending follow requests are approved automatically and each post returns to the audience you chose for it.
A private account protects only your posts. The following stay public: - Your books, chapters and libraries - Your follower and following lists, their counts and the number of your posts - Your username, name, profile photo, cover photo and biography - Your public author page on the web (Section 6.2; currently published on arwy.tr). It contains no posts, and making your account private does not remove it from search engines. To have it removed, write to info@arwy.life. - Comments you leave on other people's posts, books and chapters, and messages you write in public chat rooms Links to media (images, videos, audio) that were shared or forwarded before you made your account private may continue to work. ARWY has no control over screenshots or copies made by people who were able to see your content.
Post audience: - For each post you can choose "Public" or "Followers only". If your account is private, all of your posts are followers-only and a single post cannot be made public. - If your account is public, anyone can follow you without approval, so choosing "Followers only" does not give you full control over who sees a post. To decide who can see your posts, make your account private. - Followers-only posts cannot be reposted. If one is sent in a message, a recipient who is not allowed to see it sees only a locked card, without the text or media. - If you tag someone who does not follow you in a followers-only post, they cannot see the post and are not notified. - You can change a post's audience later by editing the post.
6.5 SENSITIVE CONTENT (18+)
- "Sensitive content" means content that may not be suitable for people under 18: violence, strong language, disturbing or traumatic themes, and sexuality that is implied but not explicit. - When you share a post you can mark it 18+. Sensitive posts are hidden by default. - Only users who are 18 or older according to the date of birth they entered can turn on Settings > Privacy > "Show sensitive content", and turning it on requires an extra confirmation. Even then, sensitive posts appear blurred and open only when tapped. Guests, users who have not entered a date of birth and users under 18 cannot see sensitive posts. - You can always see your own sensitive posts. - Your date of birth is self-declared; ARWY does not verify identity. Your date of birth and this setting are never shown to other users. - Explicit sexual content and pornography are prohibited in posts even when marked 18+, and are removed through moderation.
7. AGE BARRIER (COPPA / GDPR-K)
ARWY is for users aged 13 and older. We do not knowingly collect data from children under 13. If we learn that an under-13 user has registered, we will delete the account and all associated data without notice.
Users aged 13–17 are subject to a hard minor–adult matching barrier. Minors will never be matched with adults inside ARWY regardless of filter, subscription, or any other setting. Direct messaging, follows, and quote sharing remain open (subject to Play Store parental controls). Users aged 13–17 cannot see posts marked as sensitive (18+) (see Section 6.5).
8. INTERNATIONAL TRANSFERS
ARWY is hosted on Google Cloud (region: europe-west1, Belgium). Data may be transferred to other Google Cloud regions for backup and processing. We rely on the EU Standard Contractual Clauses (SCCs) and Google's adequacy mechanisms.
9. RETENTION
- Account data: kept while your account is active. Upon deletion via the in-app "Delete Account" page (arwy.life/delete) or by emailing info@arwy.life, all personal data is removed within 30 days, except records we are legally required to keep (e.g., payment receipts for tax purposes — up to 10 years per Turkish tax law). - Translation cache: 30 days, keyed by SHA-1 of (text + targetLang). - FCM tokens: removed on logout or when refreshed. - Crashlytics logs: 90 days. - IP records: 1 year (the traffic-log retention period under Turkish Law No. 5651), then deleted automatically. Shared with authorities only in response to a valid legal request (a court or competent authority order). - Aggregated analytics: indefinitely (anonymized).
10. YOUR RIGHTS (GDPR / KVKK / Similar) You have the right to: - Access the personal data we hold about you - Correct inaccurate data (via in-app profile settings) - Delete your account and all data (in-app "Delete Account" or info@arwy.life) - Export your data (email request to info@arwy.life) - Object to processing based on legitimate interest - Withdraw consent for optional features (location, push, marketing) - File a complaint with your local data protection authority
We respond to requests within 30 days. No fee unless the request is excessive or repetitive.
11. SECURITY
We use Firebase App Check (Play Integrity in production), Firestore security rules, encrypted Auth, server-side validation of in-app purchases via Google Play Developer API, and HTTPS for all network traffic. Despite these measures, no online service is 100% secure.
12. COOKIES AND TRACKING
ARWY (mobile app) does not use cookies. The website (projectarwy.web.app) uses only essential cookies for hosting and security; no third-party advertising cookies.
13. CHANGES TO THIS POLICY
We may update this Policy. Material changes are announced in-app (and by email where appropriate) and take effect on the date stated in the announcement. Continued use of ARWY after the effective date constitutes acceptance.
14. CONTACT
For privacy questions, data access, deletion, or any other inquiry: Email: info@arwy.life Web: arwy.life
This policy is governed by the laws of the Republic of Türkiye, with mandatory consumer protection provisions of your country of residence preserved.