- Version: 1.0
- Effective date: 4 October 2026
- Main notice: Sarıl Privacy Notice
- Controller: Emre Yalçın (in the app stores: Emre Yalçın), Yalı Caddesi No: 8, Atakum, Samsun, Türkiye, support@saril.app
This annex is part of the Privacy Notice and applies only if you use Together. Everything the Privacy Notice says about your data staying on your phone still holds for the rest of Sarıl. Together, however, sends some information to a server so you can share the same step with friends. This annex explains what goes there, why, and when it is deleted.
The consent for transfers outside your country is a separate text (Together Consent Annex).
1. The short version
- Together is optional. If you never turn it on, nothing leaves your phone.
- To use Together you sign in with Apple or Google. The server is Google's Firebase service; data is stored in a data center in Europe.
- Only this goes to the server: your companion's name and kind, your level, whether you took a step today, your shared steps' names and daily check marks, the ready-made kind wishes you send, your profile photo if you add one, your reports, and the result of checking your Premium subscription.
- Never sent: your own steps, mood entries, answers to the question of the day, letters, nicknames you give friends, and your settings.
- Anyone who knows your friend code can see your profile photo. Please read section 6.
- You can delete your Together account at any time. Your server data is then deleted immediately (section 9).
2. Sign-in and account
You turn on Together with Sign in with Apple or Sign in with Google. Firebase Authentication then creates a random user ID (uid) for you.
- Sarıl's database stores only this ID. Your name and email address are not written to Sarıl's database, and your friends never see them.
- Honest note: the sign-in service itself (Firebase Authentication) keeps the email address your sign-in provider shares in your account's technical record. With Sign in with Apple you can hide your email; Apple then provides a relay address. This email is used only to recognize and delete your account; we never send you marketing email.
3. What is processed, why, and on what legal basis
Information · Purpose · Legal basis (GDPR) · How long
User ID and sign-in provider · Recognize you in Together; link friends and steps to you · Contract (Art. 6(1)(b)) · Until you delete your Together account
Email held by the sign-in service · Technical account record; not written to Sarıl's database · Contract (Art. 6(1)(b)) · Until you delete your Together account
Profile: companion name and kind, level and stage, friend code, whether you took a step today (yes/no and date) · Let friends recognize you by your companion; the "took a step today" mark · Contract (Art. 6(1)(b)) · Until you delete your Together account; the daily mark is overwritten each day
Friendships, friend requests and people you block · Build your friend list; keep blocked people from seeing you · Contract (Art. 6(1)(b)) · Until you remove the friend, answer the request, unblock, or delete your account
Shared steps: name (from the library or a name of up to 40 characters written by the creator), schedule, members, invitations, the days each member did it, the together count, the creator's change notes · Show the shared board to you and your friends · Contract (Art. 6(1)(b)) · Your check marks until you leave the step; the step is deleted when the last member leaves
Kind wishes: from, to, which ready-made wish, which day (no free text) · Show your friend a ready-made kind wish card · Contract (Art. 6(1)(b)) · Deleted once the recipient has seen it; at most 30 days if unseen
Profile photo (optional): a 256×256 pixel thumbnail cropped on your phone; location and other hidden data (EXIF) are removed on the phone · Let friends recognize you by your photo · Contract (Art. 6(1)(b)); no face recognition or biometric processing · Until you remove it or delete your account
Reports: the reporting user's ID, the reported step name or photo owner, date · Hide inappropriate content, prevent abuse, follow app store rules · Legitimate interests (Art. 6(1)(f)) · 12 months
Premium check result: subscription type (trial or paid), plan, end and renewal date, cancellation status, platform; the store's transaction ID · Apply the Together member limit (5 / 15) correctly; stop one subscription from being tied to several accounts · Contract (Art. 6(1)(b)) · Until you delete your Together account
Payment details (card, bank) never reach Sarıl. The receipt is checked with Apple or Google; Sarıl stores only the result.
4. Who can see what
- Your friends: your companion's name and kind, your level, whether you took a step today, the kind wishes you send them, and your profile photo.
- Members of a shared step: that step's name and schedule, who did it on which day, and the count. Your own steps and other shared steps stay hidden from them.
- People you block: cannot see you; in a shared step you both stay members but don't see each other.
- Us: we may look at server data only to fix a technical problem, review a report, or answer a legal request. We never sell your information or use it for ads or analytics.
5. Nicknames
A nickname you give a friend ("Ayşe") stays on your phone only. It is never sent to the server or to your friend.
6. Who can see your profile photo (please read)
- A profile photo is optional. Without one, your companion is shown instead.
- Anyone who knows your friend code can see your photo. That may include someone who is not your friend yet but learned your code, for example if you shared it in a group. Share your code only with people you trust.
- People you block cannot see your photo.
- If one person reports your photo, it is hidden from that person. If two different people report it, it is hidden from everyone and you see a calm notice card. You can add a new photo.
- Photos are not scanned automatically and no face recognition is used.
- Take care when adding a photo that shows other people; getting their permission is your responsibility.
7. Recipients and international transfers
- Google (Firebase): Google LLC and Google Ireland Limited provide the server service and process this information on our behalf and on our instructions (processor, Art. 28 GDPR).
- Data center: Europe (a Google region inside the European Union).
- Transfers: Google's support and security teams may access the data from other countries, including the United States. For users in the EU/EEA/UK such transfers rely on the EU–US Data Privacy Framework (Google is certified) and Standard Contractual Clauses. For users in Türkiye the data center itself is abroad; we ask for explicit consent for this transfer (Together Consent Annex). If you don't consent, you can't turn on Together; the rest of Sarıl works as usual.
- Apple and Google app stores: when your Premium receipt is checked, your subscription is looked up with Apple or Google. They already hold your account; we send them no new personal information.
- Your information is not shared with anyone else and never sold.
8. Security
- Every connection between your phone and the server is encrypted.
- Access rules protect every document on the server: you can write only your own profile; only members and invitees can see a shared step; members can write only their own check marks; only the server can write the Premium result.
- Friend codes are random and hard to guess; profiles cannot be listed.
9. Deleting: "Delete Together account", "Delete my data" and more
Action · Where · What it deletes · How fast
Delete Together account · Settings → Together account → Delete account · Your sign-in account (user ID and the email held by the sign-in service), profile, friend code, profile photo, friendships and requests, block list, kind wishes you sent and received, Premium check result; you leave every shared step, and your check marks and pending invitations you sent are deleted; the Together cache and nicknames on your phone · From the server immediately; from Google's backups within 180 days at the latest
Delete my data · Settings → Privacy → Delete my data · All Sarıl data on your phone (Privacy Notice, section 7) and, if you're signed in, everything in "Delete Together account" · From the phone and server immediately; from backups within 180 days
Sign out · Settings → Together account → Sign out · Only the Together cache and nicknames on your phone; server data stays · Immediately
Remove photo · Settings → Together account → Profile photo → Remove · Your profile photo and the report count on it · From the server immediately
Leave step · Shared step menu → Leave step · Your check marks in that step; the step continues for others and is deleted when the last member leaves · Immediately
Remove friend / block · Friend menu · The friendship record; blocking also creates a block record kept only on your side · Immediately
- What remains: a report you made may stay with your user ID for up to 12 months to prevent abuse, then it is deleted. A step's together count (the list of days everyone did it) contains no personal data and remains for the other members. Pending invitations you sent to others are deleted too. Only the block list of someone who blocked you may still hold your random user ID; that is the other person's record, and your name, email and profile no longer exist.
- Subscription: deleting your Together account or your data does not cancel your app store subscription. Cancel it under Settings → Sarıl Premium → Manage subscription.
- Store records: your purchase history stays with Apple or Google; manage it in their own settings.
10. Your rights
Your rights (access, correction, deletion, objection, portability and others) and how to use them are in section 14 of the Privacy Notice; Annex A covers the EU/EEA/UK and Annex B the United States. If you write about Together, adding the friend code shown under Settings → Together account helps us find your account. Write to support@saril.app; we answer within one month (45 days under US state laws).
11. Age
You must be at least 16 to use Sarıl. If you are between 16 and 18, please talk to a parent or guardian before turning on Together, and especially before adding a profile photo.
12. Changes to this annex
If the information processed in Together or the purposes change, we will update this annex and tell you in the app. If the scope of international transfers changes, we will ask for your consent again where consent is the basis.