Overview
This document says which data Naryu processes, what protects it, who else touches it, and what you can do about it. Where it overlaps with the Privacy Policy the two say the same thing, because both are generated from one source.
What data we process
We process your account identifier, and the token Apple gives us when you sign in with Apple, your birth date, time and place, your full birth name when you give one, your biological sex, and what you choose to tell us about yourself: your gender identity, where you live now, your goals, whether your day centres on the morning or the evening, your relationship status and relational life, and your home for a feng shui reading. We also process what you write in the app, the answers and results of your surveys, your lesson progress and quiz answers, the readings we generate for you, your friendships, your feedback, your subscription status, your app language, the version and time of each consent you give, and a device token if you turn notifications on. We also process your purchases, the one time unlocks among them, and the days of Premium your referrals earn you.
Two things we deliberately do not keep. A room photograph sent for a feng shui reading is checked, described, and discarded; only the resulting reading is stored, and the photograph is never written to storage. And when you compare charts with someone, their birth details are not stored: what is kept is a one-way hash of them, used only to recognise the same comparison again.
Lawful basis
We process your data for the purposes below. The purpose is what the app actually does, and the basis is the ground in the law we rely on for it: the EU General Data Protection Regulation (GDPR) and, if you are in Turkey, the Personal Data Protection Law No. 6698 (KVKK).
To give you the service you asked for, on the basis of our agreement with you (GDPR Article 6(1)(b), KVKK article 5(2)(c)): keeping your account and your birth details, calculating your chart from them, having the AI system write your readings from that chart, keeping what you write in your journal, keeping the friendships and comparisons you make, and recording what you have subscribed to.
With your explicit consent, which is optional and which you can withdraw (GDPR Article 9(2)(a), KVKK article 6): your answers in the dosha survey. It asks about your build, weight, appetite, digestion and sleep, so the answers are information about your health. The app asks for this consent on its own screen before the first question, apart from these documents. If you say no, the survey does not start and nothing else changes. If you withdraw it in the app's privacy settings, your answers, your result and the readings made from them are erased. The chakra survey is held to the same rule: it asks for the same consent on its own screen before its first question, and withdrawing it erases its answers, its result and the readings made from them.
With your consent, off until you turn it on, which you can withdraw (GDPR Article 6(1)(a), KVKK article 5(1)): crash reports and notifications. You can turn crash reports on when you create your account or later in the app's privacy settings, and turning them off stops them and deletes any report not yet sent. You turn notifications on yourself and off in the app or in your phone's settings. Naryu uses no analytics and sends no marketing notifications. If that ever changes, it will be with your consent and off until you turn it on.
On our legitimate interests, which are keeping the service safe and working (GDPR Article 6(1)(f), KVKK article 5(2)(f)): the rate limits and integrity checks that stop the service being abused, the short request log that lets us look into abuse and outages, the account trail that records each use of the key that encrypts your fields, and the single hashed record that stops one email address claiming the same one-time welcome gift again and again.
To meet legal obligations (GDPR Article 6(1)(c), KVKK article 5(2)(ç)): answering a request to see, export or delete your data, and keeping any record that tax law requires of us, for as long as it requires it. Payments themselves go through the App Store or Google Play, which keep their own records.
Encryption and retention
Sensitive fields are encrypted individually under a key we manage, on top of the storage layer's own encryption, and the key grants no one at Naryu the ability to read those tables by hand. Some records stay readable to the service under the storage layer's encryption only, and the Privacy Policy names them.
Your account data is kept until you delete it. Our function log keeps a hashed reference for fourteen days, our request log keeps the network address a request came from for ninety days so we can look into abuse and outages, and our account trail keeps each use of the encryption key, with your account's identifier, for 365 days. Our database backups reach back 35 days, so a deleted account leaves them within 35 days. Seven hashed records outlive a deleted account and expire on their own. The Privacy Policy lists them and how long each lasts.
Third parties and sharing
A small number of providers process data on our behalf, under contract, and only to make the app work: Google and Apple for sign-in, Google also for app integrity, notifications and crash reporting, Amazon Web Services for hosting, storage and the AI interpretation, and RevenueCat together with Apple and Google for subscriptions and purchases. RevenueCat holds, under your account's identifier, your subscriptions, the one time unlocks you buy and the days of Premium a referral reward grants you.
If you have turned crash reports on and the app stops unexpectedly, a crash report goes to Google so we can fix it. It carries the error, the device model and the app version, and it does not carry an identifier for your account. With crash reports off, nothing is sent.
Turning a place name into coordinates happens on our own servers, so where you were born is not handed to a mapping company.
International transfers
Amazon Web Services stores and processes your data for us in two places: in the European Union, in Frankfurt (eu-central-1), and in the United States, in Northern Virginia (us-east-1). Everything the app keeps for your account, your profile with your birth details, your readings, your journal, your friendships and your subscription record, is kept in both at once, so that the app stays fast and available wherever you open it. Wherever you live, then, your data is in both places: if you are in the European Economic Area, it is also stored and processed in the United States.
For the copy in the United States we rely on the safeguards in Amazon Web Services' data processing terms: the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise the standard contractual clauses of the European Commission.
If you are in Turkey, your data is transferred abroad under article 9 of the Personal Data Protection Law No. 6698 (KVKK), on the basis of standard contracts.
The AI system that writes your readings runs in the same two geographies: a request answered in us-east-1 is processed in the United States, and one answered in eu-central-1 in the European Union. Inside each, any of Amazon Web Services' regions there can answer it, so in the European Union not only Frankfurt.
Your control over your data
Export and deletion both live in the app's privacy settings.
Deleting your account is a single action that reaches twelve places: your profile, your cached readings, your journal, your feedback, your daily personal notes, your referral records, your invite code, your friendships, your subscription record, any tester enrolment, your sign-in account itself, and the token that lets us sign you in with Apple.
The export reads exactly the same places the deletion erases, so what you can take with you and what disappears are the same list.
Contact
Write to support@naryu.ai. A person answers, and the address is the same one printed inside the app.