Privacy Policy

01Who we are

The Lilithea mobile app (“Lilithea”) is published by CodeCraftopia. CodeCraftopia (“we”, “us”) is the data controller for your personal data under Turkey's Personal Data Protection Law No. 6698 (“KVKK”) and, for users in the European Economic Area (“EEA”), the General Data Protection Regulation (“GDPR”).

This policy also serves as our information notice under Article 10 of KVKK.

You can write to this address with any privacy question or request.

02At a glance

• Lilithea is for people aged 18 and over only.
• We don't ask for an email address, phone number or password; your account is tied to your device.
• You're anonymous in games. Your name and photos are only shared if you both choose to connect.
• Location is optional. We only store a position rounded to about 1 km, and others only ever see an approximate distance, never your location.
• Photos are screened automatically by an AI model on our own servers; they are not sent to any third party for this.
• Messages are encrypted in transit (TLS) but are not end-to-end encrypted.
• The free version shows ads from Google AdMob.
• We don't sell your personal data.
• You can delete your account in the app at any time: Settings → Delete account.

03Data we process

What we process depends on which Lilithea features you use.

Account and device

• A device identifier that the app creates the first time it runs. It combines the identifier your operating system gives the app with a random value, and it is kept in your device's secure storage. On our servers we store only a one-way hash of it, never the identifier itself.
• Your user ID, sign-in tokens, and when your account was created and last signed in.

Required at sign-up

• Your display name, birth date, gender, sun sign and rising sign.

Optional profile details

• Your bio, interests, intent (dating, friendship or both) and photos.
• Your matching preferences: age range, the genders you want to see, a distance limit and, with Premium, a gender filter for games; and whether you appear in Discover.

Location (optional)

• Only if you allow it: your position rounded to about 1 km and when it was last updated. See Location.

Your activity in the app

• Games you play, your answers and guesses, compatibility scores, and whether you chose to connect at the end of a game.
• Your likes, passes and Super Likes in Discover; your connections and the people you've blocked.
• Reports you make and reports made about you.
• Your online status and when you were last active.

Messages

• The content of messages you exchange with your connections, and when they were sent and read.

Purchases and coins

• The product you bought, when you bought it, the store's transaction ID and when your Premium ends.
• Your coin balance and coin history (earned, bought and spent).
• We never see your card or payment details.

Safety and moderation records

• Automatic screening scores for your photos and moderation decisions.
• A digital fingerprint (SHA-256 hash) of rejected uploads. The rejected image itself is not stored.
• Whether your account has been banned, and why.

Technical data

• Your IP address, request times and technical details, server logs and security incident records.

04Who sees what

In games

Your game partner doesn't see your name, photos or bio, only limited details such as your age, your signs and the interests you share. If you both choose to connect at the end of the game, your names, photos and profiles are revealed to each other.

In Discover

While you're visible in Discover, other users can see your name, age, gender, signs, bio, interests, intent, photos, your compatibility score with them, and whether you're online or when you were last active. If you both share your location, they also see the approximate distance between you (in km).

If you turn this setting off, only people you meet in games can find you.

When you like someone who has Premium, they can see your card in their list of people who liked them. Without Premium, they only see your sign, your age and your compatibility score.

Your connections

People you've connected with see your profile and the messages you send them.

What nobody sees

• Your birth date (only your age is shown).
• Your location (at most an approximate distance is shown).
• Your device identifier, purchases and coin history.

05Purposes and legal bases

We process your personal data for the purposes below, relying on the legal bases in Articles 5 and 6 of KVKK. The equivalent GDPR bases apply to users in the EEA and the UK.

06How we collect data

We collect personal data electronically, by fully or partly automated means, from:

• what you enter in the app (your profile, preferences, photos and messages);
• records created automatically as you use Lilithea (games, likes, technical logs);
• your device's location service, if you allow it;
• the app stores (purchase information);
• other users (for example messages sent to you, or reports about you).

Automated decisions

Compatibility scores and matchmaking are calculated automatically. Photo uploads are also checked automatically first: a photo that clearly breaks the rules is not uploaded, and borderline photos are passed to a person. Decisions to ban an account are made by our authorised moderators, not by automated systems. You have the right to object to an outcome against you that results solely from automated processing (see Your rights).

07Photo safety and moderation

• Every photo you upload is re-processed on our servers, which removes embedded metadata such as the location where it was taken.
• Photos are screened automatically on our own servers by an AI model that detects nudity and sexual content. Your photos are not sent to any third party for this.
• A photo that clearly breaks the rules is refused and not stored. To record the decision, we keep only a digital fingerprint of the image (a SHA-256 hash).
• Borderline photos are hidden until a moderator reviews them. The moderator either approves the photo or removes it, and removed photos are deleted.
• Repeated violations within a short time pause photo uploads temporarily.
• You can report profiles and photos. When someone is reported as possibly under 18, their photos are hidden immediately until the review is done. Reports of inappropriate content from more than one person also send the photos for review.
• Our authorised moderators review reports within 24 hours. To assess a report they can see the related chat and game records, and every such access is logged.
• Moderators can remove content that breaks the rules and ban accounts. Moderation decisions are logged.

08Messages

Your messages are stored on our servers so they can be delivered and your chat history can be shown. The connection between the app and our servers is encrypted with TLS.

Only our authorised moderators access messages, and only when needed to review a report, investigate a safety or abuse concern, or meet a legal obligation. Every such access is logged. We don't use your messages for advertising.

We recommend not sharing sensitive information such as ID, bank details or passwords in messages.

09Location

• Location sharing is optional. It's only used if you turn it on and grant the device permission.
• The app asks your device for a low-accuracy position. Our servers store it rounded to about 1 km; we don't store your precise location.
• Your position is only updated while the app is open; we don't collect location in the background.
• Other users never see your location. If you both share location, they only see the approximate distance between you.
• We use your location only to apply distance limits and show approximate distances.
• You can turn off location sharing in the app at any time, which deletes your stored location. If you only revoke the permission in your device settings, your position stops updating, but to delete the last stored position you need to turn off location sharing in the app.

10Ads

The free version of Lilithea shows ads through Google AdMob, Google's advertising service: full-screen (interstitial) ads when the app opens, and optional rewarded ads you can watch to earn coins. Premium members don't see ads.

To show and measure ads and to prevent ad fraud, Google may collect data directly from your device through the AdMob software in the app. This includes your advertising identifier (the Android advertising ID, or the IDFA on iOS if you allow it), IP address, device and app information, and your interactions with ads. Google processes this data under its own policies and as its own responsibility.

We don't give Google your profile details, photos, messages or location for advertising.

• Google Privacy Policy
• How Google uses information from sites or apps that use its services

How to limit ad tracking

• iPhone: the advertising identifier (IDFA) is only available with Apple's App Tracking Transparency permission. You can manage it in Settings → Privacy & Security → Tracking.
• Android: you can delete or reset your advertising ID in Settings → Google → Ads (on some devices Settings → Privacy → Ads).
• If you have a Google account, you can manage your ad preferences in My Ad Center.
• With Premium you won't see any ads.

11Purchases

Coin packs and Premium are bought as in-app purchases through the Apple App Store or Google Play. Apple or Google processes the payment; we never see your card or payment details.

We receive details such as the product, the transaction ID and the time of purchase from the store, and our servers check the transaction ID with Apple or Google to confirm the purchase is genuine. We use these details to add what you bought to your account, make sure the same transaction isn't processed twice, and handle refund or support requests. Apple and Google process payment data under their own privacy policies: Apple Privacy Policy, Google Privacy Policy.

12Notifications and device permissions

• Notifications: notifications about matches, games and messages are local notifications created by the app on your device; we don't send your data to a push notification service for them. You can turn them off in your device settings at any time.
• Camera and photos: used only when you choose to add a profile photo, and only for the photo you pick or take.
• Location: used only if you turn on location sharing (see Location).

All permissions are optional and can be revoked in your device settings at any time.

13Who we share data with

We don't sell your personal data. We share it only in the cases below, and only as much as needed:

• Other users: what your profile shows and the messages you send (see Who sees what).
• Our hosting provider: our servers are run by a hosting provider that acts on our behalf and on our instructions (Database Mart LLC), in the United States (see International transfers).
• Apple and Google (app stores): to distribute the app and process purchases, as independent controllers under their own policies.
• Google (AdMob): for ads, as an independent controller (see Ads).
• Authorities: competent public authorities and courts, where the law requires it (for example a court order or a prosecutor's request), or where needed to meet our legal obligations or protect rights.
• Business transfers: if our business is merged, transferred or sold, with the acquiring party, subject to the safeguards in this policy.

14International transfers

The following providers are located outside Turkey (for example in the United States). When their services are used, your personal data is transferred abroad:

• Our hosting provider (Database Mart LLC, United States): our servers and databases. When you use the app, your account, profile, messages and game data are stored there.
• Apple and Google: app stores and in-app purchases.
• Google AdMob: ads.

We carry out these transfers in line with Article 9 of KVKK, as amended in 2024 by Law No. 7499: on the basis of an adequacy decision where one exists for the destination country; otherwise with one of the appropriate safeguards listed in the law, such as standard contracts; and, where neither is available, only occasionally and in the cases the law allows (for example where the transfer is necessary to perform a contract with you, or with your explicit consent after being informed of the possible risks).

When you download Lilithea or make purchases through the App Store or Google Play, you deal directly with Apple or Google through your own account, and what you give them is covered by their privacy policies.

Users in the EEA and the UK: your data is sent to us as a controller based in Turkey and may be processed in other countries by our service providers. In those cases we rely on the transfer safeguards provided under the GDPR, such as European Commission adequacy decisions or standard contractual clauses.

15How long we keep data

We keep personal data only for as long as it's needed for the purpose it was collected for, and for any period required by law:

• Profile, photos, preferences, game and chat data: for as long as your account is open. You can edit or delete your profile details and photos in the app at any time.
• Location: for as long as location sharing is on; it's deleted when you turn it off.
• Purchase and coin records: for the periods required by tax and commercial law.
• Moderation, report and ban records: for as long as needed to keep users safe, stop banned accounts from coming back and deal with possible legal disputes, taking statutory limitation periods into account.
• Server and security logs: for a limited period needed for security.

When these periods end, we delete, destroy or anonymise the data in line with Article 7 of KVKK and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data. The next section explains what happens when you delete your account.

16Deleting your account

You can delete your account in the app at any time: Settings → Delete account. This can't be undone. If you can't open the app, follow the steps on the account deletion page.

What happens straight away

• You're signed out and the account can no longer be accessed.
• Your photos are permanently deleted.
• Your name, bio and last stored location are deleted, and your profile is taken out of Discover, games and matchmaking.
• All your connections are closed, and your chats disappear from the other person's chat list.
• The link between the account and your device is removed, so you can create a new account on the same device.
• Any remaining coins and Premium time end.

What isn't deleted straight away

The information below is not deleted together with your account. It stays linked to the closed account's internal ID, is no longer associated with your name or device, isn't shown to other users, and is kept only for the purposes listed and for the periods in How long we keep data:

• Messages you sent, your game records (answers and results) and your likes: to review reports and suspected abuse, and to respond to legal requests.
• Basic details of the closed account (birth date, gender, signs and matching preferences): to keep the account record that moderation, purchase and game records refer to consistent, and to respond to legal requests.
• Purchase and coin records: because of our legal obligations.
• Moderation, report and ban records: for safety and legal obligations.
• Server and security logs.

If you'd like this information deleted too, write to info@lilithea.com. We'll delete it unless a legal obligation or a legal claim requires us to keep it.

17Security

• All connections between the app and our servers are encrypted with TLS (HTTPS).
• We store your device identifier on our servers only as a one-way hash, and your sign-in tokens are kept in your device's secure storage.
• Access to data is limited to authorised people who need it for their work, and moderation and admin actions are logged.
• We rate-limit requests and record security incidents to prevent abuse.

No system is completely secure. If we learn that your data has been obtained unlawfully by others, we'll inform you and the Personal Data Protection Board as soon as possible, as required by Article 12 of KVKK and other applicable law.

1818+ only

Lilithea is only for people who are 18 or older. We ask for your birth date at sign-up, and anyone under 18 is turned away both in the app and on our servers.

If we learn that someone under 18 is using Lilithea, we close their account and delete their data. If you suspect this, report the profile in the app with the “Underage user” reason, or email info@lilithea.com.

19Your rights

Your rights under KVKK

Under Article 11 of KVKK, you have the right to:

• find out whether your personal data is processed;
• request information about it if it is;
• find out why it's processed and whether it's used for that purpose;
• know the third parties in Turkey or abroad that it's transferred to;
• ask for it to be corrected if it's incomplete or inaccurate;
• ask for it to be deleted or destroyed under the conditions in Article 7 of KVKK;
• ask for corrections, deletions and destructions to be notified to the third parties it was transferred to;
• object to an outcome against you that results solely from automated analysis of your data;
• claim compensation if you suffer damage because your data was processed unlawfully.

How to make a request

Email your request to info@lilithea.com. Under the Communiqué on the Procedures and Principles of Applications to the Data Controller, your request should include your name and surname, your Turkish ID number if you're a Turkish citizen (otherwise your nationality and passport or ID number), an address or email address for our reply, and what you're asking for. Please also include the user ID shown in Settings so we can find your account. We may ask for more information to confirm the account is yours.

We'll respond free of charge within 30 days at the latest. If handling the request involves a separate cost, a fee may be charged according to the tariff set by the Personal Data Protection Board.

If your request is rejected, you find our answer insufficient, or we don't reply in time, you can complain to the Personal Data Protection Board within 30 days of learning of our reply, and in any case within 60 days of your request.

Users in the EEA and the UK (GDPR)

You have the right to access your data, have it corrected or erased, restrict its processing, receive it in a portable format, object to processing based on legitimate interests, withdraw consent at any time, and not be subject to solely automated decisions with significant effects. You can also complain to the data protection authority in the country where you live or work.

Controls in the app

• Edit or delete your profile details and photos.
• Change your matching preferences, or hide yourself from Discover.
• Turn off location sharing.
• Block and report users.
• Manage notification, camera, photo and location permissions in your device settings.
• Delete your account: Settings → Delete account.

20Changes to this policy

We may update this policy from time to time. The current version is always published on this page, with its effective date at the top. We'll let you know about significant changes before they take effect, in the app or in another reasonable way.

21Contact us

For any question or request about this policy or your personal data:

For the rules of using Lilithea, see our Terms of Use.

This policy is published in Turkish and English.