Privacy Policy

This policy explains how your personal data is collected, processed and protected when you use the Auraly AI web application (auraly-ai.com) and the Auraly AI mobile application (together, the "Service"). Under Turkish Personal Data Protection Law no. 6698 (KVKK), the data controller is Mustafa Erhan Portakal, the developer of the Service. You can send any questions to portakalm11@gmail.com.

We only collect the data needed to provide the Service:

• Account details: your username, email address and — if you signed up with email — your password. Your password is never stored as plain text; it is hashed irreversibly (bcrypt).
• Social sign-in details: if you sign in with Google or Spotify, we receive only your name and email address from those providers.
• Mood and content data: the mood text you write to get recommendations, the mood inferred from it, and the history of the track recommendations you were shown (your mood journal).
• Usage and feedback data: your likes and dislikes, favorites, play and skip events, and listening durations. A taste profile that personalises recommendations is derived from this data.
• Connected music accounts: if you connect a Spotify or YouTube account, we store the access tokens (OAuth) limited to the scope you granted, plus your Spotify user id, display name and subscription type (Premium/Free).
• Technical data: error logs for debugging (Sentry), daily AI usage counters for fair use, and your group assignment in product improvement experiments (A/B tests).

We do not run advertising trackers, and we do not access your location, contacts or device files.

• To generate track and playlist recommendations that fit your mood,
• To improve those recommendations over time based on your taste (you can turn personalisation off in settings),
• To keep your mood journal and favorites in your account,
• Account security: sending email verification and password reset messages,
• To detect errors and measure service quality,
• To enforce fair use quotas.

We do not sell or rent your data, and we do not share it with ad networks.

The mood text you write is sent to Google's generative AI service (Gemini) in order to understand your mood and produce recommendations. This transfer happens only to generate that particular recommendation; the text is processed by Google under Google's privacy policy and its API data processing terms. Recommendations are generated automatically; no automated decision producing legal effects about your account is made.

We work with the following service providers to deliver the Service; their servers may be located outside Türkiye:

• Google — sign-in with Google (OAuth), Gemini AI analysis and the YouTube Data API (track matching, playlist export),
• Spotify — track search, previews and, if you connect it, playback and playlist saving on your account,
• Sentry — application error monitoring,
• Email infrastructure (SMTP) — delivery of verification and password reset emails.

Only the minimum data required for each function is transferred to these providers. Transfers are made under Article 9 of the KVKK, within the security measures those providers commit to.

When you sign in with your Google account or connect your YouTube account, we use the information received from Google APIs only for the functions described above; we do not use it for advertising and we do not sell it to third parties. Our use and transfer of data received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Auraly AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can manage the following from the privacy settings inside the app:

• Private listening: while it is on, new recommendations are not saved to your mood journal,
• Personalisation: while it is off, your taste profile is not applied to recommendations,
• Public profile: off by default; your profile is not shown to others unless you turn it on,
• Connected accounts: you can disconnect Spotify or YouTube at any time; the access tokens are deleted.

Your data is retained for as long as your account stays open. You can permanently delete your account from profile settings on the web, from the Privacy screen in the mobile app, or by emailing us. On deletion, your account, mood journal, recommendations, favorites, taste profile, feedback events and connected account tokens are deleted irreversibly. Only aggregate usage records kept for legal obligations and cost accounting continue to be stored, stripped of your identity (anonymised).

All connections are encrypted with TLS (HTTPS). Passwords are hashed with bcrypt, sessions are managed with short-lived signed tokens (JWT), and password reset and verification links are single-use and stop working once they expire. Connected account tokens are limited to the scope you granted.

We do not use advertising or third-party tracking cookies. The authentication data needed to keep you signed in is held in your browser's local storage (localStorage) and in the device's secure storage in the mobile app; it is cleared when you sign out.

The Service is not directed at children under 13, and we do not knowingly collect data from them. If we become aware that we hold data belonging to a child under 13, we delete it as soon as possible.

Under Article 11 of the KVKK you may at any time request:

• To learn whether your personal data is processed, and to request information about it,
• To learn the purpose of processing and whether it is used accordingly,
• To know the third parties to whom it is transferred, domestically or abroad,
• To have it corrected if it is incomplete or inaccurate,
• To have it erased or destroyed,
• To object to the consequences of the processing,
• To claim compensation if you suffer damage due to unlawful processing.

You can send your requests to portakalm11@gmail.com; we respond within 30 days at the latest.

We may update this policy from time to time. For significant changes, the "Last updated" date at the top of the page is refreshed and, where needed, we notify you inside the app. The current version always stays published on this page.

For any privacy question or request: portakalm11@gmail.com

This English text is a translation provided for convenience. The binding version of this policy is the Turkish one; in the event of any discrepancy between the two, the Turkish text prevails.