Unicadde Privacy Policy

This policy explains how personal data is used in the Unicadde app and website. The controller, processing purposes, legal grounds and application rights are set out in the Privacy Notice.

In brief

• We use account and profile information to provide the services you choose.
• We show your posts and interactions to other users according to the applicable visibility settings.
• Anonymous content hides your account identity from other users; limited authorized access remains available for safety and lawful requests.
• You can manage messaging, notification and account-deletion choices in the app.
• We do not sell personal data. The initial release is free and ad-free.

1. Accounts, profiles and student verification

Account email, authentication and session information are used for registration, secure sign-in, email confirmation and address changes. In the app, you can sign in with Google, Apple or your email address and password. The authentication provider stores passwords as secure hashes rather than plain text. Your chosen provider's account identifier and supplied name/email details are processed for sign-in and secure account linking; access to Gmail or iCloud content is not requested. You may use Apple's private email address. Changing your email in the app does not change the address in your Google/Apple account. Your username, display name, optional biography and photo, university/program selection and preferences support your profile and community features. Education information is self-declared.

The service is for people aged 18 or older. Registration records the age declaration, operation time and relevant document version. Ordinary registration and student-badge verification do not request a date of birth or Turkish national identity number. For manual student verification, current enrollment information may be shown to an operator; no identity document, student card, document, photo or screen copy is collected.

The optional student badge may be granted either by verifying access to an .edu.tr mailbox using a code sent to that address or by a separately authorized operator comparing current enrollment evidence with the university you selected. The email method does not prove current enrollment or institutional affiliation; for the manual method, you may show a current enrollment screen in person or verifiable current enrollment information supplied by the institution. No copy of the evidence is uploaded, collected or retained. Your student email is not published on your profile. Only necessary verification/audit information (account, selected institution, method, operator, closed reason code, decision and expiry times, outcome) is held with restricted access; other users do not see the badge's source. The Terms of Use explain badge validity and anonymous-feature conditions.

2. Visibility, interactions and anonymity

Profile information, posts, comments and listings are shown under the relevant visibility and community scope. Hiding the post list on your profile does not change the visibility of your posts in feeds.

Users authorized to read a post can see publicly accessible profile information of people who liked it. The liker list does not disclose the link between an anonymous author and their account. Saved content, personal chat labels and the My Activity lists of your own likes, comments and saves are accessible only to your account. Account and student email addresses are not shown in these interaction lists.

Anonymous posts, comments and messages do not display your real username or ordinary profile photo in place of the relevant anonymous identity. The account link may be retained for service security and legally valid requests. Access to that link is restricted by purpose, separate authorization and an operation record.

3. Messages and notifications

Private contact starts with a message request accepted by its recipient. Messages and personal communication preferences are processed for the relevant participants. Conversations are text-based and are not end-to-end encrypted.

Private conversations are not routinely read. When a message is reported, authorized reviewers may access that content and the limited surrounding context necessary for review, with an operation record. Legally valid requests and imminent, serious safety threats are assessed separately.

Device notification identifiers, operating system, app installation and preferences are used to deliver notifications. Notifications contain a general alert and information for opening the relevant screen instead of private message or post text. You can manage notifications in app and device settings. The Terms of Use explain the differences between hiding a conversation, removing it only from your own view and deleting for everyone.

4. Images and device permissions

When you choose the gallery or camera, the relevant device function supplies the image you select. Permissions can be managed in device settings. Selecting a photo does not require general access to your entire photo library.

Uploaded files are processed; the copy used for sharing is converted to an appropriate format and unnecessary embedded information is removed. Faces, addresses and writing visible in the image remain part of it. Relevant text and images may be sent to a service provider for content-safety checks. These checks are supplemented by user reports and authorized human review; detection of every piece of personal information is not guaranteed.

5. Technical records, email and local storage

Connection and security records may include IP address, time, basic device information and approximate region derived from IP. Limited error records help resolve faults; safeguards scrub passwords, verification codes and user content from them. Error diagnosis does not use screen recording, session replay or general usage analytics.

The transactional-email service processes the recipient address and messages that may contain an email-verification or password-recovery link/code, or account information. Delivery and error records are used to investigate delivery problems. We do not use recipient-linked email open/click tracking; the provider may maintain aggregate statistics not linked to a person. An account-related welcome message does not replace marketing permission.

Marketing and legal pages do not use advertising/visitor-analytics cookies or social-media trackers. Web account sessions are temporary; tab-specific operation information is stored to track deletion status. On mobile, sessions and pending post drafts/images use protected local storage, while the language preference is kept on the device. Local records are not used for advertising tracking. Creating an account does not grant marketing-email permission.

6. Service providers and processing abroad

Hosting and file storage, transactional email, device notification, content safety, error diagnosis, network security and support providers process data within the scope required for the relevant service. Other users' access follows visibility rules; reviewers' access follows their duties and authorization. Transfers to competent authorities are limited to a concrete legal ground and the necessary scope.

The primary account and data-hosting region is Germany. Infrastructure, subprocessors and recipients' email services for other functions may operate in other countries. Article 9 requirements under Turkish data protection law are assessed separately from acceptance of the service contract. You can learn about recipient groups and transfers through the Privacy Notice or contact kvkk@unicadde.com.

7. Retention, deletion and your rights

Data categories do not share a single retention period:

When the processing purpose and legal ground end, data is deleted, destroyed or anonymized. A deletion request does not restart the retention period of older records.

You can delete your account in the app or through the account-deletion page. Once ownership is verified and final approval given, the request is irreversible; there is no 30-day reopening period. You are informed of the account, profile and content deletion result. A deleted post is removed from feeds; technical erasure and limited review/legal preservation are separate processes. The platform cannot remove copies a recipient has taken outside the service.

For information, correction and statutory deletion rights, use the Privacy Notice's application section. General support: support@unicadde.com. Security: security@unicadde.com. Child safety: childsafety@unicadde.com. In imminent danger, call 112 in Türkiye.

Material changes to processing purposes or recipient groups are communicated before the relevant operation; separate consent is requested where legally required.