+TV: Social Privacy Policy
Draft. This document is being finalized and may change before the public release of +TV: Social.
Last updated: October 4, 2026
This policy explains what personal data the +TV: Social app ("+TV") collects, why, where it is stored, and the choices you have. +TV is provided by Barış Salih Babacan, developing +TV: Social under the Garage brand (garage.ist) ("we", "us"), who is the data controller for the purposes of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the EU General Data Protection Regulation ("GDPR"). Address: [TBD: address]. Contact: support@garage.ist.
1. Data you give us
- Account. When you sign up with e-mail, Google or Apple, we receive your e-mail address and a user ID from that provider. Google and Apple may also share your name and profile photo; we use them only to pre-fill your profile, and only if they meet our profile rules.
- Profile. Display name, username, bio, profile photo and whether your account is private. Your display name, username, bio, photo and follower/following/suggestion/watchlist counts are public: anyone with a link to your profile can see them, even without an account.
- Posts. Text you write and the films or series you attach. Posts of a public account are visible to anyone; posts of a private account only to you and your approved followers.
- Watchlist. Titles you want to watch or have watched, and your ratings. Visible like your posts. Your notes, priorities, order and series progress are private to you.
- Where you watch. Your country and streaming services, if you set them. Private to you; used to tell you when a title becomes available on your services.
- Social activity. Who you follow, follow requests, and who you block. Followers and following are reflected in public counts; your block list is private.
- Messages. Direct messages you send and receive, and "watch together" invites. Messages are visible to both participants. When you delete a message its text is removed from the chat; we keep a copy for 30 days only to handle reports of abuse, then it is deleted automatically.
- Reports. When you report a user, message or post, we store your report and a copy of the reported content so our team can review it. The reported person is not told who reported them.
- Purchases. If you subscribe to the verified badge, Apple processes the payment. We receive the transaction identifiers and expiry date needed to grant the badge; we never receive your payment details.
2. Data collected automatically
- Push notifications. If you allow notifications, a Firebase installation ID for your device, plus the device platform, model and system version, so we can send you notifications.
- Crash reports. Firebase Crashlytics collects crash and error reports (device model, OS version, app version, the technical cause). They do not include your messages or profile content.
- App integrity. Firebase App Check verifies that requests come from a genuine copy of the app (Apple App Attest). It does not identify you.
- Region. Your device's region setting is used to suggest a country for "where to watch". We do not request your location.
3. Data that stays on your device
- TV remote. To control your TV, the app searches your Wi-Fi network (with your permission) and stores the TVs you pair, and the pairing keys they issue, only on your iPhone (pairing keys in the iOS Keychain). This information is never sent to our servers.
4. How we use data
To run your account and profile; show posts, watchlists and messages to the people allowed to see them; send the notifications you asked for; filter prohibited language (posts, profiles and messages are checked automatically against a list of banned words); review reports and enforce our Terms; grant purchases; fix crashes; and keep the service secure. We do not sell your data. The app currently shows no advertising and contains no advertising or tracking SDKs. If that changes, we will update this policy first and, where required, ask for your permission (App Tracking Transparency) before any tracking.
The banned-word filter works automatically: a post or profile change that matches is refused, and a matching message is hidden. If you think the filter got it wrong, write to support@garage.ist and a person will look at it.
Legal bases. We collect this data electronically through the app and process it on these grounds (KVKK Article 5, GDPR Article 6):
- Performing our contract with you — your account, profile, posts, watchlist, follows, messages, invites, notifications you turned on, and purchases.
- Our legitimate interests — keeping the service and its users safe (the banned-word filter, reports, blocking, App Check), fixing crashes, and preventing abuse. We balance these against your rights.
- Legal obligations — keeping the records the law requires and answering lawful requests from authorities.
- Your consent — push notifications and access to your local network for the TV remote. You give it in the iOS permission prompt and can withdraw it at any time in the Settings app.
5. Service providers
- Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Messaging, Crashlytics, App Check) stores and processes the data above. The database is hosted in the European Union (multi-region
eur3); some server functions run in the United States (us-central1).
- Apple — Sign in with Apple, push delivery (APNs), App Attest, in-app purchases.
- Google — Sign in with Google.
- Resend sends our account e-mails (address verification and password reset) from noreply@plus.tv. It receives your e-mail address and the message, processes them in the European Union (Ireland) and keeps a delivery log for up to 30 days.
- TMDB (The Movie Database) provides film and series information; JustWatch provides streaming availability. When the app loads title data or images from TMDB, TMDB receives your IP address like any website does. We do not send them your account data.
These providers process data only on our behalf or to provide their part of the service, under agreements that require the same level of protection as this policy. Some of them process data outside Türkiye and outside the European Economic Area. For these transfers we rely on the standard contractual clauses offered by the providers (for Google, the Google Cloud and Firebase data processing terms with standard contractual clauses under the GDPR and the standard contract under KVKK Article 9).
6. Retention and deletion
We keep your data for as long as your account exists, or until you delete the specific item (a post, a message, a watchlist entry). You can delete your account at any time in Settings → Delete Account. We then delete your profile, username, profile photo, posts, watchlist, follows, notifications and sign-in account. Some data remains:
- Messages you sent stay visible in the other person's chat history.
- Reports you made or that concern you are kept until they are resolved and for one year after that, to handle repeated abuse, then deleted.
- A minimal deletion record (your user ID and its status) is kept so a deleted account cannot be restored by an old session.
- Crash reports are kept by Firebase Crashlytics for up to 90 days.
7. Your rights
You have the right to:
- learn whether we process your personal data and request information about it;
- learn the purpose of the processing and whether the data is used accordingly;
- know the third parties, in Türkiye or abroad, to whom your data is transferred;
- ask us to correct incomplete or inaccurate data;
- ask us to delete your data (you can delete your account yourself in Settings → Delete Account);
- ask us to tell the third parties we shared your data with about a correction or deletion;
- object to a result against you that arises only from automated processing;
- claim compensation if you suffer damage from unlawful processing;
- if the GDPR applies to you, receive your data in a portable format and restrict or object to its processing.
Most profile data can be changed in the app. For anything else write to support@garage.ist; we answer within 30 days at the latest. If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, kvkk.gov.tr) or, in the European Union, to the data protection authority of your country.
8. Children
+TV is only for people aged 16 or older. We do not knowingly collect data from anyone younger. If you believe someone under 16 has an account, write to support@garage.ist and we will delete it.
9. Changes
We will post changes on this page and update the date above. Significant changes will be announced in the app.
Barış Salih Babacan, developing +TV: Social under the Garage brand (garage.ist). Address: [TBD: address]. E-mail: support@garage.ist.