Who we are
Tadabox is made and run by Faruk Talmaç (Dreamlet Games, Türkiye). We are the controller of your personal data under Türkiye's Personal Data Protection Law No. 6698 (KVKK) and, for users in the European Union, the General Data Protection Regulation (GDPR). You can reach us about anything at support@tadabox.app.
This policy covers the Tadabox Android app, the tadabox.app website and the links where what you send is opened.
What we receive when you use the app
- Account details. When you sign in with Google: the name, email address, profile picture address and Google account ID that Google gives us. We access nothing else in your Google account (such as Gmail, Drive or contacts). You can change your name in the app.
- What you make. The messages and names you write (the recipient's name, your signature) and the day and scene you choose. For an invitation: the hosts' and families' names, the date and time, the venue's name and address, and a note.
- Photos. The photos you add. The app removes location and device details from a photo before uploading it; our server re-processes the photo and keeps none of that information. The app has no access to your location, contacts or microphone; it receives only the photos you pick.
- Payments. If you send a paid gift in the app, Google Play takes the payment; your card details never reach us. We keep only the purchase record Google gives us (order number, item, date).
- Security records. When you create, publish or delete something: the time, the app or browser details and a digest of your IP address that cannot be turned back into the address. We keep these to protect your account and the service against abuse.
What we receive when you open a link
Opening a link needs no account, and we use no cookies.
- Open record. Each time a link is opened: the time, browser details and a digest of the IP address that cannot be turned back into the address. The sender sees only how many times and when the link was opened, never who opened it.
- Your reply. If the host asked who is coming and you reply: your name, whether you are coming, how many of you and your note. Only the host sees your reply.
- Reports. If you report something to us, what you write.
- In your browser. When you reply to an invitation, your browser keeps only a note that you replied, so the same reply is not sent twice. You can remove it by clearing the site's data in your browser.
When you visit the website
tadabox.app has no cookies, no visitor analytics and no ads. Our server records the IP address of each request for a short time, for security (see "How long we keep it" below).
Why we use it
| What for | Legal basis |
|---|---|
| Opening your account, making what you send and showing it | Performing our contract with you (KVKK 5/2-c; GDPR 6(1)(b)) |
| Protecting the service against abuse, spam and attacks | Legitimate interests (KVKK 5/2-f; GDPR 6(1)(f)) |
| Keeping payment records | Legal obligation (KVKK 5/2-ç; GDPR 6(1)(c)) |
| Showing hosts their guests' replies | Legitimate interests (KVKK 5/2-f; GDPR 6(1)(f)) |
| Answering your questions | Performing our contract and legitimate interests |
We do not use your data for advertising, we do not sell it, and no automated system makes decisions about you.
Who we share it with
Only with the service providers that run Tadabox for us, and only as much as needed:
- Google: sign-in and Google Play payments.
- Hostinger: our server (Frankfurt, Germany) and our support email.
- Cloudflare: protects and speeds up the website; photos are stored in Cloudflare R2 in Western Europe.
Anyone who has a link can open what was sent with it. You decide who gets your link; share it only with the people you want to see it. Beyond that, we share your data with authorities only when the law requires it.
Where your data is kept
Our servers are in the European Union: Hostinger's data center in Frankfurt (Germany) and, for photos, Cloudflare's storage in Western Europe. Wherever you use Tadabox from, your data is transferred to and kept on these servers so that we can provide the service.
How long we keep it
- Your account: until you delete it.
- What you send: a gift link stays open for 1 year and a greeting link for 30 days; an invitation link closes 30 days after the event. When a link closes, its photos are deleted at once; its words and the guests' replies are deleted for good 90 days later.
- Something you delete: it closes at once and is deleted for good, with its photos, within 7 days.
- Drafts: deleted after 90 days without changes.
- Server records: 15 days at most.
- Payment records: for the period tax law requires, 5 years from the start of the year after the purchase.
Deleting your account
In the app: Account and settings → Delete account. If the app is no longer on your phone, write to support@tadabox.app from your account's email address. Your account, everything you sent, your photos and your guests' replies are deleted for good; only payment records are kept for the legal period. Details: tadabox.app/delete-account
Your rights
Under Article 11 of the KVKK and the GDPR you can ask whether we process your data, get a copy of it, have it corrected or deleted, restrict or object to its use and take it to another service. Just write to support@tadabox.app; we answer within 30 days at the latest. If you are not satisfied with our answer, you can complain to Türkiye's Personal Data Protection Board or to the data protection authority of the EU country you live in.
How we protect it
Every connection is encrypted (HTTPS). Photos open only through short-lived, signed addresses. Your password never reaches us; your session key is kept in your phone's encrypted storage. Our server is reachable from outside only through Cloudflare and goes through a security check with every update.
Children
Tadabox is not for children under 13. If we learn that someone under 13 has opened an account, we delete it.
Changes
If we change this policy, we update the date at the top; if the change is important, we announce it in the app and on the website.