Privacy Policy

This Privacy Policy explains how Moneo YAZILIM A.Ş. ("we," "us," or "our") collects, uses, shares and protects information when you use the Hidden Eye mobile application on iOS and Android (the "App") and the hiddeneye.ai website. We are the data controller for the information described here.

By using the App you acknowledge this Privacy Policy. If you do not agree with it, please do not use the App.

1. Information we collect

a) Information that stays on your device

To run its checks, the App asks for access to certain features of your phone. This information is processed on your device during an active check and is not sent to our servers:

• Camera and flashlight: used for the Lens Finder, its filter mode and the Lights-Off Test. The App does not record or store this preview. If you allow the AI Scan Coach, single frames are sent to it during the Lens Finder and the Lights-Off Test, as described in b) below.
• Magnetometer and motion sensors: used to show magnetic field readings in the Electronics Finder, to tell whether you are moving during a Tracker Check, and to notice if the phone is moved or the door opens during Night Watch.
• Wi‑Fi and local network: used to list devices on the Wi‑Fi network you are connected to. To do this the App may contact those devices on common ports (for example, those used by network cameras) to check what services they offer.
• Bluetooth: used to show nearby Bluetooth signals and their strength, to find devices that stay with you during a Tracker Check, and to note suspicious devices during Night Watch. Devices you mark as yours are remembered on your device.
• Location permission: iOS and Android require this permission to read Wi‑Fi information. The App does not collect, store or share your location.
• Travel mode: if you turn it on, the App keeps an identifier of the Wi‑Fi networks you have joined (such as the network name or router address) on your device, so it can remind you to scan when you join a new one.
• Your scan history, checklists and reports: saved on your device so you can see them later. Night Watch events are kept only until you close that night's report. If you choose to share a report, it is shared through your phone's share menu with the recipient you pick, and the place name you gave it is included.

b) Images you send to our AI features

The following images are uploaded to our servers and analysed by a third‑party AI service provider (currently OpenAI). We use them only to give you the result:

• AI Scan: the photo of the room you take, to point out spots worth checking and objects that face a private area such as the bed or shower. We store the photo and its result so we can show them in your results, and you can delete a result in the App at any time.
• Listing Check: the screenshots of a hotel or rental listing that you choose from your photo library. The App only receives the images you pick, not the rest of your library.
• AI Scan Coach: only if you allow it. The App asks the first time the coach appears, and you can change your answer at any time in Settings > AI Scan Coach. While it is allowed, during the Lens Finder and the Lights-Off Test the App sends a single still frame from your camera when the check starts and each time you tap "Checked, next", so the coach can suggest where to look next. If you don't allow it, or the frame can't be sent, the coach uses a fixed list of spots and no frames leave your phone.

Images sent to these features are kept for no longer than 7 days and are then permanently deleted. Please avoid photographing people.

c) Anonymous ID and subscription information

When you first open the App, we create an anonymous ID for your installation so that the App can talk to our servers. If you buy a subscription, we receive the App Store or Google Play transaction identifiers and subscription status (through our subscription provider, Adapty) to confirm your access. We never receive your payment card details; Apple and Google handle payments.

d) Usage and device information

We collect information such as the features you use, app version, device model, operating system version, language setting and IP address. We use it to run, secure and improve the App.

e) Crash reports and diagnostics

We use Sentry to find and fix errors. When the App crashes or hits an error, Sentry may receive technical details about the error, app logs, device information and your IP address. For some sessions this can include a replay of the screens shown in the App around the error; text and images in these replays are masked. If you send us feedback inside the App, we receive what you write and any contact details you include.

f) Advertising measurement

To understand which of our ads lead to app installs and purchases, the App includes the Meta (Facebook) SDK and the TikTok Business SDK. These SDKs may receive app events (such as installs, app opens and subscription purchases), device information and IP address.

• On iOS, these partners receive your device's advertising identifier (IDFA) only if you allow tracking when the App asks. You can change this at any time in Settings > Privacy & Security > Tracking.
• On Android, these partners may receive your device's advertising ID. You can reset or delete it in your device's Google or privacy settings.

g) Contact form and messages you send us

When you write to us through the contact form on our website or in the App, we receive:

• your email address, your name if you give it, the topic you pick and your message;
• from the App only: the app version, platform, operating system version, device model and app language, so we can look into problems; and, if you have a subscription, a link to your anonymous ID so we can help with subscription questions;
• a one-way hash of your IP address (not the IP address itself) and the time, to stop abuse and repeated sending.

We use this information only to reply to you. We forward your message to our support inbox and send you a confirmation email with a copy of your message, using our email provider, Resend. On the website, the form is protected by Cloudflare Turnstile, which checks your browser for signs of automated spam. Contact messages are kept for 12 months and then deleted automatically. You can ask us to delete them sooner by emailing [email protected]. If you email us directly, we receive your email address and message and use them only to reply.

h) Our website

Our website uses Google Analytics to understand how visitors use it. Google Analytics uses cookies and similar technologies to collect information such as the pages you visit, how you arrived at the site, your browser and device type, and your approximate location based on your IP address. You can block or delete cookies in your browser settings, or install the Google Analytics opt-out browser add-on.

2. How we use information

• To provide the App's features, including AI analysis of images you send.
• To verify and manage subscriptions.
• To find, diagnose and fix errors and crashes, and keep the App secure.
• To understand how the App is used and improve it.
• To measure the performance of our advertising campaigns and understand how visitors use our website.
• To respond to your requests and comply with legal obligations.

Where the GDPR or Türkiye's Personal Data Protection Law No. 6698 ("KVKK") applies, we rely on these legal bases: performance of our contract with you (providing the App and subscriptions), our legitimate interests (security, fixing errors, improving the App), your consent (tracking on iOS, and any other processing where we ask for consent), and compliance with legal obligations.

3. Who we share information with

We do not sell or rent your personal data. We share information only with service providers that help us run the App, and only as needed for the purposes above:

• Our hosting providers, which run the servers that store images sent to AI features and their results.
• AI service providers (currently OpenAI), to analyse images you send to AI features. OpenAI privacy policy
• Adapty, to manage and verify subscriptions. Adapty privacy policy
• Apple and Google, which process payments and app store transactions.
• Google Firebase, to deliver app configuration. Firebase privacy information
• Google Analytics, to understand how visitors use our website. Google privacy policy
• Resend, to deliver contact form messages to us and send you a confirmation. Resend privacy policy
• Cloudflare, which hosts our website and runs Turnstile spam protection on the contact form. Cloudflare privacy policy
• Sentry, for crash reporting and diagnostics. Sentry privacy policy
• Meta Platforms and TikTok, for advertising measurement as described above. Meta privacy policy · TikTok privacy policy

We require these providers to protect information in a way that is consistent with this policy. We may also disclose information if required by law, to protect our rights or the safety of others, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply.

4. International transfers

Some of our service providers process data outside Türkiye and outside your country, including in the United States and the European Union. Where required, we transfer data with the safeguards required by applicable law, such as standard contractual clauses or your explicit consent under the KVKK.

5. How long we keep information

• Images sent to AI features and their results: up to 7 days, or sooner if you delete an AI Scan result in the App.
• Information stored on your device: until you delete it in the App or uninstall the App.
• Subscription records: as long as needed to provide your subscription and meet legal and accounting obligations.
• Usage, diagnostics and advertising measurement data: only as long as needed for the purposes above, after which it is deleted or anonymised according to our providers' retention settings.
• Contact form messages: 12 months, then deleted automatically. Emails you send us directly: as long as needed to handle your request.

6. Your choices and rights

• Permissions: you can turn off camera, photo library, Bluetooth, location, local network and motion access at any time in your device settings, and turn Travel mode and the AI Scan Coach off in the App's Settings. Some checks will not work without them.
• Tracking: on iOS you can allow or deny tracking, and change your choice in Settings. On Android you can reset or delete your advertising ID.
• Deletion: you can delete AI Scan results and reports in the App, and uninstalling the App removes data stored on your device. To ask us to delete other data related to your installation, email us.
• Your rights: depending on where you live (including under the GDPR, the KVKK and US state privacy laws), you may have the right to access, correct, delete or receive a copy of your data, to object to or restrict processing, to withdraw consent, and to complain to a data protection authority. Under the KVKK, you can exercise the rights in Article 11 by contacting us.

Because we don't use accounts, we may ask you for information from the App (such as the date of a scan) so we can find the data that relates to you. We will reply within the time required by law.

7. Security

We use reasonable technical and organisational measures to protect information, including encrypted connections between the App and our servers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Children

The App is not intended for children under 13, or under the minimum age required in your country. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

9. Changes to this policy

We may update this Privacy Policy from time to time. We will post the new version on this page and change the "Last updated" date. If the changes are significant, we will also let you know in the App.

10. Contact us

If you have questions about this Privacy Policy or want to exercise your rights, contact us: