Hypnos (the "app") is provided by Beyazıt Bestami Çoban ("we"). We are the data controller under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, for users in the EU, the GDPR. This policy explains what data we process, why and on what legal basis, who we share it with, and your rights. Questions: support@avangartlabs.com
Last updated: October 14, 2026
Your photo
- When you pick a template and upload a photo, it is sent over an encrypted connection to our AI provider Fal (fal.ai, USA) to create your image; Fal creates it with OpenAI's image model (USA). We ask for your explicit consent before your first upload.
- Before it leaves your phone, the photo is resized and its metadata (EXIF, including location) is removed.
- We do not keep your photo: it is never written to disk or logged on our server. Fal is instructed not to store the input, and the file Fal produces is deleted within 1 hour.
- We use your photo only to create the image you chose. We do not use it to recognize your face, to identify you, or to train any AI model.
- The result stays on our server briefly, only to deliver it to you, and is deleted within 24 hours. After that it exists only on your phone.
- Your photos and results never go into analytics or error reports.
- Every result file carries an invisible tag (IPTC) stating that it was made with AI. Results of non-subscribers also show a small Hypnos watermark in the corner.
Data we process
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Account ID (a random ID from Firebase) | To recognize your account, subscription and Diamonds | Performance of contract | Until you delete your account |
| Your e-mail and name, if you link Google or Apple | To recognize your account on another phone | Performance of contract | Until you delete your account. Held only by our sign-in provider Firebase, not in our database |
| Photo | To create the image you chose | Performance of contract and your explicit consent | Not stored |
| Result image | To deliver it to you | Performance of contract | At most 24 hours on our server |
| Generation records (template, status, date, cost; no photo, no result) | To run generations, refund failed ones, track cost | Performance of contract | Until you delete your account |
| Diamond balance and history | To keep your balance correct | Performance of contract | Until you delete your account |
| Subscription and purchase records (plan, renewal date, transaction ID, amount) | To give you what you bought, handle refunds and accounting | Performance of contract and legal obligation | For the legally required period; kept even if you delete your account |
| AI consent (version and date) | To prove you agreed before your photo was sent | Legal obligation | Until you delete your account |
| Your content reports (reason and the note you write) and likes/dislikes | To review inappropriate results and measure template quality | Legitimate interest | Until you delete your account |
| App version, platform (iOS/Android) | Compatibility and forced updates | Legitimate interest | Until you delete your account |
| IP address | To block abuse and excessive requests | Legitimate interest | At most 2 days in our counters; briefly in our hosting provider's logs |
| Device attestation token (App Check) | To verify requests come from our genuine app | Legitimate interest | Not stored |
| Crash and error reports (Sentry; device model, OS version; no images, no session replay, no personal data) | To find and fix bugs | Legitimate interest | 30 days |
| Usage events (Firebase Analytics; screens opened, templates used, purchases, device model, approximate location derived from IP, Firebase's app instance ID; no advertising ID, no images) | To improve the app | Legitimate interest | 2 months |
We show no ads, do not sell your data, and do not track you for advertising. Your data is collected automatically while you use the app and from what you enter.
Service providers
Your data is shared only to provide the service, with: Google Firebase (sign-in, device attestation and usage analytics, USA), Vercel (server, Frankfurt, EU), Neon (database, Frankfurt, EU), Cloudflare R2 (template images and the result store, at most 24 hours), Fal (AI image generation, USA), OpenAI (the image model Fal uses; receives your photo only through Fal, to create the image, USA), RevenueCat (subscription management, USA; holds only your random account ID and purchase records, not your name or e-mail), Apple App Store and Google Play (payments; we never see your card), Sentry (crash reports, EU).
When you sign in with Apple on Android, Apple's answer passes through our server to the app; nothing is stored along the way.
International transfers
Fal, OpenAI, Google and RevenueCat are in the USA. These transfers rely on the providers' standard contracts under Article 9 of KVKK and, where that is not possible, on your explicit consent. For users in the EU, transfers rely on the European Commission's Standard Contractual Clauses.
Deleting your account
In the app, go to Profile → Delete Account to delete your account for good. Your account, Diamond balance, generation records, reports and consent record are deleted; your Google or Apple link is removed, and if you linked Apple, our access at Apple is revoked. Purchase records we must keep by law and the records at RevenueCat remain. An active subscription continues with the store; cancel it in your App Store or Google Play settings. To prevent abuse, the amount and date of the welcome gift are kept, unlinked from your account, and your phone remembers that the gift was received. Images on your phone stay on your device.
Your rights
Under Article 11 of KVKK you may ask whether your data is processed, request information about it and its purpose, learn who it is shared with, ask for it to be corrected or deleted and for those you shared it with to be told, object to an outcome against you from automated processing, and claim compensation for damage. If you are in the EU, you also have the GDPR rights of access, rectification, erasure, restriction, objection and portability. Write to support@avangartlabs.com; we answer within 30 days. You may also complain to the Turkish Personal Data Protection Authority or the data protection authority in your country.
Children
Hypnos is not intended for anyone under 16, and we do not knowingly collect data from them. If we learn of such an account, we delete it.
Changes
If we change this policy, we will publish it here with a new date and announce significant changes in the app.
Data controller: Beyazıt Bestami Çoban, Istanbul, Türkiye, support@avangartlabs.com
Legal and policies
Know your rights and how Hypnos handles your data.