Drink Buddy Privacy Policy

1. Who is responsible

Drink Buddy is published by Harun Yahya Öztürk under the Elanorya brand. He is the controller of the information described here, and can be reached at Gülbahçe Mah. 7. Işık Sk. No: 29 İç Kapı No: 2, 16080 Osmangazi / Bursa, Türkiye. Privacy and data-rights requests are received at privacy@elanorya.com, general support at support@elanorya.com, and security reports at security@elanorya.com. Each mailbox is in service.

This document covers the Drink Buddy mobile app only. Elanorya publishes other apps, and each one has its own privacy policy describing its own system, because each one uses different processors and keeps different data.

2. Who can use Drink Buddy

Drink Buddy is for adults aged 18 and over, and older where the legal drinking age where you live is higher. We ask for your date of birth once, when you first sign in, and we keep it so that we do not have to ask again and so that we can show the check happened. If you tell us you are under 18 you cannot use the app.

We do not knowingly collect information from children. If you believe a child has an account, write to privacy@elanorya.com and we will remove it.

3. What you give us

Your email address. This is the only thing we require. We use it to sign you in: we email you a one-time link, so there is no password to choose, forget or have stolen.

Your date of birth, once, for the age check described above.

Your profile — a display name, a username, an optional short bio and an optional photo. If you change your username, the previous one is kept in a history record so that it cannot immediately be taken by somebody else.

Your check-ins — what you drank, the serving size, the time, your local date and time zone, an optional note, optional photos and, if you let the app use your location, where you were.

Your comments, reactions and likes on check-ins you can see.

Your Buddymoji — up to ten selfies, one for each reaction mood, taken with the front camera inside the app. Nothing can be chosen from a photo library. When you react to a check-in with a mood you have a selfie for, that selfie appears on your reaction. A reaction itself stores only the mood, never a photo. Nothing in the app analyses faces. We also record when you accepted the one-time notice that explains who can see your Buddymoji.

Your connections — friends, friend requests, groups, and anyone you have blocked or muted.

Your settings — time zone, language, quiet hours, notification sound, whether you can be found by username, whether you appear in friend suggestions, who may see your locations, whether notifications about your friends' check-ins say how far away they are, whether your drink statistics are hidden, whether your likes go to your friends' new check-ins on their own, and whether the app saves your check-in photos to your phone.

People you hide from your friend suggestions, so that they stay hidden.

What you send us from the app: an idea, your votes on our feedback board, a rating from 1 to 5 with an optional comment, and bug reports. A bug report carries what you write, a screenshot if you choose one from your phone, and your phone's details: the platform, the operating system version, the app version and build, and on Android the phone's maker and model. Only we read any of it.

Your purchases, if you buy Buddy+ or a Supporter badge: whether Buddy+ is on and until when, and the highest Supporter badge you own. Google Play takes the payment; we never see your card or your payment details, and we keep no prices, receipts or order numbers.

Reports you send us about content or behaviour.

Before a comment, a check-in note, a place name you type, a display name, a bio, a group name or an idea is saved, our server checks it against a short list of slurs and refuses it if it contains one. The check runs on our own server, and nothing it reads is kept for that purpose or written to a log.

4. What we collect automatically

Your device, so that we can send notifications: platform, operating system version, device model, language, app version, a push token, and when the device was last seen.

Your sessions, so that you stay signed in and can see and end your other devices. A session record includes the IP address and the app or browser identifier it was created from, and those two are stored as they are, not hashed. A session ends after 30 days without use, and always after 90 days at the latest.

The phones you sign in on, so that we can tell you about a new one. When you sign in on a phone your account has not used before, we email you to say so. To recognise a phone we keep a one-way hash of an identifier the app creates for itself, never the identifier, and we forget a phone that has not been seen for 400 days.

Your approximate position, only for the distance in your friends' notifications. On Android, if you share your location with your friends, have already allowed the app to use your location and leave "Show how far away friends are" on, the app sends your position, rounded to about 100 metres, when it opens or comes back to the front, at most once every 10 minutes. It is kept for two hours and overwritten each time, it is never shown to anybody, it is left out of our backups, and it is deleted at once when you turn that switch off or stop sharing your location with your friends. The app never asks for location access for this.

An invite you followed before installing the app. On Android, when you open an invite link before the app is installed, Google Play hands the invite's code to the app the first time it opens. The app keeps the code on your phone for up to 7 days, only to show you who invited you, and sends it nowhere but our server.

A random identifier for purchases, only if you need one. On Android, when purchases are available, our server makes one for your account the first time you open Buddy+ or the Supporter badges, buy something or restore a purchase. It is never your account's identifier, your name or your email address. The app signs in to RevenueCat with it whenever you do one of these, so that a purchase can be matched to you and restored on a new phone, and also each time it opens while you have Buddy+ or a Supporter badge, or for up to 14 days while Google Play is still waiting for a payment you started. If you never open Buddy+ or the badges, buy or restore, the app never contacts RevenueCat and no identifier is made.

A security log of sensitive events such as sign-ins and deletion requests. Here the IP address and the device identifier are stored only as one-way cryptographic hashes computed with a secret held on the server. We can tell that two attempts came from the same place; we cannot read the address itself.

Anti-abuse counters that limit how many sign-in emails can be requested and stop somebody who fails the age check from retrying immediately. These are keyed on a hash of the email address or of a device identifier, not on the value itself. One more counter, which limits how often sign-in can be attempted from one place, is keyed on the IP address as it is, and is deleted a day after its last use.

Error reports and our server's log. When something goes wrong on our server, it sends a report of the error to Sentry: what failed and where, the part of the service involved, a reference for the request and, if you were signed in, your account's identifier. A report never contains what you typed, the content of the request, its headers or your IP address. When the app itself crashes or hits an error, it sends a report to Sentry too: what failed and where in the app; the app's version and build, when it was started, whether it was on screen and which permissions you have given it (such as the camera, location or notifications); and your phone's maker and model, its processor, memory and screen, its language, time zone and operating system version, and when it was last switched on. Sentry's software adds a random identifier of its own for the installation. An app report never contains your account's identifier, your name, what you typed, your location, a screenshot, or your phone's battery, network or storage, and the app sends no usage or performance data. Our server also keeps a log of what it does, on our own server and nowhere else: for each request its method, its address with any code in it removed, and its result, and for other events the identifiers of the accounts or items concerned. The log never records the content of a request, a header, a password or an IP address.

5. Location

Nothing about where you are is recorded until you let the app use your location, and what it records is two separate choices rather than one. The first is whether a check-in records where you were at all: the app asks for location access the first time you check in, and if you allow it, your check-ins record where they happened until you turn that off in Settings. The second is who may see it, and it has four settings: nobody, which is the default; only you; your friends; or people you pick.

When a check-in does carry a location, our own server works out the country, the city and the region from map data we host ourselves: country borders from Natural Earth and place names from GeoNames. No coordinate of yours is ever sent to a mapping company or to any other third party for this, and no such service is called at all. Coordinates are stored to four decimal places. If you let the app use only your approximate location, that approximate position is what is recorded. Check-ins made before October 2026 had their city and region worked out again the same way, once.

The app does not include a background location component. It asks your phone for a position while you are checking in; when you ask the map to show where you are, which moves the map and records nothing; and, if you share your location with your friends and leave "Show how far away friends are" on, when the app opens or comes back to the front, for the distance in your friends' notifications described in section 4.

Place names are from GeoNames (geonames.org), licensed under Creative Commons Attribution 4.0, and adapted by us to group a city's districts under the city.

6. What we do not collect

We do not use advertising identifiers and we do not run advertising. There is no advertising component in the app at all.

We do not use third-party analytics, and the app contains no analytics component. The app and our server report their own errors to Sentry, as described in section 4. If we add anything else of this kind, this page will name it before it ships.

We do not sell or share your personal information, in the sense those words carry under the California Consumer Privacy Act or under any other law. We do not supply it to data brokers.

7. Why we are allowed to process it

Your email address, profile, check-ins and connections are processed because they are the service you asked for. Under the General Data Protection Regulation the basis is performance of a contract, Article 6(1)(b).

Your date of birth is processed to keep people under 18 out of an app about alcohol. The basis is a legal obligation together with our legitimate interests, Article 6(1)(c) and 6(1)(f).

Sessions, the security log, the email about a new phone and the anti-abuse counters are processed to stop accounts being taken over and to stop the sign-in system being abused. The basis is legitimate interests, Article 6(1)(f).

Error reports, our server's log and backups are processed to keep the service working and to recover it after a failure, and the word filter to keep slurs out of what people write for each other. The basis is legitimate interests, Article 6(1)(f).

A location attached to a check-in, and the approximate position used for the distance in your friends' notifications, are processed because you allowed the app to use your location and chose to share it. The basis is consent, Article 6(1)(a), and you can withdraw it at any time, in Settings or in your phone's settings, without losing anything else.

Push notifications are sent because you allowed them. The basis is consent, Article 6(1)(a), withdrawable in Settings or in your operating system.

What you send us from the app — ideas, votes, ratings and bug reports — is processed to answer you and to improve Drink Buddy, on the basis of our legitimate interests, Article 6(1)(f). Your purchases are processed to give you what you bought, on the basis of performance of a contract, Article 6(1)(b).

8. Who else sees it

Other people see only what you choose. Drink Buddy is friends-only: your check-ins go to the people you are friends with, subject to the visibility you set. There is no public feed and strangers cannot find or follow you.

A Buddymoji you react with is shown on your reaction to everyone who can see that check-in. That includes the author's friends, some of whom may not be your friends — the same people who can already see who reacted. The app tells you this before your first Buddymoji reaction.

Likes work the same way: everyone who can see a check-in can see who liked it.

When you check in, each of your friends who has not muted you gets a notification, in the notification sound you chose. It names you and the drink you checked in, but leaves the drink out for a friend who hides alcohol from their statistics. For a check-in whose place that friend can see on the map, it may also say how far away you are: "nearby" under a kilometre, or the distance in whole kilometres up to 100, and nothing farther. A friend gets at most one an hour from you and none during their quiet hours, and can turn them off in Settings.

If you leave "Appear in friend suggestions" on and can be found by your username, people who share at least two friends with you may see your name, username and photo among their suggestions, with how many friends you share, never who they are.

If you turn on "Like my friends' check-ins for me", your like is added to each new check-in from a friend you have not muted, and it shows as your like, like any other.

If you have Buddy+ or a Supporter badge, the badge is shown beside your check-ins and on your profile to everyone who can see them. Nothing else about a purchase is shown to anybody.

When you share your invite link, the page it opens shows your name and photo to whoever opens it. Search engines are told not to list it, and the preview a messaging app draws for the link names nobody.

When you share your progress or invite someone, you choose where it goes. The app prepares the text or picture on your phone and hands it to the app you pick, such as WhatsApp, Instagram or Snapchat, through your phone's share sheet; we do not send it anywhere and do not learn where it went. Your progress lists the days you checked in, your streak, your cities and countries, your groups and the drinks you checked in, alcoholic ones included unless you have hidden alcohol from your statistics, with your invite link. An invite picture shows your name and a code that adds you as a friend.

Service providers process on our instructions and for nothing else. Resend delivers your sign-in email and the email about a sign-in on a new phone, and sees your email address; it also delivers to us a daily summary of the ideas, ratings and bug reports sent that day, which carries no name, username, email address or account identifier. Cloudflare object storage holds your photos in a private bucket that is reachable only through short-lived signed links, and our encrypted backups in a second private bucket. The Expo push service, together with the Apple and Google notification services, delivers notifications and sees your push token and the notification text. If you choose to continue with Google or with Apple, that company sees a sign-in token. Sentry receives the app's and our server's error reports, in its European Union data region, as described in section 4. RevenueCat (RevenueCat, Inc., in the United States) checks your purchases with Google Play, follows renewals and refunds, and restores purchases on a new phone. Only after the app has signed in to it, at the moments described in section 4, does it receive your purchase history, the random identifier described there, the app and operating system versions, and your phone's language and currency. Our own servers, which we operate ourselves, hold everything described above.

The map in the app is drawn from OpenFreeMap, a free map service. Your phone downloads the map for the area on screen directly from OpenFreeMap, which therefore sees your IP address and which area is shown, but nothing about your account or your check-ins.

Our sign-in library runs on our own servers and is not a separate company, so it is not a processor and is not listed as one.

We will also disclose information where the law requires it — a court order or a valid request from an authority — and we will tell you when we are permitted to.

If we find child sexual abuse material in Drink Buddy, we report it, with the details of the account responsible, to the National Center for Missing & Exploited Children (NCMEC) and to the relevant national authority — in Türkiye, İhbar Web, run by the Information and Communication Technologies Authority (BTK). We do not tell the account holder first. Our Child Safety Standards explain how we handle it.

9. Where your data is

The application server and the database run on server infrastructure we operate ourselves, in Türkiye. Your photos and avatars are held in Cloudflare object storage located in the European Union, and the encrypted backups of the database in a separate bucket there. Sentry holds the app's and our server's error reports in its European Union data region; our server's log stays on our own server. RevenueCat processes your purchase information in the United States.

Where a provider processes data outside the country you live in, that processing is covered by the transfer terms in our agreement with that provider, including the European Commission's Standard Contractual Clauses where they apply.

10. How long we keep it

Your account and everything in it is kept until you delete it.

Each Buddymoji selfie is kept until you replace it, delete it or delete your account, unless it is subject to a legal obligation described below. Replacing or deleting one changes every reaction that showed it at once; no old copy stays on past check-ins.

Sessions end after 30 days without use and after 90 days in every case, and the record of a session is deleted once it has ended. A sign-in link is deleted once it has expired. Short-lived keys used to stop a request being carried out twice expire after 24 hours.

A released username stays reserved for a period after you release it, so that nobody can take a name you have just given up and be mistaken for you. This is kept even after the account is deleted, and it is deliberate.

Anything we are legally required to keep — for example content subject to an open legal claim or to an official investigation — is kept until that obligation ends, and no longer.

Content someone has reported is kept while the report is being handled and for 90 days after it is decided, even if it is deleted and even if the account is, so that the decision can be contested or handed to an authority that asks. After those 90 days the report itself keeps only its reference, its reason, its outcome and its dates. When a report concerns a child's safety, the content is kept until the authorities no longer need it. Then it is deleted.

The security log is kept for 12 months, then deleted.

Every night we make an encrypted copy of the database. Daily copies are kept for a week, weekly copies for five weeks and monthly copies for 12 months, and then deleted. A copy is used only to recover the service after a failure. This means that something deleted from the service can remain in an encrypted copy, unused, until that copy is itself deleted, at most 12 months later.

Notifications you have read or removed are deleted 180 days after they were sent; one you have not read is kept until you do. Our record of a push notification is deleted 7 days after it was delivered or given up on.

An account whose sign-up was never finished is deleted after 30 days.

Ideas, ratings and bug reports, screenshots included, are deleted 365 days after you send them. A vote on our feedback board lasts until its item is removed or your account is deleted.

The approximate position used for the distance in your friends' notifications is kept for two hours.

Someone you hide from your friend suggestions stays hidden until either account is deleted.

Your purchase information is kept while your account exists.

A phone your account has not been used on for 400 days is forgotten.

Sentry keeps an error report for up to 90 days. Our server's log is kept for 30 days.

11. Deleting your account

You can delete your account from inside the app, or from the deletion page on this site, without installing anything.

When you request deletion, your account becomes invisible to everyone else immediately. You then have 7 days to change your mind: signing back in and cancelling restores everything.

After those 7 days a job that runs every hour permanently erases your account, your check-ins, your photos, your comments and your connections, including from our object storage. This cannot be reversed and we cannot recover it. The job records what it removed.

The same job deletes your record at RevenueCat. Deleting your account does not cancel a Buddy+ subscription: cancel it in Google Play, under Subscriptions, before or after you delete your account.

Three things survive, and we would rather tell you than surprise you. A released username stays reserved for a while, as described above. Anything under a legal hold is kept until that hold ends. And the encrypted backups made before your account was erased still contain it until each of them is deleted, at most 12 months later; they are used only to recover the service after a failure.

12. Your rights

If you are in the European Economic Area or the United Kingdom you have the right to access your data, correct it, delete it, restrict or object to how we use it, and receive it in a portable form. Where we rely on your consent you may withdraw it at any time, and withdrawing it does not make what we did beforehand unlawful.

Users in Türkiye hold the rights set out in Article 11 of Law No. 6698, including learning whether their data is processed, requesting correction or erasure, and applying to the Personal Data Protection Board. No data-protection officer or representative has been appointed at this time.

Deletion works in the app, immediately, as described above. For a copy of your data, write to privacy@elanorya.com and we will send it within 30 days. There is no one-tap export button in the app today; when we build one, this page will say so.

You may complain to your data protection authority at any time.

13. Security

Sign-in links are stored only as hashes, can be used once, and expire ten minutes after they are sent.

There are no passwords to steal. The single exception is one account that is not available to the public and holds only fabricated data, which exists so that app store reviewers can sign in — a reviewer cannot read a mailbox they do not own.

Photos live in a private bucket and are served only through links that expire. IP addresses in our security log are hashed rather than stored. The rules that keep these properties true are checked automatically and a build that breaks one of them fails. Backups are encrypted before they leave our server, to a key that is kept off the server.

No system is perfectly secure and we will not pretend otherwise. If there is a breach that puts you at risk, we will tell you and the relevant authority within the time the law allows.

14. Changes

When this policy changes we update the date at the top and list the change below. If a change materially affects you, we will tell you in the app before it takes effect.

15. Version history

October 17, 2026 · Version 1.4 — Added the app's own crash reports, feedback you send from the app, the approximate position behind the distance in your friends' notifications and what those notifications now say, friend suggestions, likes added on your behalf, saving your photos to your phone, invites followed before installing, the name and photo on the invite page, and Buddy+ and the Supporter badges, with RevenueCat, which checks and restores purchases.

October 14, 2026 · Version 1.3 — Named Sentry, which receives our server's error reports, and OpenFreeMap, which draws the map. Said what our server's log holds and that it stays on our server. Added notifications of friends' check-ins, the email about a sign-in on a new phone, the word filter, and what happens when you share your progress or an invite. Stated how long we keep the security log, backups, notifications, unfinished sign-ups and the phones you sign in on, and corrected how one anti-abuse counter is keyed.

October 1, 2026 · Version 1.2 — Added Buddymoji, the selfies you can react with, and likes, and who sees them. City and region names now come from GeoNames place data on our own server. Said more precisely when the app asks for your location, and how long reported content is kept.

September 16, 2026 · Version 1.1 — Named the person responsible for your data and his postal address. Added how child sexual abuse material is reported.

September 7, 2026 · Version 1.0 — First published version.