Privacy Policy

1. Data you provide

We process registration and login details such as your name, email address, account identifier and a password hash where password login is used. Google and Apple can supply the identity details you authorise; we do not receive their passwords. Apple may provide a private relay email address. Guest use can be linked to an installation identifier without a registered profile.

We process support messages, your chosen categories and language, notification preferences and information you voluntarily send to resolve a request. Do not send card security codes, passwords or unnecessary personal information.

2. Viewing, device and transaction data

Service records can include watched episodes and progress, saved items, likes, coin balances, reward eligibility and claims, ad completion verification and subscription status. Technical data includes IP address, approximate country, device and installation identifiers, browser or app version, operating system, time zone, timestamps and error diagnostics.

Payment providers supply product, amount, currency, transaction references, entitlement status and related verification data. Card entry is handled by the checkout or store; NanaShort does not store your full payment card number or CVV.

3. Why we process data and the legal grounds

We use data to sign you in, deliver licensed videos, remember progress, personalise recommendations, credit confirmed rewards, manage purchases, enforce active-device limits, answer support requests and prevent abuse.

Depending on the applicable law, processing relies on performance of a contract, legal obligations, legitimate interests in security and reliable service, or consent where required. Optional marketing, advertising identifiers and permissions are subject to the choices and consent requirements applicable to that feature. Accepting a user agreement is not blanket consent to all data processing.

4. Service providers

• Google and Apple support sign-in, app distribution and in-app billing where used.
• iyzico and Polar handle website checkout where offered; RevenueCat helps validate and manage mobile purchase entitlements.
• Google AdMob serves and verifies optional rewarded advertisements when enabled. Its SDK may process advertising identifiers, device information, IP address, interaction and consent data.
• Expo, Firebase Cloud Messaging and Apple Push Notification service deliver enabled mobile notifications using a push token and relevant delivery data.
• Sentry provides error and performance diagnostics and, where enabled, masked session replay. Microsoft Clarity provides website interaction analytics and session recordings. Meta Pixel measures website campaign visits and conversions. These tools can process device, page, interaction and online identifier data.
• ipapi.co can receive your IP address to suggest a website language. Hosting, database, email and content-delivery providers process the data needed to deliver the Service.

Providers receive data relevant to their function and may also process data under their own privacy notices. We do not offer your personal data for sale. Disclosure to an advertising or measurement provider may be treated as sharing under some privacy laws; contact us about applicable objection or opt-out rights.

5. Cookies and device storage

The Cookie Policy describes sign-in and device cookies, browser storage, analytics and marketing technologies. The apps also use local device storage for login state, preferences and cached activity. Blocking or clearing necessary storage may sign you out or remove local preferences.

6. Ads, permissions and notifications

Where rewarded ads are available, you choose whether to watch them. Available ad privacy messages and operating-system controls let you manage relevant permissions and advertising choices. Reward verification associates an ad completion with the relevant account or episode; it is used to prevent duplicate awards.

Push notifications require permission and registration. They may concern claimable rewards, unfinished viewing, approved tasks, membership or relevant new titles and campaigns. You can disable them in NanaShort settings or the device settings. Notification preference changes do not cancel a paid subscription.

The Service does not require precise GPS location, contacts or microphone access for ordinary viewing. Any additional optional permission must be requested for the relevant feature.

7. Sharing and international processing

We may disclose necessary records to service providers, a competent authority where lawfully required, or parties involved in a genuine security investigation or legal claim. A corporate restructuring may require a data transfer with appropriate notice and safeguards.

Providers can operate outside Türkiye or your country of residence. International processing is subject to the safeguards required by the law that applies, including relevant KVKK or GDPR transfer requirements. Contact us for information about a particular transfer and the applicable safeguards.

8. Retention and security

We retain data for the period needed for its stated purpose, account administration, legitimate security investigations and applicable accounting or legal requirements. Deletion requests do not remove records that must legally be retained; access to those records is limited. Contact support for retention information relevant to your records.

We use encrypted transport, access controls and hashed passwords where applicable. Diagnostics are configured to reduce sensitive data, but no system can guarantee absolute security. Security incidents are handled and notified as applicable law requires.

9. Your rights and choices

Subject to applicable law, you can request access, correction, deletion, a copy or portability, restriction or objection, information about recipients and review of relevant automated processing. You may withdraw consent without affecting earlier lawful processing. We may need to verify your identity before acting.

Send requests to support@nanashort.com. We respond within the applicable legal time limits. You may also complain to the competent data protection authority, including Türkiye’s Personal Data Protection Authority where relevant.

10. Account deletion, children and updates

Use the available Delete account controls in Profile or email support from the address associated with your account. Account deletion is separate from cancelling Apple, Google or other recurring billing. Our account deletion page explains the process.

The Service is not directed at children and account registration is restricted to adults aged 18 or over. If you believe a child has provided personal data, contact us so we can investigate and take appropriate action.

We update this notice when processing changes and communicate material changes through an appropriate channel. An update to this notice is not, by itself, a new consent to optional processing.

11. Contact

The service provider is NanaShort, Türkiye. For support, billing questions, privacy requests and legal notices, contact support@nanashort.com. You can also send a message through Customer Service in the app.