Privacy Policy

1. Who is responsible for your data

The data controller for the Service is the operator of Nanashort. For any question about this policy or about your personal data, write to support@nanashort.com. We answer data protection requests at the same address.

2. Data we collect

Account data. How you sign in depends on where you are. On the website you sign in with Google or with Apple, and the provider passes us your name and email address — if you use Sign in with Apple and choose to hide your address, we receive Apple's private relay address instead of your real one. In the mobile app you create an account with your name, email address and a password. We never receive your Google or Apple password.

Data created by using the Service. To run the Service we record an account identifier, a device identifier, which series and episodes you open, your watch progress, the items you save to My List, your coin balance, your language and your approximate country, plus technical details such as IP address, browser or app version and operating system.

Payment data. When you buy a subscription or a coin pack we store the plan, the billing period, the status of the purchase and the reference number the payment provider returns to us. We never see or store your full card number, expiry date or CVV — those are entered directly on the payment provider's own page.

We do not collect precise GPS location, we do not read your contacts, photos or files, and the Service carries no third-party advertising.

3. Why we use your data

We use the data described above to:

• create and maintain your account and keep you signed in;
• stream episodes and remember where you left off across your devices;
• enforce the one-active-device rule described in section 5;
• process subscriptions and coin purchases and keep a record of them;
• recommend series that fit what you have watched;
• show the Service in your language;
• answer support requests and verify your identity when you ask us to act on your account;
• detect and prevent fraud and abuse;
• measure how the Service performs and fix errors;
• comply with tax, accounting and other legal obligations.

4. Legal bases for processing

Where the GDPR applies, we rely on the following legal bases: performance of a contract, for everything needed to give you the Service you signed up for; our legitimate interests, for security, fraud prevention, product measurement and improving what we offer; your consent, where we ask for it separately, which you can withdraw at any time; and compliance with a legal obligation, for records we are required to keep.

Where Turkish Law No. 6698 on the Protection of Personal Data (KVKK) applies, we process data on the equivalent grounds set out in Articles 5 and 6 of that law.

5. Device identifier and one active device

Your Nanashort account can stream on one device at a time. To make that work we generate a random identifier for each browser and each app installation and store it on your device — it is not derived from your hardware and does not identify you personally. When you sign in somewhere new, that device becomes the active one and the previous device is signed out of playback. We keep the identifier for as long as the device stays registered on your account, and it is deleted with your account.

6. Cookies and similar technologies

We use a small number of browser storage items, not for advertising profiles:

• a cookie holding your sign-in token, which expires after 30 days;
• the device identifier cookie described above;
• a language cookie and matching local storage entry that remember your chosen language;
• a session storage entry that caches your country code so we do not repeat the language look-up on every page;
• the Meta Pixel cookie described in the next section.

You can clear or block these in your browser settings. If you block the sign-in cookie you will not be able to stay signed in.

7. Third parties that process data for us

We share only what each service needs to do its job:

• Google Sign-In — verifies who you are on the website and returns your name and email address.
• Sign in with Apple — the same, and lets you hide your email address behind an Apple private relay address.
• iyzico — takes card payments for subscriptions and coin packs. Card details go straight to iyzico and never reach our servers.
• Meta Pixel — measures how people arrive at the website and how campaigns perform. It sets a cookie and reports page views to Meta.
• ipapi.co — receives your IP address once per session so we can pick a default language for your country.
• Apple and Google — distribute the mobile apps and process in-app purchases under their own privacy policies. They tell us that a purchase succeeded and which product it was; they never give us your payment details.
• Our hosting and content delivery providers — store the catalogue, the video files and the databases behind the Service.

We do not sell your personal data, and we do not share it with data brokers.

8. When we disclose data

Besides the providers listed above, we disclose personal data only when a court, a tax authority or another competent public body lawfully requires it, when it is necessary to establish or defend a legal claim, or when it is needed to investigate fraud or a security incident. If Nanashort is ever sold or merged, account data may transfer to the acquirer, and we will tell you before that happens.

9. International transfers

Our providers operate in several countries, so your data may be processed outside the country you live in, including outside the European Economic Area and outside Türkiye. Where that happens we rely on the safeguards the law requires, such as the European Commission's standard contractual clauses or an adequacy decision.

10. How long we keep data

We keep your account data for as long as your account exists. When you delete your account we remove or anonymise your profile, watch history and saved list within 30 days, except for records we are legally required to keep — invoices and payment records, which tax law obliges us to retain for up to 10 years, and security logs, which we keep for up to 12 months. Support correspondence is kept for up to 24 months.

11. Security

Traffic between your device and the Service is encrypted with TLS. Where you set a password in the mobile app it is stored only as a salted hash, never in a readable form. Access to production data is limited to the people who need it to run the Service. No system is perfectly secure, but if a breach ever affects your personal data we will notify you and the competent authority as the law requires.

12. Your rights

Depending on where you live, you can ask us to:

• confirm whether we process your data and give you a copy of it;
• correct data that is wrong or incomplete;
• delete your data;
• restrict or object to certain processing;
• receive your data in a portable, machine-readable format;
• withdraw a consent you gave us, without affecting what we did before you withdrew it.

Write to support@nanashort.com and we will answer within 30 days. We may ask you to confirm your identity first so that we do not disclose your data to someone else. If you are not satisfied with our answer, you can complain to your national data protection authority — in Türkiye, the Personal Data Protection Authority (KVKK).

13. Deleting your account

In the mobile app you can delete your account yourself: open Profile and choose Delete Account. On the website, send a deletion request to support@nanashort.com from the address on your account. Deletion is permanent — your watch history, My List and remaining coin balance are removed and cannot be restored. If you have an active subscription, cancel it first as described on our account deletion page.

14. Children

The Service contains mature dramatic themes and is not intended for children. You must be at least 18 years old to create an account. We do not knowingly collect data from children; if you believe a child has given us personal data, write to support@nanashort.com and we will delete it.

15. Changes to this policy

If we change this policy we will update the date at the top of this page, and for significant changes we will also tell you in the app or by email before the change takes effect. Continuing to use the Service after that means you accept the updated policy.

16. Contact

Questions, requests and complaints about this policy: support@nanashort.com