Privacy Policy

Last updated: October 3, 2026

Sarang is a couples app where two people share their location, memories and special days only with each other. This policy explains which data we process and why, in line with the EU General Data Protection Regulation (GDPR), Türkiye's Personal Data Protection Law (KVKK) and other applicable laws.

Who we are

Sarang is developed and operated by Umut Kaplan. For questions and requests: umutkaplanbusiness@gmail.com

Data we collect

• Account information: your email address, a one-way hash of your password (the password itself is never stored), your name, your birthday (optional), the date you confirmed you are 18 or older, and the app language (so we can send notifications and emails in your language). If you sign in with Apple or Google, these services verify your identity instead of a password; only your name and email address are shared with us (with Apple you can use "Hide My Email").
• Profile photo: if you choose to upload one.
• Location data: while location sharing is on, including when the app is closed or not in use: latitude and longitude, accuracy, speed, heading, an approximate address for that location, battery level, charging state, connection type (Wi-Fi or cellular), your phone's time zone and the status of your location permissions. While you are moving and for the first 20 minutes after you stop, your location is updated every second; after you stay in one place for more than 20 minutes, every 10 seconds.
• Motion and step data: the type of motion detected by your device's motion sensors (still, walking, running, cycling, in a vehicle) and your daily step count. Raw sensor data is never sent to the server; only this summary is.
• Location history: location points recorded as you move, with your type of motion at that moment.
• Saved places and arrival alerts: the name, location and radius of places you add, and the one-time targets you set with "Notify me on arrival".
• "Miss you" records: the type, number and time of the hearts you send.
• Location pause: the end time when you temporarily pause your location.
• App activity: the last time you opened Sarang (shown to your partner as "last opened").
• Subscription information: if you buy Premium Together, whether the subscription is active, when it ends and which plan it is. Apple takes the payment; we never see your card or payment details.
• Error logs: if the app runs into an error, the error message, app version and platform; deleted after 30 days.
• Memories and calendar: the photos, notes, titles, dates, events and daily heart records you add.
• Device notification token: so we can send you notifications.

We don't collect advertising identifiers, we don't use your data for advertising or profiling, and we don't sell it. The app has no third-party analytics or advertising tools.

Why we process data

• So your partner can see you live on the map, to calculate the distance between you and the estimated arrival time, and to show the daily timeline and location history;
• To notify you when your partner is getting close, heads your way, starts walking or driving, arrives at or leaves a saved place, when their battery is low or dies, when they miss you, and when they add a new memory or event;
• To show the "Miss you" count and arrival time in the iOS Home Screen widget and the Lock Screen Live Activity (this information stays on your device);
• To sync your memories and calendar between your two devices;
• To provide Premium Together and verify your subscription;
• To keep your account secure.

Legal basis: performance of a contract to provide the service (GDPR Art. 6(1)(b), KVKK Art. 5(2)(c)) and, for location data, your consent (GDPR Art. 6(1)(a), KVKK Art. 5(1)). You can withdraw location and motion permissions in your device settings at any time, and turn off location sharing in the app under Settings > Location and privacy > Location sharing. You can pause your location for 15 minutes, 1 hour or 8 hours; during that time your location isn't sent.

Who we share data with

• Your paired partner: your location, type of motion, step count, battery status, location history (only the part after you paired), profile, shared memories, calendar, saved places and whether you have Premium (because your partner can use it too). When you send a pairing request, the code owner sees your name and profile photo before accepting. Live location is delivered through an encrypted channel that only the two of you can access. No other user can see this data.
• Hosting: data is stored on our own server at Amazon Web Services (AWS Lightsail, Seoul region, South Korea).
• Notifications: the notification title and text are delivered through the Expo push service to Apple Push Notification service and Google Firebase Cloud Messaging.
• Subscription verification: Premium purchases are verified through RevenueCat (RevenueCat, Inc., USA). RevenueCat receives your random account ID and your App Store purchase records, but not your name, email or location.
• Email delivery: verification, password reset and email change emails are sent through Resend (Resend, Inc., USA); only your email address and the content of the email are shared with this service.
• Map providers: the provider you choose for the map (Apple Maps, Google Maps or Naver Map) loads map images of the visible area from its own servers. Your locations are placed on the map on your device; no location history is sent to these providers. When you tap "Get directions", the destination is passed to the map app you choose.
• Sign-in providers: if you sign in with Apple or Google, these services verify your identity.
• Weather: when you tap a person on the map, the weather at that location is fetched from Open-Meteo (open-meteo.com). Only coordinates rounded to about 1 km are sent, never your identity, name or account details.
• Address lookup: the street and city name for your location is found with the service provided by your device's operating system (Apple or Google).

Some of these services are outside your country (South Korea, USA). These transfers are based on providing the service to you and on your consent.

How long we keep data

• Location history is automatically deleted after 30 days.
• Positions delivered through the live location channel are not stored.
• "Notify me on arrival" targets end once triggered, or within 24 hours at the latest.
• Your last location is deleted as soon as you turn off location sharing.
• When you unpair, shared memories, photos, calendar, saved places, "Miss you" and heart records are deleted for both of you.
• When you delete your account, all your data, including your subscription record, is permanently deleted. Daily backups are deleted automatically within 14 days. Apple and RevenueCat keep purchase records under their own policies to meet legal (tax and accounting) obligations.

Security

All connections are encrypted with HTTPS. The database has row-level access rules: each user can only see their own data and the shared data of the partner they're paired with. The 4-digit app lock passcode is stored only on your device, as a salted hash in the iOS Keychain. If you choose to unlock with Face ID or Touch ID, your device performs the check; we never access face or fingerprint data, and nothing is sent to the server. Photos are kept in non-public storage and shown through time-limited links.

Your rights

You have the right to access, correct and delete your data, to restrict or object to its processing, and to data portability. Send requests to umutkaplanbusiness@gmail.com; we reply within 30 days at the latest. You can also delete your account yourself in the app: Delete account. If you live in the EU, you can also lodge a complaint with your local data protection authority.

Age limit

Sarang is only for users aged 18 and over (19 and over in South Korea). If we learn that a user is under this age, we delete their account.

Changes

If we update this policy, we'll change the date at the top of this page and announce important changes in the app.