Privacy Policy
Summary
- You create an account with email and password or with Sign in with Google. We store your profile, your test requests and, for payouts, the bank details you enter (IBAN, bank name, account holder).
- We process purchase records for credits (the stores handle your card details; we never see them).
- We use Firebase (sign-in, push notifications, usage statistics) and Google AdMob (ads). We do not collect location, contacts or audio.
- We do not sell your data. Ads on iOS are shown without the advertising ID: the app does not show the App Tracking Transparency prompt.
- Delete your account in the app (Profile > Delete Account) or by email. See section 9.
- The app is not directed to children under 13 (or under 16 where local law sets a higher age).
This Privacy Policy explains what personal data is collected when you use the aMeGo Feed mobile application for Android and iOS (the "App"), how and why it is processed, who receives it, and what rights you have. It is written to be consistent with the Google Play Data Safety form, the Apple App Privacy details, the EU/UK GDPR and Türkiye's Law on the Protection of Personal Data No. 6698 (KVKK). The App's services are provided through the megoapi.megofeed.com.tr infrastructure.
1. Who we are (data controller)
The App is developed and operated by GM DevHub, the data controller for your personal data.
- Email: info@gmdevhub.com.tr
- Web: gmdevhub.com.tr
2. Data we collect
2.1. Data you provide
| Data | Purpose |
|---|---|
| Email address and password (email sign-up) | Account creation, sign-in, account recovery |
| Name / display name, email and profile photo from your Google account (if you use Sign in with Google) | Account creation and profile display |
| Test request content (app name, icon image, target number of testers, notes) | Creating and fulfilling the test requests you submit |
| Bank details you enter: IBAN, bank name, account holder name | Paying out earnings and processing payment requests |
| Payment receipt / proof images (taken with the camera or chosen from your photo library, optional) | Manual payment verification |
| Messages and information you send to support | Providing support |
2.2. Data collected automatically
| Data | Source | Purpose |
|---|---|---|
| Hashed device ID (a SHA-256 value derived on your device from device model/OS details and a random ID) sent with requests to our server | App | Session security, fraud and abuse prevention |
| Session and authentication tokens | App / our server | Keeping you signed in, security |
| Push notification (FCM) token and the "all users" notification topic | Firebase Cloud Messaging | Sending notifications |
| Usage and device data: app-instance ID, app open and session events, device model, OS version, language, app version, approximate location (country/city) derived from IP | Google Analytics for Firebase | Usage statistics and product improvement |
| Advertising ID (Android), IP address, device and network information, ad interactions | Google Mobile Ads (AdMob) | Ad delivery, measurement, fraud prevention |
| Purchase history and transaction records (product, receipt/verification data) | Google Play Billing / Apple StoreKit, our server | Purchase verification, credit top-up, refund support |
| Language and region | Device settings | Interface language |
| IP address and basic network data | Our servers | Security and abuse prevention |
2.3. Data stored on your device
Authentication tokens, your device ID and (if you leave "remember me" on) your sign-in credentials are stored in the device's secure storage (iOS Keychain / Android Keystore). Preferences are stored locally. This data is removed when you sign out of "remember me" or uninstall the App.
2.4. Data we do NOT collect
- We do not collect location data.
- We do not access your contacts.
- We do not record audio.
- We never see or store your payment card number; card payments are handled only by Google Play or Apple.
- We do not collect data covertly in the background.
3. Third-party services
The App uses the following third-party services. Each processes data under its own privacy policy:
| Service | Provider | Purpose / data | Policy |
|---|---|---|---|
| Firebase Authentication | Sign-in with Google; identity token, name, email, photo | firebase.google.com/support/privacy | |
| Google Sign-In | Authentication through your Google account | policies.google.com/privacy | |
| Firebase Cloud Messaging | Push notifications; FCM token, device info | firebase.google.com/support/privacy | |
| Google Analytics for Firebase | Usage statistics (see 2.2) | firebase.google.com/support/privacy | |
| Google Mobile Ads (AdMob) | Ad delivery and measurement; advertising ID, IP, device info | policies.google.com/privacy | |
| Google Play Billing | Android in-app purchases; purchase tokens | policies.google.com/privacy | |
| App Store / StoreKit | Apple | iOS in-app purchases; transaction records | apple.com/legal/privacy |
Usage statistics. Firebase Analytics runs in the App and is enabled; it logs an app-open event and standard automatic events (first open, sessions, engagement time, in-app purchase events on Android). Google acts as our processor (Google Ireland Limited for the EEA, UK and Switzerland; Google LLC elsewhere), does not store IP addresses in Analytics, and keeps event-level data for at most 14 months. There is no in-app switch to turn it off; email us or uninstall the App to stop collection.
Advertising. The App shows native and banner ads through AdMob, with the maximum ad content rating set to "G" and not directed to children. On Android, ads may use the Advertising ID; you can reset or delete it, or opt out of personalization, in Settings > Google > Ads. On iOS, the App does not display the App Tracking Transparency prompt and does not access the IDFA, so we do not "track" you as defined by Apple and iOS ads are served without the advertising ID.
Payments. Credit purchases are processed entirely by Google Play Billing or Apple StoreKit. We receive only purchase receipt/verification data and the purchased package.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR / KVKK) |
|---|---|
| Account management and authentication | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c) |
| Creating and fulfilling test requests; payouts and payment requests | Performance of a contract |
| Credit purchases and balance management | Performance of a contract; legal obligation for accounting and tax records (GDPR Art. 6(1)(c); KVKK Art. 5/2-a, ç) |
| Push notifications | Consent, given through the device notification permission (GDPR Art. 6(1)(a); KVKK Art. 5/1) |
| Usage statistics (Firebase Analytics) | Legitimate interests in improving the App (GDPR Art. 6(1)(f); KVKK Art. 5/2-f); you may object |
| Advertising | Legitimate interests in funding the App; you can limit personalization in device settings |
| Security, fraud and abuse prevention | Legitimate interests; legal obligation |
| Compliance with legal obligations | Legal obligation |
5. Permissions
| Permission | Platform | Purpose |
|---|---|---|
| Notifications | iOS / Android | Test request status and purchase notifications (optional) |
| Camera | iOS / Android | Taking a photo of a payment receipt or proof (optional) |
| Photo library | iOS / Android | Choosing a receipt or app icon image (optional) |
| Internet access | iOS / Android | Required for the App to function |
You can revoke permissions at any time in your device settings; related features may then stop working.
6. Sharing, sale and international transfers
- We do not sell your personal data and do not give it to third parties for their own marketing. California residents: under the CCPA/CPRA we do not "sell" personal information; AdMob may use advertising identifiers on Android to serve ads, which some laws treat as "sharing" for advertising. You can opt out in your device ad settings or by emailing us. We do not use sensitive personal information to infer characteristics about you.
- Service providers listed in section 3 process data on their own infrastructure, which may be outside Türkiye (for example the USA and the EU). Transfers rely on the providers' Standard Contractual Clauses and the EU-US Data Privacy Framework where applicable and are made in line with KVKK Art. 9.
- Where legally required (court order, official request), data may be disclosed to competent authorities.
- In a merger, acquisition or asset sale, data may be transferred to the new operator; you will be notified in advance.
7. Data retention
| Data | Retention |
|---|---|
| Account, profile, test requests, bank details | While your account is active; deleted or anonymized within 30 days of an account deletion request |
| Purchase and financial transaction records | 10 years, as required by Turkish accounting and tax law, even after account deletion (kept separate from your profile) |
| Payment receipt images | Until the payment is verified, then up to 12 months |
| Security / IP logs | Up to 12 months |
| Support messages | Up to 12 months after the request is closed |
| FCM token | While the App is installed and notifications are enabled; removed on account deletion |
| Firebase Analytics event data | At most 14 months at Google |
| Advertising data | Governed by Google's retention periods |
8. Your rights
Under GDPR (where it applies to you), KVKK Art. 11 and similar laws you have the right to:
- Access your data, obtain a copy and learn whether it is processed
- Request correction of inaccurate or incomplete data
- Request deletion or anonymization ("right to be forgotten")
- Object to processing based on legitimate interests, or request restriction
- Request data portability
- Withdraw consent for consent-based processing at any time
- Learn the third parties to whom your data is transferred
- Lodge a complaint with a supervisory authority: in Türkiye the Personal Data Protection Authority (kvkk.gov.tr); in the EU/UK the authority in your country of residence
To exercise your rights, email info@gmdevhub.com.tr from the email address of your account. We answer within 30 days at the latest.
9. Account and data deletion
- In the App: open Profile and tap Delete Account, then confirm. Your account is deactivated immediately and you are signed out.
- By email (without opening the App): send a message to info@gmdevhub.com.tr from your account email with the subject "aMeGo Feed - account deletion". We will verify and complete the request.
- What is deleted: your profile, test requests, bank details, receipt images, device and notification records are deleted or irreversibly anonymized within 30 days. Purchase and financial transaction records are kept for the legally required period (section 7).
- Data held by Google (ads, analytics) is managed through your Google account and device ad settings. Deleting the App alone does not delete your account.
10. Children's privacy
The App is not directed at children under 13 (or under 16, or the minimum digital consent age in your country) and does not knowingly collect personal data from them. If we learn that a child has provided data, we will delete it promptly. Please contact us if you become aware of such a case.
11. Security
- The App communicates with our servers and with the services above over encrypted HTTPS/TLS.
- Authentication tokens are stored in secure on-device storage (Keychain / Keystore).
- Access to server data is restricted through authorization and role-based controls.
No system is 100% secure; please notify us if you notice anything suspicious.
12. Changes to this policy
We may update this policy from time to time. For material changes you will be notified through an in-app notice or email. The current version is always published at this URL and the "Last updated" date appears at the top (5 November 2026).
13. Contact
For privacy questions, requests or complaints:
- GM DevHub
- Email: info@gmdevhub.com.tr
- Web: gmdevhub.com.tr