Hooka
Privacy Policy
Effective date: 5 July 2026. This notice describes how the Hooka social app and hooka.com.tr (together, "Hooka", "we", "us") process your personal data. It is an informational notice, not a request for consent — where the law requires your separate explicit consent for a specific purpose (for example, push notifications), we ask for it separately, in the app, at the point we need it.
- 1. Who we are
- 2. Data we collect
- 3. Why we use it, and our legal basis
- 4. Age restriction and tobacco-related content
- 5. Who we share data with
- 6. International data transfers
- 7. How long we keep data
- 8. Security
- 9. Cookies (website)
- 10. Children's privacy
- 11. Your rights (GDPR & KVKK)
- 12. Changes to this notice
- 13. Contact us
1. Who we are
Hooka is operated by [Company Legal Name, to be completed before launch], registered at [Registered Address, Türkiye] ("the data controller" under KVKK Art. 3 and GDPR Art. 4). You can reach us at support@hooka.com.tr for any privacy question, or to exercise the rights in Section 11.
2. Data we collect
Account & identity data
- Name, username, email address, and profile bio.
- Birthdate — collected once, solely to verify you are 18 or older before granting access to the app (see Section 4). We do not re-purpose your birthdate for anything else.
- Authentication identifiers issued by Firebase Authentication when you sign in with Google, Sign in with Apple, or email — we never see or store your Google/Apple password.
- Home city and locale (language) preference.
Content you create
- Sessions you log (lounge, tobaccos/mix used, rating, notes, photos), tobacco and mix ratings/reviews, comments, and any photos or media you upload (profile avatar, cover photo, session photos).
- Your social graph on Hooka: who you follow, who you block, likes, and achievement/XP progress.
Location data
We only ever collect location at the city level, and only when you choose to tag a session, set a home city, or browse the map/discovery screens. Hooka does not track your precise GPS location in the background, and does not build a continuous location history.
Device & notification data
If you enable push notifications, your device sends a push token to our notification provider, OneSignal, so we can deliver notifications (new followers, likes, comments, achievements). This token is not linked to advertising identifiers and is not used for ad targeting.
Usage & diagnostic data
- First-party product analytics we run ourselves (screens viewed, features used, aggregated counts) to understand what's working and fix what isn't. This is not sold or shared with advertisers.
- Crash and error reports via Sentry, which can include device model, OS version, app version, and the technical state of the app at the moment of a crash.
- Standard server logs (IP address, request timestamps) kept for security and abuse-prevention purposes.
Support communications
If you email us or report content in-app, we keep that correspondence to resolve your request and improve moderation.
3. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR) / KVKK Art. 5-6 |
|---|---|
| Creating and running your account, showing you the feed, sessions, and social features | Performance of a contract with you |
| Verifying you meet the 18+ age requirement | Legal obligation / legitimate interest in complying with app-store and tobacco-advertising rules |
| Trust & safety — moderation, fraud prevention, enforcing our Terms | Legitimate interest |
| Sending push notifications you've enabled | Your consent (can be withdrawn anytime in device/app settings) |
| Product analytics and crash diagnostics to keep the app working | Legitimate interest |
| Responding to support requests, legal claims, or authority requests | Legal obligation / legitimate interest |
We do not use your data for third-party advertising, and we do not sell personal data.
4. Age restriction and tobacco-related content
Hooka involves user-generated content about hookah (shisha) sessions, which is a tobacco-related activity restricted to adults in every market we operate in. Accordingly:
- You must be 18 years of age or older to create an account (some countries set a higher minimum age for tobacco-related products or services — you are responsible for knowing and complying with the age of majority that applies to you).
- We ask for your birthdate at signup specifically to enforce this, per Apple App Store Guideline 1.4.3.
- Accounts found to belong to a minor, or found to be misrepresenting age, are terminated and the associated data is deleted.
- We do not use behavioral data to target tobacco-related content or advertising at anyone, and we run no tobacco advertising of any kind (see our Terms and Community Guidelines).
5. Who we share data with
We share data only with the service providers ("processors") that help us run Hooka, under contracts that require them to protect your data and use it only for the purpose we specify:
- Firebase Authentication (Google Ireland Ltd.) — sign-in and identity verification.
- OneSignal — delivering push notifications you've opted into.
- Sentry — crash and error monitoring so we can fix bugs.
- Our hosting provider — stores the database and any photos/media you upload.
We may also disclose data if required by law, to protect the rights, safety, or property of Hooka or our users, to investigate fraud or abuse, or as part of a merger, acquisition, or sale of assets (with notice to you). We do not sell your personal data to third parties, and we do not share it with data brokers or advertisers.
6. International data transfers
Some of the providers above (Firebase/Google, OneSignal, Sentry) may process data outside Türkiye or the EU/EEA, including in the United States. Where this happens, we rely on the safeguards recognized under KVKK Art. 9 (e.g. the recipient's binding undertaking, or an adequacy decision by the Board) and, for GDPR purposes, Standard Contractual Clauses or an equivalent adequacy mechanism.
7. How long we keep data
We keep your account data for as long as your account is active. If you delete your account in-app (Settings → Delete Account):
- Your name, username, email, and bio are immediately overwritten/anonymized, and your login is revoked.
- Your avatar and cover photo are deleted, and your birthdate and home city are permanently removed.
- Your Firebase identity is deleted from our authentication provider.
- Public content you posted (sessions, reviews, comments, mixes) may remain visible, attributed to "Deleted User," the same way many social platforms handle content that other users may have replied to or relied on. If you want specific content fully removed rather than just de-attributed, delete it yourself before deleting your account, or email support@hooka.com.tr and we will remove it manually.
Server logs and backups are retained for a limited period (up to 90 days) for security and disaster-recovery purposes, after which they are automatically purged.
8. Security
We use industry-standard measures to protect your data, including encryption in transit (HTTPS/TLS) for all traffic, hashed authentication tokens, and access controls limiting who on our team can see production data. No method of transmission or storage is 100% secure; if we become aware of a data breach affecting your personal data, we will notify the Personal Data Protection Board and affected users as required by KVKK Art. 12 and, where applicable, supervisory authorities and users under GDPR Art. 33-34.
9. Cookies (website)
The hooka.com.tr marketing website sets one first-party cookie to remember your chosen language (English/Turkish) and, for the admin panel, a session cookie required for login. We do not use third-party advertising or tracking cookies on the marketing site. The mobile app does not use cookies; it authenticates using secure tokens.
10. Children's privacy
Hooka is not directed at, and may not be used by, anyone under 18. We do not knowingly collect personal data from children. If we learn an account belongs to someone under 18, we terminate it and delete the associated personal data. If you believe a minor is using Hooka, please email support@hooka.com.tr.
11. Your rights (GDPR & KVKK)
Depending on where you live, you have some or all of the following rights over your personal data. Under KVKK Art. 11, you may: learn whether we process your data; request information about that processing; learn its purpose and whether it's used accordingly; know the third parties we share it with (in Türkiye or abroad); request correction of incomplete/inaccurate data; request erasure or destruction under the conditions in Art. 7; object to a result produced solely by automated analysis to your detriment; and claim compensation for damage from unlawful processing. Under the GDPR, EU/EEA residents additionally have the right to data portability, to restrict processing, to object to processing based on legitimate interest, to withdraw consent at any time (without affecting past lawful processing), and to lodge a complaint with your local supervisory authority.
To exercise any of these rights, use the in-app Settings → Privacy tools where available, or email support@hooka.com.tr. We respond within 30 days (KVKK) or without undue delay and within one month (GDPR), extendable for complex requests.
12. Changes to this notice
We may update this notice as Hooka's features or legal obligations evolve. For material changes, we will notify you in-app or by email before they take effect, and update the "Effective date" above.
13. Contact us
Email: support@hooka.com.tr
Data controller: [Company Legal Name] — [Registered Address, Türkiye]