nomi

Privacy Policy

Last updated: 3 June 2026

This policy explains what personal data the nomi mobile app collects, why we collect it, and what control you have over it. It applies to the nomi app on iOS and Android.

1. Who is responsible for your data

The data controller is DEOTECH Bilişim ve Danışmanlık A.Ş., Cevizli Mah. Mustafa Kemal Cad. Hukukçular Tow. Sit. No:66a/111, 34865 Kartal/İstanbul, Türkiye. For any privacy question or request, contact hello@deotech.com.tr.

Because the controller is registered in Türkiye, we also comply with the Turkish Personal Data Protection Law (KVKK, Law No. 6698) in addition to Regulation (EU) 2016/679 (GDPR).

2. What we collect and why

Data	Why we need it	Legal basis
Email address	To create and secure your account, verify your email, and let you reset your password.	Performance of a contract
Display name	Shown on your profile and to other people in a group room you join.	Performance of a contract
Account identifier	An internal ID that links your data together.	Performance of a contract
Approximate location	To find restaurants near you and show how far away they are. Only collected while you use the app, and only if you grant permission.	Consent (device permission)
Swipes, votes and validations	To avoid showing you the same restaurant twice, to improve your recommendations, and to award points and badges.	Performance of a contract
Group room activity	Your name, your votes and your attendance in rooms you create or join, so the group can reach a decision together.	Performance of a contract
Notification token	To send the push notifications you have switched on (group invites, results, reminders).	Consent (per-category toggles in Settings)

Your location is never stored. It is sent with a search request, used to rank restaurants near you, and then discarded. We do not keep a history of where you have been, and we do not track your location in the background.

Using nomi without an account

You can browse as a guest. In guest mode we do not create a profile, and swipes are not recorded. Group rooms and points require an account.

3. What we do not do

We do not sell or rent your personal data.
We do not show advertising and we do not use advertising identifiers.
We do not use third-party analytics or tracking SDKs, and we do not track you across other apps or websites.
We do not build profiles for marketing purposes.

4. Who processes data on our behalf

We use a small number of service providers that process data strictly on our instructions:

Google Firebase (authentication, database, cloud functions, hosting) — stores your account and activity data.
Expo — delivers push notifications; receives your notification token and the notification content.
Google Places — receives an approximate location with a search request in order to return nearby restaurants. It does not receive your account details.

Restaurant photos and restaurant review analysis are handled by Cloudinary and Google Gemini respectively. These process restaurant information only — no user personal data is sent to them.

5. International transfers

Our infrastructure runs in the European Union (Google Cloud region europe-west1). The data controller is established in Türkiye, which is outside the European Economic Area, so your data is accessed from there. That transfer, and any processing by a provider outside the EEA, is covered by appropriate safeguards under Chapter V of the GDPR — the European Commission's Standard Contractual Clauses or an equivalent legal mechanism.

6. How long we keep it

Account data — kept while your account exists.
Swipes, votes and validations — kept while your account exists, so your recommendations stay relevant.
Group rooms — kept while the room exists; you are removed from a room when you leave it.
Everything — erased immediately when you delete your account from inside the app. If you ask us to delete it by email instead, we complete the deletion within 30 days, unless we are legally required to keep something.

7. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased;
restrict or object to how we process it;
receive your data in a portable format;
withdraw consent at any time (for location, in your device settings; for notifications, in the app's Settings);
lodge a complaint with a supervisory authority — your national data protection authority if you are in the EU (in Portugal, the CNPD), or the Turkish Personal Data Protection Authority (KVKK) where that law applies.

Deleting your account

You can erase your account yourself, at any time, from Settings → Delete account in the app. This permanently removes your profile, points, badges, swipe and vote history, and your membership of any group rooms. It cannot be undone. If you would rather we did it for you, email hello@deotech.com.tr.

8. Security

Data is transmitted over encrypted connections and stored on Google Cloud infrastructure. The app never writes to the database directly — all access goes through authenticated server-side functions that verify who you are before returning or changing anything.

9. Children

nomi is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child has given us personal data, contact us and we will delete it.

10. Changes to this policy

If we change this policy we will update the date at the top of this page, and — for changes that materially affect you — notify you in the app.

11. Contact

DEOTECH Bilişim ve Danışmanlık A.Ş.
Cevizli Mah. Mustafa Kemal Cad. Hukukçular Tow. Sit. No:66a/111, 34865 Kartal/İstanbul, Türkiye
hello@deotech.com.tr