Privacy policy

Effective 3 November 2026. Applies to the Oulak iPhone app and this website.

Who is responsible

Oulak is made by an individual developer, identified in the Terms. I decide how the data described here is used. You can reach me at baturhancihan@gmail.com.

What Oulak collects and why

Sign in with Apple

You can only sign in with Apple. The app asks Apple for your email address (not your name). Apple lets you share your real address or hide it behind a private relay address. The email, real or relay, is kept by the sign in service and is not shown in the app or to other users. Apple may also leave the email out, and the app works without it. Your account is identified by an internal ID.

Username

You choose a username when you start. Other people use it to find you and to send you letters, so treat it as public.

Name and signature

In Profile you can, if you like, set a name and a signature. Both are optional, you are offered them once when you start and can skip it, and the name does not have to be unique. They are shown only as the signature printed at the bottom of the letters you send. You can change or remove them any time, and they are deleted with your account.

Approximate location

With your permission, while you use the app, Oulak reads your location to measure how far a bird must fly. The server rounds it to a grid of about 0.01 degrees (about 1 km) and stores that rounded point with your city, area name and country code. Only you can read the stored point. Other people never see that point. They see your city, area and the distance in whole kilometres. When you send or receive a letter, the letter also keeps its two end points rounded to 0.1 degrees (about 10 km), so both people can follow the bird on the flight map. The server also keeps the times you updated your location, so that it can limit changes to three in 24 hours.

Letters

To deliver a letter, Oulak stores its text and details: who sent it, who receives it, which bird carries it, the flight times, the origin and destination city, the distance, and whether it was read and when it was opened. The sender sees when a letter was opened, in the conversation; Oulak sends no notification about it. If someone sends your letter back without opening it, the letter stays in your account and they are not shown it. The sender can see the text at any time. The recipient can see it only after the bird has landed. Letters are text only.

Bird names and letter style

The names you give your birds and your choices of paper, envelope and seal are stored in your profile. Other people you write to see them on your letters.

Purchases

Premium is a subscription bought through Apple's in-app purchase. It is the only thing Oulak sells. Apple handles your payment. I never see your card or payment details. To know what you have bought, the app sends your account ID (the same internal ID that identifies your account, used as your RevenueCat app user ID) to RevenueCat, a purchase service. RevenueCat keeps your purchase history, such as your subscription status, and gives it back to the app so it can unlock Premium. This is used only to make the app work. It is not used for advertising or tracking, and it is not combined with data from other apps or sites.

Push notifications

If you allow notifications, the app registers a device token with Oulak, together with the platform, the environment (test or production), the app version and your device language. The server uses these to ask Apple to deliver notifications such as a bird leaving, landing or getting home. A notification never contains the text of a letter. The server also keeps a queue of the notifications for each letter, so that they go out at the right time. During testing the server also keeps a delivery log of notifications it sends: the device token and the notification text (for example who sent you a bird, never the text of a letter). It is used to check that notifications work.

On your device

The app keeps a few settings on your phone. They are not sent anywhere.

Apple refresh token

When you sign in, the app sends Apple's authorization code to a server function, which exchanges it for a refresh token and stores it in a table that the app and other users cannot read. The only purpose is to let me revoke the Sign in with Apple link when you delete your account. It is not used for anything else.

Reports and blocking

You can block a person and report a letter you received. This is what that stores.

• Block list. When you block someone, Oulak stores who blocked whom, so that nothing new from that person reaches you. The blocked person is not told. Only you see your block list.
• Report. When you report a letter, Oulak stores a copy of its text (up to 2000 characters), the name of the bird that carried it, who reported whom, the reason you chose, the note you wrote if any (up to 500 characters) and the times. The copy is kept as evidence, because the letter itself can later be changed or deleted.
• Why. To review the report and act on it (for example remove the content, warn the person or suspend the account), to keep Oulak safe, and to meet legal duties.
• Who sees it. Only me. The reported person is not told who reported them, and other users never see reports. For a serious matter, such as a threat or anything involving a minor, I may pass it to the authorities where the law allows or requires it.
• How long. The copy of the letter is removed 180 days after the report, or 90 days after I have dealt with it, whichever comes first. The report record itself is deleted after 12 months. If a report is held for the authorities, both are kept as long as the law requires. If an account is deleted, the links from the report to the accounts are removed, but the copy stays until its removal date. Your block list is kept until you unblock the person or either account is deleted.

I do not routinely read letters, but I do read the copy of a reported letter.

Who processes the data

I do not sell your data and I do not share it for advertising. These providers process it to run the app:

• Supabase hosts the database, sign in service and server functions. The project runs in the London region (eu-west-2).
• Apple provides Sign in with Apple and delivers push notifications. Apple's own privacy policy applies to what Apple handles.
• RevenueCat processes in-app purchases for the app. It receives your account ID and your purchase history, and returns what you are entitled to. RevenueCat's own privacy policy applies to what it handles.
• Google Firebase (Firebase Analytics and Firebase Crashlytics, run by Google) receives the usage counts and crash reports described below. Google's own privacy policy applies to what Google handles.

Oulak uses Google Firebase Analytics and Firebase Crashlytics, run by Google, to count which screens and features are used and to find crashes. The events are things like 'a letter was sent with the pigeon over a distance of 200 to 1000 km'. They never contain letter text, usernames, email, city, coordinates, push tokens or advertising identifiers, and they are not linked to your account. Google also receives what any app connection reveals: your IP address (Google uses it to estimate your country or region), the app version, the phone model, the system version and language, and a random identifier of this installation. That identifier is not your account, but Google can tell it apart from other installations, so I treat it as personal data. I do not use Firebase for advertising, and ad personalisation and the advertising ID are off. It is on by default everywhere. You can switch it off any time in Profile, Privacy, 'Share usage and crash data'. Switching it off removes the random identifier stored on your phone and any crash reports not yet sent; a new identifier is made only if you switch it on again. The app has no advertising.

How long data is kept

• Account, profile, location, letters and bird settings are kept until you delete your account. Letters do not expire by themselves.
• A push token is removed when you sign out of the app, or when Apple reports that the token is no longer valid.
• The Apple refresh token is kept until you delete your account.
• Usage event data in Google Analytics is kept for 2 months and then removed by Google. It is not tied to your account, so deleting your account does not change that.
• Your block list is kept until you unblock the person or either account is deleted. A report's copy of a letter is kept for up to 180 days after the report (or 90 days after I have dealt with it, if that is sooner), and the report record for 12 months, unless it is held for the authorities. See Reports and blocking.
• Purchase records at Apple and RevenueCat follow their own retention rules. Apple keeps your purchase receipts whatever you do in Oulak.
• The delivery log of notifications (device token and notification text, which can include the name of the person you wrote to and the bird) is for checking that notifications work. It is kept for 7 days and then removed automatically. It is not tied to your account in the database, so account deletion itself does not remove it earlier.
• You can delete your letters without deleting your account (Profile, Privacy, Delete all letters). That removes them from your account only. The people you wrote to keep their copies. The text of a letter is removed from our servers when both people have deleted it or when either account is deleted. Text copied into a report stays with the report, and recalled letters leave an empty record until a person deletes it or an account is deleted.
• You can export a copy of your data from Profile, Export my data. It is generated on request and not stored on our servers.
• A scheduled job moves flights through their stages every 10 seconds, and another deletes the database's own job run history after one day. Neither touches your letters.

Deleting your account

You can delete your letters without deleting your account (Profile, Privacy, Delete all letters). That removes them from your account only. The people you wrote to keep their copies. The text of a letter is removed from our servers when both people have deleted it or when either account is deleted. Text copied into a report stays with the report, and recalled letters leave an empty record until a person deletes it or an account is deleted.

You can export a copy of your data from Profile, Export my data. It is generated on request and not stored on our servers.

Open the app, go to Profile, then Privacy, then Delete account. When you confirm, Oulak:

• asks Apple to revoke the Sign in with Apple link;
• deletes your account, profile, stored location, bird names and style, block list, device tokens and queued notifications;
• deletes every letter you sent and every letter you received, including birds still in flight;
• asks RevenueCat to delete the customer record tied to your account ID (this is best effort, and RevenueCat may keep records it is required to keep).

Because a letter belongs to a conversation between two people, the other person loses those letters too. If Apple cannot be reached, the deletion still goes ahead, but then you may need to remove Oulak yourself in your Apple ID settings under Sign in with Apple. Deletion cannot be undone.

The hosting provider may keep technical backups for a limited time, which are outside what I can change day to day.

Your choices

• You can turn location access off in iOS Settings. Without a location Oulak cannot work out flights.
• You can turn notifications off in iOS Settings.
• You can switch usage and crash data sharing on or off any time in Profile, Privacy.
• You can hide your email with Apple's private relay when you sign in.
• You manage or cancel a subscription in your Apple ID settings, under Subscriptions. Deleting your Oulak account does not cancel it, so cancel first.
• To ask what is stored about you, or to ask for a correction, write to me. Where the law gives you more rights, I will respect them as far as I can.

Children

Oulak is not directed at children under 13, and I do not knowingly collect data from them. The app has no age check. If you believe a child has an account, write to me and I will delete it.

Security

Data travels over encrypted connections. Access rules in the database let each person read only their own data and the letters they are allowed to see. Letters are stored as readable text, so as the person who runs the service I can technically access the database. I do not routinely read letters; I read the copy of a letter that has been reported (see Reports and blocking). No system is perfectly secure, and I cannot promise otherwise.

Changes

If this policy changes in a way that matters, I will update the date at the top and tell you in the app or on this page.

Contact

If you write to me from Profile, Contact us, the message starts with a few lines of diagnostics: the app version and build, the iOS version, the device model, your username and your language. They are in the mail you send, you can edit or delete them before sending, and the app stores and sends nothing by itself.

The developer of Oulak, identified in the Terms, baturhancihan@gmail.com