Last updated: August 31, 2026
This Privacy Policy explains how WITME TEKNOLOJİ ANONİM ŞİRKETİ ("we," "us," "our") collects, uses, stores, and protects the personal data of users ("you") of the Grana mobile application ("the App"). By using the App, you agree to the practices described in this policy.
When you first open Grana, an anonymous session is automatically created without requiring you to enter any personal information. This lets you start using the App immediately. If you choose to create a permanent account (optional), we collect:
Email address and password (if you register via email — passwords are stored encrypted/hashed, never in plain text)
Basic identity information (name, email) shared by your Apple or Google account — if you sign in with Apple or Google
Grana's core function is applying filters to your photos. We want to be transparent about this:
Standard filter packs (Classic Kodak, Y2K Digicam, Fuji Superia, etc.) are applied with your photo processed entirely on your device — it is never uploaded to any server.
When you use the "AI Personal Recipe" feature, only a handful of numeric measurements extracted from your photo (average brightness, dominant color tones, highlight/shadow distribution) are sent to our servers — never the photo itself. Your photo is never uploaded to our servers or to any third-party AI provider.
Saving edited photos to your gallery requires photo library access; these images are stored only on your device.
Payments are processed directly through the Apple App Store or Google Play; we do not have access to, and do not store, your credit card or payment information. We use a third-party service called RevenueCat to manage your subscription status (Pro/Free, renewal date) — see Section 3.
Device type, operating system version, app version
In-app interaction data (which filters are used, screens viewed — anonymized usage statistics)
Crash reports — for debugging purposes
Marketing attribution data on where you downloaded the App from (for example, whether you came from TikTok) — this lets us measure which content works without spending on ads
To provide the App's core functionality (applying filters, generating AI recipes)
To manage and verify your subscription
To improve the App (understanding which features are used, fixing bugs)
To measure our marketing effectiveness (e.g., understanding which TikTok content brings new users)
To comply with legal obligations
We do not sell your data and do not share it with third parties for their own advertising purposes.
We rely on the following service providers to operate the App. Each is subject to its own privacy policy:
Service
Purpose
Data shared
Supabase
Authentication, database, file storage
Account identifier, session data
RevenueCat
Subscription management
Anonymous user identifier, purchase status
OpenAI LLM
AI Personal Recipe generation
Photo feature vector (not the photo itself)
PostHog
Usage analytics
Anonymized interaction data
Sentry
Crash/error reporting
Technical error logs, device information
AppsFlyer / Adjust
Marketing attribution measurement
Device identifier, install source
Apple / Google
Sign-in, payment processing, push notifications
Platform-based identity/payment data
Replace the OpenAI LLM field with the actual provider you use for AI recipe generation (e.g., Anthropic, OpenAI), and make sure they are named appropriately as a processor/subprocessor in accordance with your policy.
We retain your account data for as long as your account remains active. When you request account deletion, your data is permanently deleted from our systems within 30 days. The AI recipe cache (photo feature data, not the photo itself) is retained to reduce redundant processing costs and is not tied to a personal identifier.
Depending on your location, you may have the following rights:
Right to access: to learn what data we hold about you
Right to rectification: to request correction of inaccurate or incomplete data
Right to erasure: to request deletion of your data
Right to data portability: to request your data in a structured format
Right to object: to object to certain processing activities
For users residing in Turkey, under Law No. 6698 on the Protection of Personal Data ("KVKK"), the data controller is WITME TEKNOLOJİ ANONİM ŞİRKETİ. To exercise your rights under Article 11 of the KVKK, you may contact us at dev@witme.co
If you exceed certain volume/criteria thresholds, you may be required to register with VERBİS (Turkey's Data Controllers' Registry) — please confirm this with a consultant, as it depends on your user count and the type of data processed.
Users residing in the EU may exercise their rights under the General Data Protection Regulation (GDPR) by contacting us at dev@witme.co. The legal basis for our processing activities is the necessity of performance of a contract (to provide the service) and our legitimate interests (improving the product, preventing fraud).
California residents have the right, under the California Consumer Privacy Act, to know whether their data is sold and to request deletion. As noted above, we do not sell your data.
Grana is not directed at children under the age of 13, and we do not knowingly collect data from users under 13. If we become aware that a child under 13 has provided us with data, we will delete it promptly.
We implement industry-standard security measures (encrypted data transmission, access controls, Row Level Security database policies) to protect your data. However, no method of transmission over the internet is 100% secure.
Your data may be processed on servers located in EU. If your data is transferred to a different country, appropriate safeguards (such as standard contractual clauses) will be applied.
We may update this Privacy Policy from time to time. When material changes occur, we will notify you via an in-app notice or by updating the "last updated" date.
For questions about our privacy practices or to exercise your rights:
Email: dev@witme.co