Private by design, clear about what leaves your device.

Scope

This policy applies to the 8billion website, iPhone app and related support. The individual provider identified in the Provider and contact section is the data controller for the personal data described here. Apple and other service providers may also act under their own terms for services they control, such as App Store billing.

Provider and contact

8billion is provided by Emre Akman, an individual sole proprietor operating as 8billion, at Balat Mah. Kardeş Sok. Meteor Dikencik Sit. J Blok No 2, Nilüfer/Bursa 16140, Türkiye.

Legal, privacy and support questions can be sent to hello@8billion.app.

Adults only

8billion is intended only for adults aged 18 or older. The app asks users to confirm this requirement but does not independently verify age. If we learn that a person under 18 created an account, we will close it and delete associated data, except for limited records that must be retained for safety or legal reasons.

Website data

The public website does not ask for income, create an 8billion account or sell anything. It has no advertising or behavioral analytics SDK. The hosting service may process IP address, browser or device information, requested URL, timestamps and security events to deliver and protect the site.

If you choose an email link, your email provider and 8billion's email provider process the address, routing information and message content needed to handle the request. Do not send exact income, payment-card details, an Apple password or a two-factor authentication code.

Exact scenarios stay on your device

Exact income, employer, offer and raise values, detailed city scenarios, work and commute inputs, household details, private decision priorities, calculated decision outputs and Decision Brief PDFs are processed on the device. They are not uploaded to 8billion, Supabase or RevenueCat.

Nothing is saved unless you choose Save on this device. Saved inputs use operating-system protected storage and can be removed with Clear private device data. If you export or share a PDF, the destination you choose controls that copy.

Private Compare is a narrow exception for separately approved broad bands, not exact values. It can transmit a derived global-position band and, only when selected, broad region, purchasing-power, Life-Hour, work-mode, weekly-hours and household bands.

Account and Sign in with Apple

The core private flow works without an account. A purchase, restore or real Member Twin opt-in requires Sign in with Apple. Supabase receives the Apple account identifier, an email or private relay address only if Apple supplies one, an internal account identifier, authentication and session records, and the protected credential needed to revoke the Apple connection during account deletion.

Account information is private. It does not create a public directory and exact income is not part of the account.

Purchases and access

Apple processes payment credentials and App Store billing. 8billion does not receive a full card or bank-account number.

The only new paid product in this release is the Private Raise Decision Kit. RevenueCat and Supabase process the internal account identifier, product and entitlement identifiers, transaction identifiers, purchase status, refund or revocation status, and delivery state needed to unlock one selected Raise decision, restore eligible access, prevent duplicate delivery and maintain minimum commerce records. Exact Raise inputs and the generated PDF are not part of those records.

RevenueCat purchase history is used for access delivery, customer history and limited commerce analytics. It is not used for advertising or cross-app tracking.

Optional Member Twin and Guided Room

Member Twin is a real participating member and is separate from the statistical Income Lens. It is off until a signed-in member explicitly opts in. The service may process consent and access status, a server-assigned pseudonym, broad occupation and region, broad work, hours and household bands, chosen mode, match and action state, approved prepared questions and fixed responses, blocks and structured safety reports.

Wave, Journey Compare, prepared questions and fixed replies are free. A purchased Raise Kit may open one fixed-choice Guided Decision Room only when an active eligible real Member Twin already exists. The Kit does not create or prioritize a match and does not guarantee a room or reply.

Exact income, employer, offer values, address, email, phone, private scenarios and contact details are excluded. There is no public directory, open chat, link sharing, money request or meeting feature. Optional notifications use an Expo push token and a device-scoped random installation identifier.

Link-invoked Private Compare

Private Compare opens only from a valid trusted invitation. An invitation is valid for seven days and is single-use. The service stores invitation, comparison, approved broad-band context, exit state and structured safety state needed to operate the private comparison.

Participants can show only allow-listed broad bands. Exact income, exact city, employer, offers, contact details, links and free text are excluded. Either participant can revoke, leave, block or submit a structured report.

Purposes and legal bases

8billion's models provide private information and decision context. They do not make a legal or similarly significant decision about a user.

• Contract performance — provide requested accounts, purchase delivery, restore and Member Twin functions.
• Consent — optional Member Twin participation and optional push notifications; consent can be withdrawn in the app.
• Legitimate interests — protect accounts, prevent fraud or abuse, enforce limits, investigate structured reports and keep minimum operational records, subject to applicable objection rights.
• Legal obligation and legal claims — respond to lawful requests and retain narrowly required accounting, refund, safety or dispute records.

Service providers and transfers

8billion requires service providers that process personal data on its behalf to protect it consistently with this policy and applicable law.

Providers may process personal data outside Türkiye or the user's country, including in the European Economic Area and United States. Before a restricted international transfer is used, 8billion must complete and record the agreement, notification or other transfer mechanism required by applicable law. A provider's data-processing agreement or standard contractual clauses do not replace any separate step required under Article 9 of Türkiye's Law No. 6698.

• Apple — Sign in with Apple, App Store distribution and billing, refund handling, and Apple Push Notification service.
• Supabase — authentication, database, server functions, protected access controls and optional Member Twin records. The release project's primary database region is Frankfurt, Germany; request gateways and server functions may use other provider regions.
• RevenueCat — App Store purchase validation, access state, restore and store-event processing. It receives the internal account identifier, receipt and product or transaction data, access and refund state, device type, operating-system and app version, locale or currency, last-seen time and technical request information needed to operate and protect purchase delivery.
• Expo Push Service and Apple Push Notification service — optional notification routing. 8billion sends only a generic notification, route and pseudonymous Match identifier. The 8billion outbox stops new delivery attempts 24 hours after an event is created, and each outgoing message asks the providers to expire an undelivered copy 24 hours after that send. Provider delivery expiration is best-effort. Expo clears push receipts after 24 hours.
• OpenAI ChatGPT Sites — hosts the public website and may process IP address, browser or device information, requested URL, timestamps and security events needed to deliver and protect it.
• Cloudflare Email Routing and Google Gmail — route messages sent to hello@8billion.app to the monitored support inbox and process the routing information and message content needed to handle the request under their terms. Replies may be sent from the monitored Gmail account.

Retention

Deleted live data may remain temporarily in protected service backups until the provider's configured backup rotation completes. The production Supabase project currently keeps daily database backups for seven days. Other provider backup and platform-log windows may differ. Backup copies are not used for normal access; if disaster recovery restores one, deletion requirements are reapplied. Irreversibly de-identified aggregate information may be retained longer because it no longer identifies a person.

• On-device inputs and PDFs — until you clear private device data or delete the exported copy from the destination you selected.
• Account and authentication records, and account-linked purchase, delivery, reversal and replay-protection records — while the account exists. Access may end earlier after a refund or revocation; confirmed account deletion removes these live account-linked records.
• Closed or blocked ordinary Member Twin matches and closed or revoked Guided Rooms — up to 12 months after closure, unless confirmed account deletion removes them sooner.
• Expired, revoked, left or blocked Private Compare operational records — up to 30 days after closure; structured safety records follow the safety period below.
• Notification delivery-attempt records — up to 30 days; disabled tokens up to 30 days and otherwise inactive tokens up to 180 days.
• Resolved or dismissed structured safety reports — up to 24 months after resolution, unless a documented legal hold remains active; confirmed account deletion may leave a minimized report without direct account links for that same period.
• Normal support correspondence — up to 12 months after closure; safety or legal correspondence up to 24 months; privacy-request compliance records up to three years.
• 8billion-controlled routine security and operational records — normally up to 30 days; verified incident records up to 90 days or until the incident is resolved. Provider platform logs and backups follow provider-specific settings, contracts and policies and may use different windows.
• Apple account-deletion event and subject-revocation records — up to 400 days from first receipt to prevent replay and document completion.

Controls, deletion and rights

You can use the core flow without an account, choose whether to save locally, clear device data, opt in to or withdraw from Member Twin, disable notifications, control broad matched-member fields, block or report, restore purchases and start permanent account deletion inside the app.

The normal deletion path is My 8B, Privacy, Account & access, then Delete account. Confirmed deletion removes the live Supabase account and account-linked service records, revokes the available Sign in with Apple token, requests RevenueCat customer deletion and clears app-owned private data on that device. It does not request an Apple refund and cannot delete a PDF copy exported elsewhere.

Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection, withdraw consent, and complain to a competent data-protection authority. Requests under Türkiye's Law No. 6698 are answered as soon as possible and within 30 days. GDPR requests are normally answered within one month, subject to permitted extensions.

Read the account deletion instructions →

No ads, sale or cross-app tracking

8billion has no advertising SDK, does not sell financial data and does not use account, purchase, scenario or Member Twin information to track people across apps or websites owned by other companies.

Contact

Privacy and support questions can be sent to hello@8billion.app. Do not email exact income, income documents, payment-card details, an Apple password or a two-factor authentication code.