Privacy policy

Effective date: 21 October 2026

Who we are

The data controller is Twentyone Istanbul Dijital Pazarlama ve Stratejik Danışmanlık Limited Şirketi, İstanbul, Türkiye (tax ID 8591203029, MERSIS 0859120302900001). Contact: kemal@twentyone.ist.

What this policy covers

This website (twentyone.ist), our Lightning Address service, and the mobile and desktop apps we publish on the App Store and Google Play. If an app processes data in a way not described here, its own page on this website and its store listing say so.

This website

This website uses no cookies, no analytics and no third-party trackers. Like any web server, ours processes your IP address and request details to deliver pages and protect the service against abuse. We do not use this data to identify you, and we do not keep it longer than needed for operation and security.

Lightning Address service

To route payments to an address such as you@twentyone.ist, we store the username you claim, the public key of the linked Blink non-custodial account, and the payment requests (invoices) created for that address. We never hold or control funds.

Our apps

• Unless an app's page states otherwise, our apps do not collect personal data, do not track you across apps or websites, and contain no advertising.
• Data you enter in an app stays on your device unless a feature clearly says it is sent somewhere (for example, to make a payment you requested).
• Apple and Google may share anonymous crash reports and usage statistics with us if you allowed this in your device settings. They process this data under their own privacy policies.
• Each app's data practices are also listed in its App Store privacy label and Google Play data safety section.

Email

If you write to us, we use your email address and message only to reply and keep a record of the conversation.

Sharing and service providers

We do not sell or rent personal data. We use a small number of providers to run our services: server hosting (LunaNode, Canada) and email (Proton, Switzerland). Data may be processed outside Türkiye for this purpose, with appropriate safeguards. We disclose data to authorities only when legally required.

Retention

We keep personal data only as long as needed for the purpose it was collected for, or as long as the law requires.

Your rights

Under the Turkish Personal Data Protection Law No. 6698 (KVKK, Article 11) and, where it applies, the EU General Data Protection Regulation, you can ask whether we process your data, get a copy, have it corrected or deleted, object to processing, and complain to the supervisory authority (in Türkiye: Kişisel Verileri Koruma Kurumu). Write to kemal@twentyone.ist; we answer within 30 days.

Children

Our services are not directed at children under 13, and we do not knowingly collect their data.

Changes

We will post any changes on this page and update the effective date.