LAST UPDATED · 28 OCTOBER 2026 · Türkçe

Privacy Policy

01What data we collect

• DATAWHYWHEN
• Device model, iOS version, storage capacityTo create the report; if you ask for an offer, to calculate the value of the deviceDuring testing
• Hardware test results (screen, touch, cameras, speaker, battery, buttons, sensors)To produce the diagnostic reportDuring testing
• IMEI (the full number is not stored; the last 4 digits and an irreversible digest are kept)To link the report to a specific device, so that a buyer can verify the report belongs to the phone in handIf you complete the IMEI step
• Repair shop (dealer) codeTo share the report, with your consent, with the repair shop that gave you the codeOnly if you enter a code
• Random install ID (created when the app is first opened and kept only in this device's Keychain)To keep your sale or trade-in session going and to show you your own offers and ordersIn the offer, sale and trade-in steps
• Device condition answers you give in the offer flow: IMEI registration status, device age band, colour, whether an unregistered device can still be used, and statements such as liquid contact, cracks, scratches or the boxTo calculate the value of the deviceOnly if you ask for an offer
• Mobile phone numberSMS verification, updates about the sale and, if the price changes after inspection, an approval codeOnly if you ask for an offer
• Full nameOffer record, shipping label and payment recordOnly if you decide to sell your device
• Street address and citySender details on the shipping labelOnly if you decide to sell your device
• IBAN and the account holder's full name (the account may belong to someone other than you)Payment for the device; passed only to the company buying the device (Xendaba Bilişim)Only if you decide to sell your device
• Email addressUpdates about a sale; the payment receipt for a trade-inOptional for a sale; required for a trade-in payment
• Trade-in order: model, colour and storage of the new device; full name, street address, city and district for deliveryTo create the order for the new device and deliver it to youOnly if you trade in your device
• Status of the trade-in order and of the card pre-authorization (amounts, payment result)To track the payment; to charge the difference once your old device is approved, or to refund it if neededOnly if you trade in your device
• The report you share: test results, the computer evaluation if any, device details and the offer priceTo create the signed report page that opens from the link, and its PDFOnly if you tap Share
• Error code and iPhone model identifier (computer scan)To look up the meaning of the error record in our libraryOnly if you run a computer scan
• IP addressTo prevent abuse (for example, to limit repeated SMS requests)On every connection

We process this data on the following legal grounds under Article 5 of the KVKK (Turkish Personal Data Protection Law):

• Entering into and performing a contract (KVKK Art. 5(2)(c)): device testing and the diagnostic report, sharing the report, offers, sales and trade-ins, SMS verification, shipping and payment.
• Legal obligation (Art. 5(2)(ç)): keeping sale, trade-in and payment records for the period required by tax and commercial law.
• Establishing, exercising or protecting a right (Art. 5(2)(e)): using signed reports and sale records as evidence in a possible dispute.
• Legitimate interest (Art. 5(2)(f)): preventing abuse using the IP address (for example, limiting repeated SMS requests) and keeping the service secure.
• Explicit consent (Art. 5(1)): sharing the report with the repair shop that gave you the code. You can withdraw your consent at any time (see 07).

02What we do not collect

• Your photo library. You provide the Settings screenshot yourself through the system photo picker; the app does not access your library. The image you pick is read on your device and is not sent to the server.
• Your contacts, messages, location history or activity in other apps.
• Advertising tracking. The app does not track you and contains no third-party advertising or analytics trackers.
• How full your device storage is. Free space is only shown to you on screen and never leaves your device.
• The full IMEI is not stored. The server keeps only the last 4 digits and an irreversible digest created with a secret key; the public report page shows only the last 4 digits.
• Raw log files from the computer scan (system and crash logs, the diagnostics archive). They are processed on your computer and are not sent to the server. Only the computer report, which holds the results derived from those logs, may be sent to the server (for example when you share the report), and the identifiers in it are masked before it is stored (see 04).
• Your card details. For a trade-in payment you enter your card details on iyzico's secure payment page; the card number, expiry date and security code never reach us or the company buying the device (Xendaba Bilişim).
• The contents or identifiers of your NFC cards or tags. The NFC test only detects whether the contactless card or tag you hold near the phone responds; the app does not connect to the card, does not read its contents, and does not store or send the card or tag identifier. Only the card type (for example MIFARE) is written to the test result.

03Face data

• To test the Face ID and TrueDepth hardware, the app uses Apple's ARKit face tracking: it checks whether the TrueDepth camera can build a face mesh over your face and whether that mesh lines up with the camera image. In the computer-guided test, the position of the face and pupils in the regular camera image is also located, to compare the alignment.
• Face tracking and the measurements happen on your phone. The face mesh, face measurements and camera images are not stored on the phone, are never sent to nayi.me servers and are not shared with third parties; they are discarded when the test step ends. The only exception is the optional computer-guided test described below.
• Face data is not used for identification, advertising or machine learning (model training). In the Face ID test, iOS does the face matching; the app only learns whether it succeeded and cannot access the face data that Face ID stores.
• In the optional computer-guided Face ID test, one low-resolution frame of the camera view (with the face mesh) and a few alignment measurements (alignment offset, depth ratio and timings) are sent once, as evidence for the test, only to the nCheck computer app on the computer you chose to connect; this can be your own computer or a repair shop's. They travel over the USB cable or the local Wi-Fi link, and the Wi-Fi link can only be set up after your phone has first trusted that computer over the cable. This data never reaches nayi.me servers. The computer app uses it only to show the test result on screen and does not write the frame to the report, the archive or any log.

04Report sharing

• Sharing happens only when you tap “Share report” or “Share”. Each tap creates a new, digitally signed report page with the results at that moment; the app prepares a PDF of that page and offers it, together with the link, for you to share with the app you choose.
• Anyone who has the link can open the report page; it is not indexed by search engines. You decide who receives the link and the PDF.
• The page and the PDF contain: the phone test results; the computer evaluation and deep test findings, if any; the device model, colour, storage capacity and iOS version; the measurement date; only the last 4 digits of identifiers such as the IMEI and serial numbers; and, if you received an offer, the offer price and its date. Your name, address, email address and IBAN are not included; the phone's device name is removed.
• The shared report may also include the computer evaluation, if there is one. When you share from a record in the test history, the computer report the phone stored with that record is sent from the phone; when you share from the offer screen while the phone is connected to the nCheck computer app, the computer app sends its report. It is sent over HTTPS. The identifiers in it (device name, device identifiers such as the UDID and ECID, serial and line numbers, management profile names) are removed or reduced to the last 4 digits on the server before it is stored. The unmasked copy is never stored or written to logs.

05Who we share data with

Every recipient listed above is bound to protect the data passed to it with the same or equal protection as this policy. We do not sell your data and do not share it with anyone for advertising. Apart from the above, data is shared only when required by law.

06How long we keep data

• Diagnostic reports and shared report pages: valid for 30 days after they are created. After that the link may still open, but the page states that the report has expired. You can ask for a report to be removed at the address in section 07.
• The Face ID test frame and face data: not stored (see 03).
• SMS verification codes: 5 minutes. They become invalid once used or expired.
• Sale records (name, phone number, address, IBAN, payment): kept for 10 years as required by financial regulations.
• Trade-in orders and payment records: kept for as long as legal retention obligations require.
• Offers that did not turn into a sale: deleted after 12 months.

07Your rights and deletion requests

Under the Turkish Personal Data Protection Law (KVKK) you have the right to access your data, ask for it to be corrected or deleted, object to its processing and request a copy. Send your request to the address below; we reply within 30 days at the latest.

You can withdraw your consent to share reports with a repair shop at any time: in the app, Settings › Dealer code › Remove Code stops your later reports from being shared with that shop. To have a report or share link that was already shared deleted, write to the address below. Withdrawing consent does not affect the lawfulness of sharing that took place before.

08Security

Connections between the apps and our servers are encrypted with HTTPS. The connection between the phone and the nCheck computer app does not pass through our servers: it is made directly over a USB cable or the same local Wi-Fi network, and this local connection does not use HTTPS. A Wi-Fi connection is accepted only with a key that the app creates anew each time it starts and that only a computer your phone has already trusted over the cable can read.

Diagnostic reports are digitally signed on the server; the signature lets anyone verify whether a report has been changed afterwards. Permanent device identifiers such as the IMEI are not stored in full. Sale steps are protected by SMS verification; an offer that changes after inspection can only be approved or rejected with a code sent to your registered phone.

09Children

Device tests need no account or personal details and anyone can use them. Getting an offer, selling and trade-in are only for people aged 18 or over; we do not knowingly collect personal data from anyone under 18 for these.

10Changes

If this policy changes, the “last updated” date on this page is renewed. If there is a substantial change in the data items collected, you will also be informed in the app.

11Data controller and contact