ORIGINS
Get Origins

ORIGINS APPLICATION — PRIVACY POLICY

Back to Origins Last Updated: September 2026

ORIGINS APPLICATION — PRIVACY POLICY

Okan Atabağ ("Developer", "we", "us", "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, store, share, and protect your personal data when you use the Origins mobile application ("App").

This policy explains your rights under:

  • General Data Protection Regulation (GDPR) — European Union
  • Turkish Personal Data Protection Law No. 6698 (KVKK) — Republic of Turkey
  • California Consumer Privacy Act (CCPA) — State of California, USA
  • Other applicable data protection laws

1. DATA CONTROLLER

Okan Atabağ acts as the Data Controller for the personal data processed through the App.

Contact Information: Email: support@getoriginsapp.com

For KVKK-related inquiries: Veri Sorumlusu: Okan Atabağ E-posta: support@getoriginsapp.com

2. PERSONAL DATA WE COLLECT

2.1. Data You Provide Directly:

  • Photographs you upload for ancestry analysis (a portrait; in Deep Analysis also a side profile, and optionally hand and foot images)
  • Feedback you choose to write on the Support screen

2.2. Data Collected Automatically:

  • Device information (device type, operating system, app version)
  • Usage statistics (these do not include your name or contact details)
  • App crash reports
  • Google Play / App Store purchase tokens (for payment verification)

2.3. Data We Do NOT Collect:

  • Names, email addresses, or phone numbers
  • Location data
  • Contact lists
  • Biometric data: The App does not create, store, or transmit a facial template (a face print or recognition template) capable of identifying or verifying who you are. No identity-matching of faces is performed.

2.4. Face Data — What Stays on Your Device and What Leaves It

We want to state this distinction plainly, because two different things happen:

Stays on your device (offline): To help you frame the photo, the App uses Google ML Kit's on-device face detection. This determines where a face sits in the frame (bounding box coordinates) and whether its angle is suitable. The personalised loading animation shown over your photo while an analysis runs is also drawn on the device; it plays no part in the result. Nothing computed for either is ever transmitted or stored. To draw the animation, ML Kit also detects facial feature points (landmarks) and the outline of your face on the device; these too stay on your device and are discarded when the screen closes.

Leaves your device: When you start an analysis, the photograph itself is transmitted over HTTPS to our backend (Firebase Functions, Belgium/europe-west1) and from there to the Google Gemini AI service. That is how the analysis is produced — your photo does leave your device. Sections 4 and 5 below describe that transfer in detail.

2.5. About the Analysis Result

What the App produces — ancestral region percentages, a dominant trait, and the accompanying descriptions — is an estimate derived from your visible facial features.

We perform the analysis only on the basis of your explicit consent: the App asks for that consent separately, in-app, before an analysis begins; you may withdraw it at any time; we keep the result content on our server only briefly (see 4.3); and we never send the analysis to any analytics service (see 5).

Please remember that results are an entertainment-oriented AI estimate. They are not a DNA test and carry no genetic finding.

3. HOW WE USE YOUR DATA

3.1. Uploaded photographs are used SOLELY for:

  • Analyzing facial features via Google Gemini AI to estimate phenotypic/ancestral regions
  • Displaying the results to you within the App

3.2. Model Training

We do not use your photographs or analysis results to train AI models.

We use the Gemini API on its paid (billed) tier. Google's published terms for that tier state that prompts and responses are not used to improve Google's products.

Under those same terms, Google logs prompts and responses for a limited period in order to detect and prevent abuse, and keeps those logs only for the purpose and period its terms set out. Our statement that we do not store your photos refers to our own infrastructure.

4. DATA PROCESSING AND STORAGE

4.1. Image Analysis and International Transfer

  • Your photo is transmitted over HTTPS to our backend (Firebase Functions, europe-west1 — Belgium) and from there to Google Gemini.
  • We do not store your raw photographs on our own servers.
  • International transfer: Firebase and Gemini may run on Google infrastructure outside the country you live in. Google's Gemini API terms state that data may be stored transiently or cached in any country in which Google or its agents maintain facilities; under the same terms, content sent on the paid tier is processed in accordance with Google's Data Processing Addendum. The explicit consent requested separately in the App before an analysis also covers this transfer.
  • Analysis requests are protected with Firebase App Check and Firebase Authentication. The App never asks for your name, email, or phone number; your account is nothing more than a randomly generated user identifier.

4.2. Storage on Your Device

  • For your convenience, the App stores your analysis results and the associated photo locally on your device.
  • You can delete them at any time from the "My Origins" screen, either individually or all at once. That deletion removes the copy on your device.

4.3. Limited Server-Side Record and Retention Periods

To prevent abuse, to deliver your result to you again if your connection drops, and to control service cost, we keep a limited record in Cloud Firestore. Its retention is two-tiered:

  • The content of the analysis result (the ancestral-origin estimate and its descriptions): deleted once it reaches your device, 24 hours at most. When the result reaches your device it is deleted from the server. If it does not (your connection dropped or the app was closed), it is kept so it can be delivered when you next open the App. In every case it is deleted automatically within 24 hours at the latest.
  • The rest of the record (mode, language code, model information, referral code, timestamps, the user identifier, and the request identifier): at most 30 days. None of these fields contain the analysis result. The record is deleted in full at the end of that period.

Purchase and entitlement verification is performed server-side via the RevenueCat API.

4.4. Feedback

If you send feedback from the Support screen, its text is stored in Cloud Firestore together with your user identifier and platform, so that we can read it and improve the App. It is kept for at most 1 year and then deleted automatically.

5. THIRD-PARTY SERVICES

The parties your data is transferred to, and why:

  • Google Gemini — analysis of the photograph (the photograph itself is transferred for this purpose)
  • Google Firebase (Functions / Firestore / App Check / Authentication) — secure request handling, abuse prevention, limited record storage
  • RevenueCat — purchase and entitlement verification (no photograph or analysis result is transferred)
  • Google Firebase Analytics / Crashlytics — usage statistics and crash reports (these do not include your name or contact details). Your analysis results, ancestral-origin estimates, and photographs are not sent to these services.

6. YOUR RIGHTS

The exact scope depends on the data protection law that applies where you live, but you have the following rights. Next to each one we note how you can exercise it:

  • Information and access: Learn whether your data is being processed and request information and a copy. How: Your analysis results and photographs are already on your device, in the "My Origins" screen. For the limited record beyond that, write to us.
  • Purpose and recipients: Learn the purpose of processing and the parties your data is transferred to. How: Sections 3, 4, and 5 of this policy set this out; you can also write to us.
  • Rectification: Request correction of data that is incomplete or inaccurate. How: Write to us.
  • Erasure: Request that your data be deleted or destroyed. How: You can delete the data on your device yourself from the "My Origins" screen, individually or all at once. The limited server-side record expires by itself at the end of the periods in 4.3; if you want it gone sooner, write to us.
  • Restriction, objection, and portability: Request restriction of processing, object to processing, receive your data in a portable format. How: Write to us.
  • Automated decisions: Object to an outcome against you produced solely by automated evaluation. How: Write to us. We would also note that the result the App produces has no legal or similarly significant effect on you — the output is for entertainment only.
  • Withdrawing consent: Withdraw your explicit consent at any time. Withdrawal does not retroactively make processing carried out on that basis up to that point unlawful. How: The Support screen in the App has a "Withdraw consent" option, and the same step lets you delete the analysis history on your device if you want to. After withdrawal we ask you again before the next analysis. The result content on the server is deleted automatically within 24 hours at the latest, as set out in 4.3.
  • Compensation: Claim compensation for damage arising from unlawful processing.
  • Complaint: Lodge a complaint with the competent data protection authority in your country.

For California residents: We do not sell your personal information, do not share it, and do not transfer it to third parties for behavioural advertising. We will not treat you differently or adversely for exercising your rights.

For residents of Turkey: The corresponding rights are set out in Article 11 of Law No. 6698.

For residents of the EEA, Switzerland, and the United Kingdom: The corresponding rights are set out in Articles 15–22 of the GDPR.

7. HOW TO SUBMIT A REQUEST

Send your request by email to support@getoriginsapp.com. To help us resolve it faster, please state your name, a contact detail, and the subject of your request clearly.

Response time: We will conclude your request as quickly as its nature allows and within thirty days at the latest, free of charge. If the operation entails an additional cost, a fee from the applicable statutory tariff may apply.

What you can already do in the App: You can delete the data on your device yourself from the "My Origins" screen. The limited server-side record is deleted automatically at the end of the periods stated above; if you would like it removed sooner, write to us.

For residents of Turkey: You may also submit your request by the methods set out in the Communiqué on the Procedures and Principles of Application to the Data Controller — written application, registered electronic mail (KEP), secure electronic signature, or mobile signature. If your request is refused, if you find our response insufficient, or if we do not reply in time, you may lodge a complaint with the Turkish Personal Data Protection Board.

8. CHILDREN'S DATA

The App is not directed at children. If you believe a child's data has been processed without your consent, contact us at the address below and we will delete it.

9. CHANGES TO THIS POLICY

When we update this policy we change the "Last Updated" date at the top of the document. If there is a material change to the purposes of processing, we will inform you within the App.

10. CONTACT US

For any privacy-related questions: Email: support@getoriginsapp.com

Read this in another language