Onyx & Aura Open House privacy policy

This policy explains how the Onyx & Aura Open House app (shown as “Open House” on your device) handles personal data. It is written for two groups of people: real estate agents who use the app, and visitors who sign in at an open house.

The short version: everything entered in the app is stored only on the agent’s device (and in the agent’s own device backup, if it is on). We do not run a server for the app, and we never receive or see visitor details or anything else entered in the app.

Who we are, and who is responsible for visitor data

The Onyx & Aura is a brand; the apps are published by 16X9 FİLM YAPIM BİLİŞİM SANAYİ VE TİCARET ANONİM ŞİRKETİ. In this policy “we” and “us” mean this company. We make the app. We are the data controller only for the in-app purchase records described below.

The agent is responsible for visitor data. When an agent (or their brokerage) uses the app to collect visitors’ details at an open house, the agent decides why and how those details are used, and is the data controller for them under laws such as the Turkish Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR). We have no access to that data, so we do not process it on the agent’s behalf either.

For visitors: if you signed in at an open house

• What you enter (your name, phone number and/or email address, your answers and which contact permissions you ticked) is saved on the agent’s device, together with the date and time you signed in and the version of the permission wording you saw.
• The agent can see it. The app’s Call, Text and Email buttons work only for the permissions you gave, and each permission box starts unticked.
• The “Privacy notice” on the sign-in screen shows who is responsible for your details, why they are recorded, where they are kept, for how long, and how to reach the agent. To see, correct or delete your details, or to withdraw a permission, contact the agent. In the app they can find your record, correct it, turn off a permission or delete the record at any time.
• We cannot see, change or delete your details, because they never reach us. If you write to us, we will tell you this and, where we can, help you find the agent’s contact details.
• After each sign-in a short thank-you shows your first name, then the form is cleared for the next visitor.

For agents: what the app keeps on your device

The app saves the following on your device only:

• your profile (name, and if you add them, brokerage, phone and email) and the privacy notice details you enter;
• your open houses (address, date and time, sign-in form language and any questions of your own);
• visitor records, your follow-up statuses and notes, the times you tapped call, text or email, and the date of any permission a visitor withdrew;
• your settings and message templates;
• a cover photo or logo, if you choose one: a copy of that one image is stored inside the app.

Your PIN is stored as a salted, one-way hash in the device’s secure keychain or keystore, for this device only. It is not included in backups.

Face ID, Touch ID and fingerprint are handled entirely by your device’s operating system. The app only learns whether the check succeeded; it never receives your face or fingerprint data.

What the app does not do

• It has no accounts and does not connect to any server of ours. We do not run one for the app.
• It shows no ads.
• It contains no analytics, crash reporting or tracking tools, and it does not track anyone across other apps or websites.
• It does not use the device’s advertising identifier.
• It does not ask for access to your location, contacts, camera or microphone. Photos are used only when you choose a cover photo or logo through your device’s photo picker.
• It does not send messages by itself. Call, Text and Email open your device’s own Phone, Messages and Mail apps, and the message is sent by you, through your own phone line or email.

Exports and the seller report

“Export CSV” creates a spreadsheet file of an open house’s visitors on your device and opens your device’s share sheet, so you choose where it goes (for example your email, Files or your CRM app). The seller report (PDF) contains totals only, and no names, phone numbers, email addresses, notes or answers to your own questions. Once you share a file, the place you send it to holds a copy under its own terms. The app deletes its temporary copy after sharing.

Device backups

If iCloud backup (iPad and iPhone) or Google backup (Android) is turned on, your device backup includes the app’s data, including visitor records. Backups are under your control and covered by Apple’s or Google’s privacy terms; Apple or Google may store them on servers outside your country. For agents in Türkiye, this may count as a transfer of personal data abroad under KVKK. The app mentions during setup, in Settings and in the visitors’ privacy notice that backups may be stored outside the country. We do not receive backups.

Security

Visitor records are protected by your device’s own encryption when the device has a passcode, so keep your device locked with one. The app’s lists open only with your PIN, with Face ID, Touch ID, a fingerprint or face unlock, or with your device passcode through “Forgot PIN? Unlock with the device passcode”. The app locks when it goes to the background and while the sign-in screen is open. Because we hold no copy, we cannot recover data that is lost with a device: use backups or export a CSV if you need a copy.

Purchases

Open House Pro is an optional one-time in-app purchase. It is processed entirely by Apple (App Store) or Google (Google Play). We never receive your card or payment details. Apple and Google may show us basic order records (such as an order number, date, country and amount, and on Google Play possibly the buyer’s name) so we can handle refunds and support. We use them only for that and for our accounting and tax obligations, and the app itself sends us nothing.

Legal bases: performing the purchase contract (KVKK Art. 5/2-(c); GDPR Art. 6(1)(b)) and our tax and accounting obligations (KVKK Art. 5/2-(ç); GDPR Art. 6(1)(c)). We keep these records as long as needed for refunds and support and for the periods tax and commercial law require. They are held in Apple’s and Google’s systems, which may be outside Türkiye and the EU, including in the United States.

To check whether you own Pro, for example when you tap “Restore purchase”, the app asks the App Store or Google Play on your device. That check happens between your device and Apple or Google, under their privacy policies: Apple, Google.

Children

The app is a tool for real estate professionals and is not directed at children. The sign-in form is meant for adults visiting a home for sale.

Deleting data

In the app, an agent can delete one visitor (“Delete this visitor”), one open house with its visitors (“Delete open house and its visitors”) or everything on the device (Settings, “Delete all data”). Deleting is always free. Deleting the app deletes its data from the device (on iPad and iPhone the PIN hash can stay in the device keychain until the next setup replaces it); copies in older device backups or in files you exported stay until you delete them there. The app does not delete old records automatically: when records are older than the keeping period in the privacy notice, it shows the agent how many, and the agent decides. We hold no data from the app, so there is nothing for us to delete on our side.

Your rights

Under KVKK (Article 11) and, where it applies to you, the GDPR, you have rights over your personal data, such as to ask whether it is processed, to get a copy, to have it corrected or deleted, to object to or restrict its use, and to receive it in a portable form. For visitor data, the agent is the one to ask. For your in-app purchase records with us, contact us and we will answer within 30 days. You can also complain to the Turkish Personal Data Protection Authority (KVKK) or to the data protection authority in the EU country where you live.

The website, email, Etsy shop and Amazon books are run separately by Emre As under the name The Onyx & Aura; for how data is handled there, see the privacy notice and the KVKK Aydınlatma Metni (in Turkish). Emails to our support address are handled under that privacy notice.

Changes to this policy

If the app changes in a way that affects this policy, we will update this page and its date before the new version of the app is released.

Contact

Questions about privacy: hello@theonyxaura.com. Please do not send us visitor details. See also the app terms of use and support page.