nLoad · legal

Privacy Policy

Last updated: 25 September 2026

Summary: nLoad processes only the data needed to send the video you choose to the social media accounts you connect. Your data is not sold, not used for advertising and not used to train AI models. Uploaded files are deleted 48 hours after the upload finishes. You can disconnect accounts and delete your account at any time.

1. Data controller
2. nayi.me account
3. nLoad
4. TikTok
5. Google user data (YouTube)
6. Meta (Instagram, Facebook, Threads)
7. LinkedIn
8. Retention, deletion, security
9. Your rights and contact

1Data controller

nLoad (the iPhone app and the nload.nayi.me service) and the nayi.me account (id.nayi.me, account.nayi.me) are operated by Xendaba Bilişim Telekomünikasyon Sanayi ve Dış Tic. Ltd. Şti. ("Xendaba", "we"), which is the data controller for the personal data described here. We process personal data in accordance with the Turkish Personal Data Protection Law No. 6698 (KVKK). Contact details are in section 9. The Turkish text of this policy is published at nayi.me/gizlilik.

2nayi.me account

You sign in to nLoad with a nayi.me account. For the account we process:

Your phone number and/or email address (the verified identity you sign in with).
One-time sign-in codes: the code itself is not stored; only a hash is kept for verification, valid for at most 15 minutes.
Session information: device name, sign-in and last-use time, and an irreversible hash of your IP address (the raw IP address is not stored in the session record).
Two-step verification: the authenticator secret is stored encrypted (AES-256-GCM); recovery codes are stored only as hashes.
Workspace information: memberships, roles and invitations (the phone number or email address of the person you invite).
Security logs such as sign-in attempts; phone numbers, email addresses, codes and IP addresses are not written to these logs in plain text.

Purpose and legal basis: to create your account, let you sign in, protect your sessions and account, and prevent abuse. Legal basis: KVKK art. 5/2-c (establishment and performance of a contract) and art. 5/2-f (legitimate interest in account security).

Service providers

NetGSM: Sending sign-in codes by SMS (Türkiye).
Postmark: Sending sign-in code and invitation emails (ActiveCampaign, USA).
Hetzner Online: Server hosting (Germany). Account and nLoad data are stored on this server.

Because Postmark and Hetzner are located abroad, these transfers fall under KVKK art. 9. The transferred data is minimised: Postmark receives only your email address and the content of the message sent; Hetzner only provides hosting. These transfers are necessary to open your account and provide the service.

Cookies: id.nayi.me uses only strictly necessary cookies: the session cookie (__Host-nid), the sign-in flow cookie (__Host-nid-akis) and the form security cookie (__Host-nid-csrf). nload.nayi.me sets no cookies. No advertising or tracking cookies are used.

3nLoad

nLoad is an iPhone app that sends the video you upload to the social media accounts you authorise, through our server. It processes only the data needed to provide this service:

Uploaded file: To send it to the platforms you choose. The file is not re-encoded, shrunk or cropped.
File information: Duration, resolution, format, bit rate and size, to compare with platform limits and warn you; a single-frame cover image for shared files.
Post text: The title, description and tags you write and your per-platform choices (for example the privacy level), to pass them to the platform.
Platform account: The connected account's platform ID, username, display name and profile image address, to show which account you are posting to.
Access tokens: To post on your behalf. Stored encrypted with AES-256-GCM on the server; never sent to your phone.
Share result: The post ID and address on the platform, the delivery status and the error reason, shown on the Shares screen.
On your device: The session key is kept in the iPhone Keychain; the upload queue is kept in the app's own storage.

nLoad does not request location, contacts, microphone or advertising ID and does not request full access to your photo library; it receives only the file you select. The app contains no third-party advertising or analytics libraries. Your data is not used for advertising, not sold and not used for profiling. Legal basis: KVKK art. 5/2-c (performance of the service contract).

4TikTok

When you connect your TikTok account through TikTok Login Kit, nLoad requests the user.info.basic, video.upload and video.publish scopes. They are used only to:

show your TikTok display name and avatar in the app (user.info.basic: open ID, avatar, display name);
read the posting options your account allows (privacy levels, and whether comments, Duet and Stitch are available), so the share screen shows only valid choices;
send the video you select to your TikTok account, either as a direct post (video.publish) or to your TikTok drafts/inbox (video.upload).

The privacy level and the commercial content disclosure are your choice on every post; nothing is preselected. We store the TikTok open ID, display name, avatar address, encrypted access and refresh tokens, and the publish ID and status of each post. We do not read your other TikTok videos, followers, messages or analytics. When you disconnect TikTok in nLoad, the tokens are deleted and the permission is also revoked on TikTok's side. How TikTok processes your data is described in the TikTok Privacy Policy.

5Google user data (YouTube)

When you connect your YouTube channel, you approve only two permissions on Google's consent screen:

youtube.upload: Used only to upload the video you choose to your own channel, with the title, description and privacy setting you write.
youtube.readonly: Used only to show the connected channel's name, handle and icon in the app.

Data accessed: channel ID, name, handle and icon address; the access and refresh tokens issued by Google; the YouTube ID of the uploaded video. Other videos, comments and viewing data on your channel are not read. Storage: tokens are stored encrypted on the server; channel information and the uploaded video's ID are kept in the Shares record. Sharing: data received from Google is not shared with third parties or sold, and is not used for advertising, credit assessment or training AI/machine-learning models. Humans do not read it, except with your explicit consent, for security investigations or where required by law. Deletion: disconnecting YouTube in nLoad deletes the tokens, channel name and icon immediately and revokes the permission on Google's side. You can also revoke access from your Google Account permissions page; our daily check detects this within 24 hours and deletes the stored Google data.

nLoad's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. nLoad uses YouTube API Services; by connecting a channel you are bound by the YouTube Terms of Service, and Google's processing is described in the Google Privacy Policy.

6Meta (Instagram, Facebook, Threads)

Instagram: instagram_business_basic instagram_business_content_publish: show the profile name and publish the video you choose as a Reel or Story.
Facebook Page: pages_show_list pages_read_engagement pages_manage_posts: list the Pages you manage by name and publish the video on the Page you choose.
Threads: threads_basic threads_content_publish: show the profile name and publish the video you choose.

Instagram, Facebook and Threads download the video themselves from a time-limited, signed address on the nLoad server that is valid only for that post. YouTube, TikTok and LinkedIn receive the video directly from the nLoad server. When you disconnect in nLoad, the tokens are deleted (for Facebook the permission is also revoked on Meta's side). If you remove nLoad in your Instagram, Facebook or Threads settings, Meta notifies us and the connection is closed. Data deletion requests sent through Meta reach nload.nayi.me/v1/hesaplar/meta/veri-silme; the connection and tokens of that account are deleted and you receive a confirmation code.

7LinkedIn

The openid, profile and w_member_social scopes are used to show your name and share the video on your personal profile. When you disconnect in nLoad, the tokens are deleted and the permission is revoked on LinkedIn's side. How LinkedIn processes your data is described in the LinkedIn Privacy Policy.

8Retention, deletion and security

Uploaded file: permanently deleted 48 hours after the upload finishes; if a post is still being delivered, deletion is postponed by at most 12 hours. You can delete the file earlier yourself.
Archive: files you move to the archive are kept until you delete them; if your archive entitlement ends, they are deleted after 30 days.
A file that was never shared leaves no record when deleted. When a shared file is deleted, the file itself is removed; the Shares record (post text, platform link, single-frame cover) is kept while your account is open and is deleted when you remove it from the list or delete your account.
Platform tokens: kept encrypted while the connection exists; deleted immediately when you disconnect.
Account: kept while your account is open. You can delete it in the app (nLoad → Settings → Delete account opens id.nayi.me/hesap/sil) or by writing to destek@nayi.me. After you confirm, deletion is queued immediately and normally completes within minutes: files in your personal workspace are removed from storage and records from the database; content in team workspaces stays with the team. Records we are legally required to keep (for example invoices) are kept only until the end of the legal period.
Server logs: may contain IP address and request time for security and debugging; deleted after at most 14 days.
Security: all traffic is encrypted with HTTPS; tokens and two-step verification secrets are stored encrypted; files are accessible only through time-limited signed addresses; server access is limited to authorised personnel.

9Your rights and contact

Under KVKK art. 11 you have the right to learn whether your data is processed, request information, request correction or deletion, learn the third parties it is transferred to, object, and claim compensation for damages. Send requests to kvkk@nayi.me or destek@nayi.me; we answer within 30 days.

Data controller: Xendaba Bilişim Telekomünikasyon Sanayi ve Dış Tic. Ltd. Şti.
Address: Bahçelievler Mah. Mareşal Fevzi Çakmak Cad. No:26/A, Beşevler, Çankaya / Ankara, Türkiye
MERSİS: 0839060675800001
Phone: +90 800 606 59 59
Email: destek@nayi.me

We may update this policy; the date at the top shows the latest version. If the English and Turkish texts differ, the Turkish text at nayi.me/gizlilik prevails.