Privacy Policy

1. Who we are

The service published under the Drametric name — the website at drametric.com and the Drametric mobile application on the App Store — is operated by Ozjam Studio, who acts as the data controller for the personal data described here.

For privacy and personal data requests: privacy@drametric.com

For anything else: info@drametric.com

2. Your account data

The list below covers everything the platform actually stores. Nothing outside it is collected. Registration asks only for an email address, a password and your consent; we never ask for your age, date of birth, phone number, address or location.

• Identity and sign-in — email address, username, display name if you set one, account creation date and your last sign-in date. The account record keeps only the latest sign-in moment and no sign-in history; usage measurement additionally keeps a per-member last-access time and view count (see section 4).
• Password — never stored in readable form. We keep only an irreversible cryptographic hash (scrypt) with its random salt, and comparison at sign-in is constant-time.
• Session keys — short random keys per device. One web session and one app session may stay open per person; changing your password, role or account status ends all sessions.
• Consent record — the moment you read the privacy notice and accepted the terms of use. Created for accounts opened from the mobile app.
• Account status — membership role, whether the account is active, and where it was created (mobile store registration or the management panel).
• Staff note — a free-text field the support team can write when creating an account. It is visible only in the management panel, is never shown to you, and is destroyed when your account is deleted.
• Password reset ticket — the hash of a single-use ticket created when you request a reset. It is valid for 60 minutes, becomes void once used, and expired records are deleted within 24 hours. Your email address is not part of this record.
• Your follow list and notification preferences.

3. Subscription data

Payment is taken by Apple. Card numbers, expiry dates, billing addresses and transaction identifiers never reach Drametric and are never stored by us. All we keep is the summary that determines your access: the current subscription state (trial, active, billing issue, expired), the product identifier, the expiry date, which platform the subscription came from, the source of the record (store or management panel), the time of the store event, and whether the purchase came from Apple's test environment. The subscription start date and past trial usage are not stored. This record is a copy of the state held by the store; the original lives with Apple.

4. Usage measurement

We keep a plain usage record to see which screens are used. It contains no raw IP address, no full URL, no query parameters, no search terms and no browsing history. Management panel pages and automated bot requests are not recorded at all.

• Visit time, the pattern of the page opened (for example /series/[id]) or the name of the app screen, and the identifier of the series you viewed.
• Device class (phone/tablet/desktop) and, in the mobile app, the operating system family (iOS/Android). Device model, OS version and the raw browser identifier are not stored.
• Interface language, country code and, where present, the domain name only of any referring site. The country is resolved from a database on our own server, with no outbound lookup. City and coordinates are deliberately not stored.
• If you are a member, a pseudonymous trace identifier for your account. It is produced with a secret key, and the record itself contains neither your email address nor your username. While your account exists, the management panel can match this identifier to your account and see, per member, which screens you opened and when. Once you delete your account the match becomes permanently impossible.
• A daily session marker — your IP address, browser identifier and the date are combined and hashed, and only the leading characters are kept. The value changes the next day, so it cannot be used to follow you across days.

5. Your IP address

At the application level your raw IP address is never written to any file. It is read at request time for three purposes only and then discarded: resolving the country code, producing the daily session marker described above, and feeding the rate limiter that protects against brute-force attacks. The rate limiter lives in memory only, is never written to disk, and is lost when the server restarts.

Separately, the web server that publishes the site keeps a standard security log for each request, containing the IP address, the requested address, the referring address and the browser identifier. This log is needed to detect attacks and diagnose faults; it is rotated daily and kept for at most 14 days. The lawful basis is our legitimate interest.

6. Notifications

• If you grant permission, we store the notification token Apple issues to your device, your app language and which notification types you keep enabled. The token identifies a device rather than a person, becomes invalid when you delete the app, and invalid tokens are removed.
• The notification itself is delivered through Apple's infrastructure. A notification about a series you follow contains the series name in its text, so that information passes through Apple's delivery system.
• A short send history is kept so the same notification is not sent twice; it is deleted after 90 days.
• For broadcast announcements we record how many devices were reached, not who received them.

7. Surveys, support and contact

• Survey answers — answering is entirely optional. If you are a member the answer is linked to your account; if not, it is linked to an irreversible installation identifier the app generates for itself. That link exists only so the same survey is not asked twice. Results are evaluated as aggregate statistics and exports contain no identifying field.
• Contact messages — when you write to us, your name, email address, subject and message reach our company mailbox; this is necessary for us to reply.
• Support requests — the support team may open a record to track an issue you reported. It holds a title, status, priority, tags, the assigned staff member, opening and closing times, the team's own notes and — your account identifier if you have an account, or otherwise the email address or name you gave us so we could reach you.
• The header of any email we send in reply (recipient, subject, time) is logged; the message body is not written to that log.

8. Why we process it

The box you tick at registration records that you have read this notice and accept the terms of use. Creating your membership, keeping your session and protecting your account do not rely on your consent; they are carried out because they are necessary for our contract with you. Consent applies only where "your consent" is stated below, and withholding it affects neither your membership nor your access to the service.

• To create your membership, keep you signed in and protect your account — necessary for performance of our contract with you.
• To verify your subscription and unlock subscriber content — performance of our contract.
• To send notifications — your consent. You can turn notifications off in the app's notification settings or in your device settings.
• To evaluate survey answers — your consent.
• To handle and record support requests — our legitimate interest.
• To measure the service, find faults and prevent abuse — our legitimate interest.
• To comply with legal obligations and respond to lawful requests from authorities.

9. Who we share it with

We do not sell or rent personal data for marketing. The parties your personal data actually reaches are listed below.

• Apple — app distribution, subscription billing and notification delivery. Payment details reside only with Apple. When you tap "Manage subscription" or "Rate the app" inside the app, your device connects directly to the store.
• RevenueCat — verifying store subscriptions and syncing subscription status to the app. The only thing sent is a randomly generated internal user identifier; your email address, name and username are not sent.
• Google Workspace (Gmail) — contact form messages and password reset emails arrive in our company mailbox, and copies remain there.
• Our server hosting provider — the infrastructure where data is stored.
• If you tried a beta build through TestFlight, the feedback text, screenshots, your device model, operating system version and any crash log you sent via Apple reach us. Screenshots are kept on our server for 90 days and then deleted; the rest is not stored. This applies to beta testers only.
• When you tap a scene link the video opens on YouTube; from that point Google's own privacy practices apply. While browsing our site, series images are served through our own server, so your IP address does not reach YouTube.

10. International transfers

Some of the providers above are located outside Türkiye, so personal data may be transferred abroad to deliver the service. Such transfers rely on the contractual commitments and technical safeguards of the provider concerned.

11. Public data we analyse

Series metrics are based on view, like and comment counts published publicly on YouTube, together with the daily television audience tables published publicly by TİAK. This data belongs to the series and channels; it is not personal data of our users and is never linked to user accounts.

Dramatic analysis of episodes is produced from a speech transcript generated from the video's own audio. This runs on our servers and involves no user data.

12. How long we keep it

• Account data — for as long as your account exists.
• Usage measurement records — at most 3 years; rows older than that are deleted automatically.
• Web server security log — at most 14 days.
• Notification send history — 90 days.
• Password reset tickets — 60 minutes; expired records are deleted within 24 hours.
• Survey answers — until the survey is deleted; if you delete your account, the answer is detached from your identity.
• Support requests and contact messages — no automatic deletion period runs; records are kept until the purpose of processing no longer applies, and are deleted on your request. When the record count reaches its ceiling, the oldest entries drop off automatically.
• Longer periods apply where the law requires them.

13. What happens when you delete your account

You can delete your account yourself from the account screen in the mobile app; no request is needed. Deletion cannot be undone.

• Deleted — your email address, username, display name, password hash, session keys, account status, staff note, consent record, last sign-in, follow list, notification preferences, subscription record, the notification tokens of your devices, your notification send history and the contact messages you sent us.
• Detached from your identity — your survey answers and any support record are not deleted, but the fields identifying you (account identifier and contact details) are removed. Answers remain in aggregate statistics. Because a support record's title, tags and staff notes are free text, your name may still appear inside them; if you want the record deleted in full, just write to us.
• Remains — the irreversible trace identifier in usage records stays until its own retention period expires; after deletion it can no longer be linked to anyone. Correspondence in our company mailbox and records held by Apple, Google and RevenueCat are outside our deletion, and the policy of the provider concerned applies to them.

14. Cookies and what stays on your device

The site uses strictly necessary cookies only. There are no advertising cookies, tracking pixels or third-party analytics scripts.

• drm_member — carries your membership session, 30 days. Removed from your browser when you sign out.
• locale — remembers your chosen interface language, 1 year.
• drm_admin — created only for staff accounts that access the management panel; 7 days (panel sign-in) or 30 days (from a member sign-in).
• A temporary 10-minute cookie is created while a staff member connects the company mailbox in the management panel; it never appears for ordinary visitors.
• Browser storage holds only the comparison layouts you save in Lens and a flag recording that you have seen the introductory tooltip; neither is sent to our servers.
• In the mobile app, the device's secure storage holds only your session key, language preference, your Face ID/Touch ID lock preference and a note that you were asked about it once, a note that you have seen the introductory tips, the random installation identifier the app generates, and your Lens views. Your password is never stored on the device.

15. Your rights

You may ask whether we process your personal data, request information about it, learn the purpose of processing and whether the data is used accordingly, learn about third parties it is transferred to at home or abroad, request correction of incomplete or inaccurate data, request erasure or destruction, ask that such actions be notified to recipients of the data, object to results produced solely by automated analysis that work against you, and claim compensation for damages caused by unlawful processing.

You may send your request from the email address you previously gave us and which is registered in our system, to privacy@drametric.com, or sign it with a qualified electronic or mobile signature.

Your request should state your full name, your identity or passport number, an address for service, your registered email address and phone number if any, and what you are asking for. We respond as soon as possible and within thirty days at the latest, free of charge.

16. Security

Passwords are stored only as irreversible cryptographic hashes. Sessions run on signed keys. Data is transmitted over encrypted connections. The management panel is reached either through a staff account, whose permissions are granted individually, or through a single shared operator password held by the operator of the service; the latter is an emergency route and is not tied to any user account. An account opened through the store can never be given staff permissions.

17. Children's privacy

The platform is not directed at children under 13, and we do not knowingly collect personal data from them. Because registration does not ask for an age, a user's age is not disclosed to us. If we discover data belonging to a child under 13, we delete the record.

18. Changes

This policy may be updated when the service or the applicable law changes. The current version is always published on this page, and the date at the top shows the last update.