Privacy Policy

Last modified: October 12, 2026

1. Introduction

Welcome to Merasus. This Privacy Policy explains how we collect, use, and protect your information when you use our applications and services ("Services").

When we say "Merasus," "our," "we," or "us," we're talking about Merasus Teknoloji Anonim Şirketi, the data controller for our applications and services (MERSİS No. 616089839600001; Orta Mah. Kavaklar Cad. No: 15 D: 103, 54100 Adapazarı / Sakarya, Türkiye). This policy applies to all of our applications unless specified otherwise.

Users in Turkey: our documents under Turkey's Personal Data Protection Law No. 6698 (KVKK), including the clarification text, your rights under Article 11 of the KVKK and the application form, are at merasus.com/kvkk.

Our commitment: We believe in minimal data collection. We only collect what's absolutely necessary to provide our Services.

2. Information We Collect

The information we collect varies by application. See the application-specific sections below for details.

Information Stored Locally on Your Device

Most of our applications store data locally on your device only. This data never leaves your device and includes:

• Your preferences and settings
• Content you add or manage (playlists, URLs, favorites, scan results)
• Usage history and progress (watch history, scan progress)

We cannot access this data. It stays on your device.

Information You Provide Voluntarily

When you contact us for support, you may provide:

• Your email address
• Information about your issue

Purchase and Subscription Information

If you subscribe to an optional premium plan (such as Merasus ID Premium), the transaction is processed by Apple App Store or Google Play Store. In some applications (currently PaperNest and Wipest), we use Adapty, a third-party subscription platform, for subscription state management. EzoBlocker does not use Adapty: its purchases are verified by our own server at id.merasus.com with the app store. Through the app stores, and Adapty where it is used, we receive:

• Confirmation that a subscription was started, renewed, or cancelled
• The product identifier (e.g., weekly, monthly, or yearly plan)
• Subscription status (active, trial, expired, or cancelled)
• A randomly generated subscriber identifier, used only to link subscription state to your account

We do not receive your payment details (credit card, billing address, etc.). All payment processing is handled entirely by Apple or Google. For the apps that use Adapty, Adapty's privacy policy is available at https://adapty.io/privacy/.

Merasus ID Account (Optional, for Participating Apps)

Some of our applications offer an optional account called Merasus ID. A Merasus ID lets you sync your subscription state across devices and across participating Merasus applications. Creating or using a Merasus ID is entirely optional; our applications can be used without one.

When you choose to sign in to a Merasus ID, we collect and process:

• Your email address (entered by you, or provided by Apple Sign In or Google Sign In). Apple's private relay email is supported.
• A display name (optional; entered by you or provided by your sign-in provider)
• A profile photo (optional; only if you upload one or one is provided by your sign-in provider)
• A randomly generated user identifier
• Authentication tokens, stored in encrypted storage on your device (not retained on our servers)
• Your subscription state (tier, product identifier, renewal or expiry dates)

Merasus ID data is stored on our servers at id.merasus.com. It is used to authenticate your account across devices, to preserve your subscription entitlement across participating Merasus applications, and to respond to support requests. It is not used for advertising, profiling, or sharing with third parties for their own purposes.

Participating apps as of October 2026: PaperNest, Wipest, EzoBlocker. AREZTV does not currently use Merasus ID.

Account deletion: You can delete your Merasus ID from within the app at any time (Settings > Account > Delete Account). Upon deletion, your personal information (email, display name, profile photo, user identifier) is anonymized on our servers. Transaction and subscription records may be retained as required by tax or accounting law.

Advertising Identifiers (Participating Apps Only)

Some of our applications run paid advertising campaigns to acquire new subscribers. To measure whether those campaigns convert into actual subscriptions (without which campaign spend cannot be attributed), the apps that run these campaigns send anonymous purchase and trial-start events to Firebase Analytics (Google LLC) and the Meta SDK (Meta Platforms, Inc.). These events include:

• Your device's advertising identifier: GAID on Android (collected by default, resettable in your device settings); IDFA on iOS (collected only if you grant permission via Apple's App Tracking Transparency prompt; otherwise not collected).
• An anonymous transaction identifier provided by Adapty (used to deduplicate the event so the same purchase is not counted twice). It does not contain your name, email, or other personal information.
• The product identifier and the local currency amount of the subscription.

We do not send your name, email address, document content, photos, or any in-app behavior to Firebase or Meta. We only send the two events listed above (purchase and trial start). EzoBlocker is the exception described in the next paragraph. The apps do not display advertisements inside the app itself.

EzoBlocker: EzoBlocker does not use the Meta SDK or Adapty and does not show the App Tracking Transparency prompt. It sends in-app usage events only to Google Analytics for Firebase (Google LLC), with a pseudonymous app installation ID (not an advertising ID). On Android, these events also include the GAID and are used to measure our own Google Ads campaigns. On iOS, Firebase is used only for usage analytics, not for advertising measurement: EzoBlocker does not access the IDFA, and iOS campaign results come only from Apple's aggregated SKAdNetwork reports. Website names and DNS lookups are never sent. See the EzoBlocker section below for details.

Participating apps as of October 2026: PaperNest and EzoBlocker. Wipest and AREZTV do not currently send advertising or analytics events. This section will be updated if and when that changes for any of those apps.

How to opt out:

• iOS: Settings > Privacy & Security > Tracking > toggle the participating app off (or choose "Ask App Not to Track" the next time the app asks). When tracking is off, the app does not access your IDFA and does not send events to Meta. Firebase still receives anonymous events without an advertising identifier.
• Android: Settings > Privacy > Ads > "Delete advertising ID" or "Reset advertising ID". Resetting issues a new GAID; deleting it stops sharing entirely.
• EzoBlocker: In the app, Settings > Privacy > Usage statistics turns off all usage events, including the GAID on Android. On iOS, EzoBlocker does not use the IDFA.

3. Application-Specific Information

4. How We Use Your Information

We use the limited information we have to:

• Provide and maintain our Services
• Filter DNS lookups according to the categories and custom lists you choose (EzoBlocker), and measure connection reliability through anonymous daily totals
• Understand how EzoBlocker is used through in-app usage statistics, so we can improve the app, and, on Android, measure our own advertising campaigns for it (you can turn this off in the app)
• Authenticate optional Merasus ID accounts and preserve your subscription state across devices and participating apps
• Respond to your support requests
• Process in-app purchases and subscriptions through the app stores and, in the apps that use it, our subscription platform provider (Adapty)
• Measure whether our paid subscription advertising campaigns convert into actual subscriptions, in the participating apps listed under Section 2 ("Advertising Identifiers"), so we can stop campaigns that do not work and improve the ones that do. In PaperNest this is limited to two events (purchase and start_trial) and the device's advertising identifier; EzoBlocker uses its in-app usage statistics instead. See Section 2 and the relevant application-specific section for the full scope.
• Prevent the same phone from starting EzoBlocker's free 24-hour trial more than once (fraud prevention, based on our legitimate interest)
• Comply with legal obligations, including tax and accounting requirements

We do not use your information for:

• Showing advertisements inside our applications
• Selling your data to third parties
• Building behavioral or interest-based advertising profiles about you
• Tracking which screens you visit, which features you use, or how long you spend in our apps, except EzoBlocker's in-app usage statistics described in Section 3, which you can turn off
• Training artificial intelligence models
• Recording, analyzing, or profiling the websites and services you visit (EzoBlocker does not log DNS lookups)

5. Third-Party Services

Our applications may connect to third-party services that you configure:

• Media URLs: When you enter a media URL, your device connects directly to that service. We have no control over those services.
• Chromecast/DLNA: If you cast content, your device communicates directly with your casting device on your local network.
• Apple App Store / Google Play Store: In-app purchases and subscriptions are processed entirely by Apple or Google. We do not handle your payment information.
• Adapty (subscription management), PaperNest and Wipest only: EzoBlocker does not use Adapty. In the apps listed, we use Adapty to manage subscription state, validate store receipts, and receive renewal, trial, and cancellation webhooks. Adapty receives transaction events and subscriber identifiers. Adapty does not receive your documents or any file content from our apps. Adapty's privacy policy: https://adapty.io/privacy/
• Apple Sign In: If you sign in to a Merasus ID with Apple, Apple returns a user identifier and, if you choose, a private relay email to our authentication server at id.merasus.com.
• Google Sign-In: Used in PaperNest for Google Drive authentication and, separately, as a Merasus ID sign-in option. For Google Drive sync, your email and display name are stored locally on your device. For Merasus ID sign-in, your email and display name are also stored on our authentication server at id.merasus.com.
• iCloud Drive / Google Drive (cloud sync): If you enable cloud sync in PaperNest, your documents are stored in your own cloud account. We do not access or control your cloud storage.
• Firebase Analytics (Google LLC), participating apps only: Used in apps that run paid advertising campaigns. In PaperNest, it receives only the two subscription conversion events purchase and start_trial with the local price, currency, product identifier, anonymous Adapty transaction ID, and on Android the GAID, and no in-app behavioral events. EzoBlocker sends in-app usage statistics instead, as described below. Privacy policy: https://firebase.google.com/support/privacy.
• Meta SDK / Facebook App Events (Meta Platforms, Inc.), participating apps only: Used in apps that run paid advertising campaigns (currently PaperNest) to receive subscription conversion events. Receives the same two events with the same parameters. On iOS, your IDFA is included only if you grant permission via Apple's App Tracking Transparency prompt; if you decline, the SDK is configured not to access the IDFA and not to send events to Meta. Privacy policy: https://www.facebook.com/about/privacy.
• Upstream DNS resolvers (EzoBlocker): Our DNS servers forward lookups that are not blocked to public upstream DNS resolvers. These resolvers receive the looked-up name from our server only, not your IP address or any identifier.
• Fallback and other DNS providers (EzoBlocker): When our servers cannot be reached, or when you choose another DNS provider, your device sends lookups directly to that service (such as Cloudflare, Quad9, Cloudflare for Families, AdGuard Family, or the provider you selected), which then receives the names you look up and your IP address under its own privacy policy. See the EzoBlocker section above.
• Google (Firebase Analytics, Google Ads measurement), USA (EzoBlocker): In-app usage statistics with a pseudonymous app installation ID (not an advertising ID) and an approximate location (country, city) derived from the IP address. On Android only, also the GAID, used for Google Ads conversion measurement; on iOS, usage analytics only. Ad personalization is off. You can turn this off in the app under Settings > Privacy > Usage statistics.
• Hosting and infrastructure providers: Our servers and websites run on infrastructure rented from cloud, hosting, and content delivery (CDN) providers in Turkey and other countries, which carry traffic to our servers and protect them against attacks. EzoBlocker's DNS servers run with query logging disabled. EzoBlocker's account service and its database (device records, filter choices, custom lists, and connection health totals) are hosted by a cloud infrastructure provider; EzoBlocker DNS lookups are not routed through that service. Hosting providers host our systems but do not use your data for their own purposes.
• Support tools: Messages you send through in-app feedback or our contact form are passed to the messaging tool our support team uses, and a confirmation is sent to your email address through an email delivery service.

Please review the privacy policies of any third-party services you use with our applications.

6. Data Security

Since we store data locally on your device:

• Your data is protected by your device's security (PIN, biometrics, encryption)
• We cannot access your data remotely
• If you uninstall the app, local data is deleted

For our server features, all connections use TLS encryption. EzoBlocker access tokens are stored on our servers only as one-way hashes, and DNS lookups and tokens are excluded from all server logs. For application-specific server features, see the Application-Specific Information section.

7. Data Retention

• Local data: Stored until you delete it or uninstall the app
• Support emails: Retained for up to 2 years, then deleted
• Merasus ID account data: Retained until you delete your account. Upon deletion, personal information (email, display name, profile photo, user identifier) is anonymized on our servers.
• Purchase and subscription records: Retained as required by law (typically 5-7 years for tax and accounting purposes), even after account deletion. These records are kept in a form that does not require personally identifiable information beyond what tax authorities require.
• EzoBlocker DNS lookups: Not retained. They are processed in memory only to answer the lookup.
• EzoBlocker device record and custom lists: Retained until you delete your data in the app (Settings > Privacy > Delete my data), then permanently deleted.
• EzoBlocker install code: Kept after Delete my data, only so that the free 24-hour trial is not offered again on the same phone.
• EzoBlocker connection health: Only anonymous daily totals are retained; individual reports are not kept.
• EzoBlocker usage analytics: Retained in Google Analytics for 14 months; Delete my data resets the Firebase installation ID.
• App-specific server data: See Application-Specific Information for details

8. Your Rights

You have the right to:

• Access: View your data. Local data is already on your device. If you have a Merasus ID, you can view your account information in-app (Settings > Account).
• Delete: Clear app data or uninstall to delete local data. If you have a Merasus ID, you can delete your account at any time from within the app (Settings > Account > Delete Account). Account deletion anonymizes your personal information on our servers. In EzoBlocker, Settings > Privacy > Delete my data permanently deletes your device record and custom lists from our servers; only the install code is kept, so that the free 24-hour trial is not offered again on that phone. It also resets the Firebase installation ID.
• Portability: Export your data where the app provides this feature
• Object: Contact us if you have concerns about data processing
• Opt out of advertising identifier sharing and usage analytics:
  • iOS: Settings > Privacy & Security > Tracking > toggle the participating app off. You can also choose "Ask App Not to Track" the next time the app's tracking prompt appears. When tracking is off, the app does not access your IDFA and does not send events to Meta; Firebase still receives anonymous events without an advertising identifier.
  • Android: Settings > Privacy > Ads > "Delete advertising ID" or "Reset advertising ID". Resetting issues a new GAID; deleting it stops sharing entirely.
  • EzoBlocker: Settings > Privacy > Usage statistics turns off all usage events, including the GAID on Android. On iOS, EzoBlocker does not use the IDFA.

To exercise these rights or ask questions, contact us at [email protected]. Users in Turkey can also apply under the KVKK with our data subject application form.

9. Children's Privacy

Our Services are not intended for children under 13. We do not knowingly collect information from children under 13. If you believe a child has provided us with personal information, please contact us.

EzoBlocker includes a Family lock that a parent or guardian can set up on a device used by a child. In that case the app is installed and configured by the adult, no account or personal information about the child is requested, and the data processed is limited to what is described in the EzoBlocker section above. When Family lock is turned on, Usage statistics is switched off. If it is turned back on while Family lock stays on, only usage statistics are sent; advertising measurement (the GAID and Google Ads measurement) is not.

10. International Users

Merasus is based in Turkey. If you use our Services from outside Turkey, please note that any information you provide may be transferred to and processed in Turkey, where data protection laws may differ from your country. EzoBlocker DNS lookups are processed on our DNS servers in Turkey and other countries (locations may change), and EzoBlocker device records are stored by a cloud infrastructure provider that may process data in more than one country, as described in the EzoBlocker section.

For users in Turkey: some of the providers named in this policy are located outside Turkey, so your personal data is processed abroad, within the scope of Article 9 of the KVKK, in order to provide the Services. See our KVKK clarification text for the recipient groups.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Updating the "Last modified" date
• In-app notification for major changes

Your continued use of our Services after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy, please contact us:

Data controller: Merasus Teknoloji Anonim Şirketi, MERSİS No. 616089839600001

Address: Orta Mah. Kavaklar Cad. No: 15 D: 103, 54100 Adapazarı / Sakarya, Türkiye

Email: [email protected]

Website: https://merasus.com