Privacy Notice
1. Who controls your data
Your personal data is processed by [DATA CONTROLLER] as data controller, in the scope described below. Contact: [CONTACT EMAIL].
2. What we process, why, and on what legal basis
YOU helps you keep real-world routines inside a small, closed circle. The data we process and the legal basis for each is set out below.
| Data | Purpose | Legal basis (KVKK art. 5) |
|---|---|---|
| Email address and password (stored only as an irreversible hash) | Creating your account, authentication, signing in | Performance of a contract (5/2-c) |
| Username, display name, bio, profile image, language and time zone, optional city or region | Building your profile and showing it to your circle | Performance of a contract (5/2-c) |
| Date of birth | Restricting the app to adults aged 18 and over. It is never shown on your profile or to other members. | Legitimate interest (5/2-f) and applying the applicable age restriction |
| Routine data: title, days, time, streak counts | Providing the core function of the service | Performance of a contract (5/2-c) |
| Proof content: photo, short note or timer record, and their timestamps | Recording that a routine was kept and letting your chosen circle verify it | Performance of a contract (5/2-c) |
| Circle, membership, connection request, message, respect and event attendance records | Providing the social features of the app | Performance of a contract (5/2-c) |
| Report, block and moderation records | Keeping members safe and preventing abuse | Legitimate interest (5/2-f) |
| Error reports: error message, stack trace, browser and operating system, IP address, pseudonymous user id and username | Finding and fixing faults, keeping the service secure | Legitimate interest (5/2-f) |
| Aggregate usage statistics: page views, country, device type (no cookies, not linked to your identity) | Measuring performance and usage of the app | Legitimate interest (5/2-f) |
| Store launch list: e-mail address, language and time of sign-up (only if you fill in the “Tell me when it ships” form on the website) | Telling you once when YOU is published on the App Store and Google Play | At your request; directly related to setting up a contract (5/2-c) |
No processing relies on your consent
YOU does not send marketing messages, does not use advertising networks, does not build behavioural profiles and does not process data for personalised advertising. For that reason we do not ask you for separate consent. If consent-based processing is ever added, it will be presented in a separate consent text, under its own heading, with a separate unticked box for each purpose.
A note on special categories of data
Routine titles and proof content are written freely by you. We recommend not sharing content that could reveal your health, beliefs or other special categories of personal data. If you do share such content, it remains visible only to the circle members you chose.
3. How we collect it
Data is collected directly from you through the sign-up screen, profile editor, routine and proof flows, and in-app messaging. Error reports and aggregate usage statistics are collected automatically by electronic means while you use the app. The store launch list address is collected directly from you when you fill in the form on the website.
4. Who we share it with
- Other members: your profile, shared routines and proofs are shown only to members of circles you joined and to people you connected with. There is no public feed and no follower count.
- Supabase (database, file storage, authentication): hosted in Ireland (European Union).
- Sentry (error monitoring): processed in the European Union region.
- Vercel (hosting and aggregate analytics): your IP address may be processed in server logs.
All of these providers are located outside Türkiye, so your personal data is transferred abroad within the meaning of KVKK. Transfers are carried out in line with the Law's provisions on international transfers.
5. How long we keep it
- Account, profile, routine, proof and message data: kept while your account exists, and deleted when you delete it.
- Error reports: kept for a limited period under the provider's retention policy.
- Report, block and moderation records: may be kept for a reasonable period for safety reasons even after deletion.
- Store launch list: deleted once the launch e-mail has been sent, or when you ask; never used for anything else.
6. Your rights
Under article 11 of KVKK you may ask the data controller to:
- Confirm whether your personal data is processed, and obtain information about it.
- Learn the purpose of processing and whether it is used accordingly.
- Know the third parties, in Türkiye or abroad, that your data is transferred to.
- Have incomplete or inaccurate data corrected.
- Have your data erased or destroyed under the conditions set out in the Law.
- Have corrections and erasures notified to the third parties your data was transferred to.
- Object to a result reached solely through automated analysis that works against you.
- Claim compensation for damage caused by unlawful processing.
Send requests to [CONTACT EMAIL]. You can also export a copy of your data and request deletion of your account from Settings inside the app.
This notice is information, not an agreement to accept. On the sign-up screen you are only asked to confirm that you have read it.