Privacy Policy and Turkish Data Protection (KVKK) Notice

Scope

This text fulfils the information duty under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK) and applies to the Form Your Day iOS app and formyourday.com. The product is offered in Türkiye for adults aged 18 and over; no children's data is processed.

What we process, why, and on which legal basis

We collect only what the app needs to work. The KVKK legal basis is stated next to each item.

• Account and subscription ownership: e-mail address or Apple user identifier, session and device enrolment (App Attest/DPoP key identifiers), App Store transaction identifier. Purpose: opening your account, running your session and subscription. Legal basis: performance of the contract (Art. 5/2-c); legitimate interest for security checks (Art. 5/2-f).
• Health journal and personal plan: date of birth, height and weight, your sex answer for the calorie calculation, goals, your health-status answers (pregnancy/breastfeeding, eating disorder, clinical context), allergens and dietary restrictions, movement restrictions, sleep/rest statements, meal-water-weight-movement records, photos you keep with a meal (keeping starts switched on for a new meal with a photo; you can turn it off), day/week totals derived from Apple Health, your plan and reminder rules. These are special-category health data. Purpose: building your personal plan, keeping your records and running the deterministic calculations. Legal basis: your explicit consent (Art. 6/3-a).
• AI meal analysis and Coach: meal photo, text or voice transcript, the note you write when correcting a food, your allergens and dietary restrictions (including a restriction in your own words), your Coach messages and a de-identified context summary built from your records (an age band instead of your name and exact date of birth, single-use tokens instead of record identifiers). Purpose: producing meal drafts and Coach answers. Legal basis: your separate explicit consent (Art. 6/3-a); without it, meal analysis and the Coach are not available, while water, weight, movement and rest logging, history, export and deletion keep working.
• Product usage analytics: a closed list of events (which screen opened, whether an action succeeded) under a random analytics identifier, app and iOS version; no health content. Off by default. Legal basis: your explicit consent (Art. 5/1).
• Anonymous funnel counters: only a (step, date) counter during onboarding; no identifier. Not personal data; the seconds-long processing of the IP address for network security rests on legitimate interest (Art. 5/2-f). You can switch it off in Privacy and My Data.
• Technical observability and security: content-free request and error records, crash diagnostics not linked to an account, content-free security records. Purpose: security and continuity of the service. Legal basis: legitimate interest (Art. 5/2-f) and the data-security duty (Art. 12).
• Feedback and support: the message you send and your optional e-mail address. Purpose: answering your request. Legal basis: legitimate interest (Art. 5/2-f).
• Data-subject requests: the identity and contact details you provide in a request and our answer; consent, export and deletion receipts (content-free). Purpose: completing and evidencing the statutory request. Legal basis: legal obligation (Art. 5/2-ç, Art. 13).
• This website: page-request metadata and IP address in Cloudflare's network logs. No cookies, analytics or tracking pixels.

Your health data and your explicit consent

Your health data are special-category personal data under KVKK Article 6 and are processed only with your explicit consent. You give it when creating your account, as one un-ticked action separate from the terms of use and this notice. Health data are this service itself: without consent no account is created; your answers stay only on your device and you can reset them at any time. Withdrawing consent means deleting your account and health records; an export is offered first. Your consent to AI processing is separate and can be withdrawn on its own.

Apple Health

Apple Health data are read on your device, limited to the types you select in the iOS permission screen, and the permission is always managed in iOS Settings › Health. Only the day/week totals needed for progress continuity are sent to our servers, never raw samples; they fall under your explicit consent like the rest of your journal and can be deleted separately. If you turn on the meal export in the app, the nutrition values of the meals you confirm (AI estimates with your corrections) are written to Apple Health; turning it off stops new exports.

How data are collected

Your personal data are collected fully automatically, through the iOS app and this website, from what you enter and from the technical records created while the app runs.

Recipients, processors and transfers abroad

Your data are never sold or used for advertising or profiling. The providers below process data on our behalf and instructions to deliver the service; all of them are located abroad, so your data are transferred abroad. Our relationship with them rests on their standard data processing agreements; for Google, personal account terms apply.

• Railway (Railway Corporation; servers in the Netherlands, EU) — application server, database and private object storage; account and health journal data. Data are kept for the retention periods below.
• OpenAI (OpenAI OpCo, LLC; United States, global endpoint) — only with your consent, the meal photo/text, the food you correct and your note, your allergens and dietary restrictions and your Coach message of the moment are sent de-identified: your account, name, e-mail, device details and record identifiers do not go, and details such as phone numbers, e-mail addresses and identity numbers in your message are removed before sending. Content is not used for model training and is not stored at the provider by us; the provider may keep content for abuse monitoring only, for at most 30 days, and may keep encrypted intermediate computations of a request in its cache for at most 24 hours to answer faster.
• Brevo (Sendinblue SAS; France, EU) — only sign-in codes, mandatory account e-mails and our support replies; no health content. Sending logs are kept for 1 month; e-mail contents are not stored.
• Google (Google LLC; US) — on Drive, only client-side encrypted disaster backups, the key is never given to Google and backups age out within 30 days; on Gmail, support@formyourday.com correspondence.
• Cloudflare (Cloudflare, Inc.; US, global network) — only delivery of this website, DNS and support e-mail routing; the app API does not pass through Cloudflare.
• Apple (Apple Distribution International Ltd., Ireland / Apple Inc., US) — Sign in with Apple, App Store subscription and notification delivery; for these services Apple is an independent controller under its own agreement with you. Notifications carry no health content.

Retention periods

Every data class has an explicit period, and periods cannot be extended remotely.

• Account, profile, health journal and plan: as long as your account is open. When you delete your account they are removed from live systems immediately; encrypted backups age out within 30 days at most.
• Raw Coach conversation and reminder history: 90 days. Raw meal photos and audio: deleted once the analysis result exists; the reduced copy you keep with a meal stays with your health journal, and you can remove it whenever you like. Meal analysis and correction runs (your text, correction note and the AI result): 7 days.
• Export package: 24 hours after it is ready.
• Raw analytics events: 90 days (immediately on withdrawal); de-identified aggregates: 13 months.
• Technical records: 7–30 days; content-free security records at most 180 days.
• Feedback messages: 365 days.
• Legal records: consent, export and deletion receipts and the data-subject request file for 3 years (Deletion Regulation Art. 7/3); the minimum record of App Store subscription ownership for 3 years after account deletion (Art. 5/2-e). These records carry no health content and cannot be used for the product, AI or analytics.

Security

Data are protected in transit with TLS and on the device with the Keychain and Secure Enclave; server-side access is limited by least privilege and multi-factor authentication; backups are encrypted before upload; logs, crash reports and analytics contain no health content. In case of unauthorised access you and the Board are notified as soon as possible (Art. 12/5).

Your rights (KVKK Art. 11)

By applying to the data controller you can:

• Learn whether your personal data are processed and, if so, request information.
• Learn the purpose of processing and whether data are used in line with it.
• Know the third parties to whom data are transferred, in Türkiye or abroad.
• Request correction of incomplete or inaccurate data.
• Request deletion or destruction under the conditions of Article 7.
• Request that corrections and deletions be notified to the third parties the data were transferred to.
• Object to a result against you produced exclusively by automated analysis.
• Claim compensation for damage caused by unlawful processing.

Applying to the data controller

Requests are answered as soon as possible and within 30 days at the latest, free of charge; for written replies over 10 pages a fee of 1 TL per additional page and the cost of any storage medium may be charged. A refusal states its reasons; you may complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your request (Art. 14).

• In the app: Settings › Privacy and My Data — data export, record correction, account deletion, consent withdrawal and receipt history (your identity is verified by your session).
• From the e-mail address registered to your account, to support@formyourday.com with the subject line "KVKK Başvurusu".
• In writing (wet signature) to the controller's address, available on request from support@formyourday.com.
• A request must contain your name and surname (signature if written), Turkish ID number (nationality and passport/ID number for foreigners), a postal address for service, e-mail/phone if any, and the subject of the request; requests are made in Turkish.
• For security, health data are never sent by e-mail; a copy is provided through the identity-verified in-app export.

Product analytics and counters

Product analytics is off by default; it is never asked during onboarding or on the paywall, it is offered once after an active subscription and your first meaningful record, and you can switch it on or off at any time in Privacy and My Data. Nothing from before your consent is kept. Anonymous funnel counters carry no identifier and can be switched off in the same place. No third-party analytics SDK or advertising identifier is used.

Feedback form and support correspondence

The message in the form and the optional e-mail are processed only to answer your request, never for marketing, and are deleted after 365 days. Do not write your health data, measurements or medical information in support messages; we do not need them and e-mail is not a safe channel for them.

Cookies and tracking

This site uses no cookies, analytics or tracking pixels. Your language and appearance preferences are stored only in your own browser.

Changes

If a purpose, data scope or recipient changes materially, only the affected processing is paused, the difference is shown in the app and your decision is asked again where needed. This page is updated with its date on every change.

Contact

For all privacy questions: support@formyourday.com