Privacy Policy

In short

• Records such as measurements, vaccines, medicines, notes and photos are stored only on this phone, encrypted. You don't need an account, and we can't see these records.
• For daily content and notifications, with your consent at setup, the due date or birth date, sex, language, country and your phone's notification address go to our server and are stored there. Your child's name is not sent.
• We don't use advertising, analytics or any tool that tracks you, and we don't sell your data.
• Otherwise data leaves the phone only when you ask the guide assistant a question and when your subscription is verified.
• You can delete all your data at any time in Profile › Privacy and security.

Data controller

This policy is provided by [to be added before release] ("we"), the publisher of the Birlikte app. Address: [to be added before release]. Email: [to be added before release].

This text is the privacy notice under Türkiye's Personal Data Protection Law No. 6698 (KVKK). It also contains the information required by the General Data Protection Regulation (GDPR) for users in the European Union and the United Kingdom.

Data that stays on your phone

What you enter is stored in an encrypted database on your device: your name and relationship to the baby; child and pregnancy profiles (name, birth or due date, sex); doctor visits, growth measurements, vaccines, medicines, allergies and health facts; firsts, photos and settings.

These records are not sent to us or to any other server. Only the limited information listed in the sections below leaves the phone, and only in the cases described. The encryption key stays in your phone's secure key storage and is never transferred to another device. The doctor summary PDF and backup files go only where you choose, when you share them.

Daily content service

We choose daily content and notifications suited to pregnancy and early childhood from a multilingual content pool on our server, and send them from our server. We ask for your separate explicit consent for this during setup. The following is sent to and stored on our server:

• The due date, or your child's birth date and week of birth. Content is planned day by day, so our server needs to know the right day; the week of birth is used to work out corrected age for babies born early.
• Whether it is a twin or multiple pregnancy
• Your baby's sex, if you entered it
• The app language, the country and time zone from your phone's settings, and the notification times you chose
• Your phone's notification address (the push token issued by Apple or Google)
• A randomly generated content ID unique to this installation
• Whether you tap a notification we sent you (to see how useful the content is)

This is sent once during setup. After that our server works out the week of pregnancy and age from these dates by the calendar; the app sends an update only when you add a profile, record a birth, correct a date, or change the language or notification times. The numbers of content sent to you are kept on the server so the same item is never sent twice.

Your child's name, measurements, vaccines, medicines, notes and photos are not sent. The content ID is separate from your subscription ID and is never combined with it. Our server is hosted by Çizgi Telekomünikasyon A.Ş. (Natro, Türkiye).

We use this information to choose and send suitable content and to run the service. Our admin panel shows aggregate counts (for example, how many users are in week 20 of pregnancy, or what share of people opened a piece of content). We don't use this information for advertising, product recommendations or any other marketing. If we add product recommendations to the app in the future, we will ask for separate, optional consent.

Daily content is the core of the subscription and can't be provided without this information, so a subscription can't start without consent. You can withdraw consent later in Profile › Notifications or About and legal › Your consents. The app then sends our server a deletion request; our server stops sending you notifications and deletes your record. Your subscription is not cancelled automatically; you can cancel it in your store account settings. Viewing your records, the doctor summary, backups, deleting your data and emergency help always stay available regardless of consent.

Guide assistant

We ask for your explicit consent before you first use the assistant. When you ask a question, the following is sent:

• The text of your question and earlier messages in that conversation
• Your child's age (months and days) or the week of pregnancy, and the week of birth if entered
• The app language
• An anonymous user ID used to check your subscription and daily limit

Your child's name, birth date, photos and other records are not sent. Please don't type names, phone numbers or ID numbers into your questions.

The request goes from our relay running on Cloudflare to OpenAI (United States), and the answer comes back to you. We don't store conversations, and the app deletes a conversation when you close it. Requests are sent to OpenAI with storage turned off. Under its own terms OpenAI may keep requests for up to 30 days to prevent abuse and does not use API data to train its models.

You can withdraw consent at any time in Profile › About and legal › Your consents. The assistant then turns off; everything else keeps working.

Subscription and payments

Payments are handled by Apple (App Store) or Google (Google Play); we never receive your card details. We use RevenueCat, Inc. (United States) to verify your subscription. RevenueCat receives an anonymous app ID, purchase and renewal information, store country, device operating system and app version.

So we can track sales and trial use, RevenueCat also forwards subscription events (trial start, purchase, renewal, cancellation, refund) to our own server. This information is never combined with your health records or the content ID.

Notifications

Daily content notifications are sent from our server through Apple Push Notification Service (iOS) or Firebase Cloud Messaging (Android). For this we store your phone's notification address (push token). The notification text is only the content itself; your child's name is never added by the server. Reminders (such as vaccines and medicines) are local notifications planned on your phone and are not sent to a server. Notification permission is optional and can be changed in your phone settings.

Backups

Backup files are encrypted with a password you choose. We don't have your password and cannot recover it if it is lost. You decide where to keep the file (for example iCloud Drive, Google Drive or email); that service's own terms apply.

The database key is tied to this device, so a copy restored from the phone's own cloud backup cannot be opened. On Android, app data is excluded from Google backup. Use the app's own backup to move to a new phone.

What we don't use

• No advertising or advertising identifiers.
• No analytics, behaviour tracking, or crash reporting that contains health data.
• No location, contacts, camera or microphone permissions.
• We don't sell, rent or share your data for marketing.
• We don't track you across other companies' apps and websites.

Children's data

Birlikte is for parents and caregivers; it is not designed for children to use themselves. During setup you confirm that you are over 18 and the child's parent or caregiver. You enter information about your child and it stays on your phone; if you have consented, only the age and sex go to our server for daily content.

Purposes and legal bases

• Records on your phone: We don't process these records; the app is a tool that runs only on your device.
• Daily content service: Based on your explicit consent because the week of pregnancy, age and sex may count as health-related information (KVKK Art. 6(3)(a); GDPR Art. 9(2)(a)). The purpose is to choose suitable content.
• Assistant questions: Based on your explicit consent because they may contain health information (KVKK Art. 6(3)(a); GDPR Art. 9(2)(a)). The purpose is to answer your question.
• Subscription verification and sales records: Performance of a contract and legal obligations (KVKK Art. 5(2)(c) and (ç); GDPR Art. 6(1)(b) and (c)).
• Abuse prevention, security logs and the daily limit: Legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).

International transfers

Assistant requests are processed by OpenAI, L.L.C. (United States) and Cloudflare, Inc. (global network); subscription information by RevenueCat, Inc. (United States). The daily content server is hosted by Çizgi Telekomünikasyon A.Ş. (Natro, Türkiye). These companies act as service providers (processors) on our behalf. Notifications are delivered through the notification services of Apple, Inc. (United States) and Google LLC (United States).

Transfers outside Türkiye are made under the standard contracts published by the Turkish Personal Data Protection Board under KVKK Art. 9; transfers from the EU and UK rely on adequacy decisions or standard contractual clauses.

How long we keep data

• Records on your phone: until you delete them or remove the app.
• Daily content service: the content ID, notification address, due date or birth date and week of birth, sex, language, country and the numbers of content sent to you are kept until you withdraw consent. Which notification was sent when, and whether it was opened, is kept for 90 days; after that only totals that can't be linked to anyone remain. When you withdraw consent or use Delete all my data, the record is deleted. If you remove the app, Apple or Google reports the notification address as invalid and your record is deleted. If the app does not connect to our server for 12 months, the record is deleted automatically. A deleted record also drops out of our server backups within 30 days.
• Security logs: IP address and request time, for up to 30 days to prevent attacks and abuse.
• Assistant conversations: not stored by us. The relay keeps only error logs without content and a daily usage counter. Up to 30 days at OpenAI.
• Subscription and sales records: as long as needed to manage the subscription and meet legal obligations such as tax.

Your rights

Under KVKK Art. 11 and the GDPR you have the right to know whether your data is processed, to request information, rectification and erasure, to object to processing, to withdraw consent and to complain.

You can view, correct and fully delete the data on your phone yourself with Profile › Privacy and security › Delete all my data. The content record on our server is deleted when you withdraw consent for daily content. There is no account, so there is no account to delete. For requests about subscription records, write to [to be added before release] with the support ID shown under About and legal; we reply within 30 days.

You can complain to the Personal Data Protection Authority in Türkiye, or to the data protection authority of your country in the EU and UK.

Security

The database is encrypted with SQLCipher using a 256-bit key held in the iOS Keychain or Android Keystore. You can turn on an app lock with Face ID, fingerprint or your device passcode. Requests sent over the internet are encrypted with TLS. Only authorised people can access the information on our server, and access is logged. If a data breach occurs, we notify the Turkish Personal Data Protection Board and, where required, you within the legal deadlines. No method is perfectly secure; we recommend protecting your phone with a screen lock.

Changes

If we change this policy we publish the current version in the app and on our website, and announce important changes in the app. Effective date: 15 October 2026.

Contact

For questions and requests: [to be added before release]

[to be added before release], [to be added before release]