Privacy Policy

Last updated: 5 November 2026

This policy explains how your personal data is processed when you use the Ninja Spor mobile app (the "App"). The data controller is Yiğit Taşkın, a sole proprietorship trading as Taşkın Yazılım ("we", "us"). We process personal data in line with the Turkish Personal Data Protection Law No. 6698 ("KVKK") and other applicable laws. For the full statutory notice see the KVKK Notice; for health data see the Explicit Consent Text.

1. Data we collect

Account and device data

A random user ID (UUID) created for your account, device identifier, platform (iOS/Android), app and operating system version, device model, language, time zone, last activity time and the session token that keeps you signed in.

Account linking (optional)

If you link an account: your name and e-mail address; for e-mail sign-in, your password (stored only as a one-way hash); for Sign in with Apple or Google Sign-In, the user identifier provided by that service and, if you choose to share them, your name and e-mail address (Apple may give us a private relay address).

Onboarding answers and preferences

Your goals, sports of interest, experience level, running and strength background, available days and session length, equipment, training location, target date and target event, motivation and obstacles, reminder time and days.

Health-related data (only with your explicit consent)

Birth year, gender, height, weight, body measurements (weight, body fat percentage, waist, hip, chest, arm and thigh circumference), resting heart rate and workout heart rate, injury or limitation information and your notes about it, answers to the pre-exercise readiness questions, your "my doctor has cleared me" statement and the pain level you report after a workout. Details: Explicit Consent Text.

Training and activity data

Program enrolments and progress, workout logs (date, duration, distance, pace, speed, elevation, estimated calories, sets, repetitions and weights, effort and feeling ratings, notes), personal records, goals and badges.

Location data

When you start GPS tracking, the route of that activity (a simplified list of latitude/longitude points) and per-kilometre splits. We do not collect location when no tracking session is running. You can turn location permission off in your device settings at any time; manual logging keeps working.

Notifications

If you allow notifications: your device's push token and your reminder preferences.

Usage and technical data

In-app events (for example app opened, onboarding steps, program viewed, workout started, subscription screen viewed), error and crash reports (error message and technical context), IP address and server logs.

Subscription data

Product, store, trial or paid period, purchase and expiry dates, renewal status, transaction identifiers, price, currency and country. We never see your card or payment details: payments are taken by Apple or Google.

Advertising data (free tier only)

In the free tier, Google AdMob may process device data such as your advertising identifier and IP address to show and measure ads. On iOS your advertising identifier is shared only if you allow tracking (App Tracking Transparency); on Android you can reset or delete it in your device settings. We never send your profile, training or health data to ad networks. Premium users see no ads.

Communication

The content of e-mails you send us and our replies.

2. Why we use your data

• To create your account and provide the service: programs, tracking, statistics, records, badges and goals.
• To recommend a suitable program with fixed rules (no artificial intelligence is used) and to suggest program adjustments.
• For your safety: switching to a cautious mode based on your readiness answers and suggesting lower intensity when you report pain.
• To send reminders and notifications you have allowed: workout-day reminders set on your device, and Ninja's server messages (weekly recap, a nudge after a break, a short daily message; at most one a day). You can turn these off separately in Settings > Notifications or in your phone settings.
• To verify your subscription and unlock Premium features.
• To show ads in the free tier.
• To fix errors, keep the service secure and improve the App using aggregated statistics.
• To meet legal obligations and to respond to your requests.
• To send marketing messages, only if you have opted in.

3. Legal bases

Under KVKK we rely on: performance of our contract with you (Art. 5/2-c), compliance with legal obligations (Art. 5/2-ç), establishment, exercise or protection of a right (Art. 5/2-e), our legitimate interests such as security, error fixing and product analytics (Art. 5/2-f), and your explicit consent for marketing messages and, where required, personalised advertising (Art. 5/1). Health data is processed only with your explicit consent under Art. 6. See the KVKK Notice for details.

4. Who we share data with

We do not sell your personal data. We share it only as far as necessary with:

• Our rented server (VPS) provider in Türkiye, managed through Laravel Forge (server management software, United States). Your account and training data are stored on this server in Türkiye.
• Apple (App Store purchases, Sign in with Apple, Apple Push Notification service).
• Google (Google Play purchases, Google Sign-In, Google AdMob in the free tier, Firebase Cloud Messaging for notifications).
• RevenueCat, Inc. (USA), which manages subscription status: your app user ID and purchase records.
• Expo (USA), our push notification infrastructure: push token and notification content.
• Our e-mail delivery provider Brevo (Sendinblue SAS, France), for password reset and account deletion verification codes.
• Authorised public authorities, when required by law.

When you use the share feature, the image you create is sent by you to the app you choose (for example Instagram) and that platform's own terms apply.

5. Transfers abroad

Some of the providers above (for example Apple, Google, RevenueCat and Expo) process data outside Türkiye, mainly in the United States. Such transfers are made under Article 9 of KVKK as amended by Law No. 7499: on the basis of an adequacy decision where one exists; otherwise by providing one of the appropriate safeguards set out in the law (such as standard contractual clauses announced by the Personal Data Protection Board and notified to the Authority within five business days of signature); and only where neither is available, for occasional transfers within the exceptions listed in the law (for example your explicit consent or necessity for performing our contract with you). Contact us for current information on the transfer mechanism used.

6. How long we keep data

• Account, profile and training data: while your account is active. When you delete your account it is deleted without delay, and removed from backups within at most 30 days.
• Health data: while your consent is in force. When you withdraw consent, health fields and body measurements are deleted.
• Guest accounts that are never used for a long period (24 months) may be deleted.
• Product events and error reports: at most 24 months, then deleted or anonymised.
• Subscription and transaction records: for the periods required by applicable law.
• Account deletion record: to meet store and KVKK audit duties we keep a record that contains no direct personal data (a one-way hash of your e-mail address and whether you had an active subscription) for 3 years.

7. Security

Data is transmitted over encrypted connections (HTTPS/TLS). Passwords are stored as one-way hashes, and injury notes and readiness answers are encrypted in our database. Access is limited to authorised people and is logged. No system is perfectly secure; if a breach occurs we will act as required by KVKK Article 12, including notifying the Board and affected users.

8. Children

The App is intended for people aged 16 and over. Users aged 16–18 should use it with the consent of a parent or guardian. We do not knowingly collect data from children under 13; if we learn that we have, we delete it.

9. Your rights

You have the rights listed in KVKK Article 11, including the right to learn whether your data is processed, to request information, correction and deletion, and to object. In the App:

• Manage consents: Settings > Privacy and consents.
• Download your data: Settings > Privacy and consents > Download my data.
• Delete your account: in the App go to Settings > Account > Delete account, or use the web form at https://ninja-spor.on-forge.com/hesap-sil (verified with a code sent to your e-mail).

Deletion is permanent. Deleting your account does not cancel an active subscription: cancel it in the App Store or Google Play (see the Terms of Use). How to apply for your other rights is explained in the KVKK Notice.

10. Apple Health and Health Connect

The App does not currently connect to Apple Health or Health Connect. This may be added later; if it is, it will work only with your permission, and data read from these services will never be used for advertising or marketing or sold to third parties.

11. Website and cookies

Our website (ninja-spor.on-forge.com) does not use analytics, advertising or tracking cookies. Only strictly necessary cookies are set (session and security cookie for forms such as web account deletion). Our servers keep technical logs (IP address, browser, time) for security for at most 30 days. If you write to us by e-mail or WhatsApp, we use your message and contact details only to answer you.

12. Changes

We may update this policy. The date at the top shows the latest version, and we will tell you about important changes in the App.

13. Contact

Yiğit Taşkın (Taşkın Yazılım), Mersin, Türkiye · [email protected] · WhatsApp: +90 324 606 01 65