Privacy Notice under the Personal Data Protection Law (KVKK)
This English version is provided for convenience. The Turkish text is the legally binding version.
1. Data controller
Yiğit Taşkın (sole proprietorship, trading as Taşkın Yazılım)
Address: Toroslar, Mersin, Türkiye
E-mail: [email protected]
WhatsApp: +90 324 606 01 65
2. Data categories, purposes and legal bases
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| Identity | Name (if you link an account), app user ID (UUID), Apple / Google user identifier | Creating and managing your account, providing the service | Art. 5/2-c (performance of contract) |
| Contact | E-mail address | Account access, password reset, account deletion verification, support | Art. 5/2-c; Art. 5/2-f (legitimate interest) |
| Customer transaction | Onboarding answers (goals, sports, experience, days, equipment, target date/event, reminders, motivation), program enrolments, workout logs, goals, records, badges, subscription records, support correspondence | Providing programs, tracking and statistics; rule-based recommendations; verifying subscriptions; answering requests | Art. 5/2-c; for subscription and transaction records also Art. 5/2-ç (legal obligation) and Art. 5/2-e (establishing, exercising or protecting a right) |
| Transaction security | Device identifier, IP address, device model, operating system and app version, session token, server logs, error and crash reports | Information security, preventing misuse, fixing errors | Art. 5/2-f; Art. 5/2-ç |
| Location | Route and splits of activities for which you start GPS tracking | Calculating route, distance, pace and records | Art. 5/2-c |
| Usage / product analytics | In-app events (app opened, onboarding steps, program viewed, workout started, subscription screen viewed etc.) | Measuring and improving the service with aggregated metrics | Art. 5/2-f |
| Marketing | Marketing communication preference; advertising identifier and device data processed by Google AdMob in the free tier | Sending marketing messages; showing and measuring ads in the free tier | Marketing messages: only with explicit consent, Art. 5/1 (and approval under Law No. 6563 for commercial electronic messages). Ads: Art. 5/2-f; personalised ads only with your device permission and, where required, explicit consent (Art. 5/1) |
| Special category: health | Birth year, gender, height, weight, body measurements, resting and workout heart rate, injury/limitation information and notes, readiness question answers, doctor clearance statement, reported pain level | Personalising programs safely, safety mode, progress charts | Only with explicit consent, Art. 6 (see the Explicit Consent Text) |
Health data is processed only if you give explicit consent, which is optional; the App can be used without it. You can withdraw consent at any time in Settings > Privacy and consents; on withdrawal your health fields and body measurements are deleted. Profile and health data are never used for advertising and never shared with ad networks.
3. Method of collection
Personal data is collected electronically through the mobile app: partly from information you enter, and partly automatically (device information, GPS tracking that you start, in-app events, error reports). Subscription status is received from Apple, Google and RevenueCat; account identifiers are received from Sign in with Apple and Google Sign-In when you use them.
4. Recipients
- Our rented server (VPS) provider in Türkiye, and Laravel Forge (server management software, United States) which manages it: storing and running the service. The data stays on the server in Türkiye.
- Apple Inc. and Google LLC: store purchases, sign-in services, notifications (APNs, Firebase Cloud Messaging) and, in the free tier, ads (Google AdMob).
- RevenueCat, Inc. (USA): subscription management.
- Expo (650 Industries, Inc., USA): push notification infrastructure.
- E-mail delivery provider Brevo (Sendinblue SAS, France): sending verification codes.
- Authorised public institutions and organisations: when required by law.
5. Transfers abroad
Some of the recipients above process data outside Türkiye, mainly in the United States. Transfers abroad are made in accordance with Article 9 of KVKK as amended by Law No. 7499 (in force since 1 June 2024): based on an adequacy decision of the Personal Data Protection Board where one exists; otherwise by providing one of the appropriate safeguards listed in the law (such as standard contracts announced by the Board, which are notified to the Authority within five business days of signature, or binding corporate rules); and, only where neither is possible, for occasional transfers within the exceptions listed in the law (for example explicit consent or the transfer being necessary for the performance of a contract with you).
6. Retention and destruction
Personal data is kept for as long as required for the purposes above and the statutory periods, and is then deleted, destroyed or anonymised under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data:
- Account, profile and training data: while the account is active; deleted when the account is deleted (backups within at most 30 days).
- Health data: while consent is in force; deleted when consent is withdrawn.
- Product events and error reports: at most 24 months.
- Subscription and transaction records and security logs: for the periods required by applicable law.
7. Your rights (KVKK Article 11)
You have the right to:
- learn whether your personal data is processed;
- request information if it has been processed;
- learn the purpose of processing and whether data is used in line with that purpose;
- know the third parties in Türkiye or abroad to whom data is transferred;
- request correction if data is incomplete or inaccurate;
- request deletion or destruction of data under the conditions of Article 7;
- request that the operations under (e) and (f) be notified to third parties to whom data has been transferred;
- object to a result against you arising from analysis of your data exclusively by automated systems;
- claim compensation for damage arising from unlawful processing.
In the App you can also download your data (Settings > Privacy and consents > Download my data), manage consents and delete your account at any time.
8. How to apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may send your request in writing to the address above; with a secure electronic or mobile signature; or by e-mail to [email protected] from the e-mail address you have previously provided to us and that is registered in our system. Your application must include your name and surname, signature (if written), Turkish ID number (for Turkish citizens) or nationality and passport number (for foreign nationals), address for notification, e-mail address, telephone or fax number if any, and the subject of your request. For guest accounts, adding the user ID shown in the App helps us verify your identity.
We will conclude your request free of charge as soon as possible and within 30 days at the latest; if the operation requires an additional cost, the fee set in the Board's tariff may be charged. If your request is rejected, the answer is insufficient or no answer is given in time, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning of the answer and in any case within 60 days of your application (KVKK Article 14).
More detail is available in the Privacy Policy.