Privacy Policy

Last updated October 31, 2026

This is an English translation provided for convenience. The Turkish version is the original and binding text; if the two differ, the Turkish version prevails.

Effective date: September 13, 2026
Last updated: October 31, 2026
App: Sabri (iOS and Android)
Data controller: SelfTech (selftech.co)
Contact: hello@selftech.co

1. Summary

To use Sabri, you sign in with Apple or Google. For your account, we store your email address and the name your provider shares.
Your plan and progress — your reason, your promise, your triggers, the records of your cravings, your urge cards — are stored on our server, linked to your account; they are not lost when you change phones or reinstall the app.
Your smoking-related data (smoking status, daily count, dependence test, smoking logs, SOS ratings) may count as health data; it is saved to your account only with your explicit consent, and you can withdraw your consent at any time in Settings (2.9).
What you write in the Chat tab is sent to an AI provider to produce a reply, and your chats are stored in your account; only with your explicit consent (2.10).
We measure how you use the app (for example, which step you completed) on our own server. The texts you write never go into this measurement.
Your subscription is verified by a service called RevenueCat and linked to your account.
No ads are shown in the app, no advertising identifier is read, there are no third-party analytics and we do not sell your data. To measure whether our ads work, install information, the main steps in the app (account, introduction, subscription screen) and subscription information go to Meta: in most countries, including Turkey, this is on by default and you can turn it off in Settings; in the European Economic Area, the United Kingdom and Switzerland only with your explicit consent. Your smoking data and your chats never do (2.11).
You can delete your account at any time from inside the app: Settings → Account → Delete account.

This entire text can be read inside the app, even without an internet connection.

2. What data we collect

“Collect” means that data leaves your device and is stored; this is also Apple's and Google's definition. Under this definition, the only data we collect is the following:

2.1 Account information

Email address: The address Apple or Google passes to us. If you choose “Hide My Email” when signing in with Apple, we receive a forwarding address generated by Apple; we do not see your real address.
Name: If the provider shares it. Apple passes your name only on the first sign-in and only if you allow it. When you sign in with Google, the name and profile photo link that Google shares are also saved.
Provider identifier: The identifier Apple or Google generates for your account, and whether your email is verified. Used to recognize you when you sign in again.
Account times: When the account was created and when you last signed in.
Session information: For each open session, the IP address and device/browser information (User-Agent). Used to protect your session and to tell abuse apart. Deleted when you sign out and when you delete your account.

2.2 Notification token

If you allow notifications, your device's notification token (push token) and the device's platform (iOS/Android) are stored, linked to your account. The program's daily reminders are scheduled on the device itself. Some notifications are sent from the server and chosen based on how you use the app: for example, if you looked at a feature, if you haven't opened the app for a while, or if your subscription payment didn't go through. These notifications may include a time-limited offer for Sabri Pro. Nothing you type freely goes into a notification's text; answers you selected during onboarding (for example, the moment that is hardest for you) may. You can turn notifications off from the app's Settings screen or from your phone's settings. Expo's notification service (USA) is used to obtain the token and to deliver notifications sent from the server to your device. The token is deleted when you sign out and when you delete your account.

2.3 Subscription information

The purchased product, subscription and introductory offer status, renewal and expiry times, country and currency.
Apple receipt information or Google purchase token.
Device type, operating system and app version.

This information goes to RevenueCat. RevenueCat also notifies our server of subscription changes; our server stores your subscription status matched to your account. This way, your subscription is recognized when you sign in with the same account on another device.

On iPhone, if you downloaded the app from an Apple ad on the App Store, Apple tells us through RevenueCat which ad the download came from (campaign, ad group, search keyword, country); this information is stored in your RevenueCat record, even if you do not subscribe. We use it to see which of our ads work. No advertising identifier is read for this, no permission is asked, and the information is not matched with other companies' data.

2.4 Device information

For each device you sign in on, the device's brand and model (e.g. “iPhone 11”), operating system and version (e.g. iOS 26), the app version, a random identifier the app generates for this installation, and when the device was first and last seen are stored, linked to your account. We do this to answer your support requests and to find which device or version an error occurs on. The device's hardware identifier, advertising identifier and the name you gave your device are not collected.

2.5 Security logs

For every request to our server, the IP address, device/browser information, requested address, time and result code are logged. These logs are only for security and fault detection and are kept for at most 30 days. Authentication headers are not written to the logs.

2.6 Plan and progress data

This is the data the app actually works with. It is stored on our server, linked to your account, so that your plan and your days are waiting for you when you sign in with the same account on a new phone. You answer the onboarding before signing in: until then your answers and your plan stay only on your phone, and they are written to your account when you sign in to save your plan:

Your smoking status, daily count and pack price, your quit date and your preparation period
Your onboarding answers (where you heard about the app, triggers, reasons for quitting, concerns, previous attempts) and your dependence questionnaire score
Your “why I'm quitting” text, your Quit Day promise, your new habit and your reward goal
Your daily logs, your usage (smoking) logs and their context (place, who you were with, feeling)
Your completed SOS sessions: trigger, your 0-10 ratings, duration, the tools you used and your conversation with Sabri (your replies are ready-made answers chosen from a list)
Your prep tasks and the texts you write in them, your urge cards, the chats you've read, the name you write on your support card, your settings and your game scores

The smoking-related part of this content may count as health data and is saved to your account only with your explicit consent (2.9). All of it can be read only with your account: every row on the server is locked to your account and no other user can access it. It travels between the app and the server over an encrypted connection. We may review this data in aggregate to improve the product; we do not use it for advertising, sale or profiling.

2.7 Usage measurement

To understand which step of the app people struggle with, we record usage events on our own server: e.g. which screen you opened, which onboarding step you saw and how long it took you to get through it, that you completed a prep task, that an SOS session started and how it ended, that you saw the paywall. Events carry only numbers, yes/no values and labels chosen from a list (e.g. “selected 3 triggers”, “wrote a reason: yes”); no text you write goes into any event. Each event also records the country derived from the IP address of the request; the IP address itself is not written to the event. Events are recorded before you sign in too: that the app was opened, which onboarding steps you saw and completed (with only the same kind of summary of your answer, e.g. “selected 3 triggers”, or the answer you chose from the list for where you heard about the app), whether you allowed notifications, that the sign-in screen was seen and how sign-in ended (e.g. cancelled or an error code). These events are tied not to an account but to a random identifier the app creates for this installation. If you sign in, they are linked to your account together with that installation's later events. Without your explicit consent (2.9), events do not include your smoking status, your daily count range, your dependence level, your 0-10 ratings or your smoking logs. No third-party analytics service is used.

2.8 Crash reports

When the app crashes or a screen fails to open, we send a technical record of the error to the error tracking tool on our own server (Bugsink): the type of error and where in the code it occurred, the app and operating system version, the device model. This record is not associated with you: your account identifier, your email, your IP address and the texts you write are not sent. No screenshots are taken and how you use the app is not tracked. Its only purpose is to find and fix the error.

2.9 Health data and explicit consent

The following data relates to your smoking and may therefore count as health data, that is, special category personal data within the meaning of KVKK Art. 6 and GDPR Art. 9:

Your smoking status
Your daily cigarette count
Your answers and score on the dependence test
Your usage (smoking) logs
Your 0-10 craving ratings in SOS sessions

We save this data to your account only with your explicit consent; the legal basis is your explicit consent (KVKK Art. 6(3)(a), GDPR Art. 9(2)(a)). Signing in is not giving consent: after you sign in, the app asks you once in a separate question, and you can also give it in Settings → Your data. If you don't give consent, the data in 2.6 is not sent to your account, this data does not go into usage measurement (2.7) either, and the app works fully on your phone.

You can withdraw your consent or give it again at any time in Settings → Your data. When you withdraw it, your new records stay only on your phone; what was saved before stays in your account until you delete the account. Withdrawing does not affect the lawfulness of processing before the withdrawal.

When you delete your account (Settings → Account → Delete account), this data and your consent records are deleted from our server immediately (section 8). The moment you give or withdraw consent, where you did it and the version of the policy are saved to your account as proof.

2.10 Chatting with Sabri (AI)

In the Chat tab you write with Sabri. The replies are produced by an AI model: Sabri is not a person or a doctor, does not give medical advice and can be wrong.

When you send a message, the following is sent from our server to an AI provider so that a reply can be produced:

The message you wrote and the earlier messages of this chat
A summary of your program: your phase, how many days you have been smoke-free, your quit date, your most frequent triggers, your reason, today's SOS and craving count, your phone's local time
Short notes Sabri keeps about you and short summaries of your earlier chats
Information read from your phone when Sabri needs it: your recent craving logs, your Map summary, your craving cards, your quit plan

The request is passed through OpenRouter, Inc. (USA) to a language model provider: today Anthropic PBC (USA), and OpenAI, L.L.C. (USA) if Anthropic cannot be reached. We route the request only to endpoints that do not retain the data or use it for model training; the providers process your messages only to produce the reply and for the quality review of chats (2.10).

Your chats, Sabri's notes and chat summaries are stored in your account on our server: you see them on another phone too, and Sabri remembers you. Sabri is instructed not to write religion, political opinion, sexual orientation, ethnic origin or identity details into the notes; to see the notes or have them deleted, write to hello@selftech.co. Chats may be reviewed by our team and with AI tools, without your name or email address, to improve Sabri's replies; replies you report and replies caught by the inappropriate-language filter and not shown to you are also reviewed for quality and safety.

Because your messages can contain information about your health and are sent to a provider abroad, we show a page explaining this before your first message and ask for your explicit consent (KVKK Art. 6(3)(a) and Art. 9, GDPR Art. 9(2)(a)). If you do not consent, your message is not sent; the rest of the app works as before. You can withdraw your consent in Settings → Your data: once withdrawn, no new message is sent, and your saved chats stay in your account until you delete them or the account.

When you delete a chat it disappears for you and from Sabri's memory immediately; the record stays on our server for quality and safety. To have it permanently erased, you can write to hello@selftech.co. When you delete your account, your chats, notes and summaries are deleted immediately (section 8).

If Sabri replies while the app is closed, the first line of the reply reaches your phone as a notification through Expo; for a reply with a danger signal the notification carries no content. If your message shows a sign of self-harm or a medical emergency, the app shows a fixed card telling you where to get help. The chat enters usage measurement (2.7) only as counts and labels (e.g. message sent, length range); the text of your messages does not.

2.11 Ad measurement (Meta)

We also promote Sabri with ads on Meta (Facebook, Instagram). To measure which ad works, the following is sent to Meta (when it is sent depends on your region, see below):

A random identifier that Meta's software kit in the app generates for this installation
The moment the app was installed and opened
The moment you created your account, finished the introduction (the first setup questions), opened the subscription screen and started a purchase; for the subscription screen only whether it opened during the introduction or inside the app, for the purchase step the type of plan chosen and the currency
That a free trial or a subscription started, its product and its amount (with the currency)
As part of this communication, the device's technical information (model, operating system and version, language, time zone) and IP address

Your smoking data (2.9), your answers in the introduction, your chats (2.10), your plan and the texts you write, your email address and your name are not sent to Meta; from the introduction only the fact that you finished it is sent. The advertising identifier (IDFA / AAID) is not read and no tracking permission is asked. Subscription information goes from the app on iPhone and through RevenueCat on Android; in both cases it is matched only with the random identifier above. The app tells Meta not to use the data for anything other than measurement and conversions, for example not for ad targeting. Meta may process this data under its own policy, including in the USA: https://www.facebook.com/privacy/policy

On iPhone, Apple's SKAdNetwork is also used, and it does not depend on consent: the app reports the install on first launch, and later the furthest step reached (creating an account, finishing the introduction, opening the subscription screen, starting a purchase, a free trial or a subscription), only to Apple; nothing is sent to Meta or to us. If the install came from an ad, Apple passes this on to the ad network in a delayed, aggregated notice. The notice says only which of these steps followed the install; it contains no advertising identifier and can't be linked to you or your device.

In the European Economic Area (EU countries, Iceland, Liechtenstein, Norway), the United Kingdom and Switzerland, the legal ground is your explicit consent (GDPR Art. 6(1)(a)). Consent is off by default: the app asks once with an unticked box below the question in 2.9, and you can give or withdraw it at any time in Settings → Your data. A free trial or subscription that started on this phone at most 24 hours before you decide is sent once if you give consent; if you don't, it is deleted from the phone.

In all other countries, including Turkey, measurement is on by default and you are not asked separately. The legal ground is our legitimate interest in measuring how well our ads work (KVKK Art. 5(2)(f)); so as not to harm your fundamental rights and freedoms, what is sent is limited to the above and Meta is told not to use it for anything other than measurement. You can turn it off at any time with the Settings → Your data → Ad measurement switch; a trial or subscription that started on this phone in the 24 hours before you turn it off and has not been sent yet is not sent either.

Your region is determined from the country of your App Store or Google Play account and from your phone's time zone or region setting; if any of these points to one of the European countries above, or the region can't be determined, your consent is asked. When you turn it off or withdraw your consent, nothing is sent to Meta from that moment on; what was sent before is subject to Meta's retention rules. The record of your decision and of the default is written to your account as in 2.9.

3. What data we don't collect

Phone number, address, date of birth — not asked.
Location — no location permission is requested. The “where” you choose in the SOS flow is a label chosen from a list (e.g. “home”, “car”); it is not a GPS location.
HealthKit or Google Fit data — no integration. What you enter about your smoking habit is stored only as described in 2.6 and 2.9.
Contacts, photos, microphone, camera — no access to any of them is requested.
Advertising identifier (IDFA / AAID) — not read; on Android its permission is removed too. No ads are shown in the app.
Third-party analytics SDKs (Firebase, Amplitude, Mixpanel, etc.) — none. Usage measurement is on our own server (2.7). Meta's software kit runs only for ad measurement: in the European Economic Area, the United Kingdom and Switzerland only with your explicit consent, in other countries until you turn it off (2.11).
Tracking permission (ATT) — not asked. We do not give your data to data brokers and we do not sell it.
Your payment details — we never see your card or bank details. Apple or Google takes the payment.

4. Content that stays on your device

An SOS session in progress and unfinished drafts stay only on your phone; when the session closes, the information in 2.6, together with its conversation, is saved to your account. A copy of your plan is also kept on your phone, so the app works without internet and syncs with your account when a connection is available. App data is not included in Android's automatic backup.

5. Purposes of use

To create your account, recognize you and protect your session
To save your plan and progress to your account and carry them between your devices
To produce Sabri's reply in the chat, remember you and carry your chats between your devices (2.10)
To measure which step of the app people struggle with and improve the product (without the texts you write)
To answer support requests and find which device or version errors occur on
To verify your subscription, recognize it on another device with the same account, and make “Restore purchases” work
To tell apart erroneous or fraudulent purchase attempts
To measure which of the ads promoting the app work (Apple ads on iPhone, 2.3; Meta ads, 2.11)
To keep the service secure and detect faults
If you allowed notifications, to send reminders and notifications suited to your usage (including the Sabri Pro offer)

Your data is not sold, is not used for third-party advertising, and no marketing emails are sent to you.

6. Who processes the data

Our server — Contabo GmbH: Account, plan and progress data, chats (2.10), usage events, the notification token, device information, subscription status, security logs and crash reports are stored on a server that we manage, located in the European Union and rented from Contabo GmbH. Contabo provides the infrastructure; it does not access the data.
RevenueCat, Inc. — USA: Subscription verification; on iPhone, recording which Apple ad the download came from. Acts as a data processor; states that it processes data in AWS data centers in the USA. Policy: https://www.revenuecat.com/privacy
Meta Platforms Ireland Ltd. — Ireland (and Meta Platforms, Inc. — USA): Measuring our ads (2.11): in the European Economic Area, the United Kingdom and Switzerland only with your explicit consent, in other countries until you turn it off. Policy: https://www.facebook.com/privacy/policy
OpenRouter, Inc. — USA: Passing chat messages to the AI provider (2.10); only to endpoints that do not retain the data. Policy: https://openrouter.ai/privacy
Anthropic PBC — USA (backup: OpenAI, L.L.C. — USA): Producing Sabri's reply in the chat (2.10); messages are not used for model training. Policies: https://www.anthropic.com/legal/privacy · https://openai.com/policies/privacy-policy
Expo (650 Industries, Inc.) — USA: Generating the notification token and delivering notifications sent from the server to the device. Policy: https://expo.dev/privacy
Apple and Google: Sign-in and payment. You sign in and pay with their accounts; for these operations they act under their own policies: https://www.apple.com/legal/privacy/ · https://policies.google.com/privacy

Apart from these, we do not transfer your data to any third party. If a legally authorized authority requests it in due form, we share only the data requested.

7. Retention periods

Account information, plan and progress data, consent records, notification token, device information and subscription status: as long as your account remains open. Deleted immediately when you delete the account. “Start over” in Settings deletes plan and progress data without closing the account.
Chats, notes and summaries (2.10): as long as your account remains open. A chat you delete is also kept for this period; all of it is deleted immediately when you delete the account.
Usage events: linked to your account while it is open; if you have not signed in, only to the installation identifier. When you delete the account, the link to you is removed; they remain as anonymous numbers with no way back to a person.
Session information (IP, device information): until the session closes or the account is deleted.
Security logs: at most 30 days.
Crash reports: at most 90 days; not associated with a person.
Server backups: taken every night, kept for 7 days and restored only in a disaster. The backup copy of a deleted account disappears on its own within 8 days at the latest.
The subscription record at RevenueCat: as long as the subscription and related financial obligations continue. RevenueCat states in its own policy that it may keep it for up to six years after the customer account ends.
Measurement information sent to Meta (2.11): under Meta's own retention rules. When you turn measurement off or withdraw your consent, no new information is sent.
The copy on your device: on your device until you delete it or uninstall the app.

When the period ends, the data is deleted, destroyed or anonymized (KVKK Art. 7).

8. Deleting your account and data

In the app, tap Settings → Account → Delete account and confirm.
Your account, your plan and progress data on the server (including the health data in 2.9), your chats and notes (2.10), your consent records, your notification token, your device information, your subscription record on the server and the personal content in event records received from RevenueCat are deleted immediately. The link between usage events and you is removed. If you sign in again with the same Apple or Google account, a new, empty account is created.
The copy on your phone is not deleted by deleting the account; to delete it as well, use “Start over” in Settings or uninstall the app.

Deleting the account does not cancel your subscription. To stop being charged, you need to cancel the subscription from your App Store or Google Play account. If you also want the record at RevenueCat deleted, write to hello@selftech.co.

If you cannot access the app, you can send your deletion request from your account's email address to hello@selftech.co.

9. Children

Sabri is designed for people aged 18 and over and is rated accordingly in the stores. It is not directed at children. If you notice that someone under 18 has created an account, write to hello@selftech.co and we will delete the account.

10. KVKK Privacy Notice

This section has been prepared in accordance with Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.

10.1 Data controller

Data controller: SelfTech (selftech.co)
Contact: hello@selftech.co

10.2 Categories of personal data processed

Identity: Name (if the provider shares it)
Contact: Email address
Transaction security: Provider identifier, session IP address and device information, security logs, notification token, device brand and model, operating system and app version, installation identifier
Customer transaction: Subscription product, status and times, receipt/purchase token, country and currency
Marketing: The Apple ad the download came from: campaign, ad group, search keyword, country (iPhone only); install, open, account, introduction, subscription screen, purchase step, trial and subscription information sent to Meta, and Meta's random installation identifier (2.11)
Plan and usage: Onboarding answers, your reason, your promise, your task texts, your urge cards and your settings (2.6); usage events (2.7)
Health (special category): Smoking status, daily cigarette count, answers and score on the dependence test, usage (smoking) logs, SOS craving ratings — only with your explicit consent (2.9)
Chat: Your chat messages, Sabri's notes and chat summaries — only with your explicit consent (2.10)

Of these, the health data and health information in your chat messages may count as special category personal data (KVKK Art. 6), and they are processed only with your explicit consent. Content that stays on the device (section 4) is not transferred to us.

10.3 Purposes and legal grounds

Creating and managing the account; saving your plan and progress to your account; verifying the subscription and linking it to the account; being able to send notifications: KVKK Art. 5(2)(c): being directly related to the formation or performance of a contract
Saving the health data (2.9) to your account and carrying it between your devices: KVKK Art. 6(3)(a): your explicit consent
Chat: sending your messages to the AI provider, storing chats and notes in your account (2.10): KVKK Art. 6(3)(a) and Art. 9: your explicit consent
Session security, security logs, detecting fraudulent purchase attempts; answering support requests and finding errors by device or version; measuring how the app is used (2.7); measuring the effectiveness of our Apple ads (2.3): KVKK Art. 5(2)(f): the legitimate interest of the data controller, provided it does not harm your fundamental rights and freedoms
Measuring our Meta ads: sending install information, the main steps in the app and subscription information to Meta (2.11): KVKK Art. 5(2)(f): the data controller's legitimate interest; in the European Economic Area, the United Kingdom and Switzerland, your explicit consent
Requests of authorized authorities made in due form: KVKK Art. 5(2)(ç): fulfilling a legal obligation

Method of collection: The data is obtained by automated means and electronically — from Apple or Google when you sign in with these providers, through the software kits inside the app (RevenueCat, Expo, Meta), on iPhone from Apple's ad measurement service (AdServices), and from requests to our server.

10.4 Transfer

There is no transfer to a recipient within Turkey. The data is transferred abroad to the service providers listed in section 6: to the European Union for server hosting (Contabo GmbH), to the USA for subscription verification and ad measurement (RevenueCat, Inc.), to the USA for the notification token (Expo), to Ireland and the USA for measuring Meta ads (Meta Platforms Ireland Ltd.; Meta Platforms, Inc.; 2.11) and, with your explicit consent, to the USA for producing the reply in the chat and reviewing chat quality (OpenRouter, Inc.; Anthropic PBC, with OpenAI, L.L.C. as backup). The transfer is made in accordance with the procedures set out in KVKK Art. 9 and is limited to the purposes written in this section.

10.5 Your rights (KVKK Art. 11) and how to apply

By applying to the data controller, you have the right to:

a) learn whether your personal data is processed,
b) request information about it if it has been processed,
c) learn the purpose of processing and whether it is used in line with that purpose,
ç) know the third parties to whom it is transferred in Turkey or abroad,
d) request correction if it is incomplete or inaccurate,
e) request its deletion or destruction within the framework of KVKK Art. 7,
f) request that the operations carried out under (d) and (e) be notified to the third parties to whom it was transferred,
g) object to a result against you arising from analysis exclusively by automated systems,
ğ) request compensation for damage if you suffer damage due to unlawful processing

These are your rights.

You can send your applications to hello@selftech.co, preferably from your account's email address. Your application will be concluded free of charge within thirty days at the latest; if the process requires an additional cost, the fee in the tariff set by the Board may be charged (KVKK Art. 13). If your application is rejected, the answer is found insufficient or no answer is given in time, you can file a complaint with the Personal Data Protection Board (KVKK Art. 14).

11. Users outside Turkey

The app is also offered outside Turkey on the App Store and Google Play. The data controller is in Turkey and this policy applies the same way in every country; your data is stored on our server in the European Union (section 6). If the law of the country you are in gives you more rights, those rights are reserved.

11.1 European Union and United Kingdom

You can exercise your rights of access, rectification, erasure, restriction of processing, data portability and objection under the GDPR and the UK GDPR by applying to the same address, and you can lodge a complaint with the supervisory authority of the country you are in (in the United Kingdom, the ICO). The legal bases correspond to those in 10.3: performance of a contract (Art. 6(1)(b)), legitimate interest (Art. 6(1)(f)), legal obligation (Art. 6(1)(c)) explicit consent for the health data in 2.9 and the chat in 2.10 (Art. 9(2)(a)) and consent for the ad measurement in 2.11 (Art. 6(1)(a)).

11.2 USA

Washington's My Health My Data Act and similar state laws may treat the data in 2.9 as consumer health data. We collect this data from you, while you use the app and only with your explicit consent; its purpose is to keep your plan in your account, carry it between your devices and send you suitable reminders. The data is stored on our server (hosted by Contabo GmbH); the text of notifications sent from the server (e.g. how many days you have gone without smoking) is delivered to your phone through Expo. We do not sell this data, do not use it for advertising and do not share it with anyone else. You can withdraw your consent in Settings and have the data deleted by deleting your account; to access your data or learn who it has been shared with, write to hello@selftech.co.

Your chat messages (2.10) may also count as consumer health data: they are sent only with your explicit consent and only to produce the reply, to the AI providers in 2.10; they are not sold or used for advertising.

12. Security

All traffic between the app and our server travels over an encrypted connection (HTTPS).
In the database, each user can read only their own rows; this rule is enforced by the database itself (row-level security).
The server is open only on the necessary ports; repeated failed access attempts are blocked automatically.
The data on your device is protected by the operating system's app isolation and device encryption; the screen lock is the most effective part of this protection.

No system is completely secure. If a security breach affects your account, we will notify the Board and you in accordance with KVKK Art. 12.

13. Changes to this policy

When we change it, we update the last updated date at the top of the document.
We will separately notify you inside the app of any change that expands the type of data we collect or the purpose of processing, before that processing starts.
We share previous versions on request.

14. Contact

For any question about this policy or your data: hello@selftech.co

Sources

Sources 1–13 were read directly on September 5, 2026, sources 14–15 on September 13, 2026, and sources 16–17 on October 13, 2026.

1. Apple, App Review Guidelines — 5.1.1 (Data Collection and Storage), 5.1.4 (Kids), 1.4.1 (Physical Harm), 3.1.2 (Subscriptions): https://developer.apple.com/app-store/review/guidelines/
2. Apple, App Privacy Details on the App Store — definitions of “collect” and “tracking”, data type categories, responsibility for third-party SDKs: https://developer.apple.com/app-store/app-privacy-details/
3. Google Play, Provide information for Google Play's Data safety section — definitions of “collected”/“shared”, exemption for on-device processing: https://support.google.com/googleplay/android-developer/answer/10787469
4. Google Play, User Data policy — requirement for the privacy policy to be both in the store listing and inside the app: https://support.google.com/googleplay/android-developer/answer/10144311
5. RevenueCat, Privacy Policy — end-user data categories, AWS data centers in the USA, data processor role, six-year retention: https://www.revenuecat.com/privacy
6. RevenueCat, Apple App Privacy — which data to declare: https://www.revenuecat.com/docs/platform-resources/apple-platform-resources/apple-app-privacy
7. RevenueCat, Google Play's Data Safety — Financial Info declaration, deletion requests: https://www.revenuecat.com/docs/platform-resources/google-platform-resources/google-plays-data-safety
8. Law No. 6698 on the Protection of Personal Data — Art. 5, 6, 7, 9 (as amended by Law No. 7499), 10, 11, 13, 14, 16: https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6698.pdf
9. Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform (Official Gazette 10/3/2018, No. 30356) — Art. 4, 5: https://www.resmigazete.gov.tr/eskiler/2018/03/20180310-5.htm
10. KVKK, Transfers Abroad — no adequacy decision has been issued yet: https://www.kvkk.gov.tr/Icerik/2053/Yurtdisina-Aktarim
11. KVKK, Public Announcement — exemption criterion for registration with the Data Controllers' Registry (2023/1154): https://www.kvkk.gov.tr/Icerik/7646/Kamuoyu-Duyurusu-Veri-Sorumlulari-Siciline-Kayit-Yukumlulugune-Iliskin-Istisna-Kriterinde-Degisiklik-Yapilmasi-Hakkinda-
12. GDPR Art. 3 (Territorial scope) and Art. 27 (Representatives): https://gdpr-info.eu/art-3-gdpr/ · https://gdpr-info.eu/art-27-gdpr/
13. Apple, Request a refund for apps or content: https://support.apple.com/en-us/118223
14. Expo, Privacy Policy — notification token service: https://expo.dev/privacy
15. Apple, Offering account deletion in your app (5.1.1(v)): https://developer.apple.com/support/offering-account-deletion-in-your-app/
16. Apple Ads, App ad attribution overview — AdServices attribution data and retention period: https://ads.apple.com/app-store/help/attribution/0094-ad-attribution-overview
17. RevenueCat, Apple Ads (AdServices) integration — standard attribution does not require ATT permission: https://www.revenuecat.com/docs/integrations/attribution/apple-search-ads