Privacy Policy

1. Data controller

Data controller: Emirhan Yıldız

Address: Yasal adres

Privacy and KVKK requests: privacy@appcaelum.com

2. Categories of personal data

The following data is processed when you use the app. Which of it applies depends on the features you use.

• Account and authentication data: email address, name (if you give one), account ID, sign-in method (email, Sign in with Google or Sign in with Apple). For email sign-up, your password is handled by Google Firebase Authentication; we never see it.
• Profile data: username and profile picture (if you upload one).
• Video recordings and written memories: the short videos you record and the text you write. They are stored after being encrypted on your device (see Section 10).
• Feeling records you choose: the feeling you pick each day and its date; the monthly star map computed from them and, if created, the monthly AI reading.
• Device and technical data: IP address, request time and error logs for requests to our servers; preferences kept on your device, such as language and theme; your notification settings (kept on your device).
• Subscription and purchase data: subscription status, the product purchased, purchase and renewal dates. Your payment card details are handled by Apple or Google and never reach us.
• Account deletion survey: the optional reasons and comment you give when deleting your account. These are stored anonymously, without your account ID or email address.
• Website contact form: your name, email address, chosen topic and message.

3. Advertising-related data

Caelum currently shows no ads and processes no personal data for advertising; no advertising identifier (IDFA/AAID) is collected and there is no cross-app tracking.

If this changes, the advertising provider and the data processed will be stated clearly in this policy, and your consent will be asked for in advance where required.

4. Purposes and legal bases

• Creating your account, signing you in and providing the service (storing memories, computing monthly maps): KVKK Art. 5/2-c, performance of a contract.
• Managing your subscription and restoring purchases: KVKK Art. 5/2-c, performance of a contract.
• Creating the monthly AI reading: your explicit consent (KVKK Art. 5/1); see also Section 7 for the transfer abroad.
• Security, abuse prevention and troubleshooting (technical logs): KVKK Art. 5/2-f, legitimate interest.
• Answering support requests: KVKK Art. 5/2-c and 5/2-f.
• Meeting legal obligations (e.g. financial records, requests from authorities): KVKK Art. 5/2-ç.
• Improving the service (anonymous deletion survey): anonymous data, outside the scope of KVKK.

5. How data is collected

Data is collected electronically: from what you enter in the app and on the website, automatically while the app runs (technical logs), and from the Apple, Google and RevenueCat services you use to sign in and pay.

6. Third-party service providers

We work with the providers below to run the service. They process data only to provide their service, under their own privacy terms.

• Google Firebase (Google LLC): authentication, database (Cloud Firestore) and notification infrastructure. Encrypted written memories, feeling records, profile and account data are kept here.
• Sign in with Google and Sign in with Apple: if you choose these, your identity is verified by Google or Apple.
• Cloudflare R2 (Cloudflare, Inc.): storage of encrypted video files and profile pictures.
• RevenueCat (RevenueCat, Inc.): subscription and purchase management. Payments are made through the Apple App Store or Google Play.
• AI provider: the monthly reading is written with the Anthropic (Claude) model, through an intermediary service provider located abroad (see the AI Analysis page).
• Website contact form: messages reach us through the email delivery service Resend (Resend, Inc.).

7. International transfers

The providers above may have servers outside Türkiye (mainly in the United States and the European Union), so your personal data is transferred abroad.

Transfers are made under KVKK Art. 9, based on standard contracts signed with the providers and/or your explicit consent. The transfer for the AI reading relies on your explicit consent only.

8. Retention periods

• Memories, feeling records, monthly maps and readings: for as long as your account is open; deleted immediately when you delete your account.
• Profile data: for as long as your account is open.
• Technical logs (IP address, request logs): at most 3 years.
• Deletion record: the date of deletion, whether it completed, the categories of data deleted and the technical result are kept for 3 years. The record contains no name, email, account ID or content; you are represented only by an irreversible keyed hash. Its purpose is to be able to prove that the deletion request was carried out.
• Subscription and purchase records: kept by Apple, Google and RevenueCat under their own legal obligations.
• Contact form messages: at most 3 years after your request is resolved.
• Anonymous deletion survey: indefinitely (it can’t be linked to you).

9. Deletion and destruction

You can delete your account in the app under Settings → Delete account. This deletes all your memories and feeling records, monthly maps and readings, your profile, username, all files you uploaded (videos, profile picture) and your sign-in account.

Deletion starts as soon as you confirm in the app and usually completes within a few seconds. Deleted data can’t be recovered.

Deleting your account does not cancel an active subscription; cancel it separately in the App Store or Google Play.

10. Data security

• Your written memories and videos are encrypted before they leave your device and are stored encrypted on the servers.
• So that your memories open on whichever device you sign in on, encryption keys are managed by us as part of the service; your content is not accessed in the normal course of operations.
• Location, device and recording date information is removed from video files on your device before upload. Files are stored under random names that don’t contain your identity.
• All connections are encrypted with HTTPS. Files are reachable only through short-lived links issued to their authenticated owner.
• No system is entirely without risk; in case of a data breach, the Board and the people affected are notified as required by KVKK Art. 12.

11. Your rights under KVKK

Under KVKK Art. 11, by applying to the data controller you have the right to:

• learn whether your personal data is processed,
• request information about it if it is,
• learn the purpose of processing and whether data is used accordingly,
• know the third parties in Türkiye or abroad to whom it is transferred,
• request correction if it is incomplete or inaccurate,
• request deletion or destruction under KVKK Art. 7,
• request that corrections and deletions be notified to the third parties it was transferred to,
• object to a result against you that arises from analysis exclusively by automated systems,
• claim compensation if you suffer damage from unlawful processing.

12. Requests and contact

Send requests about your rights to privacy@appcaelum.com, with details that let us verify your identity (from the email address registered to your account). Requests are answered free of charge within 30 days at the latest.

Postal address for written requests: Yasal adres

13. Cookies

This website uses no analytics, advertising or tracking cookies. The language is set by the address (/en) and not stored in a cookie, so no cookie consent banner is shown.

14. Children

Caelum is not directed at children under 13. If you are under 18, you should use the app with the consent of a parent or guardian. If we learn that we process data of a child under 13, we delete it.

15. Changes

We may update this policy. For significant changes we will let you know in the app or by email. The current version and date are shown at the top of this page.