Privacy Policy

Effective: April 26, 2026 · Last updated: 12 October 2026

Çeyizim ("the app") respects your privacy. This document explains what data we collect, why we process it, and what rights you have, for the iOS and Android versions of the app, in line with Apple's App Privacy and Google Play Data safety requirements, the EU GDPR, and Turkey's KVKK (Law No. 6698 on the Protection of Personal Data).

1. Data Controller

The app is published by Osman Seven (individual developer).

• Contact: osman.seven97@icloud.com
• App ID (iOS and Android): com.osmanseven.ceyizim

2. Data We Collect

The app is designed to work without an account. If you use it without signing in, list data may remain only on your device and may not be backed up to the cloud. When you sign in with Apple or Google, use cloud backup, or use family sharing, the following data is processed:

Account information

• Email address (via Sign in with Apple or Google sign-in; if you use Hide My Email, this may be an Apple relay address)
• The name shared by your sign-in provider (Apple or Google)
• Optional display name

User content

• Trousseau list: item names, categories, statuses, prices (if entered), notes
• Photos you upload (compressed, under 1 MB)
• Family member invites and role assignments
• The contents of your support emails and the contact details you send with them
• When signed in, your lists may be backed up and restored using Firestore.

Purchase information

• Premium subscription state, plan type and purchase history (via RevenueCat); the purchase outcome is also used in product analytics
• Payment data is processed by Apple on iOS and by Google Play on Android; we never see your card information.

Usage and diagnostics

• Product usage events (which screens were visited, which actions were taken) via PostHog EU. These events carry no name, email address or list content, but they are sent with a persistent installation/device identifier, so they are not fully anonymous.
• Crash reports: on Android, when the app crashes Firebase Crashlytics sends a crash record (stack trace, device model, OS version, app version). The iOS version has no active crash-reporting flow; PostHog error tracking is off on both. Firebase SDKs may send their own technical diagnostic data.
• No advertising tracking. We do not collect the IDFA on iOS or the Advertising ID on Android. No ad SDK and no ATT prompt.

3. Why We Process Data

• App functionality: List sync, family sharing, photo storage, subscription management.
• Security: Abuse detection, account verification.
• Product improvement: Usage analytics to understand which features work.
• Legal obligations: Billing records (via Apple or Google Play).

4. Third-Party Services

• Firebase (Google LLC): Authentication, Firestore (database), Storage (photos), Cloud Messaging (notifications), Crashlytics (Android only, crash reports). Firebase Privacy
• RevenueCat: Subscription management, anonymous device ID. RevenueCat Privacy
• PostHog (EU Cloud): Product analytics. Data hosted in the EU (Frankfurt). Autocapture and session replay are explicitly disabled. PostHog Privacy
• Apple: App Store purchases, Sign in with Apple, push notification service.
• Google: Google Play purchases and subscription billing, Google Sign-In.

5. Data Retention

• While account is active: data is kept in sync.
• Without an account: local data is kept as long as it remains on your device; it may not be recoverable from the cloud if the app is deleted or you switch devices.
• On account deletion request: cloud data within the deleted scope is removed within 30 days. Photos in lists you own are deleted with your account on iOS 2.2.1 and later and on Android; on iOS 2.2.0 and earlier the photo files are not deleted automatically. Records you left in someone else's list stay with that list's owner on every version. What goes and what stays: Account & Data Deletion.
• Product analytics data: kept with our EU-hosted analytics provider (PostHog) for the retention period that service applies to our account.
• Billing records: per Apple's or Google's retention policy.

6. Your Rights (GDPR / KVKK)

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Request data portability (export)
• Object to processing
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority (in TR: KVKK Kurumu; in EU: your national DPA)

To exercise these rights, email osman.seven97@icloud.com. We respond within 30 days. In-app and email routes for deleting your account and data: Account & Data Deletion.

7. Children

The app is rated 4+ but the target audience is 18+. We do not knowingly collect data from children under 13. If you believe a child has provided data, please contact us.

8. Data Security

• All traffic encrypted via HTTPS/TLS.
• Local database (Core Data on iOS, SQLite on Android) stored in the app's own protected storage.
• Firebase Storage and Firestore access guarded by role-based Security Rules.

9. International Transfers

Firebase Storage photos are stored in a European regional bucket; Firebase, Apple and Google services may still process technical data on infrastructure outside Turkey. PostHog data is stored in the European Union (Frankfurt). Cross-border transfers rely on Standard Contractual Clauses and KVKK Article 9 safeguards.

10. Policy Updates

We may update this policy from time to time. For significant changes, we will notify you via in-app notification or email. The effective date is updated on every revision.

11. Contact

Questions, requests, complaints: osman.seven97@icloud.com