Privacy Policy
This Privacy Policy explains which of your personal data is processed when you use the "Yıldız Falı" mobile application (the "App"), how it is used, and what your rights are. Data controller: Eray Durukan, contact: eraydurukan48@hotmail.com.
This policy complies with Turkish Law No. 6698 (KVKK) and the EU GDPR.
1. Data we collect
1.1 Account information
- Email address (required for registration)
- Password (hashed with bcrypt; we never see it in plain text)
1.2 For astrology calculations
- Name (for personalization)
- Date of birth
- Time of birth (if provided)
- City of birth (coordinates + time zone)
- Gender (to tailor the tone of the reading)
1.3 Compatibility tests
The name, date of birth, time of birth and city of birth of the partner(s) you add — stored only in your account and not shared with the partners.
1.4 Technical data
- Device push token (if notifications are enabled)
- Time zone
- Device type & OS (for Sentry crash reports)
1.5 Advertising data
For free users, the device's advertising identifier (Android Advertising ID or iOS IDFA) is used by AdMob. On Android it can be reset under Settings > Google > Ads. On iOS, tracking permission is requested when the App is first opened (App Tracking Transparency); if you do not grant it, non-personalized ads are shown. You can change the permission at any time under Settings > Privacy & Security > Tracking.
Users in the European Economic Area, the United Kingdom and Switzerland are shown a consent window (Google User Messaging Platform) before any ads are displayed. You can change or withdraw your consent at any time in the App under Settings > Privacy preferences.
1.6 Usage analytics
To improve the App, we record which screens and features are used (e.g. screen views, starting a compatibility test), together with device type and operating system. These records contain no personal data other than the random user ID of your account; your email, name, birth information, partner information and chat content are not sent to analytics. No screen recording takes place.
In the European Economic Area, the United Kingdom and Switzerland, usage analytics are collected only if you allowed it in the consent window. Collection stops when you withdraw your consent under Settings > Privacy preferences.
1.7 Data we do not collect
- Location (live GPS)
- Contacts, photos, microphone, camera
- Data of persons under the age of 13
2. How we use the data
| Purpose | Data | Legal basis |
|---|---|---|
| Account creation, sign-in | Email, password | Performance of a contract |
| Birth chart calculation | Birth information | Explicit consent |
| AI-generated readings | Chart data (anonymous) | Explicit consent |
| Compatibility tests | Partner information | Explicit consent |
| Push notifications | Push token, time zone | Explicit consent |
| Displaying ads | Advertising ID | Legitimate interest / consent |
| Product improvement (usage analytics) | Screen and feature usage, user ID | Legitimate interest; in the EU/EEA, the UK and Switzerland only with consent |
| Subscription management | Account ID | Performance of a contract |
| Error reporting (anonymous) | Device, OS, stack trace | Legitimate interest |
3. Third-party services
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Database & authentication | All account data | EU |
| Railway | Backend hosting | API requests (transient processing) | USA |
| Google Gemini | AI reading generation | Chart results (anonymous) | USA |
| RevenueCat | Subscription management | Account ID, purchases | USA |
| Google AdMob | Advertising | Advertising ID, device information | USA |
| Sentry | Error reporting | Stack trace (no PII) | EU |
| PostHog | Usage analytics | Account ID (pseudonymous), screen and event names, device information | EU |
| Expo / EAS | Build infrastructure | (no personal data) | USA |
City data: GeoNames (geonames.org), CC BY 4.0.
4. Data retention
Data is kept for as long as the account is active. When you delete your account (Settings > Delete My Account), all your data is deleted within 30 days.
5. Data security
- Communication encrypted with TLS 1.2+
- Passwords are hashed with bcrypt (Supabase Auth)
- The backend is accessed only with the Service Role Key
- Suppliers use SOC 2 / ISO 27001 infrastructure
6. Your rights
Under Article 11 of the KVKK and Chapter 3 of the GDPR:
- Right of access
- Right to rectification (Settings > My Birth Details)
- Right to erasure / right to be forgotten (Settings > Delete My Account)
- Right to object to processing (notification preferences)
- Data portability
- Right to lodge a complaint (Turkish Personal Data Protection Authority / EU supervisory authority)
For requests: eraydurukan48@hotmail.com. We respond within 30 days at the latest.
7. Cookies / tracking
The App does not use web cookies. When tracking permission is not granted on iOS, or when personalization is turned off on Android, AdMob is called in "non-personalized ads" mode. When permission is granted, the advertising identifier is shared with Google AdMob for the purpose of personalizing and measuring ads.
8. Children
The App is not directed at persons under the age of 13. We do not knowingly collect children's data.
9. Changes
When the policy is updated, this is announced through an in-app notification and the "Last updated" date on this page.
10. Contact
Eray Durukan
Email: eraydurukan48@hotmail.com