Privacy Notice (KVKK)

1 · Data controller

The Nenni app is provided by an individual developer; it is not a company or legal entity. The data controller is Mahmut Uğur Çeker, who lives in Türkiye and gives this notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK). For any request under KVKK or the data protection law that applies to you, write to hi@mugurc.com. Because the data controller is in Türkiye, KVKK applies to all users, whichever country you live in.

2 · Personal data we process

• Account: your email address if you link one (only for signing in and recovering your account). If you don't, your account stays anonymous, but there is still a random account ID on our server.
• Baby profile: name, date of birth, gender, birth measurements; a photo if you add one.
• Special-category health data (KVKK Art. 6): feeding, sleep, diaper and solids entries (including reactions), vaccine records and post-vaccine reactions, medication and dose records, fever readings, health notes, weight/length/head circumference measurements, appointments, your postpartum mood journal and your Edinburgh scale result.
• Voice and text: if you use voice logging or a voice note, your voice recording and its text (the audio file of a voice health note stays on your device only); the questions you write to the AI assistant, recent messages and the answers you get; sleep analysis results.
• Caregiver sharing: the name, role and access of the people you invite; who added which entry; invite codes.
• Subscription: your Nenni+ purchase status.
• Notifications: your device's notification token; your notification preferences (quiet hours, time zone, language); the information needed for live notifications (lock-screen timer), including your baby's name.
• Location: if you search for a nearby health center (in Türkiye, a Family Health Center, ASM), your location at that moment — used only for the search; it is not sent to our servers and not stored. Only an approximate (rounded) version goes to the map provider (see section 5).
• Device and usage: operating system, language, app version; for AI features, a usage counter and cost record (which feature, how much, when; no content); aggregate usage measures for your account (the date the account was opened, the time and number of entries, whether a baby was added, notification permission — not the content of your entries); the time you gave consent, and the version and language of the text you agreed to.
• If you give consent, also: usage events (the screens you open, operating system, app version and your phone's region setting, e.g. TR) and app error summaries (under a random install ID on your device; not linked to your name or account); weekly aggregate statistics; whether your marketing consent is on or off, with your email address; your device's advertising ID for ad measurement.

3 · Purposes of processing

Providing the baby tracking service; backing up your entries and syncing them across your devices; sharing with the caregivers you invite; reminders and notifications. (If you use them) converting voice logs and voice notes to text, generating AI assistant and sleep analysis responses, finding a nearby health center (in Türkiye, an ASM). Verifying your subscription entitlement. Keeping the service secure, preventing misuse (including usage limits on AI features) and improving the service (for example aggregate numbers such as how many accounts keep using the app). Proving your consent.

If you give consent, also: usage and error statistics are kept on our own server (no third-party analytics service is used); once a week, aggregate statistics are recorded for research; if you give marketing consent, new-feature emails are sent and Meta measures which ad led you to install the app (only if you have also granted iOS tracking permission).

Your data is not sold for marketing purposes or rented to third parties; your baby's health records are not used for advertising.

4 · Legal basis and how we collect data

How we collect: your personal data comes from what you enter in the app and, while you use the app, is collected automatically from your device in an electronic environment.

Legal bases: it is necessary to conclude and perform the contract for the service (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)); legitimate interest in keeping the service secure, preventing misuse and measuring aggregate usage at account level (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)); and, because health data is special-category data, your explicit consent (KVKK Art. 6; GDPR Art. 9(2)(a)). Voice logging, AI features, analytics, research, marketing and ad measurement, and transfers abroad, also rely on your explicit consent (details in section 5).

You can withdraw your explicit consent at any time; processing done before you withdraw stays lawful. How to withdraw is in section 9.

5 · Sharing and transfers abroad

The cloud infrastructure runs on Supabase; your data is stored on servers in Frankfurt, Germany (EU). Because this is outside Türkiye, it is a transfer abroad too. The following service providers receive information only when you use the feature concerned, and only what is listed:

• (a) Supabase (Germany, EU): all your account, baby and health entries; for backup, syncing, sign-in and server functions.
• (b) OpenAI (USA): if you use voice logging or a voice note, your audio and its text, only for that action, to be turned into text and an entry. Your audio is not stored on our server.
• (c) Anthropic (USA): if you use the AI assistant, the questions you ask and recent messages, your baby's age and gender, and a summary of the last 7 days of entries (counts and averages for feeding/bottle/diaper/sleep/solids, the highest fever, the latest measurement and its percentile, overdue vaccines, the names of medications in use); for sleep analysis (Nenni+), sleep and feeding statistics for the last 14 days. Your baby's name and your health/entry notes are not sent; but everything you type in a question is sent, so don't type names and the like.
• (d) RevenueCat (USA): to verify your subscription entitlement; when the app opens, a random subscription ID for your device and device information (including IP address); after you sign in, your account ID and your subscription status.
• (e) Apple, Google and Expo (USA): your notification token and notifications. In caregiver notifications, your baby's name, the type of entry and its duration/amount are passed through Expo to the Apple/Google notification services; in a live notification (lock-screen timer), your baby's name and the timer information are passed to your devices through the Apple notification service. When the app checks for an update, a random install ID for your device and the app version go to Expo. Apple/Google process purchases.
• (f) Meta (USA): if you gave marketing consent and also allowed iOS tracking, your device's advertising ID and general app events (install, open, purchase) for install measurement. Your baby's entries are not part of this measurement.
• (g) OpenStreetMap Overpass (abroad; overpass-api.de, with overpass.kumi.systems as a backup): if you search for a nearby health center (in Türkiye, an ASM) and allow location access, an approximate version of your location (latitude/longitude rounded to 3 decimals, about 110 m) and the search radius go to the map service as a query; the provider sees your IP address. Your account or device ID and your baby's data are not sent; nothing is sent to our servers and your location is not stored by us. We do not control the map provider's own logs.
• (h) Wikimedia (abroad): when you open a postpartum recipe image, the server that serves the image sees your IP address and device information.

Caregivers can access only with your explicit invitation and according to the role you give; they may be in Türkiye or abroad. Except where the law requires it, nothing is passed to third parties in Türkiye.

These transfers abroad rely on the explicit consent you give by choosing to use the feature concerned (KVKK Art. 9; for GDPR purposes, Art. 49(1)(a)); we do not rely on an adequacy decision. Please know that these countries may not give your data protection equivalent to Türkiye's or the EU's, that the service providers may keep what we send for a while under their own terms, and that public authorities may ask for access. Transfers are encrypted with TLS.

6 · Retention and deletion

Your data is kept as long as your account is active. When you delete your account with Profile → Delete account, the entries in the cloud are permanently deleted: baby profiles and photos, health entries, assistant conversations and sleep analysis results, the AI usage counter and cost records, notification tokens, the marketing list record and your email address. The copy on your device is deleted too; if you only uninstall the app, the copy on your device goes away but the cloud entries remain.

Entries you added to someone else's baby are that baby's history: they are not deleted when you delete your account but are handed over to the baby's owner; health notes you did not share are deleted. If you are a baby's owner, deleting your account deletes the baby and all its entries (including those the caregivers added), and the caregivers lose access.

You can delete a single entry or a baby in the app; a deleted entry is removed from the cloud as well (when you delete a baby, the profile photo file may stay in storage until you delete your account). The delete-chat button in the assistant deletes only the copy on your device; assistant conversations on our server are deleted when you delete the baby or the account, and sleep analysis results when you delete the account; if you want them deleted sooner you can ask by email.

No separate automatic deletion period applies to assistant conversations and sleep analysis results. The AI usage counter and cost records (they contain no content) are kept while your account is active and deleted with it.

If you gave consent, the usage events and weekly statistics collected are kept under a random install ID; because they are not linked to your account, they are not deleted when you delete your account, and no automatic deletion period is set for them; if you want them deleted, ask by email.

The service providers (OpenAI, Anthropic, RevenueCat, Meta, Expo, Apple, Google) process and keep what we send under their own terms; deleting your account does not by itself delete records they keep (for example purchase records).

7 · Data security

Measures in place: transfer between your device and our server is encrypted with TLS. On the server, data is opened by row-level security (RLS) rules only to you and the caregivers you invite; your postpartum mood journal, your Edinburgh results and health notes you did not share are not shared with caregivers. Server functions require a signed-in session; there is a usage limit on AI features against misuse. Account deletion is verified with a code sent to your email (or by a typed confirmation if no email is linked). When you remove a caregiver from the team, their access ends. Our hosting provider, Supabase, states that data is encrypted on disk.

Limits: data is not end-to-end encrypted; it is processed on the server for the service to work. The entries on your device rely on your phone's own protection (screen lock and system encryption); Nenni adds no encryption or app lock of its own. A profile photo is kept in a public store at an address that is hard to guess; anyone who knows the address can view it. No system is completely secure. If your personal data is obtained by unauthorized people, we notify the Board and the people affected as KVKK Art. 12 requires.

8 · Children's data, caregivers and voice recording

You enter your baby's personal data (health data above all) as the baby's parent or legal guardian, on the baby's behalf, and by giving consent you declare that you do so as the baby's parent or guardian. Nenni is meant for parents and caregivers who are 18 or older; someone under 18 should not use it for themselves. We do not knowingly collect data from people under 18.

When you invite a caregiver, your baby's entries are opened to that person according to the role you give; the caregiver's name and role are visible to the other members of the team. Whoever holds the invite link (valid for 48 hours) can see your baby's name before joining, so send the link only to someone you trust. If you add entries to someone else's baby, those entries become part of that baby's history (see section 6).

Voice notes and voice logging: recording people without the permission of the others in the conversation is a crime in many countries (in Türkiye, Turkish Penal Code Art. 133). If you will record a conversation with your doctor, ask for permission first; the legal responsibility for the recording is yours as the person who makes it.

9 · Your rights (KVKK Art. 11)

Under KVKK Art. 11 you have the right to:

• (a) find out whether your personal data is processed;
• (b) request information if it has been processed;
• (c) find out the purpose of processing and whether it is used in line with that purpose;
• (ç) know the third parties it is transferred to, in Türkiye or abroad;
• (d) ask for it to be corrected if it is incomplete or wrong;
• (e) ask for it to be deleted or destroyed under the conditions in KVKK Art. 7;
• (f) ask for the actions in (d) and (e) to be notified to the third parties it was transferred to;
• (g) object to a result against you that comes from analysis solely by automated systems; and
• (ğ) ask for compensation if you suffer harm from unlawful processing.

You can also withdraw your explicit consent at any time and download your data in a portable format.

In the app: edit or delete your entries; Profile → Download my data (a JSON/CSV copy of everything on your device — assistant conversations, sleep analysis results and usage counters kept on our server are not in that copy; ask for them by email); Profile → Delete account; Profile → Privacy and consent (optional consents). You can turn off voice logging and the other optional consents there; because cloud backup is part of the service (data integrity), the way to withdraw cloud consent is to delete your account — you can do this from within the app.

Automated decisions: no decision that has legal effect on you is made solely by automated systems. The AI features (assistant, sleep analysis) produce information and suggestions and do not diagnose; whether to use them and whether to follow a suggestion is up to you.

10 · Requests and complaints

Requests: to use your rights, write to hi@mugurc.com. If you write from the email address linked to your account, your identity counts as verified; if no email is linked, we may ask for more information to verify who you are. Say clearly which right you want to use. Your request is answered free of charge within 30 days at the latest (if the action itself needs extra cost, the tariff set by the Personal Data Protection Board may apply).

Complaints: if you find the answer insufficient or no answer is given in time, you can complain to the Personal Data Protection Board (kvkk.gov.tr) within 30 days of learning the answer and in any case within 60 days of your request.

11 · If you live outside Türkiye

Because the data controller is in Türkiye, KVKK applies to you too; you can use all the rights above as written. The data protection law of the country where you live may also apply to our processing.

If you live in the European Economic Area, the United Kingdom or Switzerland, the GDPR / UK GDPR (Art. 3(2)) may apply. Then you also have the right to: access, rectify, erase and restrict your data, receive it in a portable form, object to processing based on legitimate interests (we use that basis only for keeping the service secure and preventing misuse), and withdraw your explicit consent at any time, without affecting earlier processing. You can complain to the data protection authority of your country (in the United Kingdom, the ICO). Our legal bases: performance of a contract (GDPR Art. 6(1)(b)), legitimate interest (Art. 6(1)(f)), consent (Art. 6(1)(a)); explicit consent for health data (Art. 9(2)(a)). Your data is stored in the EU (Germany); because the data controller is in Türkiye and the service providers above include US companies, your data is also transferred outside the EU/UK. These transfers rely on the explicit consent you give by choosing the feature concerned (GDPR Art. 49(1)(a)); these countries may not offer protection equivalent to the EU's. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing (Art. 22).

If you live in the United States: we do not sell your personal information for money. Ad measurement sent to Meta, if you give marketing consent and iOS tracking permission, may count as "sharing" or "targeted advertising" under some state laws; you can stop it by turning off marketing consent in Profile → Privacy and consent, or in iOS Settings → Privacy & Security → Tracking. We process your health data (sensitive personal information in California; consumer health data in states such as Washington) only with your explicit consent; you can withdraw consent, access, correct and delete your data. We don't discriminate against you for using these rights.

This notice is complete and is meant to be read on its own. The Turkish text is the original under Turkish law, and the two are meant to say the same thing. If they ever differ in a way that matters for your rights, the reading that protects you more applies, and the mandatory rules of the law that applies to you always prevail. Read the Turkish text.