Privacy Policy
This is a courtesy translation. The Turkish version is the binding text. Gizlilik Politikası
This policy explains how your data is handled when you use the Fitimo app ("App"). The App is published by Kubilay Oskan (Fikirizma Media), Kütükçü Mahallesi 2976 Sokak No: 17, Kepez / Antalya, Türkiye ("we"). Questions: info@fikirizma.com.
Summary
- An account is optional. If you sign in with Apple or Google, we store only your e-mail address and account id. Everything you enter (your answers, plan, food diary, weight and water history, health information and Apple Health data) is stored and processed only on your phone.
- We cannot see this data: it is not sent to our servers, not sold, and never used for advertising or analytics.
- The App contains no usage analytics or ad tracking. If the App crashes, a technical error report that does not identify you is sent (see below); you can turn this off.
What leaves your phone (no personal data)
- Barcode and product search: When you scan a barcode, only the barcode number is sent to Open Food Facts (France) and to the Fitimo barcode service (Supabase, Frankfurt, Germany); when you search for a packaged product, only the search term you type is sent to Open Food Facts.
- Product sharing (optional): If you choose to share a product that wasn't found, only the product name and label values are stored anonymously; nothing about you is added.
- App settings and updates: The app downloads feature settings (Supabase, Germany) and updates (Expo, USA). An update check sends Expo a random installation id; it does not identify you.
- Recipe ratings (optional): If you give a recipe stars, only the recipe, your rating (1–5) and a random installation id created on your phone are sent to the Fitimo server (Supabase, Frankfurt, Germany); your name, e-mail, account and health data are not added. An average is shown to everyone, anonymously, once at least 5 people have rated a recipe. Your favourites stay on your phone only.
- Subscription: Purchases are made through the Apple App Store / Google Play; the subscription status is verified through RevenueCat (USA) with a random id. We never see your payment details.
- Error reports: When the App crashes or an unexpected error occurs, the technical details of the error (error message and location, app and operating-system version, device model, the name of the screen that was open) are sent to Sentry (Functional Software Inc.; reports are stored in the EU, Germany). Reports never include your name, e-mail, account id, IP address, diary, food, weight or health data. You can turn this off at any time in Profile › Privacy centre › Error reports; while it is off, no report is sent.
When the app connects to these services, your device's IP address reaches the provider by the nature of the connection; we do not store these addresses.
Account (optional)
- If you sign in with Apple or Google, your e-mail address (possibly Apple's private relay address), the account id given by the sign-in provider and the time of your last sign-in are stored on Supabase servers (Frankfurt, Germany).
- We use them only to recognise you, link your subscription to your account (your account id is passed to RevenueCat) and support you. Your diary, weight, plan and health data are not sent to the account.
- Profile > "Delete my account and data" permanently deletes your account from the server. If you continue as a guest, no account data exists.
Meal estimation from a photo (optional, Pro)
- If you use this feature, the photo you take or choose is shrunk on your phone and sent only for the estimate, via the Fitimo server (Supabase, Germany), to our AI provider Anthropic (USA). Your account id is used only for the subscription and the daily limit; it is not sent to Anthropic.
- We do not store the photo; to avoid charging the same photo twice we keep only its fingerprint (hash) and the estimate for 30 days. Anthropic does not use the photo to train models and deletes it within 30 days (longer only if abuse is suspected).
- We ask for your explicit permission before the first use. You can withdraw it at any time in Profile › Privacy centre › Photo analysis; after that no photo is sent from this device and the feature stays off unless you turn it back on. Avoid faces or personal information in the photo; your diary and health data are not sent.
Apple Health / Health Connect
With your permission, steps, distance, active energy, workouts and weight are read and used only on your phone, for your plan and diary. You can withdraw permission at any time in your phone's settings.
Backups and new phones
Because your data is on your phone, backing it up is in your hands too. Your phone's own backup includes app data. In Profile, "Export your data" creates a single file that you can restore on a new phone with "Import your data". The file goes nowhere unless you send it.
Deletion
Profile > "Delete all my data" permanently deletes all data on the phone and, if you signed in, your account on the server. Deleting the app removes the data on the phone but not the account.
If you write to us
If you email us for support, your name, email address and message are used only to reply to you and are deleted once the matter is closed. The in-app "Support & feedback" button adds a short technical block to the email (app version, iOS/Android version, language and the last error messages the app kept on your phone); you see it before sending and can delete it. It contains no diary, weight or health data.
Legal basis
- Data on your phone: Your diary, plan and health details are processed only on your phone, for your own use; we have no access to them. Apple Health / Health Connect data is read only with the permission you give.
- Connections the App needs to work (barcode and product search, settings, updates, subscription check): providing the service you asked for (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) and our legitimate interest in keeping the App secure and up to date (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
- Error reports: our legitimate interest in keeping the App safe and working (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)); you can turn them off at any time.
- Support emails: our correspondence to solve your issue (GDPR Art. 6(1)(b) and (f); KVKK Art. 5(2)(c) and (f)).
- Account (optional): providing your account when you choose to sign in (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
- Meal estimation from a photo: your explicit consent (GDPR Art. 6(1)(a) and 49(1)(a); KVKK Art. 5(1) and 9).
Retention
- Data on your phone stays there until you delete it or remove the App.
- Error reports are deleted after 90 days at the latest.
- Support emails are deleted once the matter is closed.
- Product details you share contain no personal data and may stay in the product database indefinitely.
- Providers' connection logs (e.g. IP address) are limited to the short periods set out in their own privacy policies.
- Account data is kept for as long as the account exists and deleted as soon as you delete the account.
- Photos are not stored; a photo's fingerprint and its estimate are deleted after 30 days.
International transfers
Some providers are outside Türkiye, and some outside the EU (USA): Expo (updates) and RevenueCat (subscription). Only the technical details listed above, which do not identify you, go to them. These transfers rely on the providers' standard contractual clauses (GDPR Art. 46; KVKK Art. 9). If you create an account, your e-mail address and account id are stored in the EU (Germany); your account id is passed to RevenueCat (USA) to verify your subscription. If you use meal estimation from a photo, the photo is sent to Anthropic (USA) with your explicit consent. Sentry, which we use for error reports, is a US company; the reports are stored in the EU (Germany).
Your rights
Under KVKK Art. 11 and GDPR Arts. 15–22 you have the right to access, correct, delete and port your data and to object to its processing. Because your data is on your phone, you can do most of this yourself in Profile. For anything else, write to info@fikirizma.com; we reply within 30 days. You can also complain to the Turkish Personal Data Protection Authority (KVKK) or, if you live in the EU, to the data protection authority in your country.
Children
The App is not for anyone under 18.
Changes
If we change this policy, we will announce it in the App.