Privacy Policy

Effective 28 September 2026 · Version 2026-09-28

Ölçü is an app that records your weight, what you eat and how you feel. That is health data, and we treat it as such. This page explains, in plain language, everything we keep and where it goes. It is the English version of the Turkish privacy policy; the legal detail under Turkish law is in the KVKK disclosure notice (in Turkish).

In short

We do not sell your data. To anyone, under any circumstances.
Your health data never reaches a measurement system. The app has no outside analytics or crash-reporting provider. We count which screens are used in our own database — your weight, your calories and what you ate never enter that count, and you can switch it off.
The AI provider never receives your identity. Not your name, not your email, not your account number.
Location data inside your food photos is removed — before anything is stored.
You can download everything and delete everything, from inside the app, without asking us.

What we collect

Only what you enter, under these headings:

Your account — your email address and, if you choose, your name. If you sign in with Apple or Google, whatever that provider gives us.
What we need to calculate your target — sex, date of birth, height, weight and activity level. A calorie target cannot be calculated without these five.
What you record in the app — meals and portions, water, weight history, body measurements, mood, symptoms, fasting and exercise records.
Your eating preferences — how you eat, allergies and foods you avoid, foods you dislike, meal times.
Your food photos — if you add a meal by taking a photo.
What you write to the assistant — if you use the nutrition assistant.
Your subscription — its status. Your card details never reach us; payment is handled entirely by the App Store or Google Play.
If you allow it — your notification address and step/activity data from your phone's health app. Each is asked separately, and you can refuse both.
Usage statistics — which steps of the app are used; see below.

We do not collect your location, your contacts, the rest of your photo library, your browsing history, or what you do in other apps.

About photos

A phone camera writes more than the picture into a photo: GPS coordinates, the device make and model, the time it was taken, sometimes the owner's name. None of it is visible, but it all travels if the file is sent as it is.

So every photo you upload is rebuilt from its pixels alone before it is stored or analysed. All of the metadata is dropped, not part of it. A photo that cannot be decoded is rejected — sending on a file that could not be cleaned is exactly the outcome this exists to prevent.

Why we collect it

To do what the app promises you: calculate your target, show you what you have recorded, run the features you use and manage your subscription. And, to improve the app, we count which screens are used (see "Usage statistics"). There is no other purpose — we do not profile you, target ads at you or sell anything to anyone.

Who we share it with

The app relies on five service providers. Each receives only what it needs to do its own job.

Provider	What it receives	When
Supabase database, sign-in, file storage — data centre in Frankfurt, Germany	Your account and everything you record; your photos; usage statistics	Always — this is where your data lives
OpenAI AI features — USA	The photo (metadata removed), a voice recording, your message to the assistant, the day's calorie and macro summary, your eating preferences and allergies. Nothing that identifies you.	Only when you use that feature
RevenueCat subscriptions — USA	Your account number, subscription status and — on iPhone — which App Store ad you came from	When a subscription is checked; to measure our ads
Google AdMob advertising — Ireland / USA	Device and advertising identifiers. No health data and none of your records. Only non-personalised ads are requested.	Only in the free version
Expo notifications — USA	Your device's notification token and the notification text	Only if you allowed notifications

Usage statistics

From version 1.0.3, we count which steps of the app are used: opening the app, finishing set-up, adding a meal, seeing the subscription screen, starting a subscription and the like. The point is to see where people get stuck, so we can fix it.

These records have hard limits:

They carry no values. "A meal was added" is recorded; what you ate, how many calories, your weight or your mood is not. A closed list defines what may be recorded, and the server filters every record against it again rather than trusting the app.
They go to no third party. They are kept in our own database (Supabase), where your account already is. No analytics company receives them.
They leave with you. Deleting your account deletes them; downloading your data includes them.
You can switch them off. From the moment you turn off Profile → Data and privacy → Usage statistics and crash reports, nothing more is sent.

Crash reports

If the app crashes or hits an unexpected error, that is recorded the same way, in our own database: the error's message, where in the code it happened, the app version and the platform. What you typed, your records and your health data do not enter the report; the message and detail are truncated before they are kept. Reports are deleted automatically after 90 days, deleted with your account, and switched off by the same setting.

Which ad you came from

We advertise on the App Store and want to know which ads work. If you installed the app on iPhone by tapping an Apple ad, our subscription provider RevenueCat learns from Apple which campaign and keyword it was and adds it to your subscription record. This uses a token Apple generates that contains no device identifier; it is not used to recognise you in other apps or to show you ads, so no tracking permission is asked for. Your health data is never added to it. The same setting switches it off: if statistics are off, this is not collected either.

If you live in the European Union (GDPR)

Ölçü is available in EU App Stores, and the General Data Protection Regulation applies to users there. The following adds to the rest of this page; it does not replace it.

Controller: the person named under "Contact us" below.
Legal bases: your explicit consent for health data (Art. 9(2)(a)); performance of the contract for your account and subscription (Art. 6(1)(b)); our legitimate interest for usage statistics (Art. 6(1)(f)) — being able to see where the app is hard to use — and for which ad you came from, being able to see whether our ad spend pays for itself. To object to either, switch off the setting described above.
Where your data is: our database is in Supabase's Frankfurt (Germany) region. When you use an AI feature, the relevant content goes to OpenAI in the USA, under the data processing agreement signed with OpenAI, which incorporates the European Commission's standard contractual clauses.
Your rights: access, rectification, erasure, restriction of processing, data portability and objection. Erasure and portability are available instantly in the app; for the others, email us. You may withdraw consent at any time; withdrawing does not affect the lawfulness of processing before it.
Complaints: you have the right to lodge a complaint with the data protection authority of the country you live in.
No automated decision-making or profiling takes place; the AI's suggestions are only suggestions and have no effect of their own.

Children

Ölçü is not intended for anyone under 18 and does not knowingly collect data from that age group. If we learn that we are processing a child's data, the account and its data are deleted. Calorie restriction carries health risks during growth, so this limit should be taken seriously.

Security

All communication runs over encrypted connections.
Sign-in keys are kept in the operating system's secure storage on your device.
On the server, every query is bound to the user's identity; one user's data cannot be returned in response to another user's request.
Photo metadata is removed on upload.

No system is unbreakable. If a security incident affects your data, it will be reported to the authority and to you as the law requires.

Your rights and how to use them

From Profile → Data and privacy, without asking anyone, you can:

Download my data — a raw copy of every row we hold about you. Not a summary, the full copy.
Delete my account — your records, photos and sign-in account are permanently deleted. This cannot be undone.
See the consents I gave — which consent, and when.
Usage statistics and crash reports — on or off.

Contact us

Controller Ata Akkoyun
Email ataakkoyun68@gmail.com

Changes

When this policy changes, the version and date above change. If a change affects the scope of a consent you gave, the app shows you the consent screen again.

28 September 2026: the "Which ad you came from" section was added, and it was listed among the data that goes to RevenueCat. Because the data sent abroad now covers more, the consent screen is shown again.

25 September 2026: the usage statistics, crash reports and European Union sections were added. The scope of your health-data and international-transfer consents did not change — the statistics contain no health data and are kept in the database you already consented to — so the consent screen is not shown again.