Privacy Policy (KVKK)

Privacy Policy (KVKK)

Last updated:

Note: This English version is provided for convenience. The Turkish version, Gizlilik Politikası ve Aydınlatma Metni, is authoritative under Turkish law (KVKK) in case of any conflict.

1. Data Controller

Under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by the team operating the "Dipnot" application as data controller, within the scope described below.

  • Data Controller: Dipnot Application Team
  • Contact email: help@dipnot.app

2. Personal Data Collected, Purposes of Processing, and Legal Basis

When you register for and use the Dipnot application, the following data is processed:

Data Category Data Collected Purpose of Processing Legal Basis (KVKK art. 5)
Identity First name, Last name Account creation, identifying users, personalising profiles Explicit consent
Contact Email address, Phone number Account verification (email verification), password reset, sending notifications, communicating with the user Explicit consent
Usage Data Articles read, likes, saved content, session durations Content recommendations, improving the experience, trend analysis Legitimate interest
Technical Data Device model, operating system version, IP address, app version Ensuring the app works, debugging, security Legitimate interest

3. Third Parties and Cross-Border Transfers

Your personal data may be shared with third parties limited to the following service providers:

  • Google Firebase and Google Cloud Platform (eur3 – Europe):
    For authentication, database (Firestore), file storage (Storage), and push notifications. Your data is hosted on servers in Europe (Frankfurt, eur3).
  • Expo (Expo Application Services, Inc. – USA):
    The Dipnot mobile app is built on the Expo / React Native stack. Your push notification tokens are processed through the Expo Push service and used to deliver notifications. Limited device and runtime information (device model, operating system version, app version) may be sent to Expo's servers in the USA for stability monitoring and debugging. Additionally, on every app launch the app sends a lightweight request to Expo's servers (u.expo.dev) to check whether a new JavaScript/asset update is available (OTA — "over-the-air" update); this request includes the app install ID, runtime version, and update channel. These transfers are carried out based on your explicit consent under KVKK article 9.
  • Google Analytics (Google Analytics for Firebase):
    Used to analyse in-app usage statistics, understand user behaviour, and improve the experience. Data collected includes device identifiers, session durations, screen views, and in-app interaction events. We do not share this data with marketing or third-party ad networks. Analytics data is processed on Google's servers in the USA (Google Analytics for Firebase — standard Firebase projects have no user-configurable region setting).
  • Firebase Cloud Functions — Contact form (Google LLC, europe-west1 – Belgium, EU):
    The name, email, subject, and message you submit through the contact form on dipnot.app are processed by Firebase Cloud Functions and stored in Firestore (contactSubmissions collection) to be read by the admin panel. Your IP address and browser information (user-agent) are automatically recorded for abuse investigation and spam prevention. Your data is processed on servers in Europe (Belgium, europe-west1).

Where cross-border transfer is involved, transfers are made under KVKK article 9 to countries with adequate protection (e.g. EU countries) or to service providers that have committed in writing to provide adequate protection. Transfers to US-based providers (including Expo) are carried out with your explicit consent or under the safeguards required by KVKK article 9.

4. Method of Collection and Legal Basis

Your personal data is obtained when the Dipnot registration form is filled in, through in-app interactions, and via automatic collection of technical data. Our processing activities rely on the following legal bases set out in KVKK article 5:

  • Explicit consent (for identity and contact information)
  • Legitimate interest (for analysis of usage and technical data)

5. Retention Period

Your personal data is retained for as long as the purposes of processing require. This corresponds to the period during which your account is active. When you delete your account or request its deletion, your data is anonymised or erased within 30 days at the latest. Data that must be retained due to legal obligations (e.g. commercial communication records) is kept for the periods specified in the relevant legislation.

6. Data Subject Rights (KVKK art. 11)

Under KVKK article 11 you have the following rights:

  • To learn whether your personal data is being processed
  • To request information if it has been processed
  • To learn the purpose of processing and whether it is used for its intended purpose
  • To know the third parties to whom data has been transferred domestically or abroad
  • To request correction if data has been processed incompletely or incorrectly
  • To request deletion or destruction under the conditions set out in KVKK article 7
  • To request that the above correction and deletion actions be communicated to third parties to whom data has been transferred
  • To object to an outcome adverse to you resulting from analysis of processed data solely by automated systems
  • To claim compensation for damage suffered due to unlawful processing

You can exercise these rights by contacting help@dipnot.app with information sufficient to verify your identity. Your requests will be answered free of charge as soon as possible (within 30 days at the latest).

7. Advertising and Marketing Emails

Dipnot does not currently use any advertising network (AdMob, etc.). If we wish to send informational emails about product updates, new features, or special offers in the future, we will ask for your explicit consent separately. You can give this consent at registration or from the settings screen, and withdraw it at any time.

8. Children's Data

Dipnot does not knowingly or intentionally collect personal data of individuals under 18 years of age. Use of the application by children without parental supervision is not recommended.

9. Changes

This Privacy Policy may be updated as needed. Significant changes will be announced through an in-app notification or by email. Continued use of the application after changes take effect means you accept the updated policy.