Kiyolu Privacy Policy

Kiyolu is a daily affirmations app for iPhone and iPad. Earlier versions of the app were published under the name "Lumina". This policy applies to the Kiyolu app, including those earlier versions, its widgets, Siri and Shortcuts actions and Control Center controls (together, "the App"), to the website kiyolu.magalar.com ("the Website"), and to emails you send us.

The App and the Website are provided by Yagiz Ada Umur, an independent developer based in Türkiye ("we", "us"). For the limited personal data described in sections 8 and 9, we are the data controller under the EU and UK General Data Protection Regulation ("GDPR") and the Turkish Personal Data Protection Law No. 6698 ("KVKK"). This policy is also our information notice under Article 10 of KVKK.

In short:

• The App has no accounts, no ads, no analytics and no tracking.
• Everything you enter in the App stays on your device. We have no server that receives it, and we cannot see it.
• We only receive personal data if you email us (section 8). When you visit the Website, its hosting provider processes basic technical data (section 9).

1. Information the App stores on your device

To work, the App saves the following on your device only:

• the name you may enter during setup, used to greet you;
• your answers during setup, such as your goals and how you are feeling, used to choose your first affirmations and categories;
• your custom affirmations, favorites, custom themes and any photos you choose for them;
• your mood check-ins and Gratitude Journal entries;
• your reading activity, daily goal progress, streaks, streak freezes and the categories you read most;
• your settings, such as language, appearance, sounds, haptics, widget choices and reminder times;
• whether you have Kiyolu Premium, as confirmed by Apple.

Some of this information, such as your moods, feelings and journal entries, can be personal or sensitive. It is kept in the App's storage on your device and shared only with the App's own widgets and controls on the same device. It is never sent to us or to anyone else. You do not need an account, and we cannot access, view, recover or delete this information.

2. Information we do not collect

The App does not collect your email address, phone number, location, contacts, photo library, browsing history, health data or advertising identifier. The App contains no advertising and no third-party analytics, crash reporting, tracking tools or software development kits (SDKs) that collect data. We do not track you across other companies' apps or websites, we do not build profiles about you, and we do not sell or share personal information.

3. Permissions

All permissions are optional, and you can change them at any time in your device's Settings.

• Notifications: if you turn on reminders, the App schedules them on your device. No server is involved. Reminders can show affirmation text, including custom affirmations you wrote, on your Lock Screen. You can hide notification previews in Settings > Notifications.
• Photos: when you choose a photo for a theme, Apple's photo picker gives the App only the photo you select, which is then stored in the App on your device. If you save an affirmation image to your library, the App asks only for permission to add photos; it cannot read your photo library.
• Background App Refresh: the App may refresh in the background to keep your reminders scheduled. This happens on your device.

4. Widgets, Siri, Shortcuts and Control Center

Widgets and Control Center controls show content from the App on your screen, such as an affirmation, your daily goal or Lumi. People who can see your device may see this content. If you use Siri or the Shortcuts app with the App, Apple processes your request under Apple's Privacy Policy, and the App provides only the content needed to answer it, such as today's affirmation. These features run on your device and do not send any information to us.

5. Sharing

When you share an affirmation, for example to Instagram Stories, Messages, Save to Photos or another app, the image or text is passed to the app or service you choose, and that service's own privacy policy applies. Shared images may include a QR code that links to the App's page on the App Store; the QR code contains no information about you. When you copy an affirmation, its text is placed on your device's clipboard.

6. Purchases

Kiyolu Premium subscriptions and one-time purchases are processed entirely by Apple through the App Store. We never receive your payment details, your Apple Account details or your name. The App checks your purchases with Apple on your device so it can unlock Premium. Apple gives us sales reports that do not identify you. Apple's Privacy Policy applies to purchases.

7. Ratings, analytics and crash reports from Apple

If you have chosen to share analytics with app developers in your device settings, Apple may provide us with aggregated usage statistics and crash reports that do not identify you. We use them only to improve the App's stability and performance. You can turn this off at any time in Settings > Privacy & Security > Analytics & Improvements.

The App may ask you to rate it using Apple's standard rating prompt. Ratings and reviews are handled by Apple, and we see only what you choose to publish on the App Store.

8. When you contact us

If you email us, we receive your email address, your name if your email shows it, the content of your message and anything you attach. This data is collected electronically, from you, when you write to us. We use it only to answer you and to handle your request, for example a question, a bug report, a privacy request or a copyright notice.

• Legal basis: under the GDPR, taking the steps you ask us to take and our legitimate interest in answering you (Article 6(1)(b) and (f)); under KVKK, processing that is necessary for the establishment or performance of a contract and our legitimate interest (Article 5(2)(c) and (f)).
• Email provider: our email is provided by Google (Gmail). Google processes our messages on our behalf and may store them on servers outside Türkiye and outside your country, including in the United States. This transfer is necessary to receive and answer the request you send us (KVKK Article 9(6)(b); GDPR Article 49(1)(b)).
• Retention: we keep support emails for as long as we need them to handle your request, and then for up to 2 years, unless the law requires us to keep them longer. You can ask us to delete them sooner.

We do not share your emails with anyone else, except where the law requires it. Please do not send us sensitive information, such as health information, that we do not need to help you.

9. The Website

The Website does not use cookies, analytics or advertising, and it does not load content from third parties. It saves your language choice in your browser's local storage so that your next visit opens in your language. This choice stays in your browser, and you can clear it at any time.

The Website is hosted by Vercel Inc. When you visit it, Vercel automatically processes technical data that your browser sends, such as your IP address, browser type, the page you request and the date and time of your visit. This data is processed to deliver the Website and to keep it secure, and it may be processed in the United States or other countries. We do not use it to identify you. Legal basis: our legitimate interest in running a secure website (GDPR Article 6(1)(f); KVKK Article 5(2)(f)). Vercel keeps this data only for a limited period under its own retention rules.

10. Backups

The App does not sync your data to iCloud or any other cloud service. If you back up your device with iCloud Backup or to a computer, the App's data may be included in that backup, which is managed by Apple or by you under your own settings. When you set up a new device from a backup, your App data may move with it.

11. Keeping and deleting your data

App data stays on your device until you delete it. You can delete journal entries, favorites, custom affirmations and custom themes in the App. Deleting the App removes all of its data from your device, although copies may remain in your device backups. Because we do not hold your App data, there is nothing for us to delete on our side.

To have emails you sent us deleted, contact us (section 15).

12. Children

The App is a general-audience app. It is not directed at children under 13, or under the minimum age set by the law of your country. We do not knowingly collect personal information from children. If you believe a child has sent us personal information by email, contact us and we will delete it.

13. Your rights

Depending on where you live, data protection laws such as the GDPR (EU, EEA and UK), KVKK (Türkiye) or US state privacy laws such as the CCPA (California) give you rights over your personal data. These may include the right to:

• learn whether we process your personal data and get information about it;
• access your personal data and receive a copy;
• have inaccurate data corrected and have your data deleted;
• restrict or object to processing;
• data portability;
• learn the purpose of processing, the third parties your data is transferred to, in Türkiye or abroad, and whether it is used for that purpose;
• object to a result against you that arises only from automated processing;
• claim compensation for damage caused by unlawful processing.

Data in the App: because it stays on your device and we do not process it, you can view, change or delete it directly in the App.

Data we hold (emails you sent us): to use your rights, email us from the address you used to contact us. We will answer free of charge within 30 days. We may need to confirm that the request comes from you.

You also have the right to complain to a data protection authority. In Türkiye this is the Personal Data Protection Authority (KVKK Kurumu, www.kvkk.gov.tr); under KVKK, you must first apply to us. In the EU, EEA or UK, you can complain to the data protection authority where you live or work.

We do not sell or share personal information, as those terms are defined in the CCPA, and we do not use sensitive personal information to infer characteristics about you.

14. Changes to this policy

We may update this policy as the App changes. We will post the new version on this page with a new "Last updated" date, and we will mention significant changes in the App's update notes. If we ever add analytics or any other feature that sends information from the App off your device, we will update this policy before that version is released and, where the law requires it, ask for your consent first.

This policy is available in several languages. If the versions differ, the English version prevails, unless the law of your country requires otherwise.

15. Contact

Data controller: Yagiz Ada Umur, Türkiye
Email: yadaumur@gmail.com