Legal

KVKK Privacy Notice

Last updated: October 7, 2026

This is an English translation of the Turkish KVKK Aydınlatma Metni. If the two versions differ, the Turkish version prevails. This notice is for information only and does not ask for your consent; confirming at sign-up that you have read it is not a declaration of explicit consent. Consent to commercial electronic messages (the newsletter) is separate and entirely optional.

Contents

This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 (the "KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, to tell you about the personal data processed through the PomoSprint mobile application (the "App") and the pomosprint.app website (the "Site"). More details are available in our Privacy Policy.

1. Data Controller

Under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and related legislation, the developer who operates PomoSprint is the "data controller" for personal data processed through the PomoSprint App and Site:

Data controller: the developer who builds and operates PomoSprint
Address: Our postal address for formal requests is provided on request via destek@pomosprint.app.
Email: destek@pomosprint.app

2. Data, Purposes and Legal Grounds

The table below shows which personal data we process, for what purpose, and on which legal ground under Article 5 of the KVKK. We do not process your location, contacts, photos, camera or microphone, and we do not collect special categories of personal data (such as health or biometric data).

Data category	Data processed	Purpose	Legal ground
Identity	Your display name; if you sign in with Google or Apple, the name provided by that provider.	Creating your account; showing your name in your league room, rankings and friend lists.	Establishment and performance of a contract (Art. 5/2-c).
Contact	Your email address (this may be an Apple private relay address).	Signing in; transactional emails such as email verification and password reset; responding to your requests and applications.	Establishment and performance of a contract (Art. 5/2-c); legal obligation for responding to applications (Art. 5/2-ç).
Customer transactions	Pomodoro and Marathon sessions; mock exam type, status, planned and actual duration, selected tests, optional exam title and private note, correct/wrong/unanswered counts and net scores; personal study-time insights; categories, daily goal, normal and mock exam points and separate sand balances, streak, target category and league information; unlocked characters; friend code, connections, requests and block list; social visibility preference.	Recording sessions; calculating points, sand grains, streaks and league results on the server; providing reports; running social features such as friends and rankings; syncing your data across your devices.	Establishment and performance of a contract (Art. 5/2-c).
Onboarding information	Your birth year; study target (LGS, YKS, TUS, DUS, KPSS, language, university, or work and personal growth); the time zone used to calculate your study day.	Enforcing the minimum age of 13; suggesting suitable study categories; assigning daily and weekly statistics to the right day.	Establishment and performance of a contract (Art. 5/2-c).
Transaction security	A one-way hash of your password; session information; server access logs (such as IP address and request time); App version, device model, operating system and version; error and crash reports; sampled performance measurements.	Keeping accounts and systems secure; preventing point inflation and cheating; detecting and fixing errors.	Legitimate interest (Art. 5/2-f).
Legal transactions	The version of the Terms of Use you accepted at sign-up, the version of the Privacy Policy and this notice you confirmed reading, the time of acceptance and your commercial electronic message preference; in-app user reports (account IDs, screen, reason, details, the target's display name and relevant content, submission and handling time); correspondence about user reports and rights applications.	Recording that the contract was established and that the obligation to inform was fulfilled; enforcing the Terms of Use; reviewing and resolving reports and applications.	Establishment and performance of a contract (Art. 5/2-c); legal obligation (Art. 5/2-ç); legitimate interest (Art. 5/2-f).
Marketing	Your newsletter (commercial electronic message) preference and the related email address; the email address you entered in the waitlist on the Site, your consent to commercial electronic messages, the consent text version and the time of consent.	If you consented, sending product updates and announcements; if you are on the waitlist, letting you know when the App launches.	Your explicit consent (Art. 5/1) and your approval under Turkish Law No. 6563 on electronic commerce.

We rely on your explicit consent only for commercial electronic messages (the newsletter and the launch announcement sent to the waitlist). This consent is optional; not giving it does not affect your use of the App in any way. You can withdraw it at any time using the unsubscribe link in every newsletter email or by writing to destek@pomosprint.app. Withdrawal does not affect processing carried out before it.

4. Data That Stays on Your Device

The following is kept only on your device, is not sent to our servers and is not processed by us:

Your notification, language and theme preferences,
The list of users you hid with "Hide user",
The countdown notification shown on the Android lock screen while a session is running, and the Live Activity shown on the iPhone lock screen and in the Dynamic Island; both are generated entirely on your device,
Session end notifications, which are scheduled on your device.

5. Method of Collection

Your personal data is collected electronically, by fully or partly automated means, through forms in the App and on the Site (sign-up, onboarding, profile, waitlist), the Sign in with Google and Sign in with Apple providers, records created automatically while you use the App (session, sign-in and error records) and the emails you send us. It is collected on the legal grounds listed in Section 2.

6. Transfers of Personal Data

We do not sell, rent or share your personal data for advertising. Your data is transferred only in the following cases and only as far as the service requires:

Within Türkiye

Upon request and only to the extent required by law, to legally authorized public authorities and judicial authorities (KVKK Art. 8, Art. 5/2-ç).

Abroad (service providers)

Supabase — database, authentication and server functions. Your account and study data and waitlist entries are hosted in the European Union (Stockholm, Sweden).
Sentry — error and crash reports (technical data; email addresses are masked before they are added to reports).
Resend — sending transactional emails and the newsletter (email address).
Cloudflare — hosting and content delivery for the Site (including its fonts and animation library); forwarding emails sent to destek@pomosprint.app.
Google and Apple — authentication if you choose Sign in with Google or Sign in with Apple. In addition, emails you send to destek@pomosprint.app are forwarded to our support inbox hosted on Google's email service.

These providers process your data only to provide services to us and, due to the nature of their infrastructure, may process it in other countries, including the United States. These transfers outside Türkiye are made in line with the procedures set out in Article 9 of the KVKK and with appropriate safeguards.

7. Retention Periods

Your account and all data linked to it (identity, contact, customer transactions, onboarding information, consent records): for as long as your account is active. When you delete your account, it is permanently deleted within a reasonable period (no later than 30 days). See Delete Your Account for the steps.
Error reports and server access logs: deleted automatically when the provider's retention period ends.
Newsletter subscription: until you unsubscribe, ask us to delete it or delete your account.
Waitlist entry: until you ask us to delete it; it is used only to let you know when the App launches.
In-app user reports: the link to the reporter or target account is removed when that account is deleted; details, the name and relevant content at the time of the report, and the handling outcome may be kept to resolve the report. You can contact support to request deletion.
Support, report and application correspondence: for as long as needed to resolve your request; you can ask us to delete it from the same address.

8. Your Rights Under Article 11 of the KVKK

By applying to the data controller, you have the right to:

Learn whether your personal data is processed,
Request information about it if it has been processed,
Learn the purpose of processing and whether it is used in line with that purpose,
Know the third parties in Türkiye or abroad to whom it is transferred,
Request correction if it is incomplete or inaccurate,
Request its deletion or destruction under the conditions in Article 7 of the KVKK,
Request that third parties to whom it was transferred be notified of the correction, deletion or destruction,
Object to a result against you that arises from analysis of your data exclusively by automated systems,
Claim compensation for damage you suffer due to unlawful processing.

9. How to Apply

In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send requests about your rights from the email address registered in our system to destek@pomosprint.app. If you prefer another method listed in the Communiqué (in writing, by registered electronic mail (KEP), secure electronic signature or mobile signature), the necessary address details will be sent to you by email on request.

Under the Communiqué, your application should include your name and surname; your Turkish ID number if you are a citizen of Türkiye, or otherwise your nationality and passport or ID number; your residential or business address for notifications; your email address and phone number for notifications, if any; and the subject of your request. For applications sent from your registered email address, we verify your identity through that address.

Your application is resolved as soon as possible depending on its nature, and within 30 days at the latest. It is free of charge as a rule; however, if the process requires an additional cost, the fee set by the Personal Data Protection Board's tariff may be charged. If your application is rejected, you find the answer insufficient, or it is not answered in time, you may file a complaint with the Board within 30 days of learning the answer and in any case within 60 days of the application date (KVKK Art. 14).

10. Changes

We may update this notice as our processing activities or the law change. The current version is published on this page and the "Last updated" date is renewed.

Please also read our Privacy Policy, Terms of Use and Delete Your Account page.