Privacy Policy

1. Introduction

This Privacy Policy describes how Emrecan Erbay ("we", "our", or "us"), acting as the data controller, collects, uses, shares, and protects information about users ("you") of the VYK mobile application and related services (collectively, the "Service").

By downloading, accessing, or using VYK, you acknowledge that you have read and understood this Policy. Your use of the Service is also governed by our Terms of Service.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address and authentication credentials when you sign up via email, Apple Sign-In, or Google Sign-In.
• User-Submitted Content: URLs, video links, images, and text you submit for AI processing.
• Generated Content: Guides, notes, edits, and chat messages you create within the Service.
• Customer Support Data: Any information you share when contacting us for support.

2.2 Information Collected Automatically

• Device Identifiers: Unique device ID used for offline sync and account association.
• Crash & Performance Data: Crash logs, error reports, latency, and launch metrics collected via Sentry and Firebase to diagnose issues.
• Product Interaction: Screen views, feature usage, taps, and in-app events for analytics.
• Advertising Identifier (IDFA/GAID): Only collected if you grant permission via the App Tracking Transparency (iOS) prompt. You can revoke this at any time in device Settings.
• Push Tokens: FCM/APNS tokens used to deliver notifications you opt into.

2.3 Information from Third Parties

• Google Sign-In & Apple Sign-In: Name, email, and verified identity.
• RevenueCat: Subscription status, purchase history, entitlements.

3. How We Use Your Information

• To provide, maintain, and improve the Service
• To process video and image content and generate structured guides
• To enable AI chat for follow-up questions about your guides
• To sync your data across devices
• To manage subscriptions and purchases
• To communicate with you about the Service, including support responses
• To detect, prevent, and address technical issues, abuse, or fraud
• To comply with legal obligations

4. Legal Bases for Processing (GDPR)

For users in the European Economic Area, United Kingdom, or Switzerland, we process your data under the following legal bases (GDPR Article 6):

• Contract performance — to deliver the Service you signed up for.
• Consent — for optional features like push notifications or ad tracking (you can withdraw anytime).
• Legitimate interest — to improve and secure the Service (analytics, crash reporting, fraud prevention).
• Legal obligation — where required by applicable law.

5. How We Share Your Information

We do not sell your personal information. We share it only with the following categories of service providers, bound by contractual confidentiality and data-protection obligations:

• Authentication & Infrastructure: Firebase (Google LLC) — auth, crash reporting, push delivery.
• AI Processing: Google (Gemini API) as primary and OpenAI (GPT-4o / GPT-4o Vision) as fallback — for transcription, image analysis, and guide generation. Inputs are not used to train their models under our API agreements.
• Subscription Management: RevenueCat — entitlement tracking and receipt validation.
• Payment Processing: Apple App Store and Google Play Store — we do not receive or store payment card details.
• Error Monitoring: Sentry — backend crash and error telemetry.
• Cloud Hosting: Railway (US) — application hosting and database.
• Email Delivery: GoDaddy / SMTP — for transactional and support emails.

We may also disclose information (a) to comply with law, legal process, or lawful government requests; (b) to enforce our Terms of Service or protect against fraud or harm; (c) in connection with a merger, acquisition, or asset transfer, subject to continuity of this Policy; or (d) with your explicit consent.

6. International Data Transfers

Our service providers (Firebase, OpenAI, Google Gemini, Sentry, Railway, RevenueCat) process data in the United States and other jurisdictions that may have different data-protection standards than your country of residence. For transfers out of the EU/UK, we rely on the European Commission's Standard Contractual Clauses (SCCs). For transfers out of Türkiye, we rely on explicit consent or approved mechanisms under KVKK Article 9, as applicable. By using the Service, you acknowledge these transfers.

7. Data Retention

• Account & guide content: retained while your account is active; deleted within 30 days after account deletion.
• Crash & analytics logs: retained up to 90 days.
• Subscription & billing records: retained up to 10 years for legal and tax compliance.
• Support correspondence: retained up to 2 years after resolution.

You can delete your account and associated content at any time from the app settings. Backup copies may persist for up to 30 additional days before permanent deletion.

8. Data Security

We implement industry-standard safeguards including TLS/SSL encryption in transit, encryption at rest for databases and backups, access controls with least-privilege principles, and PII scrubbing in crash reports. No electronic transmission is 100% secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

9. Data Breach Notification

In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify the relevant supervisory authority (e.g., KVKK Kurumu) within 72 hours of becoming aware, and notify affected users without undue delay, as required by GDPR Article 33 and equivalent laws.

10. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data, subject to legal retention obligations.
• Restriction — limit how we process your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest or for direct marketing.
• Withdraw consent — at any time, without affecting the lawfulness of prior processing.
• Complaint — lodge a complaint with a supervisory authority (e.g., Turkish KVKK Kurumu at kvkk.gov.tr, or your local EU Data Protection Authority).

To exercise any of these rights, email us at hello@vyk.app. We may need to verify your identity before responding and will respond within 30 days.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the CCPA/CPRA: the right to know the categories of personal information we collect, disclose, or share; the right to delete; the right to correct; the right to opt out of the sale or sharing of personal information; and the right to limit use of sensitive personal information. We do not sell or share your personal information for cross-context behavioral advertising. We will not discriminate against you for exercising any of these rights.

To exercise these rights, contact us at hello@vyk.app.

12. Automated Decision-Making & AI

VYK uses AI (Google Gemini and OpenAI GPT-4o) to transform user-submitted content into structured guides. These systems generate content only — they do not make decisions that produce legal or similarly significant effects on you within the meaning of GDPR Article 22. Under our API agreements, your inputs are not used to train the underlying AI models.

13. Tracking Technologies & Identifiers

We use SDKs and device identifiers for essential operations, analytics, crash reporting, and (where permitted) attribution:

• App Tracking Transparency (iOS): On iOS, we request permission via the ATT prompt before accessing the IDFA. You can change your choice anytime in Settings › Privacy & Security › Tracking.
• Advertising ID (Android): You can reset or opt out of personalized advertising in Settings › Privacy › Ads.
• Analytics & Crash SDKs: Firebase and Sentry help us understand usage and diagnose errors.

14. Children's Privacy

VYK is not directed to children under 13 (United States, per COPPA) or under 16 (European Economic Area, unless local law permits a lower age). We do not knowingly collect personal information from children below the applicable age. If you believe a child has provided us personal data without parental consent, contact hello@vyk.app and we will promptly delete it. The App Store 4+ age rating refers to content suitability, not the legal consent age for data processing.

15. KVKK Notice (Türkiye)

Türkiye'de ikamet eden kullanıcılar için: Kişisel verileriniz 6698 sayılı Kişisel Verilerin Korunması Kanunu (KVKK) kapsamında, bu Politikada belirtilen amaçlarla, Madde 5 ve 6'daki hukuki sebeplere dayanarak işlenmektedir. Uygulama üzerinden elektronik ortamda toplanan verileriniz, hizmet sağlayıcılarımız aracılığıyla yurt dışına aktarılabilir (bkz. Bölüm 6). KVKK Madde 11 kapsamındaki haklarınızı kullanmak için hello@vyk.app adresine yazabilir, cevaptan memnun kalmazsanız Kişisel Verileri Koruma Kurumu'na (kvkk.gov.tr) başvurabilirsiniz.

16. Third-Party Links

The Service may contain links to third-party websites or services that we do not operate. This Policy does not apply to those services. We encourage you to review their privacy policies before providing any information. We are not responsible for the privacy practices of third parties.

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and notify you via the app or email, where appropriate. Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

18. Contact Us

For any questions, requests, or concerns about this Policy or your data: