Privacy Notice (KVKK)

1. Data Controller

In accordance with the Turkish Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR), this notice explains how your personal data is collected, processed, and protected by Futy Tech LTD as the data controller.

2. Categories of Processed Data

• Identity data: Full name, email address
• Account data: Authentication provider, subscription tier
• Agenda data: Tasks, notes, descriptions, tags, priorities
• Health & wellness data: Water intake, meal plans, exercise logs, dietary preferences (height, weight, age)
• Habit tracking data: Daily habit completions and streaks
• File attachments: Documents and images uploaded to tasks
• Device data: Browser type, IP address (for country detection), timezone
• Usage data: Feature usage patterns for service improvement
• Communication data: WhatsApp number (if verified), email for reminders
• Payment data: Processed securely through Stripe (we do not store card details)

3. Purpose of Processing

Your personal data is processed for the following purposes:

• Providing and maintaining the OwnToday service
• User authentication and account management
• Personalizing your experience (locale, timezone, dietary preferences)
• AI-powered features (task suggestions, daily briefs, meal planning)
• Sending reminders via email and WhatsApp
• Processing subscription payments through Stripe
• Service analytics and improvement
• Legal compliance and dispute resolution

4. Legal Basis for Processing

We process your data based on: (a) your explicit consent when you create an account, (b) performance of our contract with you (Terms of Use), (c) our legitimate interests in operating and improving the Service, and (d) compliance with legal obligations.

5. Data Sharing & Transfers

Your data may be shared with the following categories of recipients, solely for the purposes stated above:

• Supabase (database hosting and authentication) — EU/US
• OpenAI (AI features processing) — US
• Stripe (payment processing) — US/EU
• Vercel (application hosting) — Global CDN
• Resend (email delivery) — US

6. Data Retention

Your personal data is retained for as long as your account is active. Upon account deletion, all personal data is permanently removed within 30 days, except where retention is required by applicable law (e.g., financial records for tax purposes may be retained for up to 5 years).

7. Data Security

Your personal data is protected with industry-standard security measures including SSL/TLS encryption for data in transit, encrypted database storage, Row Level Security (RLS) policies ensuring users can only access their own data, and regular security audits. We use Supabase's enterprise-grade infrastructure for data storage and authentication.

8. Your Rights

Under KVKK and GDPR, you have the following rights regarding your personal data:

• Right to know whether your personal data is being processed
• Right to request information about the purpose and use of processing
• Right to know the third parties to whom your data is transferred
• Right to request correction of incomplete or inaccurate data
• Right to request deletion or destruction of your data
• Right to object to processing that produces results against you
• Right to request compensation for damages arising from unlawful processing
• Right to data portability (receive your data in a structured format)

9. Cookies & Local Storage

OwnToday uses essential cookies for authentication, locale preference (NEXT_LOCALE), and country detection (COUNTRY). We do not use tracking cookies or third-party advertising cookies. You can manage cookie preferences through your browser settings.

10. Children's Privacy

OwnToday is not intended for children under 13 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

11. Contact & Data Protection