Privacy Policy

01. Who we are

We are a mobile app development and publishing company based in Izmir, Türkiye. We design, build and operate our own applications for iOS and Android, and we run this website.

For the purposes of the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK), the data controller is ABONELİK BİLİŞİM HİZMETLERİ SANAYİ İÇ VE DIŞ TİCARET ANONİM ŞİRKETİ, registered at Meriç Mah. 5747/13 Sk. No: 7 İç Kapı No: 1, MTK Sitesi, Bornova, 35090 İzmir, Türkiye. You can reach us at [email protected].

02. What this policy covers

This policy applies to this website and to the mobile applications we publish under our own developer accounts on the App Store and Google Play.

Individual apps may have additional, app-specific privacy notices where they process categories of data this document does not describe in enough detail — for example health or location data. Where an app-specific notice exists, it is linked from that app's store listing and from inside the app, it is listed in our Legal Center, and it prevails over this document for that app.

These notices exist today:

• Miracle: Baby Photo Editor — Privacy Policy and Terms of Use. Miracle sends a photograph to an AI provider when you ask for a portrait, and holds a child's name and date of birth on the device. Both deserve more detail than a company-wide document can give.

This policy does not cover third-party services you reach from our apps or website, including the app stores themselves. Those services have their own policies.

03. Personal data we collect

Data you give us

• Contact data — your name, email address and the contents of your message when you write to us, apply for a role, or contact support.
• Account data — only if you choose to create an account: an email address, or a name if you decide to give one. Nothing forces you to; apps that can run without an account do.
• Password — where you set one, we store it only as a salted, one-way hash. It cannot be reversed back into your password, and nobody at this company can read it. If you forget it, we can reset it, never recover it.
• Images or text you submit to an AI feature — in apps that offer AI-generated results, the specific file or prompt you submit at the moment you ask for something to be made. It is transmitted, processed and returned. We do not keep a copy, and it is never used to train an AI model. Section 05 is the full account.
• Information you enter about another person — some apps let you set up a profile for someone in your care, a child for example, with a first name, a date of birth or similar details. Where an app does that, the details are written to your own device and are not sent to us. See section 13.

What we deliberately do not store

Beyond the email address or name you volunteer and that password hash, we keep no personal data of yours on our own systems. Specifically, we do not store:

• photos, videos or any other media you open, import or edit in an app. In most of our apps the editing happens entirely on your device and the files never reach us at all. There is one exception, and we would rather name it than bury it: where an app offers an AI-generated result, the file you submit is sent to us and on to an AI provider at the moment you ask for it. It is processed and returned, and no copy is kept afterwards — not by us and, under our agreements, not by the provider. Section 05 sets out exactly what is sent, to whom, and what happens to it;
• the content you create in an app — entries, notes, goals, preferences and history stay in local storage on your device, unless you deliberately export them yourself;
• your password in readable form, as explained above;
• payment details — card numbers and bank data never reach us at all (section 06).

This applies to data held by us. The pseudonymous identifiers and event data that analytics and advertising SDKs collect are a separate matter — those are described in sections 07 and 09, and that data sits with the provider concerned, not in a profile we keep about you.

Data collected automatically

• Device and technical data — device model, operating system version, language, region, app version, and a pseudonymous installation identifier generated by the app or the platform.
• Usage data — which screens are opened, which features are used, session length and similar product analytics events, recorded against a pseudonymous identifier rather than your name.
• Diagnostics — crash reports, error traces and performance measurements that tell us an app failed and on which device or OS version.
• Advertising identifier — in apps that show ads, the platform advertising ID (IDFA on iOS, Advertising ID on Android), but only while you have given permission for it. See section 07.
• Website data — IP address, request time, referring page and browser type, plus any cookies described in our Cookie Policy.

Data we receive from others

• Subscription status from Apple and Google: whether a purchase, renewal, refund or cancellation occurred, and for which product — but not your payment card details.
• Aggregate store reporting — download, rating and review statistics provided to us as a developer, generally in aggregated form.

We do not buy personal data from data brokers and we do not sell personal data. We never use special categories of data — health, beliefs, biometrics — for advertising. Where our free apps show ads, the advertising network involved is named in section 07 and may profile ad audiences on its own side; we explain that there rather than claiming otherwise here.

04. How and why we use personal data

We only process personal data where we have a legal basis to do so. The table below sets out our purposes and the basis we rely on under the GDPR; the corresponding grounds under KVKK Article 5 are noted in square brackets.

Where we rely on consent — for example for advertising identifiers or optional analytics — you can withdraw it at any time, without affecting processing carried out before the withdrawal.

05. AI features, images and your photo library

Some of our apps produce a result using an AI model — a portrait made from a photograph, a generated image, a written suggestion. This is the one place in our apps where a file you chose leaves your device, so it gets its own section rather than a line in a table.

Apps without an AI feature send nothing described here. If you are not sure whether the app you are using has one, the consent screen described below is the answer: you will have seen it, or there is nothing to see.

What is sent, and when

A file is sent at one moment only: when you tap to generate something from it. Nothing is uploaded in the background, nothing is uploaded while you browse, and choosing a photo is not the same as submitting it.

What travels with the request:

• the file itself — the specific photograph or text you submitted, over an encrypted connection;
• the style or theme you picked, and the technical parameters the transformation needs;
• nothing else. Not your name, not an email address, not a date of birth, not the details of anyone whose profile you set up in the app.

We ask before the first file is sent

The first time you request something that needs AI processing, the app tells you what will be sent and to whom, and asks you to agree. If you decline, no file leaves your device and that feature stops there — the rest of the app keeps working. You can change your answer at any time in the app's settings, and withdrawing consent stops any further transmission.

The providers

We use more than one AI provider so the feature keeps working when one is unavailable, which means the provider handling a particular request may change. These are all of them:

Each acts as our processor under a data processing agreement. Under those terms the file is used only to produce your result, is not used to train or improve the provider's models, and is not retained beyond what serving the request and meeting the provider's own short-term abuse-monitoring obligations requires. If we add or change a provider we will update this table and the "last updated" date at the top of this page.

What we do not do with it

• We do not keep it. The file is held in memory for the duration of the request. There is no store of submitted files in our systems, and no way for us to retrieve one after the request completes.
• We do not train on it. Not our own models, and — under the agreements above — not our providers'.
• We do not advertise with it. Submitted files are never sent to an advertising, analytics or attribution provider, and they will not appear in our marketing, our store screenshots or this website. If we ever want to feature something you made, we will ask you about that specific image and you are free to say no.
• We do not review it. Automated safety filters run at the providers. No person here looks at what you make.

The trade-off, stated plainly

Because we keep no copies, the files and the results stay on your device and nowhere else. They do not survive deleting the app, resetting your phone, or moving to a new device. That is a deliberate choice in favour of privacy, and the consequence is real: the only backup is the one you keep yourself, in your own photo library.

Your photo library, and on-device face grouping

An app may ask for access to your photo library so you can pick a file without exporting it first. You can decline and still use the app by choosing photos one at a time, and you can change the permission later in your device settings.

Where an app helps you find photos of a particular person, it does so by reading the "People" groupings your phone has already created — face recognition that Apple or Google performs on the device, as part of the operating system. No face data leaves your device. We do not compute, transmit, receive or store any facial recognition data, face template, faceprint or other biometric identifier, and we hold no biometric data about anyone. We read a grouping the phone made in order to show you a list of photos, on the phone.

06. Subscriptions and payments

Our apps are sold through the App Store and Google Play. All payments are processed by Apple or Google under their own terms and privacy policies.

We never receive or store your full card number, bank details or billing address. What we receive is the subscription state tied to a pseudonymous purchase identifier: which product is active, whether a trial is running, and whether a renewal, cancellation or refund has occurred. We use that to unlock the features you paid for and to keep our revenue records accurate.

07. Advertising in our free apps

Some of our apps are free and funded by advertising. In those apps we use Google AdMob to select and display the ads. Taking out a paid subscription removes the ads, and with them the data collection described in this section.

This entire section does not apply to apps we publish for children. Those apps carry no advertising SDK at all — see section 13.

Personalised and non-personalised ads

AdMob can serve two kinds of ads. Personalised ads use your advertising identifier and previous app or web activity to pick something more relevant; they require your consent. Non-personalised ads are chosen from context — the app you are in, your approximate region, your language — and do not build an interest profile.

If you decline, we do not stop showing ads; we switch to non-personalised ones. The app itself continues to work either way.

How we ask

• In the EEA, the UK and Switzerland we show Google's User Messaging Platform (UMP) consent form the first time you open the app, before any ad request is made. You can reopen it at any time from the app's privacy settings and change your answer.
• On iOS we additionally show Apple's App Tracking Transparency prompt. If you decline there, the advertising identifier is not available to us at all, regardless of your other answers.
• On Android you can delete or disable the advertising ID in Settings → Privacy → Ads, which has the same effect.

Google's own role

For ad serving and measurement Google does not act only on our instructions — it also uses the data for its own purposes, as an independent controller, under the Google privacy policy and the AdMob data disclosures. We have no access to, and no control over, the audience profiles Google builds on its side. What we see are aggregate reports: impressions, clicks and revenue.

We do not show ads to users we know to be children, and we do not run ads inside paid apps.

Advertising our own apps

The reverse direction also involves advertising SDKs. When we run campaigns for our own apps on Google, Meta (Facebook and Instagram) or TikTok, their SDKs are embedded so those platforms can tell which campaign led to an install or a subscription. That is measurement of our own marketing, not selling access to you: the SDKs report install and purchase events against your advertising identifier, and they run only where you have consented.

Each of these platforms is named, with what it receives and why, in section 09.

08. When we share personal data

We share personal data only in the following situations:

• With service providers who process data on our instructions under a written data processing agreement (see the next section).
• With the app stores, to the extent necessary to distribute our apps and operate purchases.
• Where the law requires it — in response to a valid order from a competent authority, or to establish, exercise or defend legal claims.
• In a corporate transaction — if part or all of our business is transferred, personal data may transfer with it, subject to this policy.

We do not sell personal data.

09. Service providers we rely on

We build our apps in-house, but we do not build our own crash reporting, analytics or billing infrastructure — running those badly would put your data at more risk than using established providers who are audited for it. Each provider below is bound by a written data processing agreement, may only use the data to deliver the service we bought, and is listed with the reason we use it.

An individual app may not use every provider on this list. If you want to know exactly which ones a specific app loads, write to us and we will tell you.

In apps we publish for children, the only provider from this table that appears is Firebase Crashlytics, and it runs there under tighter settings. No advertising, analytics or attribution SDK is present in those apps at all — section 13 sets out the regime.

10. International transfers

Some of our providers operate outside Türkiye and outside the European Economic Area. Where personal data is transferred abroad, we rely on an appropriate safeguard: an adequacy decision where one exists, or Standard Contractual Clauses together with any additional measures the transfer requires.

For transfers from Türkiye we act in accordance with Article 9 of the KVKK, including obtaining explicit consent or relying on a commitment approved by the Personal Data Protection Board where applicable.

11. How long we keep data

We keep personal data only for as long as the purpose requires, then delete or anonymise it. As a general rule:

12. Your rights

Depending on where you live, you have the right to:

• learn whether we process your personal data, and request a copy of it;
• have inaccurate or incomplete data corrected;
• have your data deleted where there is no longer a basis to keep it;
• ask us to restrict processing, or object to processing based on legitimate interests;
• receive the data you provided in a portable, machine-readable format;
• withdraw consent at any time where processing is based on consent;
• object to a decision produced solely by automated processing that has a significant effect on you;
• claim compensation for damage caused by unlawful processing.

To exercise any of these, write to [email protected]. We respond within 30 days, free of charge unless a request is manifestly unfounded or excessive. We may ask for information to verify your identity before we act.

Two limits are worth knowing in advance rather than discovering them in a reply from us. A file you submitted to an AI feature cannot be produced or deleted on request, because it was never stored — there is nothing to retrieve and nothing to erase (section 05). The same goes for anything held only on your device: we have no access to it, so we cannot export or delete it on your behalf, but you can do both yourself inside the app.

If our response does not satisfy you, you may complain to the Turkish Personal Data Protection Authority (KVKK) or, in the EEA, to your local supervisory authority.

Deleting your account

Deletion does not require a request to us. In apps that offer accounts it is built into the app — Settings → Account → Delete account — and takes effect immediately. If you cannot sign in, email us and we will do it for you after checking that the account is yours.

What goes: the email address, the name if you gave one, the password hash, profile settings and the link to your subscription state. What stays: accounting records we are legally required to keep, and pseudonymous analytics that were never tied to your name. Deleting your account does not cancel a subscription — that has to be done in your App Store or Google Play account.

The full procedure is on the account deletion page.

13. Children's data

Most of our apps are general-audience products that are not directed at children. Where we publish an app for children — one listed in the App Store Kids Category, or whose primary audience is children — that app runs under a stricter regime than the rest of this policy describes. Where the two conflict, this section wins.

Two different situations get confused with each other, so this section answers both separately: an app made for a child to use, and an app made for an adult in which the adult enters details about a child. The rules are not the same.

What is not in an app made for children

• No third-party advertising. No AdMob, no ad mediation, no ad network SDK of any kind. Section 07 does not apply to these apps.
• No third-party analytics. Google Analytics for Firebase is not used, and analytics data collection is switched off in the build. The one third-party SDK that does remain is crash reporting — described below, with the limits it operates under.
• No attribution or marketing SDKs. No Google Ads, Meta, TikTok, AppsFlyer or Adjust integration — we do not measure campaigns into these apps.
• No advertising identifier. We do not request the IDFA or the Android Advertising ID, we do not show an App Tracking Transparency prompt, and the binary does not link Apple's AdSupport framework at all.
• No accounts, no contact data. These apps do not ask for a name, an email address, a date of birth, a photo or a phone number, and offer no sign-in.
• No location, precise or approximate, and no contact list access.
• No third-party sharing. Nothing to share, because nothing is collected.

What is in them instead

• Content stays on the device. Progress, settings and anything the child creates are written to local storage and never leave the device.
• Crash reporting, and nothing else. Firebase Crashlytics is the single third-party SDK in these apps, and it is there for one reason: to tell us that the app crashed and in which code path, so we can fix it. It does not request the advertising identifier, receives no name, email address, date of birth or any other information identifying the child — none exists in these apps to begin with — and collects no location. What it transmits is a crash stack, the app version, the device model and OS version, and a random installation identifier that is regenerated when the app is deleted.
• Revenue comes from purchases, not attention. These apps are paid, or offer an optional subscription or in-app purchase. Nothing is funded by profiling a child.

Parental gates

Anything that leaves the app or spends money sits behind a parental gate — a check that a young child cannot pass by tapping. That covers in-app purchases and subscription screens, links to this website or to a store listing, any contact or support link, and links to social accounts.

The legal framework we work to

These apps are built to comply with the US Children's Online Privacy Protection Act (COPPA), Article 8 of the GDPR, the corresponding KVKK provisions, Apple's Kids Category rules (App Review Guideline 1.3) and Google Play's Families policy. Because no personal data is collected from the child at all, there is no processing that would require verifiable parental consent — the simplest way to meet the standard is not to collect in the first place.

Guideline 1.3 allows a third-party service in a Kids Category app only where it does not collect or transmit the advertising identifier, information identifying the child, their location or their device. Crash reporting is retained on that basis: it takes no advertising identifier, no identifying information and no location, and the technical details it does send — app version, device model, OS version — exist to reproduce a crash on a class of device, not to recognise a person.

Information you enter about your child

This is a different situation from the one above, and it needs its own answer. Some of our general-audience apps are built for a parent or guardian rather than for a child — a keepsake app, for example. They let you enter a child's first name, date of birth or gender so the app can personalise what it shows you, and they let you work with photographs of that child.

The distinction that matters here is this: you provide information about a child; we do not collect information from a child. Accounts are not offered to children, and nothing in these apps invites a child to enter anything about themselves.

• The child's name, date of birth and gender stay on your device. They are written to the app's own storage on your phone. They are not sent to our servers, and they are never sent to an analytics, advertising or attribution provider.
• Reminders are calculated on your phone. Where an app schedules a birthday or milestone reminder, your device works the date out from what it holds locally and schedules the notification itself. The reminder text — which may include the child's name — is composed on the device and never leaves it. The only push messages sent from our servers are ones that go to everyone, and they contain nothing about your child.
• Photographs of the child are not retained by us. They live on your device. One is transmitted only at the moment you ask for something to be made from it, and no copy is kept — section 05.
• Nothing about the child reaches an AI provider except the photograph itself. No name, no date of birth, no gender, no age, no account identifier.
• You can delete any of it at any time. Deleting a photo in the app deletes it. Deleting a child's profile deletes that profile and its photographs. Deleting the app removes all of it.

By adding a photograph of a child you confirm that you are that child's parent or legal guardian, or that you have the permission of whoever is. These apps are for adults and are not listed in the Kids Category, so the no-SDK regime described earlier in this section does not apply to them: product analytics and marketing measurement work as sections 07 and 09 describe. The carve-out in the list above is the part that does not bend — those providers receive app events, never the child.

If a child uses a general-audience app

Our other apps are not directed at children and we do not knowingly collect personal data from anyone below the minimum age of digital consent that applies where they live. If you are a parent or guardian and believe a child has given us personal data through one of them, write to [email protected] and we will delete it promptly — no account verification loop, no forms.

14. How we protect data

We apply technical and organisational measures appropriate to the risk: encryption in transit and at rest, access limited to the people who need it, separate development and production environments, logging of administrative access, and regular dependency and configuration reviews.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent authority and, where required, you — without undue delay.

15. Changes to this policy

We may update this policy as our apps and our obligations evolve. The "last updated" date at the top always reflects the current version. If a change materially affects how we use your data, we will give notice in the app or by email before it takes effect.

16. Contact

Questions, requests or complaints about this policy can be sent to [email protected], or by post to ABONELİK BİLİŞİM HİZMETLERİ SANAYİ İÇ VE DIŞ TİCARET ANONİM ŞİRKETİ, Meriç Mah. 5747/13 Sk. No: 7 İç Kapı No: 1, MTK Sitesi, Bornova, 35090 İzmir, Türkiye.