CheckMyBio Privacy Notice under the Turkish Personal Data Protection Law (KVKK)

Last updated: 18 October 2026

This notice is given under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK"). It explains how personal data is processed through the CheckMyBio app, the checkmybio.app website and the public pages on it ("CheckMyBio"). The Turkish version of this notice prevails where the two versions differ. Our Privacy Policy gives the same information for users in all countries.

1. Data controller

The data controller is Mert Can Taş, who runs CheckMyBio as an individual and offers it on the App Store and Google Play.

• Postal address for applications: Yenimahalle, Ankara, Türkiye
• E-mail: [email protected] (applications can also be sent here, see section 7)

2. Who this notice covers

• Account holders: people who create a CheckMyBio account and page.
• Visitors: people who open a CheckMyBio page, tap, copy or share an item on it, or use its order form.
• Reporters: people who report a page without an account.
• People who contact support: people who write to [email protected].
• People named on an account holder's page: for example the account-holder name of an IBAN an owner publishes. The account holder adds and publishes this data (see section 3.2).

3. Personal data, purposes and legal bases

The legal bases are the conditions of KVKK Article 5(2). No processing relies on explicit consent.

3.1 Creating your account, logging in and keeping it secure

• Data: e-mail address; an irreversible hash of your password (the password itself is never stored); language; your device's time zone; profile type and onboarding steps; a keyed hash of one-time verification codes and the number of attempts; session records (which surface, when created, last used and expiring); the versions of the terms and privacy texts you accepted and when; a moderation state with a reason category, if one applies. No IP address and no device or browser details are stored with login sessions.
• Purposes: to create your account and verify your e-mail; to let you log in; to run password reset, e-mail change and account restore; to protect your account against unauthorised access (attempt limits, locks).
• Legal bases: establishing and performing the contract (Art. 5(2)(c)); legitimate interest in the security of the account and the service (Art. 5(2)(f)).

3.2 Building and publishing your page

• Data: username, title, bio, profile photo, theme and appearance settings; links (with an optional "Sponsored" label and schedule) and social accounts; the WhatsApp phone number and prefilled text of a message button; shop info (address, map link, phone, opening hours); payment info (IBAN and account-holder name, or a payment link, with a note); catalogue cards and products (name, description, price, variants, photo); settings of Plus features; the stable code of your page's QR code. Uploaded photos are re-encoded and no metadata (EXIF), including location, is kept.
• Purposes: to let you edit and publish your page and to show it publicly; to keep printed QR codes and your old username leading to your page for a period after a change.
• Legal bases: performance of the contract (Art. 5(2)(c)); for content you publish, also data made public by the data subject (Art. 5(2)(d)).
• Important: once published, your page is public. Before you add data about other people (for example an IBAN or phone number registered to someone else), it is your responsibility to have the right to do so, to inform them and, where needed, to get their permission. For such data the account holder is responsible to those people.
• "About this page" panel (applies once the panel is enabled): a published page also shows visitors the month and year it was first published (never the day or the time); for 30 days after its address (username) changes, a note that the address changed recently, without the old address and without the date; and the list of sites its visible links lead to, as domain names only, never full web addresses. The month of first publication stays the same when the username changes, so someone who knew the page under its old address may recognise it under the new one. Purpose: to help visitors judge a page. Legal basis: legitimate interest (Art. 5(2)(f)).

3.3 Plus subscription and Plus periods granted by an admin

• Data: your subscription status (the store: App Store or Google Play; monthly or yearly product, trial or paid period, when access ends, whether it renews, a grace period, a billing issue, a refund time, a test (sandbox) or real purchase); for free Plus periods granted by an admin: start, end, the admin's reason and revocation details.
• Purposes: to unlock or lock Plus features; to show your plan status; to verify purchases and restores; to run and record Plus periods granted by admins.
• Legal bases: performance of the contract (Art. 5(2)(c)); legitimate interest in recording admin actions (Art. 5(2)(f)).
• Payment: Apple takes the payment in the iOS app; Google takes it in Google Play in the Android app. Your card, Apple ID and Google account details are not passed to us. We learn your subscription status from Apple or Google through RevenueCat. We never send your e-mail address or name to RevenueCat; it knows your account by a random id. RevenueCat receives that random id, your purchase history and the App Store's or Google Play's transaction data, and, from RevenueCat's software in the app, data about your device, operating system, app version and store country (storefront) together with your IP address (see section 5.2).

3.4 Visitor statistics (analytics shown to account holders)

• Stored: which page or item was viewed, tapped, copied or shared and when (rounded to the hour); the kind of source of the visit (for example Instagram, QR code, direct); the device class (mobile, tablet, desktop). The country and city fields are empty today. No IP address, browser details, referring address or cookie id is stored.
• City statistics (applies once city statistics are switched on): the country and city are taken from the location estimate that Cloudflare attaches to each request based on the IP address; only the country and city codes are stored, never the IP address.
• Processed in memory only, never stored: your IP address and browser details are combined, for a moment, with a random key that changes every night, so that one visit counts once in 30 minutes, robots are filtered out and excessive requests are limited; no result of this is recorded.
• Purpose: to show account holders, as aggregate numbers, how often their page is viewed and which items are used. Account holders never see data about an individual visitor.
• Controller: we are the data controller for these statistics.
• Legal basis: legitimate interest (Art. 5(2)(f)).

3.5 Order form (applies once the order form feature is enabled)

• What happens: if you use the order form on a page, the products, quantities, name and note you enter are kept only in that browser tab (session storage); they are deleted when you close the tab and are never sent to us. Sending the order opens WhatsApp with a prepared message, which goes from you to the page owner through WhatsApp; we do not receive it.
• What we process: only that the page's WhatsApp button was used, counted as in section 3.4, under the same legal basis.

3.6 Internal measurements to improve the product

• Data: some actions an account holder takes in the product (for example account created, onboarding steps, page first published, page edited, statistics viewed, a plan limit reached, a link refused by the blocklist, the Plus screen viewed, a trial started, the answer when the app offers notifications, a notification opened), with the account id, the surface used and small coded values. They contain no free text, e-mail, username, link, IP address or device id.
• Purpose: to measure which features are used and to improve the product. This data is not used for advertising and not shared with anyone.
• Legal basis: legitimate interest (Art. 5(2)(f)).

3.7 Reports, moderation, security and legal duties

• Data: the reported page and part (with its title and the web addresses it pointed to at that moment), the reason and details, the reporter's optional e-mail address; moderation decisions and admin action records (the admin, the action, the target account, the reason, the time); blocked domains; server logs (error and security logs without IP addresses; we do not log e-mail addresses; some lines contain an account id). Cloudflare keeps sampled records of security events, including IP addresses, which we can see in its dashboard; our servers use IP addresses briefly in memory to limit repeated requests (for example log-in attempts) and do not store them.
• Traffic records under Law No. 5651: as a hosting provider we may be required to keep traffic records of the requests to our sites (such as IP address, time and requested address) and to give them to authorised authorities on request. We do not keep such records today; if we start, we will keep them separately, only for this legal duty and only for the legal period, and update this notice first.
• Purposes: to review and prevent abuse such as fraud, illegal betting, impersonation, hate, adult content and spam; to tell a reporter the outcome; to keep the service running and secure; to meet our duties as a hosting provider; to answer legal claims.
• Legal bases: legitimate interest (Art. 5(2)(f)); establishing, exercising or protecting a right (Art. 5(2)(e)); being expressly provided for by law and compliance with a legal obligation (Art. 5(2)(a) and (ç)), in particular under Law No. 5651.
• Automatic check: when an account holder saves a link, an address on our safety blocklist is refused automatically. Moderation decisions are always taken by a person.

3.8 E-mails and support requests

• Data: your e-mail address and the content of the e-mails we send (verification codes, account and security notices, deletion confirmation, moderation notices, report outcome, Plus period granted or revoked); e-mails you send to support and our answers. We send no marketing e-mail.
• Purposes: to send necessary notices about your account; to answer your questions and your KVKK applications.
• Legal bases: performance of the contract (Art. 5(2)(c)); legal obligation (Art. 5(2)(ç), applications under KVKK Art. 13).

3.9 Cookies and device storage

No cookie or browser storage is used for visitor statistics. The web panel uses a session cookie to keep you logged in; the admin area uses its own session cookie and a Cloudflare access cookie, for admins only. A language cookie remembers your choice for one year when you pick a language on a page. Cloudflare may set a short-lived security cookie when it has to check whether a request comes from a person. The web panel keeps unsent form input in the browser tab if your session expires, and the order form keeps your order in the tab. The app keeps your login token in the device's secure storage, and your language choice and recently loaded screens on the device. For notifications (section 3.10) it keeps on the device whether notifications were turned on in the app on that phone, when you last chose "Not now" and the random installation id of the notification software; after a log-out while offline it keeps the old login token in secure storage until the log-out reaches our servers. From the app version that records app activity (section 3.11), the app keeps the records not yet sent in a file on the phone, separately for each account: at most 1,000 records and at most 72 hours; at log-out it tries once to send them and then deletes the file, and when an account logs in, the files of other accounts on that phone are deleted. Apart from these app activity records, everything listed here is needed for a service you asked for; no advertising or analytics cookie is used.

3.10 Push notifications

Notifications in the iOS and Android apps are on or off per phone. The app asks for the phone's permission only when you choose to turn them on. It offers them after you first publish your page or, once, when you open Analytics if your page is already published; if you choose "Not now", it offers them once more on Analytics after at least 14 days. You can also turn them on at any time under Account, with "Turn on notifications". It never asks at first launch or sign-up. Once a phone has notifications for CheckMyBio turned on, every account that logs in on it receives them there, without being asked again; an account that has never had notifications starts with all three kinds switched on and can switch each kind off at any time. The app works the same without notifications. The web panel sends none.

• Data: for each phone that receives notifications for your account: a push address (a key that Expo issues for the app on that phone), the platform (iOS or Android), the app version, when it was registered and last refreshed, and the login session it belongs to; for your account: the switches "Order clicks", "Weekly summary" and "News from CheckMyBio" and when each kind was last handled (sent or skipped). The notification software in the app sends Expo the address Apple or Google issued for your phone, a random installation id and the app's identifiers when the app gets a push address; in the Android app, Google's Firebase Cloud Messaging software creates an installation id for the app and sends it to Google with the app version and technical details such as the Android version and phone model; Google also counts deliveries as aggregated statistics. We do not use this software for advertising or to analyse how you use the app. Each notification contains only a count (clicks on your order and message buttons in the last 24 hours, or last week's views and clicks) or the text of our news; never details about visitors, amounts, payment details or page content, and never offers or advertising.
• Purposes: to send the kinds of notification that are switched on to the phones on which notifications are turned on, at most one order-click note a day, one weekly summary a week and one news item a week, never between 21:30 and 09:00 in your account's time zone (the only exception is a test of our news that an admin sends to their own phones); to deliver them through Expo, Google and Apple; to keep each phone's push address valid and to stop notifications on log-out.
• Legal bases: performance of the contract (Art. 5(2)(c)); for news about CheckMyBio also legitimate interest in informing you about the service (Art. 5(2)(f)).
• Turning them off: in the app under Account, Notifications, for each kind (the switches apply to all your phones), or in your phone's settings. Logging out stops notifications on that phone (after a log-out while offline, once the app is online again). Turning them off changes nothing else in the app.

3.11 App activity in the iOS and Android apps (applies from the first app version that records it)

• Data: while you are logged in to the iOS or Android app, the app records: when it is opened (from its icon, a notification or a link, without the link itself), when you return to it and when it leaves the screen; each screen shown, including each onboarding step, each sheet or dialog that opens and the Plus screen (with where it was opened from); each completed tap on a button, list row, tab, switch (with its new state, on or off), checkbox or menu item, and for some of them the option chosen from a fixed list (for example the type of block added); and opening a notification (which kind). Each record holds your account, a random id of the period of use it belongs to (a session; created on the phone, not derived from the phone or your account, never reused), its place in that session, what happened, the names of the screen and button from our fixed list, the app version, the platform (iOS or Android), the time on the phone and the time our servers received it.
• Never recorded: anything you type (not even its length); links or any web address; page content (such as titles, bio, product names, prices, IBANs, phone numbers or social media handles); which of your blocks, cards, links or products you tapped; your e-mail address, username or name; your push address; your IP address (our servers use it briefly to limit requests and never store it with these records); an advertising id or any other id of your phone; the phone model or operating system version; location, contacts, photos or clipboard; screenshots or screen recordings; where you touch the screen, how you scroll or how you type. Nothing is recorded before log-in or sign-up, after log-out, in the web panel or in the admin area.
• Purposes: to help you when you contact support (for example when a button seems to do nothing); to look into abuse or security problems on an account; to understand and improve how the app is used.
• Who can see it: only our admins, in the admin area and one account at a time. An admin has to give a reason each time (support request, abuse or security, or product research), and every view is recorded with the admin, the time and the reason in the admin action records (section 3.7). Admins cannot download it. It is recorded by our own code in the app, goes only to our servers and is stored by our hosting providers on our behalf (section 5.2). It is not used for advertising, not sold and not combined with data from other companies.
• Legal basis: legitimate interest in supporting account holders, keeping the service secure and improving it (Art. 5(2)(f)). We have weighed this interest against your rights: no typed text or page content is recorded, recording happens only while you are logged in to the app, records are kept for 180 days, admins see them only with a reason and every view is recorded, and recording stops and the records are deleted if you object.
• Retention: at most 180 days after the event; earlier if you object, and with the account (section 6).
• Objection: write to [email protected] from the e-mail address of your account. We then switch app activity off for your account: the records we hold are deleted, we store no new ones and the app stops sending them. Deleted records stay in our database backups for up to 7 days. There is no switch for this in the app.

4. How the data is collected

Personal data is collected electronically:

• from what you enter in the CheckMyBio app and web panel;
• automatically from the iOS and Android apps while you are logged in, for app activity (section 3.11);
• from the requests that reach our servers when public pages are visited (automatically);
• from the public report form and from support e-mails;
• from Apple, Google and RevenueCat, for your subscription status;
• from the notification software in the app and from Expo, Google and Apple, when the app gets a push address and delivers notifications (section 3.10).

5. Transfers

5.1 Within Türkiye

Your personal data is not sold and not shared with anyone for advertising. It may be disclosed to authorised public bodies and courts only when the law requires it and only to the extent requested (Art. 8, Art. 5(2)(ç)). If CheckMyBio is taken over by a company, the data is transferred to it; we will tell you in advance.

5.2 Abroad

We use the service providers below to run CheckMyBio. Railway, Neon, Cloudflare, Resend, Expo and Google for Firebase Cloud Messaging process data on our behalf and on our instructions. Apple, Google as the Play store, and RevenueCat are in a different position, explained below the table. All of them are outside Türkiye, so your data is transferred abroad.

Recipients abroad: the table above shows each recipient, the data it receives, where the data is and the company's country: Railway, Neon, Cloudflare, Resend, the e-mail provider of our support mailbox, Apple, Google, RevenueCat and, for notifications, Expo, Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service). Apple and Google receive your Apple ID or Google account and payment data directly from you, under their own terms.

Transfer to RevenueCat: your purchase data (listed in the table above) is transferred to RevenueCat, Inc. in the United States. The project is held in a RevenueCat account that belongs to a third person, not to us, and RevenueCat's data processing terms apply with that person, not with us.

A note on Apple: Apple sells the Plus subscription in the App Store and takes the payment under its own terms and privacy policy, as an independent company, not on our instructions. Your Apple ID and payment data stay with Apple.

A note on Google: Google sells the Plus subscription in Google Play on our behalf and takes the payment under Google Play's terms and Google's privacy policy. Google handles your Google account and payment data as an independent company, not on our instructions; that data stays with Google. Google Play passes the order data of your subscription to RevenueCat so that it can verify the purchase.

A note on RevenueCat: RevenueCat processes the data in the table for us as a service provider (a processor). The subscription system runs in a separate project that is held permanently in a RevenueCat account belonging to a third person, not to us. That person controls the project and can view and export the data RevenueCat holds about your purchases (listed in the table above). RevenueCat's data processing terms are agreed with that account owner, not with us. Your e-mail address and name are never sent to RevenueCat. When your account is permanently deleted, the data at RevenueCat is not deleted automatically; write to us and we will have it deleted (see section 6).

A note on notifications: Expo and Google (for Firebase Cloud Messaging) process the data in their rows on our behalf as service providers. Apple delivers notifications to iPhones through its own push notification service, which is part of iOS. Expo does not store the text of notifications. None of them receives your e-mail address, name, account id or page content from us.

6. Retention

At the end of these periods personal data is deleted or anonymised.

What remains after deletion. When an account is permanently deleted, the following still exist for the periods shown:

• Database backups: the data stays in our database backups for up to 7 days after the deletion.
• Server logs: log lines that contain the account id stay for up to 30 days.
• E-mail delivery data: our e-mail provider (Resend) keeps the e-mails we sent and their delivery data for 30 days.
• Admin action records: records of admin actions are kept, because they show who did what and why. They keep the internal id of the account or page concerned and the admin's reason. The account of a person who acted as an admin is pseudonymised instead of deleted: the e-mail address, password, sessions and profile data are removed, and an internal record without them is kept so that these records stay valid.
• Username: the name alone stays blocked for 30 days so that nobody else can take it at once.
• QR code: the code alone stays reserved, with no link to the person or the page, so that it is never given to someone else.
• Purchase history at RevenueCat: the data listed in section 5.2 stays at RevenueCat, where the RevenueCat account owner can still view and export it; we have it deleted when you write to us.
• Browser caches: photos may stay in the browser caches of people who visited the page for up to one year. We cannot delete them there.
• Firebase installation id (Android app): the installation id that Google's notification software created for the app on the phone stays at Google until it is deleted through Firebase. It contains no account details.

7. Your rights under KVKK Article 11

You can apply to us to:

a) learn whether your personal data is processed,
b) request information if it is,
c) learn the purpose of processing and whether data is used for that purpose,
ç) know the third parties in Türkiye or abroad to whom it is transferred,
d) ask for correction if it is incomplete or inaccurate,
e) ask for deletion or destruction under the conditions of KVKK Article 7,
f) ask that the actions under (d) and (e) be notified to the third parties to whom the data was transferred,
g) object to a result against you that arises from analysis exclusively by automated systems,
ğ) claim compensation for damage caused by unlawful processing.

In the app: in account settings you can correct your e-mail address and your page, delete your account, and switch each kind of notification on or off (Account, Notifications). For a copy of your data, write to [email protected] from the e-mail address of your account; the copy covers your account, page and statistics, your notification switches, the phones registered for notifications (platform, app version, when registered and last refreshed, and a note that a push address is kept for the phone), when each kind of notification was last handled (sent or skipped) and your app activity (for each session the platform and app version, and each record with its time and the English names of the screens and buttons), and on request also the internal product measurements about you. The push address itself is not in the copy, because it is a key for delivering notifications.

Objecting to app activity: write to [email protected] from the e-mail address of your account; we switch app activity off for your account, delete the records we hold and store no new ones (section 3.11). Deleted records stay in our database backups for up to 7 days.

How to apply: send your application in writing to the postal address in section 1, or by e-mail to [email protected] either from the e-mail address registered with your CheckMyBio account or signed with a secure electronic signature or mobile signature. The application should include your name, signature (for written applications), address or e-mail for the reply, and what you are asking for. We answer free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request; if the action has an additional cost, the fee set by the Board may be charged (KVKK Art. 13).

Complaint to the Board: if your application is rejected, you find the answer insufficient or it is not answered in time, you can complain to the Personal Data Protection Board within thirty days of learning the answer, and in any case within sixty days of the application (KVKK Art. 14).

8. Changes

When we change this notice, we publish the new version on this page with a new version number and date; earlier versions stay available at their own addresses.