CheckMyBio Privacy Policy
Version: 2026-10-18
Last updated: 18 October 2026
This policy explains what personal data CheckMyBio processes, why, who helps us, how long we keep it and what you can do about it. It covers the CheckMyBio iOS and Android apps, the web panel at checkmybio.app and the public pages on checkmybio.app, for account holders ("owners"), visitors of public pages, people who report a page and people who write to us. If you are in Türkiye, our KVKK Privacy Notice gives the same information in the form the Turkish Personal Data Protection Law (KVKK) requires. This policy exists in Turkish and English; if you live in Türkiye the Turkish version prevails where the two differ, for everyone else the English version prevails.
1. Who we are
CheckMyBio is run by Mert Can Taş ("we", "us"), an individual, who is the data controller for the processing described here. You can reach us at [email protected] or by post at: Yenimahalle, Ankara, Türkiye.
2. The short version
- We collect what you need to have an account and a page: your e-mail address, a hash of your password and the content you put on your page.
- Your page is public once you publish it.
- We count visits to pages without cookies and without storing IP addresses or browser details.
- Apple and Google handle payments. We never see your card, Apple ID or Google account details.
- We do not sell your data, show ads, build advertising profiles or track you across other companies' apps and websites.
- From the app version that introduces app activity, the iOS and Android apps record, while you are logged in, which screens you open and which buttons you tap, never what you type or the content of your page. We keep these records for 180 days, only our admins can see them, and you can object (sections 3.6 and 8).
- Push notifications from the app go only to phones on which notifications for CheckMyBio are turned on, and you can switch each kind off at any time.
- You can delete your account in the app. For a copy of your data or any other request, write to [email protected].
3. What we collect
3.1 Your account
E-mail address; an irreversible hash of your password (never the password itself); language; your device's time zone; profile type and onboarding progress; one-time verification codes (stored only as a keyed hash) and attempt counts; session records (surface, created, last used, expiry); the versions of the Terms of Use and this policy you accepted and when; and, if it ever applies, a moderation state with a reason category. We do not store IP addresses or device details with your login sessions or with security events.
3.2 Your page
What you add to your page: username, title, bio, profile photo, theme and appearance; links (with an optional "Sponsored" label and schedule) and social accounts; message buttons (WhatsApp phone number and prefilled text); shop info (address, map link, phone, opening hours); payment info (IBAN and account-holder name, or a payment link, with a note); catalogue cards and products (name, description, price, variants, photo); and the settings of Plus features you use. We also keep a stable code for your page's QR code, so printed codes keep working after a username change. Uploaded photos are re-encoded and we keep no photo metadata (EXIF), including location.
Your page is public once published. Anyone with the link can see it, and search engines and other services that read the web may find and copy it. If you publish data about other people, such as an IBAN registered to someone else, you are responsible for having the right to do so and for informing them where the law requires it.
"About this page" panel (applies once the panel is enabled): a published page also shows visitors a short panel with three facts we take from the page itself:
- the month and year the page was first published (never the day or the time);
- for 30 days after the page's address (username) changes, a note that the address changed recently, without the old address and without the date;
- the list of sites the page's visible links lead to, as domain names only (for example example.com), never full web addresses.
The month of first publication stays the same when you change your username, so someone who knew your page under its old address may recognise it under the new one.
3.3 Plus and payments
If you subscribe to Plus in the iOS app, Apple processes the payment under Apple's terms. If you subscribe in the Android app, Google processes the payment in Google Play under Google Play's terms. We receive your subscription status through RevenueCat, our subscription service: which store (App Store or Google Play), which product (monthly or yearly), trial or paid period, when access ends, whether it renews, grace periods, billing issues, refunds, and whether the purchase was a test purchase. We never send your e-mail address or name to RevenueCat; it knows your account by a random id. RevenueCat receives that random id, your purchase history and the App Store's or Google Play's transaction data, and, from RevenueCat's software in the app, data about your device, operating system, app version and store country (storefront) together with your IP address. Section 5 explains who can see this data at RevenueCat. If an admin grants you a free Plus period, we keep its start, end, the admin's internal reason and any revocation.
3.4 Visitors to public pages
When someone visits a CheckMyBio page, we store for the page owner: which page or item was viewed, tapped, copied or shared and when (rounded to the hour), the kind of source (for example Instagram, QR code, direct) and the device class (mobile, tablet, desktop). Country and city fields are empty today.
City statistics (applies once city statistics are switched on): the country and city are taken from the location estimate that our network provider Cloudflare attaches to each request based on the IP address. We store only the country and city codes with the event, never the IP address.
We do not store a visitor's IP address, browser details (user agent), the address of the page they came from, or a cookie id for these statistics. To count a visit only once in 30 minutes, filter out robots and limit abuse, we briefly combine the IP address and browser details with a random key that is replaced every night; nothing of this is written down. A page owner's own visits while logged in to the web panel are not counted. Owners see only these counts, never information about an individual visitor.
3.5 Order form (applies once the order form feature is enabled)
If you use the order form on a page, the products, quantities, name and note you enter are kept only in that browser tab (session storage); they are deleted when you close the tab and are never sent to us. Sending the order opens WhatsApp with a prepared message; the message goes from you to the page owner through WhatsApp, under WhatsApp's terms, and we do not receive it. We only count that the page's WhatsApp button was used, in the same way as other taps (section 3.4).
3.6 How owners use the product
Product records. We record some actions owners take, such as creating an account, onboarding steps, publishing a page for the first time, editing the page (at most once an hour), viewing statistics (at most once a day), reaching a plan limit, a link being refused by the blocklist, viewing the Plus screen, starting a trial, your answer when the app offers notifications (turned on, declined or "not now") and opening a notification (which kind), with the account id, the surface (app, web or server) and small coded values. These records contain no free text, e-mail address, username, link, IP address or device id. We use them only to understand which features are used and to improve the product.
App activity (applies from the first app version that records it). While you are logged in to the iOS or Android app, the app records how you move through it and sends these records to our servers:
- when the app is opened (from its icon, a notification or a link, without the link itself), when you return to it and when it leaves the screen;
- each screen shown, including each onboarding step, each sheet or dialog that opens and the Plus screen (with where it was opened from);
- each completed tap on a button, list row, tab, switch (with its new state, on or off), checkbox or menu item, and for some of them the option chosen from a fixed list (for example the type of block you add);
- opening a notification (which kind).
Each record holds your account, a random id of the period of use it belongs to (a session; the id is created on the phone, is not derived from the phone or your account and is never reused), its place in that session, what happened, the names of the screen and button from our fixed list, the app version, the platform (iOS or Android), the time on your phone and the time our servers received it.
We never record: anything you type (not even its length); links or any web address; the content of your page (such as titles, bio, product names, prices, IBANs, phone numbers or social media handles); which of your blocks, cards, links or products you tapped; your e-mail address, username or name; your push address; your IP address (our servers use it briefly to limit requests and never store it with these records); an advertising id or any other id of your phone; the phone model or operating system version; your location, contacts, photos or clipboard; screenshots or screen recordings; where you touch the screen, how you scroll or how you type. Nothing is recorded before you log in or sign up, after you log out, in the web panel or in the admin area.
We use app activity to help you when you contact support (for example when a button seems to do nothing), to look into abuse or security problems on an account, and to understand and improve how the app is used. Only our admins can see it, in the admin area and one account at a time. An admin has to give a reason each time (support request, abuse or security, or product research), and every view is recorded with the admin, the time and the reason (section 3.7). Admins cannot download it. App activity is recorded by our own code in the app, goes only to our servers and is stored by our hosting providers for us (section 5). It is not used for advertising, not sold and not combined with data from other companies. We keep it for 180 days (section 7). You can get a copy of it and you can object to it (section 8).
3.7 Reports and moderation
Anyone can report a page without an account. We keep the reported page and part (with its title and the web addresses it pointed to at that moment), the reason, the details and, if you give it, your e-mail address, which we use only to tell you the outcome. We keep moderation decisions, blocked domains and a record of every admin action (admin, action, target, reason, time).
3.8 E-mails and support
We send e-mails that your account needs: verification codes, security and account notices, deletion confirmation, moderation notices, report outcomes and Plus periods granted or revoked. We send no marketing e-mail. If you write to [email protected], we keep your message and our answer to handle your request.
3.9 Technical and security data
- Our servers write logs for errors and security. We do not log e-mail addresses, codes or tokens, and these logs contain no IP addresses and no request headers; some lines contain an account id.
- Our network provider Cloudflare sees every request in transit, including the IP address, to deliver it and to block attacks. Cloudflare keeps sampled records of security events, including IP addresses, which we can see in its dashboard.
- Our servers use IP addresses briefly in memory to limit repeated requests (for example log-in attempts) and do not store them.
- Traffic records under Turkish Law No. 5651: as a hosting provider we may be required to keep traffic records of the requests to our sites (such as IP address, time and requested address) and to hand them to authorised authorities on request. We do not keep such records today. If we start, they will be kept separately from the product data, accessible only to us, used only for that legal duty, and deleted when the legal period ends; we will update this policy before we start.
3.10 Cookies and device storage
- No cookie or browser storage is used to count visitors.
- The web panel uses a session cookie to keep you logged in; the admin area uses its own session cookie and a cookie of Cloudflare's access service, for admins only.
- If you pick a language on a page, a cookie remembers your choice for one year.
- If Cloudflare has to check whether a request comes from a person (for example during an attack), it may set its own short-lived security cookie for that check.
- The web panel keeps unsent form input in the browser tab if your session expires, so you do not lose it; the order form keeps your order in the tab (section 3.5).
- The app keeps your login token in the device's secure storage, and keeps your language choice and a copy of recently loaded screens on the device so it can show them offline.
- For notifications (section 3.12), the app keeps on the device whether notifications were turned on in the app on that phone, when you last chose "Not now", and the random installation id of the notification software. If you log out while offline, it keeps the old login token in secure storage until the log-out reaches our servers.
- From the app version that records app activity (section 3.6), the app keeps the records not yet sent in a file on the phone, separately for each account: at most 1,000 records and at most 72 hours. When you log out, the app tries once to send them and then deletes the file; when an account logs in, the files of other accounts on that phone are deleted.
Apart from the app activity records waiting to be sent, all of these are needed for a service you asked for. We use no advertising or analytics cookies, so we do not show a cookie banner.
3.11 Device permissions
The app asks for access to your photos only when you choose a photo for your page, and to your photo library only when you save an image such as your QR code or poster. It asks for permission to show notifications only when you choose to turn them on (section 3.12). The Android app also uses Google Play's billing service so that you can buy Plus. To deliver notifications, the apps contain Expo's notification software, and the Android app also contains Google's Firebase Cloud Messaging software (section 3.12). The apps contain no advertising, analytics or crash-reporting software from other companies and do not use an advertising identifier. App activity (section 3.6) is recorded by CheckMyBio's own code in the app and sent only to our servers.
3.12 Push notifications
Notifications in the iOS and Android apps are on or off per phone. The app asks for the phone's permission only when you choose to turn them on. It offers them after you first publish your page or, once, when you open Analytics if your page is already published; if you choose "Not now", it offers them once more on Analytics after at least 14 days. You can also turn them on at any time under Account, with "Turn on notifications". The app never asks when you first open it or sign up.
Once a phone has notifications for CheckMyBio turned on, every account that logs in on it receives them there, without being asked again. An account that has never had notifications starts with all three kinds switched on; you can switch each kind off at any time (see "How to turn them off" below). Everything in CheckMyBio works the same without notifications. The web panel sends no notifications.
- What we send: three kinds, each with its own switch. "Order clicks": at most once a day, the number of clicks on your order and message buttons in the last 24 hours. "Weekly summary": every Monday, your page's views and clicks in the past week. "News from CheckMyBio": new features and important updates, at most once a week. A notification contains only these numbers or the text of our news: never details about visitors, amounts, payment details or the content of your page, and never offers or advertising. We send nothing between 21:30 and 09:00 in your account's time zone; the only exception is a test of our news that an admin sends to their own phones.
- What we store: for each phone that receives notifications for your account, a push address (a key that Expo issues for the app on that phone so that we can reach it), the platform (iOS or Android), the app version, when it was registered and last refreshed, and the login session it belongs to. If another account logs in on the same phone while notifications are turned on there, the push address moves to that account. For your account we store the three switches and when each kind of notification was last handled (sent or skipped). We also record your answer when the app offers notifications and when you open a notification (section 3.6).
- Who delivers them: our servers send each notification to Expo, which passes it on to Google's Firebase Cloud Messaging for Android phones or to Apple's push notification service for iPhones (section 5). They receive the address of your phone and the text of the notification.
- What the notification software on your phone sends: when the app gets a push address, Expo's software sends Expo the address that Apple or Google issued for your phone, a random installation id it creates for the app, and the app's identifiers. In the Android app, Google's Firebase Cloud Messaging software creates an installation id for the app on your phone and sends it to Google, together with the app version and technical details such as the Android version and the phone model, so that notifications can be delivered. Google also counts deliveries as aggregated statistics. We do not use this software for advertising or to analyse how you use the app.
- How to turn them off: in the app, under Account, Notifications, switch off each kind (the switches apply to all your phones), or turn off notifications for CheckMyBio in your phone's settings. Logging out stops notifications on that phone; if you log out while offline, this happens once the app is online again. Turning notifications off changes nothing else in the app.
4. How we use data and on which legal basis
| Purpose | Data | KVKK basis (Art. 5(2)) | GDPR basis (Art. 6(1)), where the GDPR applies |
|---|---|---|---|
| Create and run your account, log you in, keep it secure | 3.1 | (c) contract; (f) legitimate interest in security | (b) contract; (f) security |
| Show and update your page | 3.2 | (c) contract; (d) data you made public | (b) contract |
| Show visitors the "About this page" panel (once enabled) | 3.2 | (f) legitimate interest in helping visitors judge a page | (f) legitimate interest |
| Unlock Plus, verify purchases and restores, run admin-granted periods | 3.3 | (c) contract; (f) recording admin actions | (b) contract; (f) |
| Show owners how their page is used | 3.4 | (f) legitimate interest | (f) legitimate interest |
| Understand feature use and improve the product (product records) | 3.6 | (f) legitimate interest | (f) legitimate interest |
| Help you when you contact support, look into abuse or security problems on an account, and understand and improve how the app is used (app activity) | 3.6 | (f) legitimate interest in supporting owners, keeping the service secure and improving it | (f) legitimate interest |
| Handle reports, prevent abuse, keep the service secure | 3.7, 3.9 | (f) legitimate interest; (e) establishing or defending a right | (f) legitimate interest |
| Meet legal duties (Law No. 5651, authority requests, data protection requests) | 3.7, 3.8, 3.9 | (a) required by law; (ç) legal obligation | (c) legal obligation |
| Send necessary e-mails and answer you | 3.8 | (c) contract; (ç) legal obligation | (b) contract; (c) |
| Send push notifications of the kinds switched on to the phones on which notifications are turned on, and deliver them through Expo, Google and Apple | 3.12 | (c) contract; for news about CheckMyBio also (f) legitimate interest in telling you about the service | (b) contract; (f) for news |
Where we rely on legitimate interest, we have weighed it against your interests: visitor statistics store no identifiers; product records contain no content; app activity contains no text you type and no page content, is recorded only while you are logged in to the app, is kept for 180 days, can be seen only by admins who give a reason each time, with every view recorded, and is switched off and deleted if you object; security data is kept only briefly. You can object (section 8).
We do not sell personal data, show ads, use data for advertising, share it with data brokers, track you across other companies' apps and websites, or use your data to train artificial intelligence models. We make no decisions with legal or similarly significant effects about you by automated means alone; moderation decisions are taken by a person. One check is automatic: when you save a link, an address on our safety blocklist is refused. If you think a refusal is wrong, write to us and a person will look at it.
5. Who we share data with
We use the service providers below. Railway, Neon, Cloudflare, Resend, Expo and Google for Firebase Cloud Messaging process data for us under our instructions. Apple, Google as the Play store, and RevenueCat are in a different position, explained below the table.
| Provider | What for | Data | Where the data is | Company country |
|---|---|---|---|---|
| Apple | iOS app distribution; sale, renewal, cancellation and refunds of Plus in the App Store | Apple ID and payment data stay with Apple; purchase receipts | Apple's systems | United States |
| Google (Google LLC) | Android app distribution; sale of Plus in Google Play on our behalf, renewal, cancellation and refunds | Google account and payment data stay with Google; Google Play order data | Google's systems | United States |
| RevenueCat, Inc. | Purchase verification and subscription status | Random account id, purchase history, App Store and Google Play transaction data; from its software in the app: device, operating system, app version and storefront data and the IP address | RevenueCat's systems | United States |
| Railway Corporation | Runs our website and app servers | Everything the servers process; server logs | EU (Amsterdam); Railway's primary operations are in the United States | United States |
| Neon | Database and backups | Stored data in section 3 | EU (Frankfurt) | United States |
| Cloudflare, Inc. | Domain, secure connections, attack protection, storage of photos and data copies, admin access, forwarding of support e-mail | Requests to our sites including IP addresses, in transit; photos; data copies; admin sign-in; support e-mails | Requests: the location nearest the visitor; storage: EU | United States |
| Resend (Plus Five Five, Inc.) | Sends our e-mails | Recipient address, e-mail content, delivery data | EU (Ireland); also processed in the United States | United States |
| The e-mail provider of our own mailbox | Receives and stores support e-mails forwarded from [email protected] | Messages you send to support and our answers | The provider's systems | Outside Türkiye |
| Expo (650 Industries, Inc.) | Issues push addresses and passes our notifications on to Google and Apple for delivery | Push address, the address Apple or Google issued for your phone, the app's installation id, the text of each notification | Expo's systems, including in the United States | United States |
| Google (Firebase Cloud Messaging) | Delivers notifications to Android phones | Firebase installation id and registration address, app version and technical details of the phone, the text of each notification; aggregated delivery statistics | Google's global infrastructure | United States |
| Apple (Apple Push Notification service) | Delivers notifications to iPhones | The address Apple issues for the app on your phone, the text of each notification | Apple's systems | United States |
Apple sells the Plus subscription in the App Store and takes the payment under its own terms and privacy policy, as an independent company and not under our instructions. Your Apple ID and payment data stay with Apple.
Google sells the Plus subscription in Google Play on our behalf and takes the payment under Google Play's terms and Google's privacy policy. Google handles your Google account and payment data as an independent company, not under our instructions; that data stays with Google. Google Play passes the order data of your subscription to RevenueCat so that it can verify the purchase.
RevenueCat processes the data in the table for us as a service provider (a processor). Our subscription project is held permanently in a RevenueCat account that belongs to a third person, not to us. That person controls the project and can view and export the data RevenueCat holds about your purchases (listed in the table above). RevenueCat's data processing terms are agreed with that account owner, not with us. We never send your e-mail address or name to RevenueCat. See section 7 for what happens when you delete your account.
Notifications (section 3.12): Expo and Google (for Firebase Cloud Messaging) process the data in their rows for us as service providers. Apple delivers notifications to iPhones through its own push notification service, which is part of iOS. Expo does not store the text of notifications. None of them receives your e-mail address, your name, your account id or the content of your page from us.
We also disclose data:
- to courts and authorities when the law requires it, and only as far as required;
- to a company that takes over CheckMyBio, if that happens; we will tell you in advance, and this policy will continue to protect your data.
6. Transfers abroad
All the recipients below are outside Türkiye, so your data is transferred abroad. Some of them also process data in the United States where the data is stored in the EU. This is who receives which data, and where:
- Railway Corporation (United States): everything our website and app servers process, and the server logs. The servers are in the EU (Amsterdam); Railway's primary operations are in the United States.
- Neon (United States): the stored data described in section 3 and its backups, in the EU (Frankfurt).
- Cloudflare, Inc. (United States): requests to our sites, including IP addresses, at the location nearest the visitor; photos and data copies, stored in the EU; admin sign-in; support e-mails while they are forwarded.
- Resend (Plus Five Five, Inc., United States): the recipient address, content and delivery data of the e-mails we send, in the EU (Ireland) and also in the United States.
- The e-mail provider of our support mailbox: messages you send to [email protected] and our answers. The provider is outside Türkiye.
- Apple and Google (United States): they receive your Apple ID or Google account and payment data directly from you, under their own terms.
- RevenueCat, Inc. (United States): your purchase data (listed in section 5) is transferred to RevenueCat. Our subscription project is held in a RevenueCat account that belongs to a third person, not to us, and RevenueCat's data processing terms apply with that person, not with us.
- Expo (650 Industries, Inc., United States): if notifications for CheckMyBio are on for your phone, your push address, the address Apple or Google issued for your phone, the app's installation id and the text of each notification, processed also in the United States.
- Google for Firebase Cloud Messaging (Google LLC, United States): in the Android app, the Firebase installation id and registration address, the app version and technical details of the phone, and the text of each notification, on Google's global infrastructure.
- Apple for its push notification service (Apple Inc., United States): on iPhones with notifications turned on, the address Apple issues for the app and the text of each notification.
7. How long we keep data
| Data | Kept |
|---|---|
| Account and page | Until you delete your account. Deletion closes your page at once and starts a 30-day waiting period. Your account and its data are permanently deleted from our live systems shortly after the 30 days end, except for the items under "What remains after deletion" below |
| Unfinished sign-ups | 24 hours |
| Verification codes | 10 minutes for an address without an account; otherwise 30 days |
| Session records | 30 days after the session ends |
| Deleted blocks | 10 minutes to undo; deleted after 24 hours |
| Unused or replaced photos | 24 hours |
| Visitor statistics | 12 to 13 months, and deleted with the account |
| Product usage records | At most 13 months, and deleted with the account |
| App activity (section 3.6) | At most 180 days after it happened; deleted earlier if you object, and with the account. Deleted records stay in our database backups for up to 7 days |
| App activity waiting on the phone | Until it is sent, at most 72 hours; deleted when you log out |
| The note that app activity is off for your account after an objection | Until the account is deleted |
| Copies of your data we prepare for you | Up to 8 days after the copy is made, then deleted from our storage |
| Reporter e-mail address | 90 days after the report is resolved; the report itself stays without it until the page is deleted |
| Admin action records, including the news notifications admins sent and every view of an account's app activity | Kept permanently, also after the account is deleted; news notifications are kept without a list of recipients |
| Push address of a phone | Deleted, whichever comes first: when you log out on that phone (after a log-out while offline, once the app is online again); when the session on that phone is revoked, for example by a password change or a deletion request (a deletion request deletes all of them at once); when we learn that the phone no longer accepts notifications (for example the app was uninstalled); or after 120 days without the app refreshing it. If the session on that phone expires instead, the push address is deleted together with the session record, at the latest 30 days after the session ended. Once the session has ended, that phone receives no more notifications |
| Notification switches and when each kind was last handled | Until the account is deleted |
| Notification receipts at Expo | 24 hours; Expo does not store the text of notifications |
| Undelivered notifications at Google and Apple | At most until 21:30 the same day in your account's time zone; an admin's test sent to their own phones, at most 1 hour |
| Firebase installation id at Google (Android app) | Until it is deleted through Firebase, then removed from Google's systems within 180 days. We do not delete it today, also not when you delete your account |
| Support e-mails | As long as needed to handle your request and any follow-up, and at most 2 years after the last message |
| Database backups | Up to 7 days |
| Server logs | Up to 30 days |
| E-mail delivery data at our e-mail provider | 30 days |
| Old username after a change or deletion | 30 days, the name only |
| Traffic records under Law No. 5651 | Not kept today; if kept, for the period the law sets |
| Purchase history at RevenueCat | Stays at RevenueCat after your account is deleted; write to us and we will have it deleted |
| Purchase records at Apple and Google | Under Apple's and Google's own terms |
| Language cookie | 1 year |
What remains after deletion. When your account is permanently deleted, the following still exist for the periods shown:
- Database backups: your data stays in our database backups for up to 7 days after the deletion.
- Server logs: log lines that contain your account id stay for up to 30 days.
- E-mail delivery data: our e-mail provider keeps the e-mails we sent you and their delivery data for 30 days.
- Admin action records: records of admin actions are kept, because they show who did what and why. They keep the internal id of the account or page concerned and the admin's reason. If you were an admin, your account is pseudonymised instead of deleted: your e-mail address, password, sessions and profile data are removed, and an internal record without them is kept so that these records stay valid.
- Your username: the name alone stays blocked for 30 days so that nobody else can take it at once.
- Your QR code: the code alone stays reserved, with no link to you or your page, so that it is never given to someone else.
- Purchase history at RevenueCat: the data listed in section 5 stays at RevenueCat, where the RevenueCat account owner can still view and export it; write to us and we will have it deleted.
- Browser caches: photos may stay in the browser caches of people who visited your page for up to one year. We cannot delete them there.
- Firebase installation id (Android app): the installation id that Google's notification software created for the app on your phone stays at Google until it is deleted through Firebase (section 7). It contains no account details.
8. Your rights and choices
- In the app: correct your e-mail address and page, and delete your account (Account settings). Switch each kind of notification on or off under Account, Notifications, or turn notifications off in your phone's settings (section 3.12).
- By e-mail: write to [email protected] from the e-mail address of your account to ask for a copy of your data, access, correction, deletion, information about how we use your data, or to object. We send a copy in a common machine-readable format; it covers your account, page and statistics, your notification switches, the phones registered for notifications (platform, app version, when registered and last refreshed, and a note that a push address is kept for the phone), when each kind of notification was last handled (sent or skipped) and your app activity (for each session the platform and app version, and each record with its time and the English names of the screens and buttons), and on request also your product usage records. The push address itself is not in the copy, because it is a key for delivering notifications. We answer free of charge within 30 days.
- Objecting to app activity: write to [email protected] from the e-mail address of your account. We then switch app activity off for your account: the records we hold are deleted, we store no new ones and the app stops sending them. Deleted records stay in our database backups for up to 7 days. There is no switch for this in the app.
- Checking who you are: we answer requests about an account only when they come from its e-mail address or we can otherwise confirm that you are the account holder.
- Türkiye: your rights under KVKK Article 11 and how to complain to the Personal Data Protection Board are in the KVKK notice, section 7.
- EU, EEA and UK: if the GDPR or the UK GDPR applies to you, you have the rights of access, rectification, erasure, restriction, data portability and objection, and you can complain to the data protection authority where you live or work.
- United States: we do not sell or share personal information for cross-context behavioural advertising, and we treat everyone who uses these rights equally.
- Data on someone else's page: if an owner published your data, you can ask the owner directly or report the page (section 3.7).
9. Deleting your account and your subscription
Deleting your CheckMyBio account does not cancel an App Store or Google Play subscription. Cancel it first in your Apple account settings or in Google Play, or Apple or Google keeps billing you. Your account data is permanently deleted from our live systems shortly after the 30-day period ends, with the exceptions in section 7; the subscription stays with your Apple ID or Google account and can be restored on another CheckMyBio account.
You can delete your account in the app (Account, then "Delete my account") or on the web at checkmybio.app/app/account/delete after logging in. If you cannot log in, write to [email protected] from the e-mail address of your account.
10. Children
CheckMyBio accounts are only for people aged 18 or over. We do not knowingly let anyone younger open an account; if we learn that an account belongs to someone under 18, we close it and delete its data. Anyone can open a public page; visits are counted only as described in section 3.4. If you believe a child has given us personal data, write to [email protected].
11. Security
Passwords are stored only as Argon2id hashes and codes only as keyed hashes. All our sites use HTTPS only. Connections to the database are encrypted and the server's certificate is checked. Stored photos and data copies are encrypted at rest. The admin area sits behind an extra sign-in with two-factor authentication, and every admin action is recorded. Push addresses are used only to send notifications and never appear in our logs, in data copies or in any answer of our servers. An admin must give a reason before seeing an account's app activity, and every view is recorded. App activity records never appear in our server logs, which only count them. No system is perfectly secure. If a breach affects your data, we inform the Personal Data Protection Board and other authorities within the periods the law sets, and we tell you as soon as we can.
12. Other services
Pages on CheckMyBio link to services we do not run, such as WhatsApp, social networks, map services and payment links. When you open them, their own privacy policies apply, and we do not control what they collect.
13. Changes
When we change this policy, we publish the new version here with a new version number and date; earlier versions stay available at their own addresses. We tell owners about changes that significantly affect them by e-mail or in the app before they take effect.
14. Contact
E-mail: [email protected]. Post: the address in section 1.