Mim Ayet KVKK Notice
Effective date: [YAYIN TARİHİ]
Under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles for the Obligation to Inform, we inform you about the personal data processed in the Mim Ayet app. This text is for information only and does not ask for your consent. Your explicit consent for usage analytics is asked in the app with a separate text, which is also published on the Analytics Consent page. The Turkish version of this notice prevails.
Data controller
The data controller is Mustafa Erdoğan (Truffleinit). Email: [email protected].
Data that never leaves your phone
Your location; your prayer, missed prayer, fasting, khatm and dhikr records; special days data; the camera image; the name you write in calligraphy and your usage counters are processed only on your phone. This data is not sent to us or our service providers. The Privacy Policy has the details.
Data processed, purposes and legal bases
Data that leaves your phone falls into the groups below. For each group we state which data is processed, for what purpose, on which article of KVKK, and to whom it is transferred.
Server requests
Data: anonymous ID, request ID, the ID of the city you chose, the influencer code if you entered one, and the server logs of these requests. Your IP address is processed on Cloudflare's network during the connection and is not written to our server logs.
Purpose: to deliver prayer times, religious days, mosque lists, Quran audio and app settings to you; to verify the influencer code; to find server errors and keep the service secure.
Legal basis: for delivering content and verifying the code, necessity directly related to the conclusion or performance of a contract (KVKK art. 5(2)(c)); for server logs, our legitimate interest, provided it does not harm your fundamental rights and freedoms (KVKK art. 5(2)(f)).
Recipients: Cloudflare (server and hosting service).
Essential technical records
Data: anonymous ID, app version, device type, operating system; app errors and crashes, the names of the last 50 steps before an error, and once a day, checks showing the app works properly (for example, that notifications are scheduled and widgets are up to date). No IP address, location or worship data.
Purpose: to keep the app working properly; to find and fix errors and silent problems (for example, notifications that were not scheduled or purchase mismatches).
Legal basis: necessity directly related to the conclusion or performance of a contract, to provide the service (KVKK art. 5(2)(c)), and our legitimate interest, provided it does not harm your fundamental rights and freedoms (KVKK art. 5(2)(f)). These records are collected without asking for permission.
Recipients: PostHog (error tracking service; EU region).
Usage analytics
Data: anonymous ID, session ID, language and in-app events (screens opened, buttons tapped). IP addresses are not recorded.
Purpose: to understand how the app is used and to try out new features.
Legal basis: your explicit consent (KVKK art. 5(1)). Because Mim Ayet is a prayer times and Quran app, your usage data may suggest your religious belief; if such data counts as special category data, the basis is still your explicit consent (KVKK art. 6(3)(a)). Permission is off by default; if you do not allow it, no usage analytics events are sent. You can withdraw your permission at any time in Settings → Privacy.
Recipients: PostHog (analytics service; EU region).
Detailed logging
Data: detailed log records and the anonymous ID. No location or worship data; IP addresses are not recorded.
Purpose: to find the cause of a problem you report.
Legal basis: your explicit consent (KVKK art. 5(1)). You turn detailed logging on yourself in Settings → Help with a separate permission; it is independent of the analytics permission and turns itself off after 24 hours.
Recipients: PostHog (EU region).
Purchases
Data: anonymous ID; purchase, trial, renewal and refund history; product, store, price, time and status of the transaction; the influencer code if you used one. Your card details never reach us or RevenueCat; payments are taken by the App Store or Google Play.
Purpose: to verify your purchase and to unlock and restore Premium; for sales made with an influencer code, to calculate the influencer's share.
Legal basis: for purchases and Premium, necessity directly related to the conclusion or performance of a contract (KVKK art. 5(2)(c)); for calculating the influencer's share, our legitimate interest, provided it does not harm your fundamental rights and freedoms (KVKK art. 5(2)(f)); for keeping sales records as tax law requires, compliance with our legal obligation (KVKK art. 5(2)(ç)).
Recipients: RevenueCat (purchase infrastructure; US) and Cloudflare (server where sales records are kept).
Support requests
Data: your email address and anything you write in the email; from the "Report a problem" email, the support code, app version, device, operating system, city ID, prayer time source, notification and alarm permissions, battery setting, last sync time and active special settings; with your approval, the local log from your phone.
Purpose: to answer your request and solve the problem you reported.
Legal basis: necessity directly related to the conclusion or performance of a contract (KVKK art. 5(2)(c)). We receive the email only if you send it.
Recipients: Google (email service). Emails you send us are stored on Google (Gmail) servers.
KVKK applications
Data: the identity and contact details in your application, your request and your support code.
Purpose: to conclude your application as the Law requires.
Legal basis: compliance with our legal obligation as data controller (KVKK art. 5(2)(ç) and art. 13).
Recipients: Google (email service).
Method of collection
Personal data is collected electronically. Server requests, technical records, usage analytics and purchase data are collected by automated means through the app and our server; purchase information comes from the App Store and Google Play through RevenueCat. Support requests and KVKK applications are collected by non-automated means, through the email you send.
Transfers of personal data
Your personal data is transferred only to these recipient groups:
- our service providers (data processors), only for the purposes above: Cloudflare, PostHog, RevenueCat and Google (email service),
- competent public authorities and courts, where required by law, to comply with our legal obligations (KVKK art. 5(2)(ç)).
International data transfers
The service providers we use to run the app (Cloudflare, PostHog, RevenueCat and Google) may process data abroad, in the EU and the US. Our server runs on Cloudflare's global network; your requests may be served by a data center near you. This text states which data goes to which service provider.
We keep the data that goes abroad to a minimum: your IP address is not written to PostHog records or our server logs, essential technical records contain no location or worship data, and usage analytics is sent only if you allow it. Your location, worship records and special days data are not sent to us or our service providers; your worship records go only into your phone's own backup (iCloud or Google), and special days data is left out of that too.
Transfers of personal data abroad are governed by Article 9 of KVKK. Your downloads and payments in the App Store and Google Play are subject to Apple's and Google's own privacy policies.
Your rights under KVKK
Under Article 11 of the Turkish Personal Data Protection Law No. 6698 (KVKK), you have the right to:
- learn whether your personal data is processed,
- request information about the processing,
- learn the purpose of processing and whether data is used accordingly,
- know the third parties in Türkiye or abroad to whom data is transferred,
- request correction of incomplete or inaccurate data,
- request deletion or destruction under the conditions of KVKK Article 7,
- request that corrections and deletions be notified to third parties who received the data,
- object to an adverse outcome resulting solely from automated analysis,
- claim compensation for damage caused by unlawful processing.
How to apply
You can apply regarding your rights, in Turkish, in one of these ways (Communiqué on the Procedures and Principles of Application to the Data Controller, art. 5):
- by email to [email protected] from an email address you have previously given us and that is in our records
- by email signed with a secure electronic signature or mobile signature: [email protected]
What to include and response time
Your application must include your name and surname, your Turkish ID number (for foreigners, your nationality and passport number), your address, your email or phone number if any, and your request.
Because there is no account, we can find your records only with your support code, so please include it. Your support code is already filled in the email that opens from Settings → Help → "Report a problem".
Applications are concluded free of charge within 30 days at the latest. If the process involves an additional cost, the fee in the Board's tariff may be charged (KVKK art. 13).
You can also send questions about your rights to [email protected].
Complaint to the Board
If your application is refused, the answer is insufficient or no answer is given in time, you can complain to the Personal Data Protection Board within 30 days of learning the answer, and in any case within 60 days of your application (KVKK art. 14). You must apply to the data controller before complaining.
Legal sources
This notice is based on the official sources below. The Turkish text prevails.