Cyanfold — Information Notice on the Protection of Personal Data (KVKK)
This is the permanent address of version 1.0. Read the current version.
This notice is governed by Turkish law. In case of conflict, the Turkish version prevails.
Contents
TASLAK — avukat ve yeminli/hukuk çevirmeni incelemesi gerekir. / DRAFT — requires review by a lawyer and a sworn/legal translator. English translation of
diller/tr/kvkk.md(Kişisel Verilerin Korunması Hakkında Aydınlatma Metni), prepared under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. Published athttps://cyanfold.app/en/kvkk. This notice is governed by Turkish law; in case of conflict, the Turkish version (https://cyanfold.app/tr/kvkk) prevails. Numbering is identical.
Data Controller: Kerem Berkay Yanık (the natural person who develops and publishes the App as an individual), [POSTA ADRESİ] ("Cyanfold")
Contact: support@cyanfold.app · Registered e-mail (KEP): [● if any]
As Cyanfold, we process your personal data during your use of the Cyanfold mobile and desktop application (the "App") in accordance with Law No. 6698 on the Protection of Personal Data ("KVKK"). This notice has been prepared to inform you pursuant to Article 10 KVKK.
1. Personal data processed and purposes of processing
| Data category | Data | Purpose |
|---|---|---|
| Transaction security / customer transaction | Daily-limit ledger: day key, the first 8 bytes of the hash values of drawings opened, reward-credit IDs, trial start time, Apple appTransactionID (as a key). This data is kept only on your device and in your iCloud account; it is not transmitted to Cyanfold. | Applying the free-tier limits and the 72-hour Pro preview, preventing abuse |
| Customer transaction | StoreKit purchase and entitlement information (processed by Apple, verified on the device) | Providing Pro / Day Pass entitlements, restoring purchases |
| Marketing (advertising) — iPhone/iPad free tier only (including during the 72-hour Pro preview) | Advertising identifier (IDFA, only if you grant ATT permission), device identifiers and signals, IP address and approximate location, ad interactions, SDK diagnostic data (collected by the Google Mobile Ads SDK and UMP) | Showing ads, measuring them, frequency capping, fraud prevention; personalised ads with your permission |
| Communication | In a problem report / support e-mail: e-mail address, name (if set in your mail app), message content | Responding to your requests |
| Transaction security (diagnostics) | App version, device model, operating system version, conversion error codes and counts, MetricKit digest; optionally, a copy of a drawing you attach | Diagnosing and fixing errors |
Your drawing files (content, name, folder) are processed only on your device and are not collected by Cyanfold. They do not reach us unless you choose to attach a drawing to a problem report.
2. Method of collecting personal data
Your personal data is collected electronically: by automated means while the App runs on your device, through Apple's StoreKit and iCloud services, through the Google Mobile Ads SDK and the User Messaging Platform (iPhone/iPad free tier only), and through e-mails you send.
3. Legal grounds (Article 5 KVKK)
- Processing is directly related to the conclusion or performance of a contract (Art. 5(2)(c)): providing the App, providing purchased entitlements, responding to support requests.
- Legitimate interest of the data controller (Art. 5(2)(f)): preventing abuse of the free tier, diagnosing errors, fraud prevention and frequency capping for non-personalised ads.
- Legal obligation (Art. 5(2)(ç)): retention and disclosure obligations arising from legislation.
- Explicit consent (Art. 5(1)): personalised advertising and access to device identifiers for advertising purposes ⟦lawyer: Section 6⟧; and for transfers abroad where the other mechanisms of Art. 9 cannot be used and the transfer is occasional.
4. Recipients and purposes of transfer
- Apple Inc. and its affiliates (USA/Ireland): App Store purchases, iCloud storage, crash reports (with your permission).
- Google LLC / Google Ireland Ltd. (USA/Ireland): advertising services on the iPhone/iPad free tier only; Google is an independent data controller for advertising data.
- Our e-mail service provider [● name, country]: storage of support e-mails (data processor).
- Authorised public institutions and organisations: where required by law.
Transfers abroad (Article 9 KVKK): Because the recipients above are located abroad, your data may be transferred abroad. Transfers are made within the framework of [● lawyer to confirm: execution of the standard contract announced by the Board and notification to the Authority within 5 business days / binding corporate rules / explicit consent for occasional transfers]. iCloud data is stored under the agreement between you and Apple.
5. Retention periods
- Data on the device: until you delete it or remove the App (Keychain items may remain after removal).
- Ledger: day data is renewed daily; reopen entries expire after 30 days.
- Support e-mails: [● 24 months] from the last correspondence; attached drawings are deleted within [● 90 days] after the issue is closed.
- Advertising data: according to Google's retention policy.
When the periods expire, data is deleted or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
6. Note on processing that requires explicit consent (draft — lawyer's decision)
If you tap "Allow" in iOS's "App Tracking Transparency" prompt, ads may be personalised. Whether this prompt constitutes explicit consent within the meaning of KVKK — "freely given, specific and informed" — is debatable. Options: (a) showing users in Türkiye non-personalised ads only, regardless of ATT permission (lowest risk); (b) turning the in-app explanation screen shown before ATT into a separate explicit consent text linking to this notice, with "I agree / I do not agree" options; (c) enabling the appropriate Google UMP message type for Türkiye as well. The service is not made conditional on giving explicit consent (users who do not consent continue with non-personalised ads).
7. Your rights under Article 11 KVKK
By applying to the data controller, you have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether it is used in accordance with that purpose; know the third parties in Türkiye or abroad to whom it is transferred; request correction if it is incomplete or inaccurate; request deletion or destruction within the framework of Article 7 KVKK; request that corrections/deletions be notified to the third parties to whom the data was transferred; object to a result to your detriment arising from analysis exclusively by automated systems; and claim compensation if you suffer damage due to unlawful processing.
How to apply: Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may apply in writing with a wet-signed petition to [POSTA ADRESİ], with a secure electronic signature to [● KEP address], or, if you do not have an e-mail address registered in our system, to support@cyanfold.app with information enabling us to verify your identity. Applications are concluded free of charge within 30 days at the latest (if the action requires an additional cost, the fee schedule set by the Board may apply). If your application is rejected, you find the response insufficient, or no response is given in time, you may lodge a complaint with the Personal Data Protection Board (KVKK Kurulu).
Note: Data kept on your device and in your iCloud account is not accessible to Cyanfold; you can manage it by deleting the App and through your Apple Account settings.