Cyanfold — Privacy Policy

TASLAK — avukat ve yeminli/hukuk çevirmeni incelemesi gerekir. / DRAFT — requires review by a lawyer and a sworn/legal translator. Reference (prevailing) version — source: 03-privacy-policy-en.md. Numbering is identical in all languages.

Last updated: [●]

This Privacy Policy explains how Kerem Berkay Yanık, an individual developer, [POSTA ADRESİ], Türkiye ("we", "us") handles personal data when you use the Cyanfold app for iPhone, iPad and Mac and its extensions (the "App"). We are the data controller (veri sorumlusu) for the processing described here, except where a third party (Apple, Google) acts as an independent controller, as explained below.

1. The short version

• Your drawings never leave your device because of us. The App opens, renders, measures, marks up and exports drawings entirely on your device. We have no server and never upload your files, their names, folders, contents or hashes.
• No account, no sign-in. We do not ask for your name, e-mail or phone number to use the App.
• Ads on iPhone and iPad (free tier only). Google AdMob shows ads and collects device and usage data for advertising. Ads are personalised only if you allow tracking (Apple's App Tracking Transparency prompt) and, in the EEA, UK and Switzerland, only if you consent in Google's consent form. Otherwise ads are non-personalised. There are no ads on Mac and no ads with an active Pro subscription or Day Pass. Ads do continue during the free 72-hour Pro preview.
• Daily limit and trial are stored in your own iCloud (Keychain and key-value storage), which we cannot read.
• Problem reports reach us only if you choose to send one by e-mail.

2. What we process, why, and on what legal basis

We do not: sell your personal data for money; build profiles ourselves; collect precise location, contacts, photos, camera, microphone, health or financial data; send any drawing identifier (name, path, hash, GUID) or appTransactionID to Google or any other third party.

⟦OPTIONAL — only if added later⟧ Usage analytics (TelemetryDeck): anonymous usage signals (feature used, conversion error code, app version, size bucket), never drawing content, names, paths or hashes; can be switched off in Settings › Privacy. Legal basis: ⟦consent in EEA/UK (recommended: default off there) / legitimate interest elsewhere⟧. Purchases backend (RevenueCat): an anonymous app user ID and App Store transaction data, to manage entitlements and offers; processor. Remote configuration: the App downloads a small file from [● host] to learn about current sale days; the host receives your IP address and standard request data (server logs kept [● 7 days]).

3. Advertising, tracking and your choices

• App Tracking Transparency (iOS/iPadOS). Before the first ad the App explains why it asks, then shows Apple's system prompt. If you choose "Ask App Not to Track", the App does not access the IDFA and requests only non-personalised ads. You can change this any time in iOS Settings › Privacy & Security › Tracking.
• Consent form (EEA, UK, Switzerland and certain US states). Google's User Messaging Platform shows a consent or opt-out message where required. You can review or change your choices in Settings › Privacy › Ad Privacy Choices in the App.
• Non-personalised ads still use data such as IP address and device information for delivery, frequency capping, measurement and fraud prevention.
• Remove ads by subscribing to Pro or using a Day Pass, or use the App on Mac (no ads).
• Google's role: for ads, Google is an independent controller of the data it collects (and, for EEA consent, operates under the IAB Transparency & Consent Framework). See How Google uses information from sites or apps that use our services: https://policies.google.com/technologies/partner-sites and Google's Privacy Policy https://policies.google.com/privacy.
• Ads are limited to content rated "G" and are not targeted at children.

4. iCloud

The daily-limit and trial state is stored in your Apple Account's iCloud Keychain and iCloud key-value storage so that it syncs between your devices and is not reset by reinstalling. This data is stored by Apple under Apple's Privacy Policy; we cannot access it. If iCloud is off, the data stays on your device.

5. Who receives data

• Apple (App Store, StoreKit, iCloud, crash reports if you opted in) — independent controller; apple.com/legal/privacy.
• Google (AdMob, UMP) — on iPhone/iPad free tier only; independent controller for advertising data.
• Our e-mail provider [● name] — processor, for support e-mails.
• Authorities, where required by law; or a successor if the App is transferred (you will be informed).

6. International transfers

Google and Apple process data in the United States and other countries. Transfers from the EEA/UK rely on the EU-U.S. Data Privacy Framework (where the recipient is certified) and/or Standard Contractual Clauses. For transfers from Türkiye, KVKK Article 9 (as amended in 2024) applies; ⟦lawyer: confirm the mechanism — standard contracts notified to the KVKK Authority, or explicit consent for occasional transfers⟧. Support e-mails are stored with [● provider] in [● region].

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing, to data portability, to withdraw consent at any time (without affecting earlier processing), and to complain to a supervisory authority.

• EEA/UK/Switzerland (GDPR / UK GDPR / FADP): you may complain to your local data protection authority.
• Türkiye (KVKK Art. 11): see our KVKK Information Notice; you may apply to us and then to the Personal Data Protection Board (KVKK Kurulu).
• California and other US states (CCPA/CPRA, VCDPA, CPA, CTDPA, and similar): you have the right to know, delete and correct personal information, and to opt out of "sale" or "sharing" of personal information for cross-context behavioural advertising and of targeted advertising. We do not sell personal information for money. Personalised ads served by Google with your permission may be considered "sharing"/"targeted advertising"; opt out by denying tracking in ATT and via Settings › Privacy › Ad Privacy Choices. We do not use or disclose sensitive personal information and will not discriminate against you for exercising your rights. Categories collected in the last 12 months: identifiers (device advertising ID, with permission), internet or network activity (ad interactions), approximate geolocation (from IP), diagnostics — via Google's SDK, for advertising; and, if you contact us, identifiers (e-mail) and the content of your message. You may use an authorised agent.
• Brazil (LGPD, Law No. 13.709/2018): you have the rights in Art. 18 LGPD (confirmation of processing, access, correction, anonymisation/blocking/deletion, portability, information about sharing, withdrawal of consent) and may complain to the National Data Protection Authority (ANPD). Contact of our data protection officer (encarregado): [● privacy@cyanfold.app].
• Japan (APPI): personal data is provided to Google and Apple in the United States and other countries as described in Sections 5 and 6; you may request disclosure, correction, suspension of use or deletion of retained personal data under the Act on the Protection of Personal Information. [● lawyer: confirm third-country information under APPI Art. 28.]
• Republic of Korea (PIPA): you may request access, correction, deletion or suspension of processing, and withdraw consent. Overseas transfer: advertising data to Google LLC (USA) and app data to Apple Inc. (USA), as described in Sections 5 and 6. [● lawyer: confirm whether a domestic agent (PIPA Art. 31-2) and a separate overseas-transfer notice are required.] Complaints: Personal Information Protection Commission (PIPC) / KISA Privacy Center (privacy.kisa.or.kr).

Because we do not run a server and cannot read your iCloud data, most data about you is on your device or with Apple/Google. You can delete on-device data by deleting the App; ad data through Google (myadcenter.google.com) and your iOS settings (including "Reset Advertising Identifier" where available); support e-mails by asking us. ⟦Developers: consider an in-app "Reset local data" action that also removes the Keychain/KVS ledger, except where kept to prevent trial abuse.⟧

To exercise your rights, e-mail [● privacy@cyanfold.app]. We will answer within one month (GDPR) / 30 days (KVKK) / 45 days (CCPA), and may need to verify your request.

8. Children

The App is a professional tool. It is not directed at children and is rated 4+ only because it contains no objectionable content. We do not knowingly collect personal data from children under 13 (or the age required in your country, e.g. 16 in parts of the EEA). Ads are limited to "G" content. If you believe a child has sent us personal data (for example, in a support e-mail), contact us and we will delete it.

9. Security

Drawings and app data are protected by iOS/macOS sandboxing and data protection; the ledger is stored in the Keychain. No method is perfectly secure; keep your device updated and protected with a passcode.

10. Changes

We will post changes on this page and update the date above; for material changes we will also notify you in the App.

11. Contact

Data controller: Kerem Berkay Yanık (an individual developer, a natural person), [POSTA ADRESİ], Türkiye. E-mail: support@cyanfold.app. ⟦If appointed: EU representative (GDPR Art. 27): [●]; UK representative: [●].⟧

12. Notice for users in Türkiye

If you live in Türkiye, please also read our KVKK Information Notice (KVKK Aydınlatma Metni, Turkish Law No. 6698): https://cyanfold.app/tr/kvkk (English translation: https://cyanfold.app/en/kvkk).