Bizim Yuva Privacy Policy

Who is responsible

Bizim Yuva is developed and operated by ICM (icm.sh), the data controller for the processing described here.

• Privacy requests: kvkk@bizimyuva.tr
• Support: destek@bizimyuva.tr

The short version

• You can use Bizim Yuva without creating an account; registering is optional.
• Your plans are shared only with the partner you invite.
• Your data is stored in the European Union.
• No ads, no tracking across apps and no selling of data.
• You can export or delete your data at any time.

Data we process

• Device information. When you first open the app, an account is created for your device (a guest account). For this we use a device key and an installation ID created by the app, your device's vendor identifier (IDFV on iOS, Android ID on Android; used to recover a guest account if you reinstall within 90 days), the device model, operating system and app version, language, time zone and, if you allow notifications, a push token.
• Account details (optional). Your email address and password (stored only as a secure hash), or your Apple or Google sign-in identifiers, and a display name. Phone numbers are not collected.
• Profile (optional). Your role (bride, groom or partner), birth date and profile photo. Your partner can see your name, photo, birthday, role and email address.
• Your plans. Relationship dates, journey stages, special days, venues, to-dos, lists, budget items, installments, payments, receipt photos, love notes and anything else you add.
• Information about other people. If you add guests or gift givers, their names and the details you enter, such as phone number, email address, side, group, RSVP status or gifts. Make sure you have the right to record this information; only you and your partner can see it.
• Photos. Photos you choose to upload, such as receipts, covers and memories. Location metadata is removed on your device before upload. Each couple has 5 GB of storage.
• Invitation page replies. If you publish a web invitation, your guests' replies (name, attendance, headcount and, optionally, phone number and message), stored with a hashed IP address and the browser type.
• Usage data and crash reports. See “Analytics and crash reports” below.
• Technical logs. Request logs with a shortened (masked) IP address, used for security and troubleshooting.
• Consent and legal records. Your consents and acceptance of our terms, with the date, app version and a hashed IP address.
• Support messages. What you send us, with basic diagnostics such as app and operating system version and device type.

We do not process special categories of personal data. Event types such as henna night or religious marriage are planning categories, not information about your beliefs. Your location, contacts and calendar contents are not collected.

Why we process it

• To provide the app — your account, pairing with your partner, syncing between devices, reminders and storage: performance of a contract (KVKK Art. 5(2)(c), GDPR Art. 6(1)(b)).
• To record your guests and gifts and run your invitation page: your legitimate interest in planning your events. Guests who reply on the invitation page agree to their reply being shared with the couple.
• Analytics and crash reports, to improve the app and keep it secure: our legitimate interest, with a one-tap opt-out (KVKK Art. 5(2)(f), GDPR Art. 6(1)(f)).
• Marketing emails: only with your explicit consent, which is off by default.
• Birth date: your explicit consent, given by filling in this optional field.
• Security, logs, proof of consent and requests from authorities: our legal obligations, including those under Law No. 5651, and our legitimate interest.

Sharing with your partner

When you pair with your partner, your shared plans are visible to and editable by both of you. Either of you can export the shared data, and resetting data affects both of you. If you leave the couple, the shared data stays with the couple.

Analytics and crash reports

We use PostHog (EU) to understand which screens and features are used. It receives a pseudonymous ID, event names and technical properties such as app version, platform and language. It never receives your name, email address, notes, amounts, guest names or photos, and automatic capture and session recording are turned off.

We use Sentry (EU) to find and fix errors. It receives error details, device and operating system information, the app version and a pseudonymous ID.

Both are on by default. You can turn them off at any time in Settings → Data & privacy → Usage data sharing (Ayarlar → Veri ve gizlilik → Kullanım verisi paylaşımı).

Notifications

If you allow notifications, reminders and love notes are delivered through Expo and Apple's or Google's push services. A love note's text and your partner's name can appear in the notification; you can hide these previews in Settings. Gift amounts never appear in notifications, and we don't send marketing notifications.

Permissions

The app asks for a permission only when you use the feature that needs it, and every permission is optional:

• Camera: to photograph receipts, products and memories, and to scan your partner's invite code.
• Photos: to upload the photos you pick. The app never reads your whole photo library.
• Calendar: to add special days to your phone's calendar. Your calendar is never read.
• Location (approximate, while in use): to centre the map when you choose a venue. Your location is not sent to our servers; only the address you choose is saved.
• Notifications: for reminders, countdowns and love notes.

Who receives your data

These service providers process data on our behalf:

Exchange rates come from the Central Bank of the Republic of Türkiye (TCMB); no personal data is sent. Maps and address search run on your device using Apple's or Google's services. Apple and Google act as separate controllers for their app stores and sign-in services. We do not sell personal data and we do not share it for advertising.

Transfers abroad

Our infrastructure is outside Türkiye, so using Bizim Yuva means your personal data is transferred abroad: it is stored in the European Union, and push notifications and app updates pass through the United States. These transfers rely on the standard contracts set out in Article 9 of KVKK; we do not ask for separate consent for them.

How long we keep data

• Your account and plans: as long as your account exists.
• Items you delete: kept in the trash for 30 days, then deleted permanently.
• Account deletion: after a 30-day waiting period, deleted permanently within about a day. A guest account is deleted at once and erased within 7 days.
• Inactive guest accounts: deleted after 12 months without use, after reminders.
• Backups: up to 30 days.
• Server logs: 365 days, with masked IP addresses.
• Crash reports: 90 days. Analytics data: 14 months.
• Invitation page replies: until 90 days after the event, or sooner if the event or account is deleted.
• Data export links: 7 days.
• Notifications: up to 180 days.
• Support messages: 2 years, no longer linked to your account once it is deleted.
• Consent and acceptance records: as long as the law requires us to be able to prove them.

Deleting, resetting and exporting

• Delete your account: in Settings → Data & privacy → Delete my account (Ayarlar → Veri ve gizlilik → Hesabımı sil), or by email. See how account deletion works.
• Reset your data: delete all or some of your plans but keep your account. Deleted items stay in the trash for 30 days. This affects both partners.
• Export your data: download a copy of your data (JSON) from Settings at any time; the link is valid for 7 days.

Children

Bizim Yuva is for people aged 18 and over and is not directed at children. If we learn that an account belongs to someone under 18, we close it and delete its data within 7 days.

Advertising

Bizim Yuva shows no ads, contains no advertising or tracking SDKs and does not use your device's advertising identifier. If we introduce ads in the future, they will not be targeted at you, and we will update this policy and let you know in advance.

Security

We protect data with encryption in transit, private storage, hashed passwords and access controls. No system is perfectly secure; if you notice a problem, write to kvkk@bizimyuva.tr.

Your rights

Under Article 11 of KVKK and the GDPR you can ask whether we process your personal data, get information about it and a copy, have it corrected or deleted, learn who it was shared with at home or abroad, object to its processing, and claim compensation for damage caused by unlawful processing.

Write to kvkk@bizimyuva.tr. We will confirm your identity and answer within 30 days. You also have the right to complain to the Personal Data Protection Authority (KVKK) or to your local data protection authority. We do not make decisions about you based solely on automated processing.

Changes

We may update this policy. If the changes are significant, we will tell you in the app before they take effect. The date above shows when the policy was last changed.