Privacy Policy

This notice explains what information is processed in the Yulaf app and website, which services are used and how to make a request about your data. Send privacy questions to [email protected]. 1. Account and profile information The name, email address, language and preferences you provide when creating an account or editing your profile are processed to manage your account and personalise the app. When you sign in with Apple or Google, information necessary for sign-in is received from the relevant authentication service. 2. Kitchen information, recipes and shared lists Ingredients, quantities, dates, shopping lists, recipes, meal plans and kitchen memberships you add are processed to provide your chosen features. Information you add to a shared kitchen can be seen by its other members. Keep this in mind when inviting people and sharing. 3. Photos, voice and AI requests Requests, conversation history, selected preferences and product or receipt photos submitted to AI features are processed to answer your request. Image analysis records and conversation history may be associated with your account. Avoid sharing personal information on receipts or in photos that is unnecessary for the service. When you use voice input, the selected audio file is sent to OpenAI's transcription service. The resulting text is used to process your request and may become part of the related conversation or analysis record. Converting speech to text does not mean the audio file and resulting text have the same retention conditions. Dietary preferences or messages you write may contain information about your health. Share only necessary information. This policy does not replace any explicit consent that must be obtained separately for special-category data or other processing. The app is not a medical advice service. 4. Service providers and data sharing Yulaf uses external services for some features. AI inputs therefore cannot be described as remaining solely on your device or Yulaf servers. The provider and model used may vary with the feature and service availability. OpenRouter and the model providers to which requests are routed, Google Gemini or OpenAI may process text, recipe, translation and image-analysis requests. Relevant ingredients, preferences, conversation context and selected images may be transferred for this purpose. OpenAI is used for transcription, while fal.ai processes descriptions and generation parameters to produce recipe images. Firebase/Google is used for authentication and mobile app usage, error and performance measurement; OneSignal for notification delivery; and RevenueCat, Apple and Google for verifying purchase and subscription entitlements. Notification services may receive user or device notification identifiers and relevant notification content. Error or session analytics services may also process technical data when enabled. Hosting and email services support operation of the app and responses to support requests. Information may be processed outside Turkey through external providers. Providers' processing, retention and transfer conditions depend on the relevant service and agreements. Contact our support address to request information about recipients and transfer conditions. 5. Purchases, support and technical records Store transaction identifiers, selected products and subscription status are processed to verify purchases and subscriptions. We do not directly receive your payment card details for store purchases. Your name, email address, subject and message in the contact form are processed to respond to you. Technical records, usage events, device and app information may be processed for security, troubleshooting, performance and service improvement. Do not include passwords or payment card details in support messages. 6. How is information collected and used? Information is collected electronically through app and website forms, selected files and voice input, use of the service, and sign-in or payment services. It is used to provide your account and chosen features, respond to your request, maintain security and fulfil applicable legal obligations. The legal basis for processing depends on its purpose and applicable law. Processing that requires consent and does not fall within performance of a contract, legal obligations or legitimate interests respecting your fundamental rights requires separate appropriate permission. Reading this notice or using the app does not mean that you give unlimited consent to all data processing. 7. Retention and deletion requests Account-related kitchen information, conversations and analysis records are stored to maintain the relevant app features. Removing an item from your device, clearing browser data or uninstalling the app does not automatically delete your server account and records. Legal records and backups may have separate retention conditions. You can ask our support address about the retention period and deletion status of a particular data category. You can initiate an account deletion request in the app's account settings. The current flow closes the account for use and records the deletion request; this step does not mean all associated data has been permanently deleted. For information about the scope, status and completion of your permanent deletion request, contact [email protected]. Identity verification may be requested to the extent necessary to respond to your request. Deleting or closing your account does not automatically cancel a store subscription. Manage it separately through the App Store or Google Play account where you purchased it. 8. Permissions, security and cookies You can manage photo, microphone and notification permissions in device settings. Turning permissions off does not automatically erase previously processed information. Although measures such as access controls and secure transmission are used, no system can guarantee absolute security. Essential website session and form-security cookies are explained on the Cookies and Local Storage page. Mobile app permissions and device storage are separate from browser cookie settings. 9. Family and children's information Yulaf helps family members manage kitchen tasks together. This feature does not mean that a verified child-account or parental consent system exists. Consider applicable age, authority and permission requirements before sharing a child's personal or health information. Tell us if you believe information about a child has been shared inappropriately. 10. Your rights and contact Under applicable law, you may have rights to learn whether your data is processed, request information and access, correction, deletion, restriction of processing, objection and, where appropriate, portability. You may withdraw consent for consent-based processing; this does not retroactively affect prior lawful processing. Your rights to apply to a competent data protection authority remain unaffected. Send privacy and data requests to [email protected]. Specify the information or account your request concerns; do not send your password. Requests are handled under applicable legal conditions and time limits. 11. Privacy choices In the iOS app, basic usage analytics starts automatically only when both the device region and connection country indicate the United States. Otherwise it stays off unless you enable it in Settings. Usage analytics If enabled, Firebase/Google Analytics receives app usage events and an app instance identifier to help improve Yulaf. This choice does not enable session recording, advertising identity matching or linking RevenueCat purchases to Firebase. RevenueCat handles purchase verification and its own subscription reports separately. We do not link RevenueCat purchase records to the Firebase usage identifier. Ad install measurement We use Apple's SKAdNetwork to measure ad-driven installs. This flow does not ask for App Tracking Transparency (ATT) permission or start Meta SDK advertising-identifier matching. Install reports do not link individual purchases to ads. Account access, purchase verification, security and essential diagnostics continue independently of these choices. These choices do not enable session recording. You can change your choices in Settings at any time. We save your choices, their date and the notice version on this device. Withdrawal stops new optional collection; server-side changes need an internet connection and are retried when the app reopens. Previously sent data is not automatically erased. For access or deletion requests, contact [email protected].