Privacy Policy

1. Information we process and why

• Installation identity. The app creates a technical account identifier and authentication session through Supabase without asking you to register with an email address or password. This identifier is also used with RevenueCat to associate purchases with your installation. It is pseudonymous, not a guarantee of anonymity.
• Photos and vision boards. You may select photos or take pictures using the permissions provided by your device. The editor processes these locally. The current text-to-image feature does not send your selected camera or photo-library pictures to Gemini. Images you export to Photos remain subject to your device and backup settings.
• AI generation requests. When you request an AI image, your prompt and generation settings are sent through our API, hosted by Vercel, to Google Gemini. The generated images pass through our API to your device. Do not include sensitive personal information or information about other people without an appropriate basis.
• Subscriptions and usage. We process product identifiers, purchase and renewal information, subscription status and dates, technical user identifiers, and transaction references to verify access, restore purchases, calculate image quotas, and prevent duplicate usage. Apple processes App Store payments; we do not receive your full card number or card security code.
• Generation and support records. Our database stores request identifiers, a fingerprint of generation inputs, image counts, timestamps, generation and delivery status, failure reasons, support codes, and any support adjustments. The app may report whether an image was saved or displayed. These records help account for quota and investigate problems.
• Technical information. Our hosting, authentication, purchase providers (and advertising providers in older app versions) may process IP addresses, device and app information, request logs and diagnostics to deliver their services, protect against abuse and measure reliability.
• Support correspondence. If you email us, we receive your email address and any information you choose to send. We use it to answer your request. Please avoid sending payment credentials or unnecessary sensitive information.

We do not request GPS location, contacts, a postal address, a phone number, or social-media login information for the app's current features. An IP address may still reveal an approximate location to service providers.

2. Service providers and disclosures

We share information needed for the following services. Providers may also process information for their own purposes where described in their applicable terms and privacy notices.

• Apple: App Store payments, subscription management and purchase restoration. Apple privacy policy.
• RevenueCat: purchase verification, subscription status, restoration, and subscription reporting. It processes app user identifiers, transaction and product information, and related technical data. RevenueCat privacy policy.
• Supabase: installation authentication and storage of subscription, usage and support records. Supabase privacy policy.
• Vercel: hosting this page and the API that processes generation and subscription requests. Vercel privacy policy.
• Google Gemini API: generating images from text prompts. We use an API project with active billing. Under Google's paid-service terms, prompts and responses are not used to improve Google's products. Google may retain them for a limited period for abuse prevention, security and legal requirements. This is not a promise of zero retention. Gemini API terms and Google privacy policy.
• Google AdMob (versions before 1.0.1 only): serving advertisements where enabled in older versions. Version 1.0.1 removes the advertising SDK. See the advertising section below and Google's partner data explanation.

We may also disclose information when required by law, to respond to valid legal requests, to protect users and the service against abuse, or to handle a business transfer subject to applicable privacy obligations. We do not operate a public user directory or sell user lists.

3. Advertising and measurement

Version 1.0.1 does not include an advertising SDK or display advertisements. Earlier versions included Google AdMob and requested non-personalized ads; the following description applies only to those older versions. Non-personalized does not mean that no data is processed: advertising services may use IP addresses, device information, identifiers and ad interactions for delivery, frequency limits, reporting and fraud prevention. Device identifiers are subject to platform permissions and the SDK's configuration.

We do not run our own remarketing campaigns or integrate Google Analytics in the current app. RevenueCat provides subscription reporting, and infrastructure providers process operational measurements. Advertising measurement applies only to older versions that still include ads. This privacy page itself contains no advertising, analytics scripts or forms; ordinary hosting request logs may still be processed.

4. Purposes and legal grounds

Where applicable law requires a legal basis, we process information to provide the features and subscriptions you request, for legitimate interests such as service security, abuse prevention, quota accounting and support, and to comply with legal obligations. Where consent is required for optional access or processing, we rely on that consent. Device permission alone does not replace any additional consent required by law.

You can revoke camera and photo permissions in device settings. You can stop sending prompts by not using AI generation. Revoking permissions or deleting data does not automatically cancel an App Store subscription.

5. Storage, retention and deletion

Images and prompts: our API processes image bytes in memory for delivery and does not maintain a cloud image gallery. The quota database does not store raw prompt text or image files. The app can retain a pending prompt locally for request recovery and stores generated images locally. Provider processing and retention, including Gemini security logs, are separate from our quota database. Device backups and exported copies may retain local content.

Technical account: the app's Settings screen includes a delete-data option that deletes the installation's Supabase authentication account and installation record, attempts to remove its locally stored AI images, and clears the local session. Deletion may need to wait for an in-progress generation to finish or expire. The app may create a new technical identity when used again.

Records that remain: deleting the technical account removes its user association from our subscription-period and generation records, but does not automatically erase the underlying quota history, transaction-derived references, support events or grants. These remain to preserve purchase restoration, prevent repeated quota claims and resolve disputes. They may still be linkable through transaction or support information and should not be treated as fully anonymous. The current system does not automatically purge these records after a fixed number of days.

The in-app deletion action does not automatically erase records held by Apple or RevenueCat, support emails, provider logs, backups, or images exported to your photo library. Contact us for a broader deletion request. We assess retained records against the request and applicable obligations, delete information no longer needed, and explain any justified retention. Support and diagnostic information is retained according to the purpose of the issue, security needs and legal obligations; backup and provider retention schedules also apply.

To stop future subscription charges, manage or cancel your subscription through Apple. Deleting or reinstalling the app does not cancel it or reset previously used quota.

6. International processing and security

Arda Adalar operates from Türkiye. Our service providers operate internationally, so information may be processed outside your country, including in Europe and the United States. Where applicable law requires it, international transfers require an appropriate legal mechanism and safeguards; a link to a provider's policy does not itself establish those safeguards. Contact us for information about the arrangements relevant to your data.

We use HTTPS, authenticated API access, database access controls and server-side quota checks to protect information. No storage or transmission method is completely secure.

7. Your choices and privacy rights

Depending on your location and applicable law, you may have rights to access, correct, delete or obtain a copy of your personal data, restrict or object to processing, withdraw consent, and complain to a supervisory authority. These may include rights under Türkiye's KVKK, the EEA/UK data protection framework, and applicable US state laws. Withdrawing consent does not invalidate processing that was lawful before withdrawal.

Email ardaadalar5@gmail.com with your request. A support code from the app may help locate records, but a support code alone does not prove identity. We may request proportionate verification before disclosing or changing data. We will respond within the time required by applicable law and explain any applicable exceptions.

If applicable law grants a right to opt out of sale or sharing for targeted advertising, or to limit particular uses of sensitive data, contact us to exercise that right. Older versions request non-personalized advertising; legal definitions of sale or sharing may be broader than exchanging information for money. We do not discriminate against users for exercising applicable privacy rights.

8. Children and AI features

The app is not directed to children under 13, and we do not knowingly collect their personal information. The Gemini-powered AI generation feature is intended for adults aged 18 and over. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

9. Changes and contact

We will update this page and its date when our practices change. For material changes, we will provide additional notice where required by law. Questions, privacy requests and complaints may be sent in Turkish or English to:

Arda Adalar · VisionBoardAI · Türkiye
ardaadalar5@gmail.com