Privacy Policy

Effective date: 29 September 2026

This policy explains how your personal data is processed when you use the Tarım Rehberi mobile app (Android and iOS) and the server services it connects to. It also serves as the information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and Articles 13–14 of the EU General Data Protection Regulation (GDPR). If there is any discrepancy, the Turkish version prevails.

1. Data controller

The data controller is the app's developer, Selman Gündağ (Türkiye).
Contact and all requests: gundagselman@gmail.com

2. Data we process and why

2.1 Account information

• Data: name, e-mail address, Firebase user ID (uid), e-mail verification status and verification-link details. With Google Sign-In, the name and e-mail of your Google account; with Sign in with Apple, the name and e-mail Apple shares (this may be Apple's private relay address).
• Your password is not stored on our server; for e-mail/password sign-in it is handled by Firebase Authentication (Google). Password-reset e-mails are sent by Firebase.
• Purpose: to create your account, sign you in, verify your e-mail address and link your data to your account.

2.2 Location and elevation

• Data: your device location (latitude/longitude, medium accuracy), the city name and elevation derived from it, and the garden location (latitude/longitude/elevation) saved for each plant you add. This data is stored on our server.
• Purpose: to calculate weather, frost and climate warnings, the care calendar and notifications for your garden's own location and elevation. Because notifications are calculated on the server, the location has to be stored there.
• Location is read only while the app is open; no background location is collected. If you do not grant location permission you can pick your location manually on the map or by address search; if you pick none, a default location (Ankara) is used.
• Location is also sent directly from the app to weather, air-quality, elevation and map services (see Section 4).

2.3 Garden, plant and task data

• Data: the plants you add, variety, quantity, sowing/planting date and start type (seed/seedling/established), tree age, growth-stage calculations (growing degree days), expected and actual harvest dates; care tasks and whether they are done; your garden type and experience level.
• Purpose: to provide the garden calendar, tasks, growth-stage tracking and notifications.
• A copy of this data is also kept on your device so the app opens quickly.

2.4 Photos and AI features

• Data: the photos you choose for disease diagnosis, plant identification and soil-report reading; an optional note (up to 400 characters) and crop plan; together with the app language, garden type, approximate location (rounded to roughly 10 km) and the last 7 days of weather data.
• How it is processed: the photo is sent to our server, held in memory only for the duration of the request and forwarded to the AI provider (Anthropic or OpenAI). Photos are not stored on our server. Diagnosis and identification results are not stored on the server either.
• Soil analysis: the values read from your report (e.g. pH, organic matter, nutrients) and the analysis date are saved to your profile; you can ask us to delete them, and they are deleted when you delete your account.
• Usage log: which AI feature you used and when, the model used, number of tokens and cost. Purpose: to apply free-usage limits, prevent abuse and monitor costs.
• AI results are generated automatically and are for information only; no automated decision with legal effect is made about you.
• Camera and photo-library permissions are used only when you choose a photo.

2.5 Notifications

• Data: Firebase Cloud Messaging device token and platform; a log of notifications sent (title, body, related plant, delivery result); the in-app notification inbox and read status; your notification preference.
• Purpose: to send care, frost and harvest notifications, avoid duplicates and fix delivery errors.
• You can turn notifications off in the app settings or in your device settings.

2.6 Premium subscription and purchases

• Data: Premium status, product (monthly/yearly), platform (App Store/Google Play), purchase verification data (iOS transaction ID or Android purchase token), subscription expiry date and verification date.
• Purpose: to verify your subscription with Apple or Google and unlock Premium features.
• We never see or store your card or payment details; payment is taken by Apple or Google.

2.7 App settings

Language, dark mode, font size, notifications on/off and microclimate preference. Purpose: to remember your preferences and send notifications in the right language.

2.8 Feedback ("Report Issue")

Your message, name, e-mail address and user ID are stored, and the message is also forwarded to the developer's mailbox (Gmail). Purpose: to look into the problem you reported and reply to you.

2.9 Error reports and server logs

• App error report: error type, error message, stack trace, operating-system name and version, app version and user ID. Device model is not collected.
• Server error record: request path, IP address and user-agent.
• Server access logs: IP address, time, request path (including coordinates for weather requests).
• Purpose: to fix errors, keep the service secure and detect abuse.

2.10 What we do not collect

We do not collect advertising IDs, contacts, microphone, SMS, health data or payment-card details. We do not process special categories of personal data. We do not sell your data or share it for advertising.

3. Legal bases

• Performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)): account, garden calendar, location- and elevation-based notifications, AI requests you start, Premium subscription.
• Legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)): retention and disclosure duties under the law.
• Legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)): security, debugging, abuse prevention, usage limits and backups.
• Explicit consent (KVKK Art. 5/1 and Art. 9; GDPR Art. 6(1)(a), Art. 49(1)(a)): for international transfers where no other transfer mechanism applies (see Section 5). Location, camera, photo and notification permissions are also given by you on your device's permission prompts and can be withdrawn at any time.

4. Recipients and service providers

Data is shared only with the following providers, for the stated purpose and only as far as necessary. They provide their services on our behalf or under their own terms.

• Under Anthropic's and OpenAI's commercial API terms, this content is not used to train their models by default; the providers may keep it for a limited period for safety and abuse monitoring.
• Agricultural news is fetched by our server from public feeds of official institutions and news sources; no data about you is shared in the process. Market prices are entered by the administrator.
• External links in the market-prices section are subject to the linked site's policy.
• Data may be disclosed to competent authorities where required by law.

5. International transfers (KVKK Art. 9)

Our app server is located in Germany, and some authentication, notification, AI, map and e-mail providers process data in the USA and other countries. Your personal data is therefore transferred abroad when you use the app.

These transfers are made under Article 9 of KVKK on the basis of standard contracts and the appropriate safeguards offered by the providers, and, where these are not available, on the basis of your explicit consent. For transfers from the EU/EEA, the providers' safeguards such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework apply.

You can withdraw your explicit consent at any time by writing to gundagselman@gmail.com. However, the app's core functions (sign-in, notifications, AI features) cannot work without these transfers; if you withdraw consent you will not be able to use them and your account may need to be deleted.

6. Retention periods

Expired data is deleted or anonymised. Where the law requires a longer period, that period applies.

7. Your rights and how to apply

Under Article 11 of KVKK you have the right to:

• learn whether your personal data is processed and request information about it,
• learn the purpose of processing and whether it is used accordingly,
• know the third parties in Türkiye or abroad to whom it is transferred,
• request correction of incomplete or inaccurate data,
• request erasure or destruction under the conditions of Article 7 of KVKK,
• request that correction and erasure be notified to third parties to whom the data was transferred,
• object to a result against you arising exclusively from automated analysis,
• claim compensation for damage caused by unlawful processing.

Users in the EU/EEA also have the GDPR rights of access, rectification, erasure, restriction, data portability, objection and withdrawal of consent, and the right to lodge a complaint with their local supervisory authority.

How to apply: send your request from the e-mail address registered to your account to gundagselman@gmail.com with the subject "Data protection request". Include your name, the e-mail address of your account and your request. We may ask for additional information to verify your identity. Requests are answered free of charge within 30 days at the latest. If your request is refused, you find the answer insufficient or we do not answer in time, you may complain to the Turkish Personal Data Protection Board (KVKK Art. 14).

In the app you can also change your location, delete plants from your garden, turn off notifications and delete your account. For other correction or deletion requests, write to us.

8. Deleting your account

In the app: Home → profile icon (top left) → Profile & Settings → Delete My Account (last item) → confirm with Delete Account.

Deletion happens immediately: your account, location and garden data, tasks, soil analysis, notification tokens and logs, AI usage log, feedback and error reports are deleted from our server, and your Firebase sign-in account is deleted too. If you used Sign in with Apple, the Apple authorisation is revoked.

If you cannot access the app, use the e-mail method on the Account Deletion page. Records that may remain after deletion, and for how long, are listed in Section 6.

9. Children

Tarım Rehberi is not directed at children. We do not knowingly collect personal data from children under 13; in the EU/EEA, users under 16 should use the app only with the consent of a parent or guardian. If you believe a child's data is being processed, contact us and the data will be deleted.

10. Security

• All connections between the app and the server are encrypted with HTTPS/TLS.
• Requests that access your account data are authorised by verifying the Firebase ID token on the server.
• We do not store passwords or photos; only a rounded location is sent to AI providers.
• Access to the server and database is restricted to the authorised person; backups are kept for a limited time.

No system is 100% secure. In the event of a data breach, the Personal Data Protection Board and affected users will be notified as required by Article 12 of KVKK (and, where applicable, the GDPR).

11. Ads, analytics and tracking

The app contains no advertising, advertising IDs, analytics (e.g. Firebase Analytics) or crash-reporting SDKs (e.g. Crashlytics). Your data is not used to track you across other companies' apps or websites and is not shared with data brokers.

12. Changes and contact

We may update this policy; the current version is always on this page with its effective date at the top. We will inform you of significant changes in the app or in the store release notes.

Questions and requests: gundagselman@gmail.com — Selman Gündağ