Privacy Policy and Information Notice

1. Introduction and scope

This Privacy Policy and Information Notice explains how Arda İpekçi, an individual developer and data controller under Türkiye's Personal Data Protection Law No. 6698 (KVKK), handles personal data in the Düş Kapanı: Kahraman Sensin app (Dreamcatcher Stories). Reading this notice does not itself constitute consent or a contract. Consent for processing children's data is requested separately in the app and may be withdrawn in Settings. Third-party stores and payment providers have their own privacy policies.

2. Data controller

Arda İpekçi (individual developer), Kuştepe Mah. İzmen Sitesi A1 Blok No: 8 D:10 Şişli / Istanbul, Türkiye. Email for general and KVKK requests: destek@duskapani.com.

3. Definitions

A parent or guardian is an adult legal representative who creates an account, enters child details and makes purchases. A child is a person under 18 whose profile is created by that parent or guardian. Explicit consent is freely given, informed consent for a specific purpose. Personal data identifies or can identify a person. Processing includes collecting, recording, storing, changing, disclosing, transferring or deleting data. A processor handles data on the controller's behalf.

4. Personal data we process

4.1 Parent or guardian data

• Optional name and surname, email address (including an Apple Hide My Email relay address where used), Apple or Google user ID, account creation and last sign-in times.
• Regular sign-in uses Apple on iOS or Google on Android. A limited number of email-and-password accounts may be used for store review and developer testing; passwords are stored only as cryptographic hashes.
• A restricted Apple or Google provider user identifier, without your name or email address, is kept to prevent repeated claims of the one-time free story after account deletion.
• Purchase status, star balance and account transactions.
• Limited first-story activation records: predefined screen/action and status codes, account user ID, random event and session IDs, app version/build, platform and event/server timestamps. These do not contain a child's name, birth date or appearance, questionnaire or story content, free text, raw errors, advertising/device identifiers or location.
• If notifications are enabled, a push token and platform indicator. Apart from the app/build/platform data above, we do not collect OS version, device language or advertising/device IDs such as IDFA, IDFV or GAID.

4.2 Child data

With a parent or guardian's explicit consent: name or nickname; age band (0–3, 4–6, 7+); optional gender; characteristics, interests and story themes; text descriptions of appearance; and names and text descriptions of family members or side characters. We do not upload or collect real child photos, facial or biometric data. AI-created reference illustrations may be kept for character consistency; they are not real photographs.

4.3 Generated data

Personalised story text, AI-generated illustrations and text-to-speech audio.

4.4 Payments

Apple App Store and Google Play process payments. We do not directly collect or store card or bank details; we receive transaction confirmation and purchase status.

5. Purposes and legal grounds

Under KVKK Articles 5 and 6, we process account and session data to perform the contract; child profiles and personalised story data with parent or guardian explicit consent; purchases to perform the contract; safety review, free-story abuse prevention, support, and limited service improvement on legitimate-interest grounds where rights are not harmed; and tax/KVKK records to meet legal duties. First-story activation records are minimised, are not used for advertising, marketing or behavioural profiling, are not sent to a third-party analytics SDK, and follow the retention period in section 10.

6. Service providers

Data is shared only as needed to provide the service, under relevant processing arrangements:

• OpenAI (US): personalised story text, using child profile and story choices for generation.
• Anthropic (US): child-safety and character-consistency checks for generated illustrations, using images and limited character descriptions.
• Google (US): Android sign-in, Gemini illustrations and narration, text/image safety review, Google Play distribution and payments.
• Supabase (Frankfurt, EU): database, authentication, file storage and limited first-party service improvement records.
• RevenueCat (US): purchase management with anonymous user ID and purchase status.
• Apple (US): iOS sign-in, app distribution and payments.
• Cloudflare (global): informational website, legal pages and developer admin traffic; it does not process mobile users' in-app profile or story content for this purpose.
• Expo (US): push delivery using a device push token, without child profile data.

Provider roles may change. We publish current recipients and purposes in this policy and apply any required notice or consent process for a new recipient category or processing purpose. We do not sell or rent personal data or share it for third-party marketing. Data may be disclosed to authorities when legally required.

7. International transfers

Account, profile, content and files may be hosted by Supabase in Frankfurt, Germany. US providers including OpenAI, Anthropic, Google, Apple, RevenueCat and Expo may process limited data for generation, safety, authentication, purchases and notifications. Cloudflare may process limited website technical data, including IP addresses and access logs, on global infrastructure. Transfers are limited to necessary data and occur under applicable KVKK Article 9 conditions, such as an adequacy decision, appropriate safeguards, standard contracts or other lawful transfer grounds. Children's data is not transferred for advertising, behavioural profiling or third-party marketing.

8. Your rights

Under KVKK Article 11, you may ask whether data is processed, request information about processing and its purpose, learn who receives data in Türkiye or abroad, request correction or deletion under the applicable conditions, ask that corrections or deletions be notified to recipients, object to an adverse result based solely on automated analysis, and seek compensation for unlawful processing. Write to destek@duskapani.com; we respond within 30 days.

9. Security

Measures include TLS in transit, infrastructure encryption at rest, restricted system roles and row-level database access controls, Apple/Google sign-in, device secure storage for session keys, data minimisation and confidentiality duties. If a breach is identified, we notify the Turkish Personal Data Protection Authority as soon as possible and within 72 hours, and affected people as soon as reasonably possible, as required by KVKK and Board decisions.

10. Retention

• Account/profile data and generated stories: while the account remains active. Your own stories are not locked again while the account remains active.
• On account deletion: account, profiles, generated and purchased stories, and associated personal data are permanently deleted, except legally required transaction/billing records and the restricted abuse-prevention identifier.
• Apple/Google provider user identifier: while the one-free-story rule and its abuse-prevention purpose remain in effect, even after account deletion; never for advertising, marketing or profiling.
• First-story service improvement events: no more than 90 days after receipt, or deleted sooner with the account.
• Transaction/billing records: the period required by Turkish tax law; system and debugging logs: 90 days; safety review records: one year; KVKK request/response records: three years.

Data is deleted, destroyed or anonymised when its retention period or purpose ends.

11. Extra protections for children

Before child data is sent and saved, the app presents this notice, an adult parent/guardian declaration and a separate unticked explicit-consent checkbox. Consent is verified against the current policy version on the server and its version/date is recorded. A child-data-free welcome screen may appear after authentication. We do not collect child photos, voice recordings, biometric or location data, contacts or social-account links. Child data is not used for marketing or ad profiles. Parents may update or delete a child's profile and exercise KVKK Article 11 rights on the child's behalf. See our Child Safety Standards.

12. Cookies and local storage

The mobile app does not use ordinary HTTP cookies. SecureStore/Keychain/Keystore holds session keys and tokens while signed in. Pending service improvement events after consent are limited to 24 records and seven days; the random activation session ID rotates after 24 hours. AsyncStorage holds preferences and app cache until cleared. The app document directory holds downloaded audio and illustrations for offline use until cleared. These are not shared for marketing. The website uses only necessary functional cookies.

13. Policy changes

We may update this policy as the service, law or technical needs change. Updates take effect when published. We request fresh explicit consent when required and notify users of other material changes by email and in the app. The current English policy is always available at duskapani.com/en/privacy-policy.html. The Turkish version is available through the language switch above.

14. Contact and complaints

Email destek@duskapani.com or write to Kuştepe Mah. İzmen Sitesi A1 Blok No: 8 D:10 Şişli / Istanbul, Türkiye. For a KVKK request, provide the identity and contact details needed to verify you and the subject of your request. Requests are answered within 30 days and are normally free; an applicable statutory tariff may apply if processing incurs extra cost. If dissatisfied, you may complain to the Turkish Personal Data Protection Board at kvkk.gov.tr.

15. Information for US residents

Dreamcatcher Stories is a parent-managed app. Children cannot register for an account or send their personal information directly to us through the app. A parent or legal guardian chooses the details entered about a child. The app does not use children's information for targeted advertising, and we do not sell or share personal information for cross-context behavioural advertising.

Depending on where you live and whether a state privacy law applies to us, you may have rights to know or access the personal information we hold, request a copy, correct it, request deletion, and appeal a denied request. You can submit a request at destek@duskapani.com. We may ask for information needed to verify your identity or parental authority. We will respond within the period required by the applicable law. We will not discriminate against you for exercising an applicable privacy right. Some information may be retained where the law permits or requires it, as described in section 10.

Parents may review, update or delete their child's profile and stories through the app, or contact us to request access or deletion and to stop further use of the child's data. No child profile is saved without the parent or guardian consent controls described in section 11. For US children under 13, additional protections may apply under the Children's Online Privacy Protection Act (COPPA); this notice describes our data practices and does not replace any notice or consent step required in the app.