App Privacy Policy

This is the privacy policy of the Kidlio mobile app. The app is not yet available on the App Store or Google Play; this policy applies from the day the app is released. How the kidlio.net site itself handles data is described in a separate notice: Privacy Policy. This English text is a translation; if it conflicts with the Turkish text, the Turkish text prevails.

1. Data Controller and Purpose of This Notice

This Privacy Policy explains for what purposes, on what legal grounds, and how personal data is processed in the Kidlio app, which is operated by Brainytech. It serves as the privacy notice required under Article 10 of Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK) and the information required under Article 13 of the EU General Data Protection Regulation (GDPR).

The data controller is Meryem Bilginer, a sole proprietorship operating under the Brainytech brand.
Address: Selimpaşa Mah. 1010. Sk. No: 10/1 İç Kapı No: 79, Silivri/İstanbul
MERSİS No.: 0609081922800001
Email: contact@brainytech.net

2. Data We Collect and How We Collect It

We collect your personal data electronically, from the information you enter in the app and automatically while you use it:

• Account information: first and last name, email address, password (we never store the password itself, only an irreversibly hashed version), the account ID provided by Apple or Google if you sign in with them, your app language preference, your last login time, and the session key that keeps you signed in
• Family information: family group name (the name you give your family in the app), family membership and role, optionally your relationship to the child (e.g., mom, grandpa), and the email address of anyone you invite to your family
• Your child's name (first name only), date of birth, gender, avatar, and interest categories (to personalize content for their age)
• Preferences you give during initial setup (e.g., your goal, how much time you can spend each day, the categories you're interested in)
• Optionally, height/weight measurements and short memory notes that you add to your child's profile
• Optionally, bedtimes, wake-up times, and nap records that you enter
• Activities your child has completed and viewed, favorites, and plans you create (including a plan's date, time, and optional note; for progress tracking and recommendations)
• Your child's reaction to an activity, as you observed it (e.g., “Loved it / It was okay / Didn’t quite warm up to it”) — used only to personalize recommendations and plans; it is not a health or developmental assessment
• Subscription information: plan, billing period, start and end dates, the payment provider's transaction ID, and the cancellation reason you optionally choose when canceling. Your full card number and security code never reach us; for card payments, we receive only the cardholder's name, the last four digits of the card, and the card type from the payment provider
• If you opted in, your consent to receive offers and recommendations by email
• Security logs: technical records that include your IP address when a security event occurs, such as a failed login attempt
• App verification: on iOS, Apple's App Attest service is used to verify that requests reaching our servers come from the genuine Kidlio app. For this, the identifier of a security key generated on your device and Apple's attestation for that key are sent to our server; this information is not linked to your account or your child and is processed only to prevent abuse
• Usage statistics, only if you turn them on in Settings (see Section 6)

If you add a profile photo, it is stored only on your device and is not sent to our servers. Reminder and sleep notifications are created on your device; no notification ID is sent to our servers for them.

Your account information and your child's name and date of birth are required to provide the service; without them, we cannot provide it. All other information is optional.

3. Purposes and Legal Grounds

We process your personal data only for the following purposes and on the following legal grounds under the KVKK:

• To create your account, verify your identity, manage family membership, and provide the service: entering into and performing our contract with you (KVKK Art. 5(2)(c))
• To process your child's profile information and recommend activities and plans suited to their age, interests, and the reactions you observe: legitimate interest (Art. 5(2)(f)), so that we can provide the service for your child at your request
• The email address of someone you invite: legitimate interest (Art. 5(2)(f)), to deliver the invitation
• Height/weight measurements and bedtime, wake-up, and nap records (which can be considered health data): only with the explicit consent of the family owner or of an admin the family owner has marked as a parent or guardian (Art. 6(3)(a))
• Subscriptions and payments: performance of the contract (Art. 5(2)(c)); legal obligation for invoicing and accounting records (Art. 5(2)(ç))
• Service messages such as password resets, invitations, and subscription updates, and technical support: performance of the contract (Art. 5(2)(c))
• Offers and recommendations by email: only if you have given consent to receive commercial electronic messages under Turkish Law No. 6563; you can withdraw your consent at any time by emailing contact@brainytech.net
• Keeping the service secure and preventing misuse and unauthorized access: legitimate interest (Art. 5(2)(f))
• Usage statistics to improve the service: only if you turn them on in Settings, your explicit consent (Art. 5(1))
• Legal requests and disputes: legal obligation (Art. 5(2)(ç)) and establishing, exercising, or defending a legal right (Art. 5(2)(e))

4. Protecting Children's Data

Kidlio does not allow anyone under 18 to sign up directly; the app is designed to be used by parents, under parental supervision. Information about a child is always entered by a parent, never by the child. To personalize activity recommendations and track progress, we store only your child's first name (not their last name), date of birth, gender, avatar, interest categories, completed activities, and the reactions you observe after an activity.

If you choose, you can add height/weight measurements and short memory notes to your child's profile; these entries are entirely optional and are only for your family's own tracking. Because height and weight can be considered health data, separate explicit consent from the family owner, or from an admin the family owner has marked as a parent or guardian, is required for each child before the first measurement is added; no family member can add measurements until this consent has been given. This consent is not a condition of signing up. Only the child's parent or legal guardian, or a person they have authorized, should give this consent. The family owner or an admin marked as a parent can withdraw consent at any time from the child's Growth tab; when consent is withdrawn, all of that child's height/weight measurements are permanently deleted.

Memory notes are not designed to be health records; we recommend that you do not enter health information such as illnesses, medications, or vaccinations there. Activity reactions are based only on your own observations and are used to personalize recommendations; they are not a medical, health-related, or developmental assessment or diagnosis.

If you choose, you can also record your child's bedtimes, wake-up times, and naps. Because these records can also be considered health data, they are kept only with the explicit consent of the family owner or an admin marked as a parent, given per child and separately from the height/weight consent. Kidlio stores only the times you enter. It does not measure, score, or comment on sleep quality. Playing a sleep sound does not create a record on its own; a record is saved only if you confirm it. Each record also stores which family member started it and which family member ended it.

If you choose (it is off by default), a notification with a “Woke up” button is shown on the lock screen while a sleep record is open. This notification is created on your device itself, not sent from our servers or any third-party notification service. It shows your child's name and the time the sleep started (anyone who can see your phone's lock screen can see it; you can turn the notification off in settings), and it is removed from your device when the record is closed, when you turn off the notification setting, when consent is withdrawn, or when you log out. If a record stays open for a long time, a reminder notification, also created on your device, may be shown. The family owner or an admin marked as a parent can withdraw the sleep-record consent at any time from the child's Sleep screen; when consent is withdrawn, all of that child's sleep records are permanently deleted.

Kidlio does not provide medical assessments, comments, or guidance based on height/weight measurements or sleep records. The content of these records (measurements, sleep times, and durations) is not used for advertising, analytics, or any other purpose, and is not shared with anyone other than the infrastructure providers that host the service and the family members you invite. For the sleep feature, only event information (a record being started, ended, or edited, your response to a record suggestion, and your notification preference) is counted as a usage statistic, without any information about your child, if you have turned on usage statistics (see Section 6).

We do not collect photos, audio recordings, or location information about your child. You can edit or delete your child's profile and data from within the app at any time.

5. Sharing Your Data

We do not sell or rent your personal data, and we do not share it for targeted advertising. Data is shared only with the following recipients, and only for the stated purpose:

• Infrastructure providers that are essential for running the service (servers and email service): on our behalf and under our instructions, as data processors
• Apple or Google, if you sign in with them, to verify your sign-in; on iOS, Apple also verifies that the app is genuine (App Attest — no account or child information is sent)
• An analytics provider, for usage statistics (PostHog — data is stored in the European Union)
• For subscriptions and payments: Apple App Store and Google Play (when you purchase through the store), RevenueCat, which manages subscription status (your Kidlio user number is shared to match the store subscription to your account), and iyzico for card payments. Your full card number and security code never reach Kidlio's servers; they are processed by the relevant provider.
• Public authorities and courts with legal authority: when required by law or requested by a competent authority

No information about your child is shared with our analytics, sign-in, or payment providers; children's data is stored only on the infrastructure that hosts the service.

Family sharing: Family members invited by the family owner or admins can see the profile information of the children in the family (name, date of birth, avatar), their activity history, height/weight measurements, sleep records, and memories, and can add memories. These family members can add height/weight measurements and sleep records only after the relevant explicit consent has been given for that child. The family owner can make anyone in the family an admin. Admins can invite and remove members, add children, and change a child's basic information; they cannot remove the family owner or delete the family. The family owner can also mark admins who are a child's parent or legal guardian; this mark lets them take over the family if the family owner deletes their account and chooses to delete the family, and lets them give consent for records that may be considered health data. If the mark is removed, the person is notified by email. The family owner can transfer ownership to an admin and must do so before leaving the family. A person who is removed from or leaves the family loses access and must be invited again to rejoin.

6. Usage Statistics

We collect usage statistics to understand which parts of the app are useful, only if you allow it. This is off by default: unless you tick the optional box on the sign-up screen, tap “Share” when the app asks you once (“Help us improve Kidlio?”), or turn on the “Usage statistics” switch in Settings > Privacy, no usage records are sent and no installation ID is created. Leaving it off does not limit any feature of the app. These records are not linked to your name, email address, or account; they are associated only with a random installation ID generated on your device. They therefore do not directly identify you, but legally they are pseudonymous rather than fully anonymous data. While it is on, your IP address technically reaches the analytics provider when records are sent, as is inherent to any internet connection. This analytics collection is based on the explicit consent you give by turning on the switch (Article 5(1) of the KVKK).

What is sent:

• Only a limited set of events: opening the app; completing sign-up and initial setup; completing an activity and tapping a locked activity; viewing the subscription screen and starting a subscription; opening your child's profile and adding a memory (only the memory's type, not its content); starting, ending, or editing a sleep record, your response to the record suggestion shown while a sleep sound is playing, and your sleep notification preference (not sleep times or durations)
• The time of the event and related details (e.g., which activity was done, how long it took, and how many children took part; for subscriptions, the plan, billing period, and currency; the sign-up method and your marketing consent choice; the number of days since sign-up)
• App version, platform (iOS or Android), and a random installation ID generated on your device

What is not sent:

• Your name, email address, or password
• Your child's name, date of birth, age, or any profile information
• Height/weight measurements, the content of memory notes, sleep times, or durations
• Location, contacts, photos, or advertising ID

This data is not used for advertising and is not shared with third parties for marketing. You can withdraw your consent at any time by turning the same switch off; when you do, no new records are sent and any records waiting to be sent are also deleted from your device.

7. How Long We Keep Your Data

We keep your data for as long as needed for the purpose of processing and while your account is active. When you delete your account:

• Your account and your children's profiles become inaccessible; within 30 days, personal information such as your name, email address, and your children's names, dates of birth, and gender is irreversibly anonymized, and your children's height/weight measurements, memories, and sleep records are permanently deleted.
• If other people are in a family you own, you choose what happens to the family before deleting your account: (1) You transfer ownership to an admin; the family, children's profiles, and the family's records stay with the family, and only your own personal information is deleted as described above. (2) You delete the family too; everyone in the family is notified by email, and admins the family owner has marked as a parent or guardian can take over the family within 30 days. If no one takes it over, the family, children's profiles, and all records about the children are permanently deleted or anonymized at the end of the 30 days.
• If you choose “Delete immediately and permanently” when deleting your account, this information is anonymized right away.
• Payment and billing records that we are legally required to keep are retained with restricted access for the period required by applicable law (e.g., the Turkish Tax Procedure Law and Turkish Commercial Code), and are deleted or anonymized at the end of that period.

Height/weight and sleep records are permanently deleted when the relevant consent is withdrawn, even if your account is not deleted. Deleting your account does not automatically cancel a subscription started through an app store; you need to cancel your store subscription separately in your App Store or Google Play settings.

Under Article 7 of the KVKK, you can request the deletion, destruction, or anonymization of your data at any time.

8. Your Rights Under the KVKK

Under Article 11 of the KVKK, you have the right to:

• Find out whether your personal data is being processed
• Request information about it if it has been processed
• Find out the purpose of the processing and whether your data is used in line with that purpose
• Know the third parties in Türkiye or abroad to whom your data has been transferred
• Ask for your data to be corrected if it is incomplete or inaccurate
• Ask for your data to be deleted or destroyed under the conditions set out in Article 7 of the KVKK
• Ask for any correction, deletion, or destruction to be notified to the third parties to whom your data has been transferred
• Object to an outcome that is unfavorable to you and results solely from automated analysis of your data
• Claim compensation if you suffer damage because your data was processed unlawfully

You can download a copy of your personal data at any time in the app under Settings > Privacy > “Copy of my data”, as a single machine-readable file (JSON). This file contains your account, preference, family, sent invitation, subscription, and payment information, as well as the records of the children you added and of the children in families you own or in which you are marked as a parent/guardian. Your password, session tokens, and card details are excluded for security reasons, and other family members' personal details are excluded to protect their privacy.

You can submit your request by emailing contact@brainytech.net from the email address registered in our system, or by any other method listed in the Communiqué on the Procedures and Principles of Application to the Data Controller. Your request will be resolved within 30 days at the latest and, as a rule, free of charge. If your request is rejected, you find the response inadequate, or you receive no response in time, you can file a complaint with the Turkish Personal Data Protection Board within 30 days of learning of the response and, in any case, within 60 days of your request.

9. International Data Transfers

Kidlio is available worldwide. Our application servers, database, and email delivery infrastructure are located in Türkiye. Some of the providers we use to run the service are located outside Türkiye:

• Analytics (PostHog): European Union
• Subscription management (RevenueCat), store payments (Apple, Google), sign-in with Apple/Google, and Apple app verification (App Attest): United States
• Card payments (iyzico): Türkiye

These transfers are made in accordance with Article 9 of the KVKK, with appropriate safeguards, primarily the standard contracts published by the Turkish Personal Data Protection Board. For transfers covered by the GDPR, we rely on the European Commission's adequacy decisions (e.g., the EU-U.S. Data Privacy Framework) or standard contractual clauses. You can request a copy of these safeguards at contact@brainytech.net.

If you are in the European Union or the United Kingdom, your data is processed by Brainytech as a data controller established in Türkiye; the European Commission has not issued an adequacy decision for Türkiye. Your child's data is not transferred to providers outside Türkiye.

10. Users in the European Union and the United Kingdom (GDPR)

If you are in the EU or the United Kingdom, the GDPR (or the UK GDPR) applies to your data.

Legal bases:

• Your account, family membership, subscription, and providing the service: performance of a contract (Art. 6(1)(b))
• Child profile and personalization, and the email address of someone you invite: legitimate interest (Art. 6(1)(f)), so that we can provide the service at your request
• Height/weight measurements: separate explicit consent of the person with parental responsibility for the child (Art. 6(1)(a) and Art. 9(2)(a))
• Bedtime/wake-up and nap records: separate explicit consent of the person with parental responsibility for the child (Art. 6(1)(a) and Art. 9(2)(a))
• Offers and recommendations by email: consent (Art. 6(1)(a))
• Security logs: legitimate interest (Art. 6(1)(f))
• Usage statistics: consent, only if you turn them on in Settings (Art. 6(1)(a))
• Legal retention obligations: legal obligation (Art. 6(1)(c))

Your rights: to access, rectify, and erase your data (the “right to be forgotten”), to restrict processing, to receive your data in a structured format and transfer it (data portability), and to withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. You can download a copy of your data at any time in Settings > Privacy > “Copy of my data” as a machine-readable file (JSON); its scope is described in Section 8.

RIGHT TO OBJECT: You can object at any time, on grounds relating to your particular situation, to processing based on legitimate interest (child profile, the email address of someone you invite, and security logs). You can withdraw your consent to usage statistics at any time in Settings > Privacy.

Requests sent to contact@brainytech.net are answered within one month at the latest. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work, or where the alleged infringement took place.

Kidlio does not make decisions based solely on automated processing (including profiling) that have legal or similarly significant effects on you, and does not use behavioral advertising; activity recommendations are based only on the age and preference information you enter and the activity reactions you observe.

11. Users in the United States

Children's online privacy (COPPA): Kidlio does not collect data directly from children under 13. The person who signs up for the app and creates the child profile is always a parent or legal guardian; in addition, subscription purchases are protected by a parental gate. About your child, we store only their first name (not their last name), date of birth, gender, avatar, interest categories, and activity progress, along with the height/weight, sleep, and memory records you choose to enter (see Section 4). We do not collect location, photos, audio recordings, contacts, or advertising IDs. We keep your child's information only as long as needed to provide the service; retention and deletion periods are described in Section 7.

To review, correct, or delete your child's information, or to stop further collection, use the child profile screen in the app or email us at contact@brainytech.net. We do not show behavioral advertising to children, and we do not share children's data with third parties for marketing purposes.

State privacy laws: Depending on your state (e.g., California, Washington), you may have the right to access, correct, and delete your personal data, and not to be discriminated against for exercising these rights. We do not sell your personal data or share it for targeted advertising. Height/weight and sleep records may be considered “consumer health data” under some state laws (e.g., the Washington My Health My Data Act): these records are kept only with your consent, are not sold, and are not shared with third parties; you can have them deleted at any time by withdrawing your consent. You can send your requests to contact@brainytech.net.

12. Changes to This Policy

When we update this policy, we change the “Last updated” date. We announce significant changes in the app or by email before they take effect. If we need to process your data for a new purpose based on your consent, we will ask for your consent again first.

13. Contact

If you have questions about our privacy policy or your personal data, contact us at:
contact@brainytech.net