Viyora Privacy Policy

Effective date: 28 October 2026

This policy explains what happens to your personal data when you use the Viyora iPhone app (the "App") and the viyora.app website (the "Site"). If you live in Turkey, the information notice required by Turkish Personal Data Protection Law No. 6698 ("KVKK") is at the end of this page, in section 17.

At a glance

1. Who is responsible

Viyora is developed and provided by Berke Sasa, an independent developer based in Turkey ("we", "us", "Viyora"). Berke Sasa is the controller of the processing described in this policy.

• Email: hello@viyora.app

We have not appointed a data protection officer. Please send any question or request about your personal data to this address.

2. Scope

This policy covers the App, the Site, emails you send us, the waitlist on the Site and TestFlight beta tests. Apple (App Store, iCloud, TestFlight), the social networks you share to and other sites we link to are governed by their own privacy policies.

3. What we do not collect

• We do not ask for account details because there is no account: name, email, phone number or password. Contact details you choose to share through support and the waitlist are explained in sections 6.4 and 6.6.
• Your GPS or precise location, contacts, calendar, camera, microphone or Health app data. Approximate location derived from an IP address for Site analytics is described separately in section 6.5.
• Your photos. When you tap "Save to Photos", the App only adds that one image to your library; it does not read your existing photos.
• Your advertising identifier (IDFA) or your activity in other apps and websites.
• Your payment card or billing details. Only Apple handles these.

There are no ads in the App or on the Site. We do not track you across apps and websites owned by other companies. We do not sell or rent your personal data, and we do not share it with anyone for advertising.

4. Data that stays on your device

The main record of your personal content and preferences is stored on your device. Optional iCloud backup is described in section 5; the limited preference and catalogue information included in usage statistics is described in section 6.1:

• Your mood entries, notes and writing are never sent to us; we cannot see, read or analyze them. The limited information included in usage statistics is explained separately below.
• The App is designed to store this data encrypted on your device. iOS device protections apply in addition.
• Some of this information, such as mood entries and notes, may be treated as sensitive health-related data under some laws. For that reason we never send it, or anything that could be inferred from it, to analytics or diagnostics. Optional iCloud backup is described in section 5.
• You alone manage this data: you can edit or delete it in the App, or remove all of it by deleting the App from your device.
• If you use your iPhone's own iCloud Backup or a computer backup, a copy of the App's data may also be included in that device backup. Those backups are part of your relationship with Apple and are managed by you.
• Widgets read from a shared area on the same device as the App. That data does not leave your device either.
• Lock Screen: notifications (which may include your name) and widgets can be seen by people around you while your phone is locked. You can manage this in iOS Settings and in the App's notification and widget settings.
• Notifications are scheduled and shown on your device; they do not pass through a server of ours.

5. iCloud backup (optional)

If you turn on backup in Profile > My Data, the data listed in section 4 is written, through Apple's CloudKit service, to the private database of your own iCloud account.

• Backup is off by default. It runs only if you turn it on.
• Backups use your iCloud storage and are subject to Apple's iCloud terms and Privacy Policy. As the developer we have no access to this database and cannot see the contents of your backups.
• Technical state such as notification permissions and Premium status is not backed up. Your Premium status is verified separately from your backup.
• The App keeps your most recent backups and deletes older ones automatically.
• You can turn backup off at any time, and delete all Viyora backups in Profile > My Data > "Delete My iCloud Backups". You can also delete them from the iCloud storage management section in iOS Settings.
• If you are not signed in to iCloud, or iCloud is off, the App works fully without backup.
• When you restore a backup, the data on your device is replaced with that backup. The App first makes a safety copy of your current data.

6. Data we process

The following data reaches our systems or those of service providers working for us.

6.1 Usage statistics without direct identifiers (PostHog)

We collect limited usage statistics that do not include your name or email, to understand how the App is used, find bugs and improve features.

When it starts: nothing is sent the first time you open the App until you continue past the welcome screen.

How identifying information is limited:

• Statistics are sent with a random number generated on your device and renewed every day. No persistent user identifier is created to track you across days.
• No device or advertising identifier is added to the statistics, and they are never combined with your purchase record identifier.
• When a request reaches PostHog, your IP address is technically visible. Geolocation is turned off and your IP address is discarded without being stored.
• Session recording and automatic tap capture are off.

What is sent:

• Which screens are opened, whether a step was started, finished or skipped, and which features are used (for example theme preview, sharing, favorites, widgets, the purchase screen and its outcome, opening a notification).
• Catalogue information about content: topic, theme, font, plan type; and, on surfaces that do not depend on your mood (such as the Quote of the Day and Explore decks), the identifier of a quote you add to favorites.
• Coarse context: time since install, number of affirmation days and streak length in broad bands (for example "7 to 29 days"), plan type (free, trial, monthly, yearly, lifetime), the character you chose (a visual preference), App language, whether notifications are on, whether a widget is in use.
• The kind of app you shared to (Instagram, WhatsApp, Messages, save, copy, other). The shared content itself is not sent.
• When iCloud backup is turned on or off, or fails, an error code.
• When an unexpected error occurs in the App, its technical details so we can find and fix it: the type of error (for example "TypeError"), where in the code and on which screen it happened, and the App version. The text of the error message is not sent; it is removed on your device before sending.
• Technical details: App and iOS version, device model (for example "iPhone 15", not the name you gave your phone), your phone's language and region setting (for example "en-GB"), time zone and screen size.

Never sent: your name; your notes; what you write in "Notes to Self" or its length; the moods you pick; your "what's affecting you" choices; anything that could reveal your mood, such as the identifier or topic of the affirmation chosen for it; the text of error messages; your advertising identifier; the name you gave your device. Your IP address is transmitted to PostHog during the connection, but discarded without being stored in statistics events.

Provider and location: PostHog Inc. Data is hosted in the European Union (Frankfurt, Germany).

Retention: 12 months, after which it is deleted.

Legal basis: your name and email are not included; however, events can be linked by the same random number during a day, so we take into account that this information may be personal data. We rely on our legitimate interest in improving the App and finding bugs (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).

Turning it off: switch off Profile > My Data > "Anonymous usage statistics" and nothing more is sent from that moment. Because there is no account or persistent user identifier, we may not always be able to reliably match past events to a particular person. We assess rights requests using the information available to us.

6.2 Purchases (Apple and RevenueCat)

Premium is purchased through Apple's App Store. Apple takes the payment and processes your payment details under its own privacy policy. Apple does not share your name, email or card details with us.

We use RevenueCat to unlock Premium, restore purchases and track subscription status. RevenueCat processes:

• a random user number generated by the App, which does not contain your name or email,
• purchase information received from Apple: which product, purchase, renewal and expiry dates, trial status, cancellation and refund status, price and currency, store country, Apple transaction numbers,
• technical details: App and iOS version, device type, language setting and, during the connection, your IP address (which RevenueCat may use to determine your country and for security).

Your name, email, notes and content in the App are never sent to RevenueCat.

Purpose: unlocking Premium, restoring your purchases, showing your subscription status and renewal date, reminding you before renewal if you ask us to, preventing abuse and keeping revenue records.

Legal basis: providing the service you bought (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)), and our legitimate interest in preventing abuse and protecting our rights in a dispute (GDPR Art. 6(1)(f); KVKK Art. 5(2)(e) and (f)).

Location: RevenueCat, Inc., United States.

6.3 Information Apple shares with us

• Aggregate statistics: in App Store Connect we see aggregate numbers of downloads, sales, countries and versions. These do not identify you.
• Crash reports: if "Share With App Developers" is on in your iPhone settings, Apple may share technical crash reports and diagnostics with us when the App crashes. These include the device model, iOS version and technical details of the error. You can manage this in iOS Settings > Privacy & Security > Analytics & Improvements.

Purpose and legal basis: finding and fixing bugs; our legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).

6.4 Support emails

If you write to us through Profile > Contact Us or directly at hello@viyora.app, we process:

• your email address and any name you include,
• the content of your message and attachments,
• a technical line the App adds to the draft so we can help: App version, iOS version, Premium status, an iCloud backup error code if any, and your purchase ID (RevenueCat's random user number, see 6.2). The purchase ID lets us match your email to your purchase record at RevenueCat; it is used only to look into a purchase issue or, when needed, to grant Premium manually. The line does not include your device's name, and you can delete or edit it before sending.

Purpose: solving your problem, answering your question, pointing you to the right place for purchase issues, considering your suggestions.

Legal basis: providing the service (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) and our legitimate interest in answering you (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).

Providers: emails are routed by Cloudflare, Inc. and stored in Google LLC's email service (Gmail), both based in the United States.

Retention: up to 2 years after the conversation ends.

For purchase issues, Apple holds the payment and refund records. Please do not send us card details, your Apple Account password or identity documents.

6.5 Website

• Hosting logs: the Site is hosted by Vercel Inc. To serve the Site and protect it against attacks, technical records such as your IP address, browser and device details, the page you visit and the time are kept briefly in the provider’s systems. We use Cloudflare, Inc. for the domain name and email routing. Legal basis: our legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• Site analytics (Google Analytics 4): Site analytics starts when you arrive, as the Site’s own audience measurement, and the cookie banner tells you so; the legal basis is our legitimate interest (KVKK Art. 5(2)(f); KVKK Guide on Cookie Practices, section 5.9; GDPR Art. 6(1)(f)). This measurement is used only for the Site’s visitor and performance statistics, never for advertising, profiling or tracking you across sites, and Google signals and advertising features are turned off. It processes pages visited, referral and campaign information, device and browser details, approximate location derived from your IP address (country/city), and interactions such as opening the waitlist form and joining the list. Your waitlist email address and personal content in the App are not sent to Google Analytics. Your IP address is technically transmitted when connecting to Google; raw IP addresses are not shown to us in analytics reports. The purpose is to improve the Site. This analytics service is separate from PostHog statistics in the App.
• Cookies and preference storage: when Site analytics runs, _ga and _ga_<id> cookies are kept for up to 395 days (about 13 months) from when they are first set. Your analytics choice is stored under viyora-analytics-consent in browser local storage until you clear it; this preference record is not sent to us. Choosing “Decline” stops new measurement, removes analytics cookies and keeps analytics from loading on later visits. We do not use advertising, retargeting or social media cookies. Details and the preference button are in the Cookie Policy.
• Retention: our retention policy for user- and event-level Google Analytics data is 2 months. Aggregate statistics that cannot be linked to a person may be kept longer. You can decline analytics at any time through “Cookie preferences” at the bottom of the page. International processing and transfers are described in sections 8 and 17.5.
• Language suggestion: if your browser is set to Turkish, English pages show a language suggestion bar. If you close it, that choice is kept in browser session storage only while the tab is open. It is never sent to us and is deleted when you close the tab.

6.6 Waitlist

If you fill in the "Be the first to know" form on the Site, we process your email address and the language you used (English or Turkish).

• Purpose: sending you a single announcement email when Viyora arrives on the App Store. We do not use it for anything else.
• Legal basis: your consent given with the checkbox on the form (GDPR Art. 6(1)(a); KVKK Art. 5(1)).
• Provider: Resend (Plus Five Five, Inc.), United States.
• Abuse prevention: to stop automated sign-ups, your IP address is held in server memory for a 10-minute rate-limit window after your last form attempt and automatically cleared by a timer.
• Retention: we delete the list after the announcement is sent. If you withdraw your consent earlier, we delete your address straight away.
• Withdrawing consent: just write to hello@viyora.app. You can also leave the list with the link in the announcement email.
• Only people aged 16 or over may join the waitlist.

6.7 TestFlight beta tests

If you agree to try beta versions of the App through TestFlight, Apple passes us the email address and name we invited you with, the feedback and screenshots you send, technical details such as device model and iOS version, and crash reports.

• Purpose: testing and improving the App.
• Legal basis: necessary for your participation in the beta test, and our legitimate interest (GDPR Art. 6(1)(b) and (f); KVKK Art. 5(2)(c) and (f)).
• Retention: up to 2 years after the version concerned has been evaluated. Write to us to leave the test or to have your feedback deleted.

6.8 Rights requests and legal obligations

If you make a rights request, we process the information in it to assess and answer your request (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)). If an authority with legal power makes a proper request, we may share the information we hold only within the scope of that request.

7. Service providers

We share personal data only for the purposes described in this policy and only with these providers:

Processing that providers carry out on our behalf is subject to the relevant service and data processing terms. Providers may also act under their own privacy policies for matters such as their security and legal obligations. For the App Store and iCloud, Apple acts as an independent controller.

If Viyora is transferred to a company in the future, or becomes one, the data described here may pass to the new owner with the same protection and for the same purposes. We would announce this on the Site.

8. International transfers

The data described in section 6 is processed in the European Union (Germany) for PostHog, and in countries outside Turkey, including the United States, for services such as RevenueCat, Google, Cloudflare, Vercel and Resend. Recipients, data types and purposes are listed in sections 7 and 17.5. iCloud backups are kept in your own Apple account; the App Store, iCloud and Apple’s independent processing are also subject to Apple’s terms.

You can ask about the conditions and safeguards used for a particular transfer at hello@viyora.app.

9. Retention

When a period ends, the data is deleted, destroyed or anonymized.

10. Security

We take reasonable technical and organizational measures to protect your data: an architecture that does not send your personal content to a developer-operated server, encrypted storage on the device, encrypted connections (HTTPS), collecting only what is needed, and strong access protection on our provider accounts. Still, no system is completely secure. We recommend protecting your phone with a passcode and keeping iOS up to date.

If we learn that your personal data has been accessed without authorization, we will notify the relevant authorities and, where required, you, within the legal deadlines.

11. Your rights

Everyone

Wherever you live, you can write to us to find out which data we process about you, get a copy, ask us to correct it if it is wrong or delete it if it is no longer needed, and object to processing. We answer within 30 days, free of charge except for fee exceptions permitted by law.

European Union, EEA, United Kingdom and Switzerland

Under the GDPR, the UK GDPR and Swiss data protection law you have the rights of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests and, where processing is based on consent, withdrawal of consent at any time. Withdrawing consent does not make earlier processing unlawful. You have the right to complain to the data protection authority where you live or work (EU authorities: edpb.europa.eu; UK: ico.org.uk).

Providing your data to us is not a legal or contractual requirement. The App works without an account or personal details; Premium simply cannot be provided without purchase verification.

United States

We do not sell your personal information or share it for cross-context behavioral advertising (including within the meaning of California law). We do not collect sensitive personal information to infer characteristics about you. If the law of your state gives you rights to access, correct or delete your information and not to be discriminated against for using them, you can exercise them by writing to us. The same applies where your browser sends a Global Privacy Control signal: we do not sell or share in any case.

Turkey

Your rights under Article 11 of the KVKK and how to apply are set out in section 17. If you find our answer insufficient, you can complain to the Turkish Personal Data Protection Board.

Other countries

If the law where you live gives you additional rights (for example Brazil's LGPD or Canada's PIPEDA), you can exercise them by writing to us as well.

How to exercise your rights

Write to hello@viyora.app. We may ask for additional information to make sure the request concerns you. Because there is no account, we may ask, for example, for the order ID on Apple's purchase receipt or the purchase ID the App adds to its support draft so we can find your records.

You can delete some data yourself:

Important: deleting the App does not cancel your subscription. You can cancel it in iOS Settings > [your name] > Subscriptions, or in Profile > My Subscription.

12. Children

Viyora is not directed at children under 13 and does not knowingly collect personal data from them. If we learn that a child under 13 has sent us personal data (for example in a support email), we will delete it. If you are a parent or guardian and notice this, please write to us.

13. Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects, and we do not profile you. The App showing an affirmation for the mood you pick happens entirely on your device and is never reported to us.

14. Sharing and external links

When you share a quote or image, whatever you send to the app you pick in the iOS share sheet (for example Instagram or WhatsApp) is governed by that service's terms and privacy policy. Shared images may carry the Viyora logo and "viyora.app". The App and the Site may link to other sites, such as Apple's; we are not responsible for their practices.

15. Changes

We may update this policy as the App or our legal obligations change. The current version is always on this page, with the effective date at the top. If we make an important change (for example, starting to collect a new type of data), we will announce it on the Site and, where possible, in the App before it takes effect. If a change requires new processing based on consent, we will ask for your consent separately.

16. Contact

Berke Sasa (Viyora) Email: hello@viyora.app

If the English and Turkish versions of this policy differ, the Turkish version prevails for users in Turkey and the English version prevails for everyone else, to the extent permitted by law.

17. Information Notice under Turkish Law No. 6698 (KVKK)

This section is provided under Article 10 of Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It explains the processing of personal data related to the Viyora iPhone app (the "App") and the viyora.app website (the "Site"). The earlier sections of this policy give more detail. This is a translation provided for convenience; the Turkish version prevails.

This section is for information only; it does not ask for your consent or acceptance.

17.1 Data controller

17.2 Data that stays on your device

The App does not create an account. Your name, mood entries, "what's affecting you" choices, notes and "Notes to Self" entries are stored on your device; they are not sent to the data controller, who cannot access them. The main record of your favorites, streak and preferences is also on your device. Limited preferences such as your chosen character, theme and plan type, broad streak bands, and events for favoriting quotes that do not depend on your mood may be included in usage statistics; see sections 6.1 and 17.3.

If you turn on iCloud backup, this data is written, at your request and under your iCloud agreement with Apple, to the private database of your own iCloud account. The data controller has no access to that database. You can turn backup off at any time and delete all your backups in Profile > My Data.

Because some information, such as mood entries, may be considered health-related, neither it nor anything that could be inferred from it is sent to usage statistics or diagnostics. Optional iCloud backup is explained separately above.

17.3 Personal data processed, purposes and legal grounds

The Site sets Google Analytics cookies when you arrive and the cookie banner tells you so; choosing “Decline” stops measurement and removes the cookies. Your analytics choice is kept in browser local storage until you clear it. The choice to close the language suggestion bar is kept in session storage until the tab is closed. Neither preference record is sent to the data controller. See the Cookie Policy.

17.4 Method of collection

Personal data is collected electronically:

• automatically, through software development kits integrated into the App (PostHog, RevenueCat),
• through Apple's App Store Connect and TestFlight services,
• through emails you send to the data controller,
• through the waitlist form on the Site,
• automatically, through the Site’s hosting infrastructure,
• unless you decline, through Google Analytics cookies and its script for Site analytics.

17.5 Transfers

Personal data is not transferred to any third party in Turkey. It may be shared with public authorities that have legal power, upon a proper request, only within the scope of that request and in line with Articles 8 and 9 of the KVKK.

To provide the services, personal data is transferred abroad to the following service providers:

Information about transfers: you can ask about the conditions and safeguards for a particular transfer at hello@viyora.app.

For App Store purchases, your payment details and Apple Account go directly to Apple, not to the data controller; Apple is an independent controller in this respect. iCloud backups are kept at your request in your own Apple account (17.2).

17.6 Retention

At the end of these periods, personal data is deleted, destroyed or anonymized.

17.7 Your rights under Article 11 of the KVKK

By applying to the data controller, you have the right to:

1. learn whether your personal data is processed,
2. request information if it has been processed,
3. learn the purpose of processing and whether it is used in line with that purpose,
4. know the third parties in Turkey or abroad to whom it is transferred,
5. request correction if it is incomplete or inaccurate,
6. request its deletion or destruction under the conditions of Article 7 of the KVKK,
7. request that the actions under items 5 and 6 be notified to third parties to whom the data was transferred,
8. object to a result against you arising from the analysis of the processed data exclusively through automated systems,
9. claim compensation if you suffer damage because of unlawful processing.

Because usage statistics have no account or persistent user identifier, we may not always be able to reliably match past events to a particular person. We assess rights requests using the information available to us. You can stop their collection at any time with Profile > My Data > "Anonymous usage statistics".

17.8 How to apply

To exercise your rights, simply write to hello@viyora.app. Your application should include your name and surname, a way for us to contact you and the subject of your request. We may ask for additional information to make sure the request is yours. Because there is no account, adding the order ID from Apple's purchase receipt, or the purchase ID at the bottom of the Profile > Contact Us draft, helps us find your purchase records.

We will conclude your application free of charge as soon as possible and within 30 days at the latest, depending on its nature. If the action requires an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board.

If your application is rejected, our answer is insufficient or we do not answer in time, you can complain to the Personal Data Protection Board within 30 days of learning our answer, and in any case within 60 days of your application (kvkk.gov.tr).