Privacy Policy
Version: 2026-10-24 · Effective: 24 October 2026
This policy explains how personal data is processed when you use the Petiki mobile app ("Petiki"). For users in Türkiye it is also the information notice (aydınlatma metni) under Law No. 6698 on the Protection of Personal Data ("KVKK"); for users in the EU/EEA and the UK it provides the information required by the GDPR. This English text is a translation; for KVKK purposes the Turkish version prevails.
In short: Petiki shows no ads, uses no third-party analytics or tracking tools, does not sell your data and does not track you across other companies' apps or websites (no "tracking" in the Apple ATT sense). We use your data only to run the app, verify purchases, keep the service secure and, if you allow it, send you notifications.
1. Controller
[Ad Soyad ya da şirket unvanı] · [Tebligat adresi] · Email: support@petiki.co
2. Data we process
| Category | Data | Source |
|---|---|---|
| Identity | Display name (optional), the unique identifier of your Apple or Google account, the Sign in with Apple authorization token (kept only to revoke it when you delete your account) | You; Sign in with Apple / Google |
| Contact | Email address shared by Apple or Google (with Apple "Hide My Email", Apple's relay address) | Apple / Google, only if you link your account |
| App content | Tasks, categories, notes, reminder times, recurrence rules, task completions | You |
| Usage and game data | Focus sessions (start, end, duration, time spent away from the app in deep focus), streak days, pets and their state, coin transactions, potions, inventory, badges | Automatically while you use the app |
| Purchases | Product, store transaction ID, store, date, subscription period and expiry, trial status. We never receive card or payment details. | Apple / Google, RevenueCat |
| Device and security | App-generated device ID, platform, app version, language, time zone, push token, session tokens, server request logs (user ID, request path, result, time). Your IP address is processed in memory only during a request for security and abuse prevention (rate limiting) and is not stored | Automatically |
| Consent records | Versions of the Terms you accepted and the privacy notice you were shown, your notification and promotional choices, their time, platform and app version | You |
We do not collect special categories of data (health, beliefs, etc.). Please do not enter such information in tasks or notes; if you do, it is stored only for you. Your data is also kept on your device (local database) and your session tokens in the device's secure storage. Petiki does not access your location, contacts, photos, microphone or camera.
3. Purposes and legal bases
| Purpose | Legal basis (KVKK art. 5 / GDPR art. 6) |
|---|---|
| Creating your account, running the app, syncing and backing up your data | Performance of a contract (KVKK 5/2-c; GDPR 6(1)(b)) |
| Sign in with Apple/Google, account linking, revoking Apple authorization on deletion | Performance of a contract |
| Verifying purchases, granting coins/potions/Plus, handling refunds and cancellations | Performance of a contract; legal obligations (KVKK 5/2-ç; GDPR 6(1)(c)); establishing and defending legal claims (KVKK 5/2-e; GDPR 6(1)(f)) |
| Notifications scheduled on your device (focus timer, task reminders) | Performance of a contract, with your OS permission |
| Server reminder notifications ("I'm hungry", "your streak is ending", "I missed you") | Consent (KVKK 5/1; GDPR 6(1)(a)) — optional, can be withdrawn at any time |
| Promotional and news notifications | Consent (KVKK 5/1, Law No. 6563; GDPR 6(1)(a)) — optional, off by default |
| Security, abuse and cheat prevention, debugging, coin ledger integrity | Legitimate interests (KVKK 5/2-f; GDPR 6(1)(f)) |
| Proving your consents | Legal obligation; legitimate interests |
| Responding to authorities | Legal obligation |
We do not use your data for profiling or automated decisions that affect you, for advertising, or sell it.
4. Recipients and international transfers
| Recipient | Purpose | Data | Location |
|---|---|---|---|
| [Sunucu sağlayıcı, ör. Hetzner Online GmbH] | Server and database hosting | All account data | [Ülke, ör. Almanya] |
| [Yedek deposu, ör. Cloudflare R2] | Encrypted database backups | All account data | [Ülke/bölge] |
| Cloudflare, Inc. | Network security, DDoS protection, secure connection to our server | IP address, request data (in transit) | USA and global |
| 650 Industries, Inc. (Expo) | Relaying notifications to Apple/Google; downloading app updates | Push token, notification text; IP and device/app info during updates | USA |
| Apple Inc. (APNs), Google LLC (FCM) | Delivering notifications to your device | Push token, notification text | USA |
| RevenueCat, Inc. | Verifying subscriptions and purchases | Petiki user ID, purchase and subscription records, device/app info | USA |
| Apple Inc., Google LLC | Sign-in and payments (as independent controllers under their own policies) | Sign-in and payment data | USA |
Some of these providers are located outside Türkiye and the EU/EEA. They process your data only to provide Petiki, on our behalf and under their own data processing agreements and security commitments; they do not use it for their own purposes or sell it. Where available, transfers rely on the providers' safeguards such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses included in their data processing terms. We limit the data sent abroad to what the service needs (e.g. purchase verification receives your Petiki user ID, purchase records and, when you open the store screen, device/app info).
5. Optional consents
Both are optional; Petiki works fully without them. You can change them at any time in Settings > Notifications; each change is recorded with its time.
- Reminder notifications sent from our server when your pet is hungry, your streak is about to end or you haven't visited for a few days.
- Promotional and news notifications about offers, new features and events. Off by default.
6. Retention
| Data | Period |
|---|---|
| Account and app data | While your account exists. When you request deletion the account is closed immediately and data is permanently deleted after 7 days |
| Guest accounts unused for 12 months | Deleted with all data 12 months after last use, unless a subscription is active or the account made an in-app purchase |
| Records deleted during sync | 30 days |
| Server request logs (no IP addresses) | Up to 30 days |
| Backups | Daily backups 14 days, monthly backups 6 months; deleted accounts disappear from backups through rotation at the latest 7 months after the deletion request |
| Sign in with Apple authorization | Revoked immediately when you request deletion |
| Consent and purchase records | Deleted with the account, together with your customer record at our purchase verification provider (RevenueCat). Apple and Google keep their own records under their policies |
| Job queue records (e.g. store notifications) | 7 days after completion, 30 days if failed; records about you are removed immediately when the account is deleted (store notifications arriving after deletion within 7 days) |
7. Security
All traffic between the app and our server is encrypted (HTTPS/TLS). Session tokens are short-lived and stored in your device's secure storage; the server stores only their hashes. The app accesses the database with a separate least-privilege user. Backups are encrypted. Access is limited to the people operating the service.
8. Children
Petiki is not directed at children under 13 and we do not knowingly collect their data. Users aged 13–17 use Petiki with parental permission. If we learn a child under 13 has provided data, we delete the account; parents can contact support@petiki.co.
9. Your rights
Depending on where you live you have the right to: be informed whether your data is processed and access it; know the purposes and recipients; rectification; erasure; restriction; objection (including to processing based on legitimate interests); data portability; withdraw consent at any time without affecting earlier processing; not be subject to solely automated decisions; and compensation for unlawful processing (KVKK art. 11; GDPR arts. 15–22).
In the app: Settings > Legal and privacy > Download my data gives you all your data as a machine-readable file (JSON); Settings > Legal and privacy > Delete my account deletes your account. Without the app use the account deletion page.
Requests: email support@petiki.co from the address registered with Petiki, or write to [Tebligat adresi]. We respond free of charge within 30 days (one month under the GDPR). You may lodge a complaint with the Turkish Personal Data Protection Board (KVKK) or, in the EU/EEA/UK, with your local data protection authority.
10. Changes
We may update this policy. For material changes we show the new version in the app; the version shown and the time are recorded.