Privacy Policy

Last updated: July 7, 2026

This Privacy Policy explains how your personal data is handled when you use the Boon AI mobile application (the "App"). Boon AI is a habit and routine tracker with an AI-powered coach. This policy is written to meet our transparency obligations under the EU General Data Protection Regulation ("GDPR") and the Turkish Personal Data Protection Law ("KVKK").

1. Data Controller

The data controller is Dode Yazılım.
Contact: [email protected]

2. Data We Collect

Account information: Your email address, if you create an account. You can also use the App with an anonymous session, without providing an email.
User content: The routines and habits you create, daily check-ins, journal entries, and mood logs.
AI coach messages: The content of your conversations with the AI coach (processed to generate responses).
Subscription status: Whether your premium subscription is active. Your payment card details never reach us — payments are processed by the App Store / Google Play.
Crash data: Technical error reports. No personal content is sent; only technical diagnostics and an internal user ID.
Anonymous product analytics: Aggregated statistics about which screens and features are used, for product improvement.

No ads, no ad tracking: The App shows no advertising, performs no behavioral or advertising tracking, and does not collect the IDFA (advertising identifier).

3. Service Providers

We rely on the following infrastructure providers to deliver the service:

Supabase Database & Authentication

Your account information and user content (routines, check-ins, journal, mood) are stored on Supabase infrastructure. The servers are located in Australia (ap-southeast-2), which means your data is transferred internationally (see Section 6). Data is protected with TLS in transit and encryption at rest.

OpenAI AI Coach

AI coach responses are generated using the OpenAI API. Your messages are relayed through a secure server-side proxy (Supabase Edge Function) — the API key is never present on your device. Under OpenAI's API defaults, content submitted via the API is not used to train their models.

RevenueCat Subscription Management

Used to validate and track your premium subscription. RevenueCat only receives your internal user ID and store purchase information — never your payment card details.

Sentry Crash Reporting

Used to detect app crashes and technical errors. No personal content (email, journal entries, etc.) is sent; only technical diagnostics and an internal user ID are processed.

PostHog Product Analytics (EU Region)

We collect anonymous usage statistics to understand how the App's features are used. Data is processed on PostHog's servers in the European Union. It is never used for advertising purposes.

4. Purposes of Processing

Providing the habit tracking and AI coaching service,
Creating your account and syncing your data across devices,
Granting premium subscription entitlements,
Detecting errors, improving security and service quality,
Complying with legal obligations.

5. Legal Bases

We process your personal data on the basis of performance of a contract (delivering the service), legitimate interests (crash reporting, security, product improvement), and, where required, your consent — in particular for international data transfers under KVKK Article 9 — in accordance with GDPR Article 6 and KVKK Article 5.

6. International Data Transfers

The service providers listed above operate servers outside your country (Supabase: Australia; OpenAI, RevenueCat, Sentry: United States; PostHog: European Union). Transfers are carried out under data processing agreements with these providers and appropriate safeguards such as Standard Contractual Clauses (SCCs) under the GDPR, and in accordance with KVKK Article 9.

7. Data Retention

Account data and user content: retained for as long as your account is active. When you delete your account, your data is removed from our systems within a reasonable period (typically 30 days).
Crash and analytics records: automatically deleted within the providers' standard retention windows (generally no more than 12 months).
Records that must be kept longer under applicable law are retained for the legally required period.

8. Your Rights

Under GDPR Articles 15–22 and KVKK Article 11, you have the right to access, rectify, and erase your data, to object to or restrict processing, and to data portability.

Account deletion: You can permanently delete your account and data in the App via Settings → Delete Account.
Data export: You can download a copy of your data from within the App (GDPR/KVKK data portability).
For any other request, write to [email protected]. We respond within 30 days at the latest.

You also have the right to lodge a complaint with your local supervisory authority (or, in Türkiye, with the Personal Data Protection Board).

9. Children's Privacy

Boon AI is not directed at children under 13, and we do not knowingly collect personal data from anyone under 13. If we become aware that we have processed data belonging to a child under 13, we will delete it promptly.

10. Security

Your data is encrypted with TLS in transit, and protected with encryption at rest and access controls. While no system is 100% secure, we apply industry-standard technical and organizational measures to protect your data.

11. Changes to This Policy

We may update this policy from time to time. The current version is always published on this page, and the "Last updated" date is revised accordingly.

12. Contact

For any privacy-related question or request:
Dode Yazılım — [email protected]