Olarya Privacy Policy

1. Executive summary

Summary: Because Olarya tracks menstrual cycle and symptoms, it carries health and sensitive data risks. Therefore, app store declarations, KVKK disclosures, explicit consent flows, and data deletion processes must align with actual data practices.

• Olarya should not be positioned as providing medical advice, diagnosis, treatment, birth control, or pregnancy prevention. The app is for personal tracking and informational purposes. [Official source: App Review Guidelines — https://developer.apple.com/app-store/review/guidelines/]
• Menstruation, symptom, fertility, pregnancy, sexual activity, and health integration data must be handled with special sensitivity. [Official source: KVKK Special Categories of Personal Data — https://www.kvkk.gov.tr/Icerik/2051/Ozel-Nitelikli-Kisisel-Veriler]
• Google Play privacy policy URL must be in the Play Console and within the app; it must be public, working, and not a PDF. [Official source: Google Play User Data policy — https://support.google.com/googleplay/android-developer/answer/10144311?hl=tr]
• Google Play Data Safety and Apple App Privacy answers must cover actual flows like Supabase, RevenueCat, HealthKit, Health Connect, Expo Notifications, and profile photo permissions. [Official source: App privacy details on the App Store — https://developer.apple.com/app-store/app-privacy-details/]
• If user account and Supabase Auth are used, account/data deletion must be actionable from within the app and via the web. [Official source: Google Play User Data policy — https://support.google.com/googleplay/android-developer/answer/10144311?hl=tr]
• For KVKK, the privacy policy, disclosure text, and explicit consent text are not the same; the explicit consent text must be separate and based on free will. [Official source: KVKK 2026 Principle Decision — https://www.kvkk.gov.tr/Icerik/8710/veri-sorumlulari-tarafindan-acik-riza-ve-aydinlatma-metinlerinin-ayri-ayri-duzenlenmesi-gerektigi-hakkinda-kisisel-verileri-koruma-kurulunun-18-02-2026-tarihli-ve-2026-347-sayili-ilke-kararina-iliskin-kamuoyu-duyurusu]
• Google Mobile Ads and UMP are included in the Android release. The Play Console ads declaration, device identifiers, consent flow, and health-data separation must match the actual production bundle.

2. Purpose and scope

Summary: This policy covers the Olarya mobile app, in-app online features, support processes, and associated web pages.

This Privacy Policy explains how the period cycle, symptom, and personal health tracking app named Olarya processes personal data. The policy applies to the React Native/Expo mobile app, optional Supabase-based online features, RevenueCat subscription infrastructure, Apple Health/HealthKit, Android Health Connect, local notifications, support requests, and account deletion processes.

This text is a privacy policy. It can serve as the visible equivalent of the disclosure obligation under KVKK within the app; however, the explicit consent text required for sensitive data must be presented on a separate approval screen.

3. Data controller / operator details

Summary: This section summarizes the data controller, contact details, and related policy links for Olarya.

• App name: Olarya
• Operator / developer: TupApp
• Data controller title: TupApp
• Country / city / address: Türkiye
• Privacy contact email: privacy@tupapp.com
• Privacy policy URL: https://tupapp.com/privacy.html
• Account and data deletion URL: https://tupapp.com/account-deletion.html

4. What data we collect?

Summary: Olarya's fundamental approach is to keep data on the device as much as possible. If online features are turned on, some data may be processed via Supabase, RevenueCat, or related platform services.

4.1 Personal data

• Email address: may be processed in the Supabase Auth email OTP flow for optional cloud backup or account verification.
• Nickname / display name: may be used for game ranking or profile view.
• Date of birth: may be stored on the device if the user enables the notification or profile feature.
• Profile photo / avatar: may be stored on the device if selected from the gallery or in the app depending on the feature's scope. The default approach is to keep it on the device; server transfer is limited to online features enabled by the user.

4.2 Sensitive / health data

• Period start and end dates, period history, cycle length, and period duration.
• Mood, pain level, energy level, flow intensity, headache, bloating, cramps, backache, tenderness, nausea, fatigue, and appetite information.
• Discharge type, sexual activity, medication or supplement notes, free-text notes, and user tags.
• Pregnancy mode, pregnancy start, or estimated due date information.
• Basal body temperature, body temperature, resting heart rate, and sleep duration.
• Supported health metrics from the past 30 days read with user permission via Apple Health or Android Health Connect.

4.3 Device and technical data

• Device OS, app platform, app version, and technical error info may be processed only to the extent required by the infrastructure used.
• Notification settings, quiet hours, notification privacy mode, and app preferences are stored on the device.
• PIN lock information is stored on Expo SecureStore if secure storage is possible; otherwise, in local storage.

4.4 Usage, game, and subscription data

• Game score, game ID, duration, move/guess count, week key, and ranking information may be processed via Supabase.
• Olarya Plus subscription status, expiration time, and RevenueCat customer info may be processed for subscription management.
• Cloud backup files may include the profile, daily logs, symptoms, health metrics, and notification settings exported by the user.
• Community profile, posts, comments, reactions, bookmarks, reports, and blocking records may be processed as part of the online community feature.
• Community moderation queue items, rule violation reviews, and access security records may be retained to operate the service safely.
• When referrals are used, Olarya may process the referral code, inviter and invitee account identifiers, email-verification status, an initial-setup completion marker, timestamps, reward status, and abuse-risk flags.
• When online reward notifications are enabled, Olarya may process an Expo push token, device platform, app version, language preference, and notification-delivery status.

4.5 Advertising and identifier data

The Android release includes Google Mobile Ads and UMP. Free users do not see the game-list banner for 183 days after first opening the ad-enabled build; this period does not apply to the partner-calendar banner. With an active partner connection, a non-personalized banner may appear from the first day when ad consent and other requirements are met. Active Plus members do not see ads. Google Mobile Ads may process device or app identifiers under its policies. Health data, location, and community content are not used for ad targeting.

5. How we collect data?

Summary: Data is collected via user input, device permissions, OS integrations, or use of online features.

• Directly from the user: period logs, daily check-ins, symptoms, notes, temperature input, notification preferences, profile settings, nickname, and support emails.
• Automatically / on-device: local notification scheduling, theme/language preference, app lock, device health integration permission result, and technical platform information.
• SDKs and services: Supabase Auth/Database/Storage/Edge Functions, RevenueCat, Apple Health/HealthKit, Android Health Connect, Expo Notifications, and Expo Image Picker.
• Third-party login providers: The use of Google Sign-In or Apple Sign-In is not verified in this version. If added, the provider name and transferred data categories must be included in this text.

6. Purposes of processing

Summary: Data is processed to deliver the app's core tracking functions, run online features chosen by the user, ensure security, and meet legal obligations.

• To display period cycle, symptom, health metric, and personal tracking records.
• To calculate estimated period, fertile window, and ovulation days for personal tracking.
• To schedule local reminders and notifications.
• To add Apple Health or Health Connect data to in-app records if requested by the user.
• To provide cloud backup, backup restoration, and partner calendar sharing if requested by the user.
• To run game rankings and anonymous/nicknamed leaderboard functions.
• To verify Olarya Plus subscription, restore purchases, and update subscription status.
• To fulfill account and data deletion requests.
• To ensure security, prevent abuse, control access, and maintain service integrity.
• To operate posting, moderation, reporting, blocking, and abuse-prevention processes in the community area.

7. Legal grounds

Summary: The KVKK and global release approaches are considered together. A separate, explicit, and revocable consent flow within the app is recommended for sensitive health data.

7.1 KVKK approach

• Condition for processing basic app functions: performance of a contract/service delivery, explicit consent, and applicable legal obligations are evaluated together within the scope of the user's request to use the app.
• Because there is a risk of processing sensitive data in health, sexual life, pregnancy, fertility, and free-text fields, a separate explicit consent screen is recommended.
• Health data must not be used for marketing, ad targeting, or third-party ad measurement. If such use is planned, explicit consent and store policies must be re-evaluated.

7.2 Additional info for EU/EEA users

• Performance of a contract or taking steps at the user's request for the core service.
• Legitimate interest or legal obligation for security, abuse prevention, and legal requests.
• Explicit consent or an appropriate special category processing exception under relevant legislation for health and similar special category data.
• If consent is withdrawn, the lawfulness of processing before the withdrawal is not affected; however, the associated feature may be stopped.

8. Special note on health and sensitive data

Summary: Olarya processes data in a health context; this data must not be used for ad targeting, third-party marketing, or medical decision-making.

Olarya's predictions are for personal tracking. The app is not a tool for diagnosis, treatment, medication management, clinical measurement, medical device service, birth control, or pregnancy prevention. For health concerns, consult a qualified healthcare professional.

Free-text notes may contain health, sexual life, medication, pregnancy, or other sensitive info. Users should only enter info they are comfortable sharing in these fields.

9. Advertising, analytics, and tracking technologies

Summary: The Android release includes Google Mobile Ads and UMP. The game-list banner has a 183-day waiting period; the active partner-calendar banner does not. The required consent flow completes before an ad request in either placement.

• AdMob: The Android release may use Google Mobile Ads for non-personalized banners below the game list and in the active partner calendar. The game-list banner has a 183-day waiting period and is suppressed on recorded period days; the partner-calendar banner may appear from the first active connection. Active Plus members do not see ads. The UMP consent flow completes before an ad request.
• Analytics: Firebase Analytics, Sentry, Crashlytics, or similar analytics/crash tracking services are not detected. If added, data categories and retention periods must be updated.
• Local storage: Cycle profile, daily logs, health metrics, notification preferences, and theme/language settings may be stored on the device.
• Notifications: Local notifications can be scheduled with Expo Notifications. If notification privacy mode is active, sensitive content can be hidden in the notification text.

10. Third-party processors, service providers, and SDKs

Summary: These services may only process data when the related feature is used. Infrastructures like Supabase are generally considered service providers/processors; role and contract status are kept aligned with the production configuration.

11. Data sharing and transfer

Summary: Olarya does not sell health data. Data may only be transferred in limited situations such as user-selected features, service providers, legal obligations, or company transfer.

• Service provider / processor: Supabase, RevenueCat, and platform services may process data to run the related feature.
• Partner calendar sharing: If enabled by the user, the partner can only see calendar summary day statuses; symptom notes, health metrics, and free notes must not be shared.
• Game ranking: Game data such as nickname, score, and rank may be shown in the weekly ranking; health data must not be associated with the ranking.
• Legal obligations: Necessary data may be shared in response to valid requests from authorized public institutions or within the scope of legal processes.
• Company transfer: In the event of a merger, acquisition, or asset transfer, users must be appropriately informed.

12. International data transfers

Summary: Online features may run through Supabase, RevenueCat, and platform services; service providers may process data in different countries.

The Supabase project used for Olarya's online features is hosted in the Supabase region selected in the production configuration. RevenueCat, Apple, Google/Android, and other service providers may process data in different countries. If a transfer outside Turkey or outside the EU/EEA is involved, an appropriate transfer mechanism is evaluated according to applicable data protection legislation.

Adequacy decisions, standard contractual clauses, or other appropriate safeguards may be required for EU/EEA users. [Official source: Adequacy decisions — https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en]

13. Where data is stored and retention periods

Summary: Local data stays on the user's device. Online data is kept as long as the relevant feature continues or for the specified retention periods.

• Local cycle, symptom, health metric, and notification data: stored on the device until the user deletes it from within the app or uninstalls the app.
• Cloud backups: according to the current app design, a maximum of 3 backups are stored; they are removed when the user deletes the backup or the account deletion process is completed.
• Raw game scores: may be kept for about 8 weeks according to the current server cleanup design.
• Weekly leaderboard summaries: may be kept for about 26 weeks according to the current cleanup design.
• Partner invite attempts and security logs: may be kept for about 30 days according to the current cleanup design.
• Post-account deletion backups, community records, and residual online records: deleted or anonymized within 30 days at the latest.

14. Security measures

Summary: Olarya uses keeping data local, limiting access, Supabase RLS policies, and secure storage as its fundamental security layers.

• Online communication must be conducted over HTTPS/TLS.
• Row Level Security is enabled on Supabase tables, aiming for users to only access their own records.
• Cloud backup is kept on a dedicated Supabase Storage bucket.
• PIN lock information is stored on Expo SecureStore whenever possible.
• Service role key and admin secret values must not be embedded in the app; they must only be stored as Supabase Edge Function secrets.
• Admin/support access is role-restricted, limited to authorized people, and access logs are kept.

15. User rights

Summary: Users have the right to access, rectify, delete their data, and obtain information about processing activities. Additional rights may also be granted to EU/EEA users.

15.1 Rights under KVKK

Under Article 11 of the KVKK, users may exercise rights such as learning whether their personal data is processed, requesting info if processed, learning the purpose and whether used accordingly, knowing third parties transferred to domestically/internationally, requesting correction of incomplete/inaccurate data, requesting deletion/destruction, and other rights specified in the law. [Official source: KVKK Rights of the Data Subject — https://www.kvkk.gov.tr/Icerik/2036/Ilgili-Kisinin-Haklari]

15.2 Additional rights for EU/EEA users

Where applicable, EU/EEA users may have the right to access, rectification, erasure, restriction, objection, data portability, and withdrawal of consent. [Official source: Data subject rights — https://commission.europa.eu/law/law-topic/data-protection/information-individuals_en]

15.3 How to exercise rights?

Requests may be sent to privacy@tupapp.com. Registered email address or reasonable additional info may be requested for identity verification. Requests are answered according to applicable law and within 30 days at the latest.

16. Account and data deletion process

Summary: Users can delete local data from within the app; for the online account and Supabase records, the in-app flow or the web page must be used.

• Local data: Can be deleted from the device via the data deletion option on the Profile screen or by uninstalling the app.
• Online account and data: Can be initiated via the in-app account deletion flow or the account deletion page.
• Deletion scope may include the Supabase Auth user, cloud backups, partner invitations and access, calendar snapshots, community records, game profile and scores, referral codes and conversions, reward and notification records, push-device registration, Plus status, and RevenueCat customer data linked to the Olarya user ID.
• Processing time: within 30 days at the latest.
• Legal retention exception: Some records may be kept for a limited time for legal obligations, disputes, or security.

17. Children's data / age limit

Summary: Olarya does not target children; due to the period and health tracking context, the target audience is 18 years and older.

Olarya's target audience is 18 years and older. The app should not target children. For users under 18, parental consent or additional protection may be required depending on the country. Age targeting must be consistent with Google Play and App Store category/declarations.

18. Policy changes

Summary: If data processing practices change, the policy must also change.

When this policy is updated, the new version is published on this page. Additional notifications via in-app alerts, emails, or store release notes may be provided for significant changes. The last update date and version info are located at the top of the page.

19. Contact

Summary: A separate and working communication channel must be used for privacy, data requests, and account deletion requests.

• Privacy email: privacy@tupapp.com
• Support page: support.html
• Account deletion: account-deletion.html
• Mailing address: Turkey; an official mailing address is shared separately when required for a valid request.

20. Data and store disclosure summary

Summary: This section summarizes Olarya's data categories, store disclosure approach, and the key privacy links offered to users.

Data categories

• Cycle profile, symptom logs, and optional health measurements are kept on the device by default; they may be processed on Supabase if cloud backup is enabled.
• For online features such as account, subscription, partner sharing, community, and game ranking, only the data necessary to run the relevant feature is processed.
• Olarya does not use health data for ad targeting, third-party marketing, or game ranking.
• Use https://tupapp.com/privacy.html as the privacy policy URL and https://tupapp.com/account-deletion.html as the account and data deletion URL.
• Store data disclosures should stay aligned with the real app flows for health data, email, subscriptions, backups, partner sharing, and game data.

21. Short texts

Summary: The texts below are examples for in-app consent and store descriptions. They should be kept aligned with product screens.

Short privacy note for store description

Text: Olarya keeps your cycle and symptom data on your device by default. Cloud backup, health integration, and partner sharing are optional. Your health data is not used for ad targeting.

Primary button: Open privacy policy · Alternative button: Later · Character count: 211

Health data consent dialog

Text: Olarya processes your period, symptoms, and optional health metrics to show your cycle predictions and personal logs. This data may be sensitive. If you permit, this info will be used within the app; it will not be used for ad targeting.

Primary button: I permit · Alternative button: I do not permit · Character count: 268

Analytics collection dialog

Text: No behavioral analytics SDK is used in this version. If error and performance tracking are added in the future, we will separately explain what data is collected and offer necessary choices.

Primary button: Understood · Alternative button: Open privacy policy · Character count: 179

Pre-ad / ATT explanation

Text: In Olarya's Android release, the game-list ad is not shown for the first 183 days. A non-personalized banner may appear in an active partner calendar from the first day. Active Plus members do not see ads. Your health data is not used for ad targeting; the required consent flow is shown before an ad request.

Primary button: Understood · Alternative button: More info · Character count: 198

22. FAQ

Summary: This section provides brief answers to users' most practical privacy questions.

What data is stored?

Period history, cycle settings, daily symptom logs, optional health measurements, notification preferences, and app settings may be stored. If the community feature is used, post and comment data are processed separately from health records; most data remains on the device by default.

Is my health data used for advertising?

No. The Android game-list and partner-calendar banners are non-personalized. Health, cycle, pregnancy, symptom, note, location, and community data are not used for ad targeting.

How can I delete my account and data?

You can delete local data from within the app. For the online account and Supabase data, use the account deletion page or the in-app account deletion flow.

Where is data stored?

Local data is stored on your device. Supabase and RevenueCat may be used for online features such as cloud backup, partner sharing, game ranking, and subscription status. The Supabase project is hosted in the region selected in the production configuration.

What is shared with third parties?

Only data necessary to run the features you select is processed with service providers. For instance, Supabase for cloud backup, RevenueCat for subscription, Apple/Android services for health integration may be used.

Can children use the app?

The minimum age limit is 18. The app should not target children.

How will I know if the policy changes?

The new version is published on this page. Additional methods like in-app notifications or emails may be used for significant changes.

23. Official resources

Summary: The compliance notes on this page are based on official store, KVKK, EU, and provider resources.

• Official source: Google Play User Data policy — https://support.google.com/googleplay/android-developer/answer/10144311
• Official source: Google Play Data Safety guide — https://support.google.com/googleplay/android-developer/answer/10787469
• Official source: Apple App Privacy Details — https://developer.apple.com/app-store/app-privacy-details/
• Official source: Apple User Privacy and Data Use — https://developer.apple.com/app-store/user-privacy-and-data-use/
• Official source: Health Connect publishing guide — https://developer.android.com/health-and-fitness/health-connect/publish
• Official source: KVKK Disclosure Obligation — https://www.kvkk.gov.tr/Icerik/2033/Aydinlatma-Yukumlulugu-
• Official source: KVKK Data Subject Rights — https://www.kvkk.gov.tr/Icerik/2036/Ilgili-Kisinin-Haklari
• Official source: Supabase Privacy — https://supabase.com/privacy
• Official source: RevenueCat Privacy — https://www.revenuecat.com/privacy/