Data Protection Notice (KVKK)
Last updated: 21.09.2026
This notice is issued under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”) and the accompanying Communiqué on the Procedures and Principles for Fulfilling the Disclosure Obligation.
The Privacy Policy describes in general terms how we handle your data. This notice discharges a separate obligation that KVKK imposes in addition to it. Read the two together.
1. Data Controller
Odefit (the App) acts as data controller under KVKK.
Contact: [email protected]
2. Categories of Personal Data Processed
2.1 Ordinary personal data
| Category | Examples |
|---|---|
| Identity | Name, surname, profile photo |
| Contact | Email address |
| Transaction security | Session records, device/push token, IP address |
| Customer transactions | Subscription status, purchased packages, appointments |
| Marketing | Advertising identifier, in-app interaction data |
2.2 Special-category personal data (health data)
Under KVKK Article 6, health data is special-category personal data and requires separate, explicit consent. The App processes:
- Height, weight, body-fat percentage and body measurements
- Training records, fitness test results and performance data
- Nutrition/meal records and water intake
- Progress photographs (before/after images)
- Any health condition, injury, illness, pregnancy or medication information you choose to share with a professional or the AI coach
These are processed solely on the basis of your explicit consent. You may decline. If you do, you can still use the App’s account and messaging functions, but features that depend on health data (training and nutrition tracking, progress photos, fitness tests, AI coaching) will not work.
3. Purposes of Processing
- Creating, verifying and managing your account
- Providing training, nutrition and progress-tracking functions
- Providing AI coaching, meal recognition and weekly reports
- Enabling you to contact professionals and manage packages and appointments
- Operating subscription and payment processes
- Sending notifications
- Maintaining service security and detecting misuse or off-platform solicitation
- Meeting legal obligations and responding to lawful requests
4. Legal Bases (KVKK Articles 5 and 6)
| Data / processing | Legal basis |
|---|---|
| Account data, subscriptions, package purchases | Necessary for the performance of a contract (Art. 5/2-c) |
| Security logs, misuse detection | Legitimate interest (Art. 5/2-f) |
| Invoice/record retention | Legal obligation (Art. 5/2-ç) |
| All health data | Explicit consent (Art. 6/2) |
| Sharing progress photos with a professional | Separate explicit consent |
| Marketing/advertising identifier | Consent (revocable in device settings) |
5. Transfers
| Recipient | Data | Purpose | Transferred abroad |
|---|---|---|---|
| Supabase (hosting, database, storage) | Account and app data | Infrastructure | Yes |
| Google (Gemini API) | Text/image/audio you submit to AI features and related profile fields | AI coaching, meal recognition, transcription | Yes |
| Google (Firebase Cloud Messaging) | Device push token | Push notifications | Yes |
| Google (AdMob) | Advertising identifier | Ads in the free tier | Yes |
| RevenueCat | Subscription status | Subscription management | Yes |
| Open Food Facts | Barcode number only | Product nutrition lookup | Yes |
| Your chosen professional | Only what you share | Coaching service | No (may vary with their location) |
| Competent public authorities | As requested | Legal obligation | No |
Transfers abroad: the providers above may hold data on servers outside Türkiye. Under KVKK Article 9 such transfers require a lawful mechanism — an undertaking/standard contract, an adequacy decision, or explicit consent. By using the App and accepting the consent text you also consent to these transfers.
6. Method of Collection
Personal data is collected electronically, by partly automated and automated means, through information you enter yourself, technical data your device generates automatically, and third-party sign-in providers (Google, Apple).
7. Retention
- Account and app data: for as long as your account is active
- On deletion: associated data is erased; records subject to a statutory retention obligation (for example commercial or tax records) are kept for the period that legislation requires
- Read notifications: deleted automatically 30 days after being read
- Message moderation records: for a proportionate period, for platform safety
8. Your Rights (KVKK Article 11)
You may apply to the controller to:
- Learn whether your personal data is processed
- Request information if it has been
- Learn the purpose and whether it is used accordingly
- Know the third parties to whom it is transferred, at home or abroad
- Request correction if it is incomplete or inaccurate
- Request erasure or destruction under the conditions in Article 7
- Request that correction/erasure be notified to third parties it was transferred to
- Object to a result produced against you solely by automated analysis
- Claim compensation for loss caused by unlawful processing
How to apply: email [email protected]. Your request will be answered within 30 days at the latest. If it is refused or goes unanswered, you may complain to the Personal Data Protection Board.
9. Withdrawing Consent
Where processing rests on your consent you may withdraw it at any time. Withdrawal does not make processing carried out before it unlawful. Once withdrawn, the affected features stop working and, on request, the related data is deleted.
10. Children’s Data
The App is not intended for anyone under 18 and does not knowingly collect their data. If we learn that we hold data belonging to someone under 18, we delete it.