Odefit Privacy Policy

Last updated: October 29, 2026 Effective date: July 25, 2026

1. Data Controller

This Privacy Policy has been prepared by the Odefit mobile application (“Odefit”, “we”, “the App”).

Email: [email protected]

Under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”), Odefit acts as the data controller.

2. What This Policy Covers

This policy explains the personal data we collect, process, and store while you use the Odefit app and visit the odefit.com website; the purposes for which we use it; who we share it with; and your rights.

3. Data We Collect

3.1 Information you provide when creating an account

• Name, surname, email address
• Basic profile information (name, email, profile photo) received from Google or Apple when you sign in with those providers
• Password (stored encrypted; even we cannot see your plain-text password)

3.2 Your health and body data (special category personal data)

• Height, weight, age, gender
• Body measurements (if any)
• Fitness goals (weight loss, muscle gain, etc.)
• Workout history and completed/missed sessions
• Nutrition logs (meal logs, water intake)
• The content of your AI coaching chat conversations

Under KVKK Art. 6, this data may fall under special category personal data (health-related data). We only process this data after obtaining your explicit consent. You may withdraw your consent at any time via the app settings or by contacting us; withdrawing consent may make related features (AI coaching, nutrition tracking, etc.) unusable.

3.3 Photos

Meal photos you upload for the food-scanning feature are sent to the AI service for macro-nutrient analysis.

3.4 Technical data collected automatically

• Device information (operating system, device model)
• App usage statistics (crash logs, performance data)
• IP address and approximate location (if available)

3.5 Payment information

Your subscription purchases are processed through the Apple App Store / Google Play. We do not see or store your credit card information — this information is processed directly by Apple/Google and our subscription infrastructure provider, RevenueCat. We only receive your subscription status (active/inactive, plan type).

3.6 Our website (odefit.com) and cookies

When you visit odefit.com:

• Necessary local storage: your chosen theme and your cookie choice are kept in your browser. They are there for the site to work and are not shared with anyone.
• Analytics cookies (only if you agree): we use Google Analytics (Google LLC) to understand how the site is used. If you agree, the pages you visit, time on the site, device and browser type, approximate location and IP address are sent to Google; Google’s servers may be outside Turkey. This data is not used for advertising and is not linked to your account in the app.
• If you do not agree, analytics cookies are never loaded. You can withdraw your consent at any time through “Cookie preferences” at the bottom of the site.

4. Why We Process Your Data

5. Who We Share Your Data With

• Supabase (our database, authentication, and file storage infrastructure provider, hosted in the EU (EU-West) region)
• Google Gemini API (for meal-photo analysis and generating AI coaching responses; your photo and message content is sent to this service and is not retained beyond the purpose of processing)
• RevenueCat (to manage your subscription/purchase status)
• Firebase Cloud Messaging (to send push notifications)
• Authorized public institutions and organizations, where legally required

We never sell your data to third parties for marketing purposes.

6. Data Retention Period

Your personal data is retained for as long as your account is active and as needed for the purposes above. When you delete your account, your data is deleted or anonymized within 30 days; data subject to a legal retention obligation (e.g., invoice records) is retained for the period required by applicable law.

7. Data Security

• Your data is encrypted in transit (TLS/HTTPS)
• Database access is restricted using Row Level Security policies — you can only access your own data
• AI service keys are kept server-side only (Edge Functions) and are never embedded in the mobile app

8. Your Rights Under KVKK

Under KVKK Art. 11, you have the right to:

• Learn whether your personal data is being processed
• Request information about it, if it is being processed
• Learn the purpose of processing and whether it is used in accordance with that purpose
• Know the third parties to whom your data is transferred, domestically or abroad
• Request correction of incomplete/inaccurate data
• Request deletion/destruction of your data
• Request that these actions be notified to third parties to whom your data was transferred
• Object to a result that arises to your detriment through analysis conducted solely by automated systems
• Request compensation for damage arising from unlawful processing

You can reach us at [email protected] to exercise these rights.

9. Children’s Privacy

Odefit is not directed at users under 18. We do not knowingly collect data from individuals under 18. If we become aware of such a case, we will delete the relevant data immediately.

10. Changes

We may update this policy from time to time. We will notify you of material changes via in-app notification or email.

11. Contact

For questions: [email protected]