Privacy Policy and
Data Protection Notice

Personal Data We Process

YiYo processes only the data required for its modules to work. What is processed is limited to the information you provide and the features you use:

• Identity and contact data: Name, e-mail address. If you choose to sign in with Google or Apple, the name and e-mail provided by those services. With Apple you may use the "hide my e-mail" option.
• Special category data (health data): Height, weight, age, gender, activity level; food allergies (gluten, lactose, egg, shellfish, fish, nuts, soy); the health conditions you declare (diabetes, hypertension, cholesterol, coeliac disease, thyroid/Hashimoto, kidney conditions); diet style (vegetarian, vegan, gluten-free, etc.) and any free-text notes you write.
• Nutrition preferences and lifestyle: Goal type (lose weight, gain weight, build muscle, maintain), plan duration, number of daily meals, cuisine preference, kitchen access, work or study pattern, foods you like and dislike.
• Plan and tracking data: Generated meal plans, meal completion status, calorie and macronutrient (protein, carbohydrate, fat) values, water intake records, daily progress, weekly and monthly summaries with the AI comments generated for them, and plan history.
• Recipe suggestion data: The ingredients you select, custom ingredients you add, generated recipe history and recipes you save as favourites.
• Image and barcode data: Meal photos you take or select from your gallery for calorie analysis, and the product barcodes you scan. See section 05 for how photos are handled.
• Support request data: The subject and message you send through the in-app support form, your e-mail address, the date of the request, and the app version and platform (iOS/Android) needed to diagnose the issue.
• App preferences: Language, theme (light/dark), sound effect preference, reminder (meal, water, activity) times and on/off states. These preferences are stored only on your device.
• Connection records: The infrastructure provider may keep technical records such as IP address, connection time and device/operating system type, for the security of the service and the prevention of abuse.

YiYo does not access or process location data, contacts, step counters or health app (Apple Health / Google Fit) data.

How We Collect It and Legal Grounds

Your data is collected electronically, by non-fully-automated means, when you register, answer the onboarding questions, create a plan, log meals and water, add food by photo or barcode, generate recipes and send support requests.

• Performance of a contract (KVKK art. 5/2-c): Account creation, authentication, generation and storage of plans.
• Explicit consent (KVKK art. 6/2 and art. 9): Processing of health data and international transfers. This consent is collected separately on first launch and can be withdrawn at any time.
• Legitimate interest (KVKK art. 5/2-f): Security of the service, debugging and prevention of abuse.
• Legal obligation (KVKK art. 5/2-ç): Retention and disclosure duties arising from legislation.

Purposes of Processing

Your data is processed for the following purposes:

• Creating your account, verifying your identity and handling e-mail verification and password resets
• Generating AI-assisted daily, weekly and monthly nutrition plans suited to your profile
• Providing calorie, macronutrient and water tracking, and calculating daily targets
• Identifying the dish on your plate and its estimated nutritional values through photo analysis
• Retrieving product nutrition data by barcode and adding it as a meal
• Generating recipes from your selected ingredients within your preferences and restrictions, and syncing your favourites across devices
• Providing weekly and monthly performance summaries with AI commentary
• Scheduling meal, water and movement reminders on your device
• Answering your support requests, fixing bugs and improving the service
• Backing up your data against device loss and syncing it across devices

Data Transfers and International Transfers

Your data is never sold or rented to any third party for advertising, marketing or profiling. Only the following infrastructure providers are used to deliver the service:

• Google Firebase (Google Ireland/LLC): Authentication, database (Firestore) and server functions. Server functions run in the Frankfurt (Europe) region; the database and authentication infrastructure are hosted in Google's data centres abroad.
• Groq, Inc. (USA): The AI models used for plan generation, recipe generation, weekly/monthly commentary and photo analysis. Your nutrition profile (height, weight, age, gender, allergies, health conditions, preferences) is sent for plan and recipe generation, and your meal photo for photo analysis. Your name, e-mail address and account identifier are not sent to the AI provider.
• Open Food Facts (open-source food database): When you scan a barcode, only the product's barcode number is queried; no information about your identity is sent.
• Apple and Google (sign-in providers): If you use "Sign in with Apple" or "Sign in with Google", authentication is carried out through these providers.

Because some of these providers have servers abroad, your data is transferred internationally within the scope of article 9 of the KVKK. For your health data and meal photos, this transfer is based on the Explicit Consent Statement collected on first launch.

Apart from this, your data may only be shared upon lawful requests from authorised public authorities.

Photos, Camera and Barcode

Camera and gallery access is requested only when you use these features; refusing does not prevent you from using the other modules.

• The meal photo you take or select is resized and compressed on your device and sent to the AI provider for analysis.
• The photo itself is never stored on YiYo servers; no permanent photo archive is kept. When the analysis completes, only the result (dish name, estimated weight, calories and macronutrients) is written to your meal record.
• During barcode scanning no camera image is saved; only the decoded barcode number is queried, and the product's name, brand and nutritional values are added to your meal record.

Retention, Local Storage and Deletion

• Your account, profile, plan and tracking data, as well as your support requests, are retained for as long as your account is active.
• Some data is kept in your device's local storage, isolated in a per-user area, so that the app can work without an internet connection. Removing the app from your device deletes this local data.
• Reminder times, theme and sound preferences are never sent to the server; they stay on your device. Your language preference is also stored on your device; it is sent to the server only with the relevant requests, so that AI content can be generated in that language.
• When you delete your account, your profile, plan and tracking data, along with your support requests, are permanently deleted. See Account Deletion for details.
• Server logs kept for debugging and security (which may include your account identifier and the content of the request) are retained for up to 30 days and then deleted automatically.

Data Security

• All communication between the app and the servers uses an encrypted (TLS) connection.
• Database access is restricted by server-side security rules: each user can only read and write their own data.
• The support team can only see the support tickets belonging to you; it cannot access your profile, health or plan data.
• The secret keys used when calling the AI provider are held server-side in a secret manager; they are not present in the app.
• Your password is never visible to YiYo; authentication is handled by Firebase Authentication, and e-mail verification is mandatory for users who register by e-mail.

Your Rights as a Data Subject

Under article 11 of the KVKK you have the following rights:

• To learn whether your personal data is processed, and to request information if it is
• To learn the purpose of processing and whether it is used in line with that purpose
• To know the third parties, in Türkiye or abroad, to whom your data is transferred
• To request correction of incomplete or inaccurate data
• To request erasure or destruction of your data
• To request that correction, erasure and destruction be notified to the third parties your data was transferred to
• To object to an adverse outcome arising from analysis carried out solely by automated systems
• To claim compensation for damage caused by unlawful processing of your data

You can update your profile information on the Profile page in the app and delete your account and data with the "Delete Account" option on the same page. Other requests can be sent to [email protected]; applications are concluded within 30 days at the latest.

Children's Privacy

Because YiYo processes health data, it is intended for users aged 18 or over. Users aged 13 to 17 may use the app only with the consent of a parent or guardian; their personal data, including health data, is processed on the basis of the parent's or guardian's explicit consent. A parent or guardian can send requests to access, correct or delete the minor's data to [email protected]. Children under 13 may not use YiYo. If data is found to be processed for a child under 13, or for a user under 18 who uses the app without a parent's or guardian's consent, the account and data concerned are deleted.

Changes to This Policy

This policy is updated whenever the app's features or the infrastructure providers used change. The current version is always published on this page and the "last updated" date at the top is refreshed. For changes that broaden the scope of processing, your explicit consent is obtained again where required.

Website

This section explains the data processed when you visit the yiyo.karsh.app website. No accounts are created on the website and no personal data is collected through forms.

• Hosting and connection logs: The website is hosted on Google Firebase Hosting and delivered through Cloudflare. These providers process connection logs (IP address, time of access, browser information, network error reports) for the security and operation of the service; these logs are subject to the providers' own retention periods.
• Cookies: The website uses no analytics, advertising or tracking cookies. The infrastructure provider may use strictly necessary technical cookies for security purposes.
• Third-party content: All of the site's files, including fonts, are loaded from the yiyo.karsh.app domain; the website contains no third-party analytics, advertising or tracking scripts. Cloudflare may add its own technical scripts to the pages for security purposes, such as detecting bot traffic and protecting e-mail addresses from automated harvesting. If you click an App Store link, you are taken to Apple's website, where Apple's privacy policy applies.
• Preferences stored in your browser: Your theme preference (yiyoTheme), a language you explicitly choose from the language menu or the language suggestion bar (yiyoLangPick) and your motion preference (yiyoMotion) are kept only in your browser's local storage (localStorage); a flag that stops the language suggestion bar from reappearing during the same visit (yiyoLangHint) is kept only for that session in your browser's session storage (sessionStorage). This information is never sent to the server; you can delete it by clearing the site data in your browser.