Nobbi Privacy Policy

DRAFT — legal review required (TASLAK — hukuki inceleme gerekir). This text was compiled from facts found in the code and working notes. It is not legal advice and makes no claim of compliance with KVKK, GDPR or any other law, and no claim of any certification. Items in [...] are to be filled in or decided by Okan or a lawyer (see ACIK-SORULAR.md). The source of every fact is listed in KAYNAKLAR.md. The Turkish text is the primary version.

Effective date: [EFFECTIVE DATE]
Version: Draft 1 (21 October 2026)

1. Who we are and what this covers

Nobbi is an iOS app that helps parents and authorised caregivers keep shared baby and child care records. Operator and data controller: [CONTROLLER NAME], [ADDRESS]. Privacy questions and rights requests: [PRIVACY EMAIL].

Nobbi is not directed at children. An adult parent or caregiver creates the account and, as parent or guardian, provides information about the child. We do not intend accounts for anyone under [MINIMUM AGE].

Nobbi is a recording and reminder tool. It gives no medical advice, diagnosis or treatment recommendation. If you are worried, talk to your doctor.

2. In short: where is your data?

The in-app screen "Where is your data?" (Verin nerede?) says the following (the app speaks to you informally; the German and Turkish app texts are the same in substance):

• On your phone. A copy of your records and any records not sent yet stay on this phone; you can read and write without a connection.
• On our server. Records are stored on a Supabase server in Europe (Frankfurt) so they can be shared with family members. Only the family sees them.
• Mini photos. Mini photos are sent encrypted; copies stay on your phone. If you like they are backed up, encrypted, to your iCloud Drive; you can switch this on or off in Settings.
• Through Apple. Notifications and Live Activities reach your phone through Apple's notification service. The text is a care reminder.
• Nowhere. Nothing about your child is sent to cloud AI. No ads; data is not sold.

The sections below add detail. "Only the family sees them" describes what family members can see inside the app according to their role; access by infrastructure providers and, if you report a photo, by our support team is set out in section 6.

3. What we process

Kept on the server

• Account: the email address provided through Sign in with Apple (Apple's relay address if you chose "Hide My Email"), display name, account ID. [If email-code sign-in is enabled: the email address you enter.] With Sign in with Apple, the refresh token Apple provides is kept in a restricted private area so we can tell Apple to revoke it when an account is deleted.
• Family members and invitations: membership and role (admin, caregiver, viewer); an optional relationship label and working-hours note entered by an admin; invitations (role, expiry, and the name the inviting person types for the invitee; when the invitee accepts and has no display name yet, that name becomes their profile name). When you enter other people's details, you are responsible for informing them.
• Child profile: name, date of birth, sex, gestational weeks (if entered), colour, time zone and chosen avatar code. The app does not ask for a child's ID number. The child's profile photo stays on the phone in this version and is not uploaded. [LAWYER/CHECK: confirm for the release build]
• Care records: feeding, diapers, sleep, medication/supplements, weight-height-head-circumference measurements, notes, reminders/appointments, and which account entered each record. These may be health-related. These records are stored on the server in readable form; they are not end-to-end encrypted. Our hosting provider applies access controls and encryption in transit and at rest, but the people who operate the system can technically access them.
• Health records and doctor questions (temperature, vomiting, diarrhea, vaccinations and "My questions"): only the value, time and the note you write (max. 280 characters) are stored; the app does not interpret values and adds no thresholds, labels or advice. Admins and caregivers can write, viewers can read. The doctor summary/PDF is created on your phone; a file you share cannot be recalled. [This feature may not yet be in a released build at the time of writing: confirm before publishing.]
• Notifications and widgets: your device's Apple push (APNs) token, installation/session IDs and notification preferences. A token may be bound even if you decline notifications so that an invisible "look again" signal can refresh widgets. The token is deleted when you sign out.
• Live Activity: an activity-specific Apple token (valid for up to 8 hours) is kept on the server. A Live Activity can show the child's name and times; a "hide child name" setting exists.
• Mini-photo keys and device events: each phone's photo-encryption public key, device ID and last-seen time (the private key never leaves the phone); who has blocked whom.
• Support and report records: see section 5 if you report a photo; your correspondence if you write to us.
• Technical logs: our infrastructure provider may keep request logs (IP address, time, error) for a limited time. Period and scope: [TO BE CONFIRMED].

Stays on the phone, not sent to our server: the mini-photo archive and its keys, appearance/lock-screen preferences, records waiting to be sent, a small data file shared with widgets.

What we do not use: advertising, tracking, data brokers, third-party analytics or third-party crash-reporting tools (the app's software dependencies are only the Supabase client and its libraries). Nothing about your child is sent to cloud AI. We do not request location, contacts or microphone access; the camera is used only to take mini photos and Face ID only to verify you before showing the photo-backup recovery key.

4. Why we process it, and on what basis

To create and verify your account, match family members to roles, show and sync shared records, handle invitations, send notifications and widget updates, deliver family photos, prevent abuse and provide support. Legal bases (contract, explicit consent, legitimate interests, etc.) and how parent/guardian consent for health-related child data is obtained: [LAWYER DECISION].

5. Mini photos

• The photo, its note and tags are encrypted on your phone before sending; decryption keys exist only on the phones of the people you select. On the server the encrypted copy exists only for delivery and is deleted once every recipient has received it, or after 7 days at the latest.
• For delivery the server sees the sender account, recipients, child, times and encrypted file sizes.
• If you report a photo (with your explicit consent), a decrypted copy, its note and tags, and the sender's account ID go to our support team; that copy is no longer end-to-end encrypted and is kept for 90 days.
• Photos are not added to your photo library unless you choose "Save to gallery".
• Optional iCloud Drive backup: in builds with the iCloud capability and when iCloud is available, data that exists only on your phone is backed up, encrypted, to your iCloud Drive. This backup lives in Apple's service under your account; it does not go to the Nobbi server, we cannot access it, and we may not be able to delete copies on Apple's side. [LAWYER/CHECK: whether iCloud is active in the release build]

6. Who can see your data

• Family members, by role (admin, caregiver, viewer); admins and caregivers can write. A mini photo is seen only by the selected recipients.
• Infrastructure providers: Supabase (server, authentication, storage; Frankfurt) and Apple (Sign in with Apple, push notifications/APNs, iCloud). They process data as far as their role requires. Transfers and sub-processors: [LAWYER].
• Our support team: only a photo you report and your support correspondence.
• We may have to disclose information on a lawful request by authorities. We do not sell your data.

7. Data on your phone

The local database on the phone is a cache and a send queue. Records entered offline wait on the phone and are sent when a connection returns. When an account deletion completes (after the 15-day cancellation period), this phone's data for the account is erased.

8. Retention and account deletion

• Care records are kept while your account/family continues. When you delete a record it disappears from family screens; it may remain on the server marked as deleted and in the change history. The defined automatic permanent-deletion period for this: [PERIOD DECISION PENDING].
• A content-free marker of deleted records is kept for 45 days so other devices learn of the deletion.
• Mini photos: encrypted transfer copy up to 7 days; reported-photo record 90 days; a phone's key registration/revocation events 30 days; a phone key not opened for 45 days is revoked.
• Account deletion. A deletion request completes at the earliest 15 days after confirmation; during that time you can cancel by signing in again. On completion your account, sessions and notification tokens are deleted and the Sign in with Apple token is revoked at Apple. What happens to a child's data depends on the other family members: if no other active member exists (and you separately confirm), the child's records and photo storage are deleted; if other members exist, the child's data is not deleted, the content of the records you entered remains as shared family data, and your identity link is removed. If you are a child's last admin you must hand over the admin role first.
• [IMPORTANT — decision before publishing: the in-app account-deletion entry is closed in the build this draft was written against. This paragraph can be published only once the entry is opened or an email-based deletion route is defined; see ACIK-SORULAR.md item 1.]
• Deletion from server backups: [TO BE CONFIRMED]. Your own iCloud/Files copies are under your control.

9. Nobbi Plus and payments

This version has no purchases; all features are available to everyone. [When Plus sales start: subscriptions are bought through Apple; payment, billing, refunds and renewal are handled by Apple; your card details do not reach us. Apple's transaction IDs, product, period and status are kept linked to your account/family.] We do not advertise or track.

10. Children's data

You provide a child's data as parent or guardian. The app is not directed at children and we do not knowingly collect accounts or data from children. A child's data is never sent to any cloud AI service, including for AI training.

11. Your rights and contact

Under applicable law (e.g. KVKK Art. 11, GDPR) you may have rights of access, rectification, erasure, objection, restriction, portability and to withdraw consent. Requests: [PRIVACY EMAIL]. You may complain to the competent supervisory authority. Procedure, deadlines and authorities: [LAWYER].

12. Changes

If we update this policy we will announce it on this page and in the app, and give advance notice of material changes. Current address: [POLICY URL].