Privacy Policy
Last updated: 19 October 2026
1. Introduction
HeartPin is an app for two partners, provided by Seyfi Can Zeyrek, an individual developer in Türkiye, who publishes it under the name Morrowline. You pair your phone with your partner's and keep a shared space: widgets for your home screen and lock screen, notes, miss-you pings, drawings, photos, places, games, a daily question, a shared pet and a streak. This policy explains what personal data HeartPin handles, why, who receives it and what you can do about it. It covers the HeartPin app for iPhone and Android, its widgets and its notifications.
The Terms of use at https://heartpin.morrowline.app/en/terms/ apply together with this policy. Users in Türkiye can read the separate information notice under the Turkish data protection law (KVKK) on our website; when the app is in Turkish, it is also linked from Settings.
In short:
- HeartPin creates an anonymous account identifier for you. There is no email address, phone number or password to give.
- Anything you add to your shared space is visible to your partner and is stored on servers run by Google (Firebase).
- Location is used only if you allow it. Your partner's app receives your position rounded to about 1 km, and you can stop sharing it at any time.
- We collect crash reports to keep the app stable. HeartPin has no ads, no analytics service and no tracking.
- You can delete your account in the app at Settings > Delete account.
2. Who we are
The controller responsible for your personal data is Seyfi Can Zeyrek, an individual developer, Esenyalı Mahallesi, İzmir, Türkiye ("we", "us"). Privacy contact: zeyrekseyfican@gmail.com. The app is published in the App Store and on Google Play under the name Morrowline. We have not appointed a data protection officer.
3. Scope
This policy applies to the HeartPin app, its home-screen and lock-screen widgets, its notifications, the invite page we host for people who open a HeartPin invite link in a browser, and our legal and support pages. The invite page is a static page; the provider that hosts it receives your IP address as part of the normal web request.
It does not cover the App Store, Google Play, your operating system, your phone maker, the map and search services described below when you use them directly, or any site or app of another company. Screens in the app can give extra notices at the moment data is collected, for example before the system asks for location access.
4. Data we collect
We collect only what the features you use need. The labels below match the ones used in the store privacy summaries.
You give us
| Data | What it includes | Why we use it | Who receives it |
|---|---|---|---|
| Name or nickname (optional) | The first name or nickname you type, shown to your partner, on widgets and on your invite | To show who you are to your partner | Your partner, Google (Firebase) |
| Photos (optional) | A profile photo; a widget photo with its original; portraits on a widget; a place photo | To show them in the app, on widgets and to your partner | Your partner, Google (Firebase) |
| Messages and notes you send (optional) | Notes up to 1,000 characters (including sealed notes that open on a date), miss-you pings and nudges, reactions, whether a note or ping was seen, answers to the daily question and questions you write yourselves | To deliver them to your partner and show them in the app and on widgets | Your partner, Google (Firebase) |
| Other content you create | Drawings, widget content (titles, dates, countdowns, names, the relationship start date), places (name, address, note, category, coordinates, visit date), check-ins, a short status that lasts up to 24 hours | To run the features and keep both phones in sync | Your partner, Google (Firebase) |
| Game content you create (optional) | Game answers, pet name and pet care, streak | To run games, the pet and the streak | Your partner, Google (Firebase) |
| Search queries (optional) | The place name or address you type in Our places, and the pin you drop on the map | To find a place and label it | Google (Firebase) as our search relay, Photon (komoot); as a fallback Apple (App Store and iOS) or Google (Android and Google Play) |
| Precise location, rounded (optional) | Your device location while the app is open, rounded to two decimal places (about 1.1 km), with the time | To show the distance between you and your partner | Your partner's app, Google (Firebase) |
| Terms acceptance record | The version of the Terms you accepted and when, recorded when you tap Agree and continue | To show which terms apply to you | Google (Firebase) |
We collect automatically
| Data | What it includes | Why we use it | Who receives it |
|---|---|---|---|
| Account identifier (user ID) | The anonymous identifier created when you first open the app; the pairing (the two identifiers, its status, time zone and invite code); the same identifier used as your purchase identifier and attached to crash reports | To run your account and your pairing | Google (Firebase), RevenueCat, your partner (pairing status) |
| Device identifiers and push token | The push token and platform, the Firebase installation identifier, the crash-reporting installation identifier, app attestation tokens | To deliver notifications and widget updates, to run Firebase and to secure the service | Google (Firebase), Apple (App Store and iOS) |
| App usage and interactions | When you were last active, which notes and pings were seen, an activity list of what you and your partner did, your notification choices and the number of free moments you have used | To run the features and show your partner what is new | Your partner (activity, last active, seen state), Google (Firebase) |
| Crash reports | Crash and error reports with the app version and the device state at the time (model, operating system, free memory and disk, orientation) | To find and fix crashes | Google (Firebase) |
| Other diagnostics | App attestation results, a hashed form of your network address used to limit invite-code guessing, server logs; on Android, usage and device details that Google Play services send for the on-device photo cut-out model | To keep the service secure and working | Google (Firebase), Google (ML Kit), Apple (App Store and iOS), Google (Android and Google Play) |
| Approximate location of the map | The map area you view in Our places, requested as map tiles together with your IP address | To draw the map | OpenFreeMap |
We receive from others
| Data | What it includes | Why we use it | Who receives it |
|---|---|---|---|
| Purchase and subscription status | Whether Couple Pro is active, its product and expiry, from the store and RevenueCat; we never see your payment card | To unlock Couple Pro for you and your partner | RevenueCat, Google (Firebase), Apple (App Store and iOS), Google (Android and Google Play) |
| Your partner's content | What your partner adds to your shared space, which can include your name, photos of you or places you visited together | To show it to you | Google (Firebase) |
We collect crash reports and diagnostics through Google (Firebase Crashlytics); we do not use an analytics service. Crash reporting is on for everyone and has no switch in the app; section 7 explains the basis and how to object.
How photos are handled
Photos you add are uploaded to Cloud Storage for Firebase, a Google service, and are visible to the person you are paired with; for widget photos both the cropped copy and the original are stored. Place photos are re-encoded on your phone without camera or location metadata before they are uploaded. Other photos are resized by the photo picker of your phone, which leaves out location data; other camera details in the file may remain. A photo you take with the camera is uploaded as your profile photo; the camera opens only when you choose to take one. Cutting a person out of a photo for a widget happens on your phone.
Stays on your device
A copy of widget content, including images, is kept on your phone so widgets can draw without a connection; on iPhone it sits in an app group shared by the app and the widget. The position used for the reminder about saved places nearby, the person cut-out of a photo, an image cache and your preferences (for example Share my distance) also stay on the device.
What we do not collect
HeartPin does not ask for your contacts, calendar, microphone or an email address or phone number, does not read your location in the background, and does not read the advertising identifier of your device.
Sensitive information
Your location, the content of your notes and photos of you can be sensitive. Location is collected only after you allow it in the system prompt and only while Share my distance is on. HeartPin does not ask about your health, sex life or sexual orientation; what you write or upload is chosen by you and is processed only to deliver it to your partner. Do not add details you do not want your partner or our service providers to hold.
Required or optional
The anonymous identifier is needed to use the app. A name, photos, location, place search, a status and notifications are optional; without them the matching feature does not work and the rest of the app does.
5. How we collect data
- Directly from you: what you type, choose, draw or upload, and the Agree and continue step on the welcome screen.
- Automatically: the app, your operating system and our service providers' software create the identifier, push token, last-active time, attestation results and crash reports; permissions you grant let the app read your location.
- From other sources: the stores and RevenueCat tell us whether your subscription is active, and your partner adds content that you can see.
6. How we use data
- To provide and sync the service: pairing, notes, pings, drawings, widgets, places, games, the daily question, the pet and the streak.
- To create and secure your account: the anonymous identifier, app attestation, limits on invite-code guessing and other abuse.
- To deliver notifications and refresh your widgets.
- To process purchases and decide whether Couple Pro is active, and to count free moments.
- To keep the app working: crash reports and server logs.
- To answer your emails and requests.
- To comply with the law and to defend legal claims.
HeartPin does not show ads and does not use your data for advertising. We do not sell your personal information and we do not share it for cross-context behavioural advertising. We do not build profiles about you beyond what the features above need, and we do not send marketing messages.
7. Legal bases
| Purpose | Data | Legal basis (GDPR / UK GDPR) | KVKK article 5 |
|---|---|---|---|
| Provide the service you asked for | Name, content, photos, places, account identifier, pairing, push token, last active, activity list, free-moment count, terms acceptance record | Contract: we need this to provide the service (art. 6(1)(b)) | 5/2-c performance of a contract |
| Distance between you and your partner | Rounded location | Contract (art. 6(1)(b)); you start it by allowing location access and can end it at any time | 5/2-c performance of a contract |
| Place search and map | Search text, rounded map centre, dropped pin, map area | Contract (art. 6(1)(b)) | 5/2-c performance of a contract |
| Purchases | Purchase and subscription status | Contract (art. 6(1)(b)); accounting records also a legal obligation (art. 6(1)(c)) | 5/2-c and 5/2-ç |
| Crash reporting and stability | Crash reports, device state, crash-reporting installation identifier, account identifier | Legitimate interests (art. 6(1)(f)): keeping the app stable and fixing errors | 5/2-f legitimate interest |
| Security and abuse prevention | App attestation, hashed network address, logs | Legitimate interests (art. 6(1)(f)): protecting the service and its users | 5/2-f legitimate interest |
| Support and requests | Your email, the support code and app version in it | Legitimate interests (art. 6(1)(f)): answering you and handling your rights | 5/2-f legitimate interest |
| Legal claims | Records relevant to a dispute | Legitimate interests (art. 6(1)(f)): defending legal claims | 5/2-e establishing, exercising or protecting a right |
You can object at any time to processing based on legitimate interests, including crash reporting, by writing to zeyrekseyfican@gmail.com with your support code. The app has no switch for crash reporting, so we handle an objection by email: we weigh your reasons against ours and tell you what we will do. We do not rely on consent for any processing in the app.
8. Device permissions
HeartPin asks for permissions only for the features below. You can refuse any of them and change your mind in your phone's settings; the rest of the app works without them.
Location (while the app is open)
Why we ask: To show the distance between you and your partner, to centre the map on you and to remind you about saved places nearby. On iPhone the system prompt says: "HeartPin uses your location while in use to show straight-line distance to your partner, show where you are on the map and remind you about saved places." On Android the permissions are approximate and precise location.
What we do not do: We never ask for background location, and we do not use your location for advertising or sell it.
Stored or sent: While the app is open, you have allowed location access and Share my distance is on, the app reads your device location, rounds it to about 1 km and stores it so the distance to your partner can be shown; your partner’s app receives this rounded position. The reminder about saved places compares your position with your places on your phone and does not send it to us.
How to turn it off: To stop sharing your location, turn off Share my distance in the app’s settings or turn off location access for the app in your phone’s settings; the app then deletes your stored rounded position and your partner no longer sees the distance. Share my distance is in Settings > Your data and applies to this phone. The position is deleted at once when you turn off the switch, and the next time HeartPin opens when you turn off location access. On iPhone: Settings > Privacy & Security > Location Services > HeartPin. On Android: Settings > Apps > HeartPin > Permissions > Location.
Notifications
Why we ask: To tell you what your partner did (notes, pings, drawings, games, places) and when your pairing changes.
What we do not do: We do not send marketing or advertising messages, and HeartPin works without notifications.
Stored or sent: If you allow notifications, a push token identifies your device to the push service so we can reach you. Notifications are service messages about what your partner does in the app and about pairing; we do not send marketing notifications. A visible notification can show your partner's name and, for places, the name of the place; it never contains the text of a note.
How to turn it off: In your phone's settings under Notifications > HeartPin, or for single categories in Settings > Notifications in the app.
Camera
Why we ask: To take your profile photo.
What we do not do: We do not record video, take pictures in the background or recognise faces.
Stored or sent: The photo is resized on your phone and uploaded as your profile photo. On Android the system camera app takes the picture and HeartPin asks for no camera permission.
How to turn it off: On iPhone: Settings > Privacy & Security > Camera > HeartPin.
Photos
Why we ask: To let you choose pictures for widgets, portraits, places and your profile photo.
What we do not do: We do not browse your library; the system picker returns only the pictures you choose, and on Android the photo picker needs no permission.
Stored or sent: The pictures you choose are uploaded as described in section 4.
How to turn it off: On iPhone: Settings > Privacy & Security > Photos > HeartPin.
9. What other people can see
Anything you add to a shared space (notes, pings, drawings, photos, widgets, places, answers, your status, when you were last active and the distance between you) is visible to the person you are paired with. Your partner's app also receives your rounded position, as described in section 8. Your partner's game answers are shown to you after you have given yours. Each of you can delete the notes, drawings and places you added.
Before someone joins with your invite code, they can see your name, your profile photo, a preview of your widget and whether you left a note. Keep your invite code to the person you intend.
Home-screen and lock-screen widgets can show your notes, drawings, photos, names, countdowns and distance to anyone who can see your screen. Silent background messages that refresh widgets carry widget content, such as note drafts, names, answers and image links, through the push services of Google and Apple.
Shared content is stored on our servers so it can be delivered to the other person; we do not use it for advertising. Access rules let only the two of you read your shared space in the app. The person who runs the service can technically access stored data and does so only when needed to run and secure the service or to handle a report or a legal request.
If you unpair, your stored location and game rounds are cleared, and the notes, drawings, places, pet and photos you added stay with your partner. If you pair again later, you start a new space. Deleting your account works differently: it removes what you added (section 13).
There is no report or block button in the app. Unpairing ends all contact with your partner. To report content or behaviour, or if you feel unsafe because of how HeartPin is used, use Contact us in Settings or write to zeyrekseyfican@gmail.com.
For app store review, two fixed invite codes pair a reviewer with a demo partner created by our server; the demo partner is synthetic content, not a real person, and demo spaces are deleted after 30 days.
10. Who receives data
Some data leaves your device to run the features you use: your profile, content, photos, places, rounded location and push token go to Google (Firebase), and your purchase status to RevenueCat.
Service providers
These providers process data for us under their data processing terms.
| Recipient | What it does for us | Data |
|---|---|---|
| Google (Firebase) | Hosts the backend: sign-in, database, file storage, server functions (including our place-search relay) and web hosting; delivers push messages; crash reporting (Crashlytics); app attestation (App Check) | Everything in section 4 that is stored on our servers, crash reports and diagnostics |
| RevenueCat | Handles subscription purchases and tells us whether Couple Pro is active | Account identifier used as purchase identifier, purchase and subscription status, device and app details sent by its software |
| Google (ML Kit) | Android only: supplies the on-device model that cuts a person out of a widget photo; the photo stays on the phone | No photos; usage and device details |
| Google (Gmail) | Hosts our support mailbox | Your email address, your message and the app version and support code in it |
Settings shows a support code, which is your account identifier; it is added to emails you start from Contact us so we can find your account, and we may ask for it before we act on a request.
Independent services
These services decide for themselves how they handle the data they receive; their own privacy policies apply.
| Recipient | What it receives |
|---|---|
| Photon (komoot) | The text you type when searching for a place, the rounded map centre and the coordinates of a dropped pin, passed on by our search relay. Photon sees the address of our server, not yours, and does not receive your account identifier. |
| OpenFreeMap | The visible map area and your IP address, to draw map tiles. |
| Apple (App Store and iOS) | App Store purchases, notification delivery on iPhone, app attestation and, as a fallback, place search through the iPhone's geocoder. |
| Google (Android and Google Play) | Google Play purchases, app attestation on Android and, as a fallback, place search through the Android geocoder. |
When you search for a place, the text you type and the approximate map centre (and, for a dropped pin, its coordinates) are sent through our server to the Photon geocoder run by komoot; if that search fails, your phone’s built-in geocoder from Apple or Google is used instead. Map tiles are loaded from OpenFreeMap, which sees the map area and your IP address. Our search relay logs the length, status and timing of a request, not the text or the coordinates.
Other people in the app
Your partner receives what section 9 describes.
Legal and corporate
We disclose data to authorities when the law requires it, to protect rights and safety, and to a successor if the service is transferred; this policy then continues to apply.
Sale and sharing
We do not sell your personal information and we do not share it for cross-context behavioural advertising.
11. International transfers
Our backend runs on Google Cloud: the database is in the United States multi-region "nam5" and server functions run in "us-central1" in the United States. Uploaded files, crash reports and app attestation are handled on Google's infrastructure, which can be in the United States and other countries. RevenueCat, Google (Gmail), Google (ML Kit), Apple and Google Play process data in the United States and other countries. Photon (komoot) runs in Germany; OpenFreeMap is a public service whose server locations we do not control.
When data of people in the European Economic Area or the United Kingdom goes to providers outside these areas, we rely on the standard contractual clauses of the European Commission (with the UK addendum for the United Kingdom) included in the providers' data processing terms. For Türkiye, transfers abroad rest on article 9 of Law no. 6698 and its appropriate safeguards. We have no agreement with Photon (komoot) or OpenFreeMap; data reaches them only when you search for a place or open the map. You can ask for a copy of the safeguards at zeyrekseyfican@gmail.com.
12. Retention
| Data | How long | What triggers deletion |
|---|---|---|
| Account identifier, name, profile photo, status, pairing, last active, push token, notification choices, free-moment counter, terms acceptance record | Until you delete your account; a status lasts at most 24 hours | Deleting your account |
| Notes, pings, drawings, photos, widgets, places, answers, check-ins and game content | Until the author deletes them or deletes their account; when the last member of a space deletes their account, the whole space goes | Deleting the content or the account |
| Pet and streak | As long as the shared space exists | Deletion of the space |
| Rounded location | Until you turn off Share my distance or location access, unpair or delete your account | Any of these |
| Activity list | 90 days | Automatic expiry |
| Hashed network addresses for rate limits and invite codes | A few days | Automatic expiry |
| Place search text and map requests | Our relay keeps neither the text nor the coordinates; Photon (komoot) and OpenFreeMap keep requests for the period they set | Controlled by those services |
| Crash reports, attestation and push data | For the period Google sets in its own retention settings; we have not shortened it | Controlled by Google |
| Purchase and subscription records | As long as the stores, RevenueCat and the law require (for example accounting records) | Store and legal rules |
| Support emails | While needed to answer you and handle your request | When the matter is closed |
| Demo spaces for app review | 30 days | Automatic deletion |
| Widget copies and caches on your phone | Until you remove the app or unpair | Removing the app |
Deleted data can remain in encrypted backups and logs for a limited period until they are overwritten. Content your partner has already received on their device or widget stays there until it refreshes. Store purchase records stay with Apple or Google under their rules. Your phone's own backup (iCloud or Google backup) can include app data stored on the device.
13. Account and data deletion
The app creates an anonymous account identifier when you first open it; it is not tied to your name unless you add one. To delete your account, open the Settings tab, tap Delete account and confirm. The deletion runs at once; if a step fails, the app tells you before your sign-in identity is removed, and you can try again. The page https://heartpin.morrowline.app/en/delete-account/ repeats these steps.
Deleting your account removes your profile, your private settings, your sign-in identity, your stored location and the invitations you created, and everything you added to a shared space now or earlier: notes, reactions, answers, questions you wrote, pings, drawings, photos, check-ins, game rounds and places you added; your text and answers are removed from shared widgets. Your partner keeps their own content and the shared pet and streak. Your name and photo are also removed from places your partner added, and the activity list loses your entries. If you were the only member of your space, the whole space and its files are removed. The number of free moments you used stays with your seat, so a new account in the same seat cannot reset it.
When you delete your account we also ask RevenueCat to delete its subscription record for you; Apple and Google keep their own purchase records. If that request fails, the RevenueCat record stays under RevenueCat's rules. Crash reports already sent to Google, content already shown on your partner's phone and our support emails are not removed by the deletion in the app.
Deleting your account does not cancel a subscription; cancel it in your App Store or Google Play account settings. Deleting the app does not delete your account either.
On iPhone your sign-in can survive a reinstall in the system keychain, and Android backup can restore it. A new install that finds an earlier account shows a Welcome back screen where you can continue or choose Start fresh, which deletes the earlier account in the same way. If you lose your phone without either of these, you lose access to the account, and you can ask us to delete it.
To ask for deletion without the app, write to zeyrekseyfican@gmail.com and include your support code if you have it. Without the code we may ask for details that only the account holder knows, such as your name, your partner's name and when you paired, before we act; if we cannot identify the account, we tell you.
14. Your rights and choices
Wherever you live, you can ask us what we hold about you, ask for a copy, ask us to correct or delete it, ask us to restrict or stop using it where the law gives you that right, object to processing based on legitimate interests, and complain. In the app you can switch notification categories off, turn off Share my distance, change or remove your photos, delete your notes, drawings and places, unpair and delete your account.
To use a right the app does not offer, write to zeyrekseyfican@gmail.com and include your support code. We may ask for details linked to your account to check who you are. We answer within one month (45 days for requests under US state laws, 30 days for requests under the Turkish law), and we do not treat you differently for using a right. If we refuse a request, you can appeal by replying to our message; we answer within the period the law sets. An authorised agent can write for you with proof of authority. If the data protection law where you live gives you other rights, we honour them: write to us and tell us where you live.
15. Additional information for the EEA and UK
The controller is named in section 2. Under the GDPR and the UK GDPR you have the right of access, rectification, erasure, restriction, data portability and objection (articles 15 to 21), and the right not to be subject to a decision based solely on automated processing with legal or similarly significant effects (article 22); we make no such decisions. We do not rely on consent, so there is no consent to withdraw; you can object to crash reporting and other processing based on legitimate interests as described in section 7. You can complain to the supervisory authority where you live or work; in the United Kingdom this is the Information Commissioner's Office. UK users can also complain to us first at zeyrekseyfican@gmail.com: we acknowledge a complaint within 30 days and investigate it without undue delay. The anonymous identifier is needed to use the app; everything else is optional, as section 4 explains. The legal bases are in section 7, the recipients in section 10 and the transfers in section 11. We have not appointed a representative in the EU or the UK.
16. Additional information for US residents
We extend the rights below to all US residents. We do not sell personal information and we do not share it for cross-context behavioural advertising. We have no actual knowledge of selling or sharing the personal information of anyone under 16. There is therefore no opt-out link for sale or sharing, and an opt-out preference signal changes nothing.
| California category | Examples | Source | Disclosed to |
|---|---|---|---|
| Identifiers | Account identifier, name or nickname, push token, installation identifiers, IP address | You, your device | Service providers (Google (Firebase), RevenueCat); your partner (name) |
| Commercial information | Subscription status | Stores, RevenueCat | Service providers |
| Internet or other electronic network activity | Last active, seen state, activity list, crash reports, diagnostics, search text | Your device, you | Service providers; Photon (komoot) for search text |
| Geolocation data | Location rounded to about 1 km, saved places, dropped pins, map area | Your device, you | Service providers; your partner; Photon (komoot); OpenFreeMap |
| Audio, electronic, visual or similar information | Photos you upload | You | Service providers; your partner |
| Other personal information | Notes, drawings, answers, widgets, game content | You | Service providers; your partner |
| Inferences | Streaks and counters computed from your actions | Our systems | Your partner |
We collected these categories in the last 12 months for the purposes in section 6 and keep them as section 12 describes. Sensitive personal information we collect: your location rounded to about 1 km, the coordinates of a pin you drop for place search, and the content of your notes. We use it only to provide the service you asked for and do not use it to infer characteristics about you. You have the right to know, delete and correct personal information and to limit the use of sensitive personal information (we already use it only for the service). Submit a request at zeyrekseyfican@gmail.com with your support code; we verify it against details tied to your account. Authorised agents and appeals work as section 14 describes.
17. Additional information for Türkiye
For users in Türkiye the data controller is Seyfi Can Zeyrek, an individual resident in Türkiye. Your personal data is also described in the separate information notice under Law no. 6698 (KVKK) at https://heartpin.morrowline.app/en/kvkk/. That notice informs you; it does not ask for consent. Under article 11 of the law you may ask whether your data is processed, request information about it, learn the purpose and whether it is used accordingly, learn the recipients in Türkiye or abroad, request correction or deletion and notification of these to recipients, object to a result against you from solely automated analysis, and claim compensation for unlawful processing. Apply in writing at zeyrekseyfican@gmail.com or to the address in section 2; we answer within thirty days.
18. Children
HeartPin is for adults. You must be at least 18 years old to use it. The app is not directed to children, and we do not knowingly collect personal data from anyone under 18. If we learn that someone under 18 uses HeartPin, we delete the account and its data. A parent or guardian who believes a child uses HeartPin can write to zeyrekseyfican@gmail.com.
19. Security
We protect your data with these safeguards. Data travels between the app and our servers over encrypted connections. Access rules on the database and file storage let only the two members of a space read it, and your private settings and purchase record are readable only by you and our server. Our server functions and data stores require app attestation (Play Integrity on Android, App Attest or DeviceCheck on iPhone) and limit repeated requests. Google's cloud services encrypt stored data at rest. Your sign-in is kept in the system keychain or app storage of your phone. No system's security is perfect: lock your phone, give your invite code only to your partner and remove the app from phones you no longer use. We will tell you and the authorities about a breach as the law requires.
20. Changes to this policy
When we change this policy in a material way, for example to add a type of data, a recipient or a purpose, we tell you in the app and update the date above before the change applies. Earlier versions are available on request.
21. Contact
Seyfi Can Zeyrek (individual developer; publisher name: Morrowline), Esenyalı Mahallesi, İzmir, Türkiye. Email: zeyrekseyfican@gmail.com. We answer within one month. For users in the EEA and the UK these are also the trader details, and you can contact your local data protection authority. Users in Türkiye apply under the KVKK as section 17 describes.
