Privacy Policy — StickyFridge

Effective date: 2026-08-21
Contact: mkceliks@gmail.com

1. Who we are

"StickyFridge" ("we", "us", or "the App") is operated by Mustafa Kemal Çelik, Mersin, Türkiye. We can be reached at mkceliks@gmail.com.

2. What we collect

Account data (required)

• Email address (from Apple Sign-In, Google Sign-In, or magic-link verification)
• A display name you provide
• Your chosen @handle

Profile data (optional)

• Profile photo you upload
• Phone number in E.164 format, if you opt in to contact-based friend discovery
• Language preference and time zone

Content you create (required to use the product)

• Tracker configurations (name, icon, template)
• Daily entries: text notes, numeric fields, photos you attach, timestamps
• Reactions and comments on your own entries and entries shared with you as a supporter
• Invite codes you create or accept

Device + usage data

• A push notification token (provided by Apple/Google) so we can notify you of reactions, comments, invites, reminders, and weekly digests
• Telemetry events (e.g. tracker_created, entry_created, app_opened) — device-anonymous except for the user id we already associate with your account
• Crash and error diagnostics via Sentry (device model, OS version, app version, and stack traces). Sentry performance tracing is disabled.
• Server logs and metrics: request and user identifiers, error details, email address during authentication diagnostics, and technical context such as tracker/template names

Subscription + purchase data

• RevenueCat user id, product and entitlement details, subscription status, trial/renewal state, period dates, store, and transaction identifier

Contact matching (opt-in only)

• If you grant Contacts permission, we send one-way HMAC-SHA256 hashes of your contacts' phone numbers to match you with StickyFridge users. The plaintext numbers never leave your device. Only the hashes are transmitted, and only hashes that match an existing StickyFridge user are returned to your device.

3. What we do NOT collect

• We do not collect plaintext phone numbers of your contacts.
• We do not sell, rent, or share your personal data with advertisers.
• We do not use third-party advertising SDKs.
• We do not read the content of your photos beyond displaying them to you and the supporters you invite. One exception: when you explicitly approve a meal photo for calorie estimation, that photo is sent to a third-party AI service (OpenAI) — see sections 4 and 10.
• We do not track you across other apps or websites.

4. Why we collect it (legal basis under GDPR / KVKK)

• Providing the service (contract): account data, tracker data, entries, invites, reactions, comments.
• Authentication and abuse prevention (legitimate interest): auth tokens, rate-limit counters, telemetry.
• Push notifications (consent): push token — revocable by disabling notifications in iOS/Android settings.
• Contact-matching (explicit opt-in consent): phone hash exchange. Revocable by revoking Contacts permission and/or deleting your phone number from your profile.
• Optional AI calorie estimation: the App shows a first-use notice before the first estimate. If you accept it, the selected meal photo is sent to OpenAI only when you press the estimate button. You can decline the notice or leave this feature unused without affecting the rest of the App.
• Subscription management (contract and legal obligation): purchase, entitlement, renewal, and transaction details.
• Security and service operations (legitimate interest): server logs, error diagnostics, limited product-activity notifications, and operational and security alerts.

5. Who sees your content

• You: everything you create.
• Supporters you explicitly invite: the specific tracker you invited them to, its entries (including photos + notes), your reactions and comments.
• No one else sees your trackers or entries. A user who guesses your username or email cannot access your data.
• Supporters can react and comment; you can delete your own comments and revoke any supporter at any time.

6. Storage + security

• Content is stored on Cloudflare R2 (private bucket, US/EU region) and Railway-hosted PostgreSQL (EU region).
• Image access is authenticated: only you and your active supporters can fetch your photos.
• Phone numbers, when provided, are HMAC-SHA256 hashed with a server-held pepper before being compared against other users' hashes. We never compare plaintext.
• All connections are TLS-encrypted.

7. Retention

• Entries, photos, and trackers are retained while your account is active.
• A photo sent for calorie estimation is not separately stored by us for that purpose after the estimate is produced. OpenAI may retain input and output content in API abuse-monitoring logs for up to 30 days by default; if a different approved retention configuration applies to our account, that configuration governs. See OpenAI API data controls for details.
• Subscription records are retained while your account is active and, after deletion, only as needed to resolve payment disputes or meet legal obligations.
• Deleted (archived) trackers and soft-deleted comments remain in our database for up to 30 days after deletion, then are hard-deleted.
• Inactive accounts: we may delete accounts that have been unused for 24 consecutive months, after a 30-day email warning.
• You can delete your account at any time from Settings → Delete account. Upon deletion, personal data is erased within 30 days (except where law requires longer retention).

8. Your rights (GDPR / KVKK)

You have the right to:

• Access a copy of your data (email mkceliks@gmail.com — we respond within 30 days).
• Correct inaccurate data (directly in Settings, or by email).
• Delete your account and all associated data.
• Object to or restrict processing of your data (email us).
• Port your data to another service in a machine-readable format.
• Lodge a complaint with your local data protection authority (Türkiye: KVKK / kvkk.gov.tr; EU: your country's DPA).

9. Children

StickyFridge is not intended for users under 13 (or under 16 in GDPR jurisdictions requiring parental consent for data processing). We do not knowingly collect data from children. If you believe a child has signed up, email mkceliks@gmail.com and we will delete the account.

10. Third-party services

We use the following service providers strictly for the functions listed:

• Cloudflare R2 — image storage.
• Railway — application hosting, PostgreSQL database.
• Expo — mobile build, OTA updates, push-notification routing.
• Resend — transactional email (magic-link codes).
• Apple + Google — OAuth sign-in, push-notification delivery, App Store / Play Store distribution.
• OpenAI — calorie estimation from meal photos you ask us to estimate after accepting the first-use notice (US).
• Sentry — app crash and error reporting.
• RevenueCat — subscription and purchase verification, including product, entitlement, store, transaction, and renewal status.
• Grafana Cloud — server logs, traces, and performance metrics. Records may include request/user identifiers, error context, email address during authentication diagnostics, and tracker/template names.
• Slack — limited product-activity notifications plus operational and security alerts. Product notifications may include an @handle, sign-in method, or tracker/template name; these notifications do not include photo, note, or comment content. Operational alerts may include request ID, route, error context, stack trace, and, for some subscription-webhook authentication failures, remote address and user agent.

Each processor has its own privacy commitments; we do not pass them more data than they need to operate.

11. International transfers

Your data may be processed in the EU, US, or Türkiye depending on which service handles the request. When applicable law requires a transfer safeguard, we use the mechanism required for that transfer; this may include Standard Contractual Clauses or another legally recognized safeguard. Email us if you would like details.

12. Changes

We publish the current version of this policy here and update the "Effective date" above. If applicable law requires additional notice or consent, we will provide it through an appropriate channel.