Privacy Policy
Last updated: 1 October 2026
1. Who we are
This Privacy Policy explains how personal data is processed when you use the MycoPeek mobile application and its website (together, the “App”). The App is an informational and educational tool that uses artificial intelligence to help identify mushrooms and other fungi from photos.
Data controller: [COMPANY NAME], [ADDRESS], [TAX / REGISTRATION NUMBER]. We act as data controller under the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, where applicable, the EU General Data Protection Regulation (“GDPR”).
Contact: [EMAIL ADDRESS]
By using the App, you acknowledge that you have read this Policy. It should be read together with our Terms of Use.
2. Data we collect
We collect only the minimum data needed to provide the service. You need an account to use the App.
| Category | Examples | How it is collected |
|---|---|---|
| Content you upload | Mushroom photos and their identification results | From you, with camera or photo library permission |
| Account data | Email address, password (stored only as a secure hash), language and notification preferences; optionally your first name, last name and profile photo | When you register and when you edit your profile |
| Scan history | Your past scans and their results | From your use of the App |
| Purchase data | Subscription status, plan, renewal date, transaction ID | Via the App Store or Google Play and our subscription provider RevenueCat |
| Device and usage data | Platform (iOS or Android), app version, IP address, request logs, push notification token | Automatically, when the App communicates with our servers |
| Support messages | Your email address, your message, the topic you choose and, where provided, your platform and app version | When you contact us in the App or on our website |
We do not receive your card details. Payments are processed by Apple or Google; we only receive the limited information needed to verify your subscription.
Do not submit sensitive data. Please avoid including faces, license plates, home addresses or other people in your photos. The App does not perform facial recognition or collect biometric data.
Our website. Our website only uses cookies that are strictly necessary for it to work, such as the session cookie that protects the support form. It does not use analytics or advertising cookies. When you use the support form, we process the information you enter as described in this Policy.
3. Why we process your data and on what legal basis
We process your data for the purposes below, relying on the legal bases in Article 5 of KVKK and Article 6 of the GDPR.
| Purpose | Legal basis |
|---|---|
| Analyzing photos and generating identification results | Performance of a contract |
| Managing your account and scan history | Performance of a contract |
| Verifying subscriptions, handling refund requests | Performance of a contract, legitimate interests |
| Fixing bugs, keeping the App secure, preventing abuse | Legitimate interests |
| Improving the App through anonymous or aggregated statistics | Legitimate interests |
| Sending notifications and marketing messages | Consent; withdrawable at any time |
| Responding to support requests | Legitimate interests |
| Complying with legal obligations, protecting our rights | Legal obligation, establishment and defense of legal claims |
You have the right to object to processing based on legitimate interests. We do not use your uploaded photos to train our own models.
4. Who we share data with
We do not sell your personal data. We share data only with service providers that help us run the App, and only to the extent necessary.
AI provider. To generate identification results, your photos are sent to OpenAI. OpenAI processes this content under its own terms and retention rules, so please do not include sensitive or personal information in your photos.
Other service providers:
| Service | Provider | Data shared |
|---|---|---|
| Hosting and storage | Cloudflare (R2 storage) and our server hosting provider | Uploaded photos, account and scan data |
| Subscription management | Apple, Google, RevenueCat | Subscription and transaction IDs |
| Account emails | Mailgun | Email address, email content (such as verification and password reset links) |
| Push notifications | Firebase Cloud Messaging (Google) | Push notification token, notification content |
| Support | Our email provider | Email address, message content |
Other cases. We may also disclose data where required by law or by a court or public authority; to prevent fraud and security incidents; or in a merger, acquisition or sale of assets. If you request a refund, we may share limited usage information with Apple or Google (such as time since install, usage time and trial use) to help assess the request.
5. International transfers, retention and security
International transfers. Our service providers may store data on servers outside your country (for example in the US or the EU). We carry out these transfers using mechanisms that comply with Article 9 of KVKK and the GDPR, such as standard contractual clauses or, where required, your explicit consent.
Retention periods:
| Data | Period |
|---|---|
| Scans, their photos and results | Until you delete the scan or your account. The photos of a deleted scan are removed immediately and the scan record within 30 days |
| Account data | Until you delete your account; then removed within 30 days |
| Technical logs | For a limited period, then deleted automatically by rotation (web server logs: up to 8 weeks) |
| Support messages | As long as needed to handle your request. Messages you sent by email or through our website are kept in our support mailbox. When you delete your account, your email address and the link to your account are removed from the messages you sent in the App |
| Purchase records | As long as required by law, without the link to your account |
When a period ends, data is deleted, destroyed or anonymized. We may keep it longer where there is a legal dispute or legal obligation.
Security. We protect data with encryption in transit, access controls and least-privilege access. However, no system can guarantee complete security.
6. Your rights
Under Article 11 of KVKK and, where applicable, the GDPR, you have the right to:
- Find out whether your data is processed and request information about it
- Have incomplete or inaccurate data corrected
- Have your data deleted or destroyed
- Restrict processing and object to processing based on legitimate interests
- Receive a portable copy of your data
- Learn which third parties your data has been transferred to
- Withdraw your consent at any time
- Claim compensation if you suffer damage
You can send requests to [EMAIL ADDRESS], use Settings > Delete account in the App or use the form on our Support page. We respond free of charge within 30 days and may ask you to verify your identity. You may also lodge a complaint with the Turkish Personal Data Protection Authority or, if you live in the EU, your local supervisory authority.
California residents. We do not sell or share personal information for cross-context behavioral advertising, and you may request access to or deletion of your data as described above.
Permissions. You can turn off camera, photo library and notification permissions in your device settings at any time.
7. Children
The App is not directed at children under [16 / 18], and we do not knowingly collect data from them. If we become aware of such data, we delete it as soon as possible. Parents can contact us at [EMAIL ADDRESS].
8. Changes
We may update this Policy from time to time. The current version is published on this page with its new effective date. We will notify you of significant changes within the App.
9. Contact
[COMPANY NAME]
Address: [ADDRESS]
Email: [EMAIL ADDRESS]