Privacy Policy
Effective date: 4 August 2026This policy explains what personal data the Grafta mobile app collects, why we process it, who we share it with, and how you can exercise your rights. Turkish version: Gizlilik Politikası.
1. Data controller
Dode Yazılım (“we”) develops Grafta and acts as the data controller.
Privacy and data requests: iletisim@dodeyazilim.com
General support: destek@dodeyazilim.com
2. Data we collect
| Category | Contents | Source |
|---|---|---|
| Account | Email address, display name and profile image (if any), user ID | Google or Apple sign-in, or email sign-up |
| Photos | Hair/beard photos you upload for analysis, recovery diary photos, hairline drawings | Your uploads |
| Analysis & content | Hair loss stage assessment, graft estimate, AI preview images, diary notes, operation date, goals | In-app usage |
| Community content | Posts and comments you share, your reports and blocks | If you use the community feature |
| Care & progress | Daily care task completions, streak counter, badges, quiz and learning progress | In-app usage |
| Subscription data | Subscription status, purchase history, remaining credit balance | Via RevenueCat, through the App Store / Google Play |
| Technical data | Device model, OS version, app version, language, crash reports, aggregated usage events, push token | Automatic |
| Clinic enquiry | Only if you choose to contact a clinic: your contact details and analysis summary | With your explicit consent |
We never see your payment details. All purchases are processed by the App Store or Google Play. Your card number and billing address stay with Apple/Google — we only receive whether your subscription is active.
3. Why we process your data
- Providing the service: analysis, preview generation, diary and care tracking, account management.
- Managing subscriptions: verifying access to premium features, tracking credit balance.
- Community safety: reviewing reported content, preventing abuse.
- Improving the product: detecting and fixing bugs, understanding which features are used.
- Communication: account-related notices and, if you opt in, reminder push notifications.
Legal bases
Under GDPR Art. 6 (and Turkey’s KVKK Art. 5) we rely on: performance of a contract (to deliver the service to you), consent (photo uploads, sharing with a clinic, push notifications, optional analytics), and legitimate interests (security, abuse prevention, troubleshooting). You can withdraw consent at any time.
4. Your photos and AI processing
Photos you upload are stored in private, non-public storage scoped to your account. No other user can access them; access rules are enforced at the database level.
To generate analyses and previews, your photos are transmitted temporarily to fal.ai, our AI processing provider. This happens only during an operation you initiate; photos are not permanently retained by the provider and are not used to train models.
We do not use photos for identity verification or biometric identification. Deleting a photo in the app also deletes it from storage.
5. Who we share data with
We do not sell your data and do not share it for advertising. We rely on the following providers to operate the service:
| Provider | Purpose | Data shared |
|---|---|---|
| Supabase | Database, authentication, photo storage | Account, content and photos (EU servers) |
| fal.ai | AI analysis and preview generation | Photo and text input during the operation (temporary) |
| RevenueCat | Subscription state management | Anonymous customer ID, subscription status |
| Apple / Google | Sign-in, payments, notification delivery | Account identifier, purchase record |
| Sentry | Crash and error reporting | Technical error records (EU servers) |
| PostHog | Product analytics | Usage events (EU servers) |
| Expo | Push notification delivery | Device push token |
| Partner clinics | Only if you submit an enquiry | Your contact details and analysis summary |
Some providers are located outside Türkiye and the EU (e.g. the United States). Such transfers are covered by standard contractual clauses and the providers’ data processing agreements.
6. Sharing with clinics
Your diary, analyses and photos are yours by default. A clinic can only see this information if you explicitly submit an enquiry and approve the sharing. You can withdraw that approval from within the app at any time.
7. Retention and deletion
- We keep your data for as long as your account exists.
- You can delete individual photos, diary entries or community posts in the app; deletion is permanent.
- If you choose Delete account in the app, your profile, analyses, previews, diary entries, credit history, care records and all stored photos are permanently deleted. This cannot be undone.
- Records we must retain by law (e.g. purchase and invoice records held by Apple and Google) may be kept for the period required by applicable legislation.
8. Your rights
Under GDPR (and KVKK Art. 11) you have the right to:
- Know whether we process your data and access it,
- Have inaccurate or incomplete data corrected,
- Request erasure of your data,
- Receive your data in a structured format (portability),
- Object to processing and withdraw consent,
- Lodge a complaint with your supervisory authority (in Türkiye, the Personal Data Protection Board).
Send requests to iletisim@dodeyazilim.com; we respond within 30 days at the latest. You can delete your account immediately, without waiting, using “Delete account” in the app.
9. Security
All traffic is carried over encrypted connections (HTTPS/TLS). Your photos are held in private storage protected by row-level access rules, so only you can reach your data. That said, no system can be guaranteed 100% secure.
10. Children
Grafta is not directed at children under 13 and we do not knowingly collect their data. If you are under 18, use the app only with the consent of a parent or guardian. If we learn that we have collected data from a child under 13, we delete it without delay.
11. Medical disclaimer
Grafta is not a medical device or healthcare service. Analyses, estimates and previews in the app are informational only and do not replace diagnosis, treatment or a physician’s advice.
12. Changes
We may update this policy from time to time. We will notify you in the app about material changes. The effective date at the top reflects the latest update.
13. Contact
Privacy and data requests: iletisim@dodeyazilim.com
Support: destek@dodeyazilim.com