Privacy Policy
Version 1.0 · Effective: 27.10.2026 · Türkçe
This page explains briefly how the CoreKut mobile app and corekut.com process your data. CoreKut is offered in Türkiye and is governed by the Turkish Personal Data Protection Law No. 6698 (KVKK). The binding Turkish texts are the Privacy Notice and the Explicit Consent Text; this English version is provided for information.
Controller: Ege Koparan (individual) · Cumhuriyet Mahallesi, 1973 Sokak No: 18 Daire: 1, 09020 Efeler, Aydın, Türkiye · destek@corekut.com
In short
- As a guest, your health and training data stay on your phone.
- Nutrition and supplement plans are calculated on our server: with your explicit consent your weight, height, age and similar data are sent, not stored after the calculation, and never sent to AI.
- With an account, your data is backed up to your account only with your explicit consent (Supabase, Frankfurt/EU).
- The AI coach works only if you give separate explicit consent.
- What is sent: your question and a summary of your data go to an AI service provider (OpenAI, USA; Google Vertex AI, EU, as fallback).
- What is not sent: your name, email and identifiers.
- What we don't do:
- we do not sell your data or use it for advertising;
- we do not track you across apps;
- we use no advertising or third-party analytics tools.
- Usage statistics: we count which features are used, without health data or IP address, and keep them for 13 months. You can turn this off in Settings.
- Deleting your account: in the app or at corekut.com/hesap-sil.
Data we collect and why
| Data | Purpose |
|---|---|
| Name, surname, email (with Google Sign-In: the name, email and account ID Google provides) | Your account and sign-in |
| Weight, height, age, sex, body measurements, goal; training, nutrition, water and supplement logs; muscle fatigue | Building your program (on your phone); calculating nutrition and supplement plans (with consent, not stored); backing them up with your consent if you have an account |
| Coach conversations and coach ratings | AI coach answers and their improvement (with your consent) |
| Usage events, app version, platform, random device ID | Improving the app; enforcing coach limits |
| IP address (briefly), server logs, Cloudflare Turnstile signals | Security and abuse prevention |
| Subscription status (payment details never reach us) | Unlocking Pro |
| Leaderboard: "First L." name, points, level | Leaderboard (you can opt out in Settings) |
We do not request: location, contacts, photos, camera, microphone, health apps (HealthKit/Health Connect), advertising ID.
Who we share with
Only service providers acting on our behalf:
- Hetzner: servers, Germany;
- Supabase: database, EU;
- OpenAI: AI, USA;
- Google Vertex AI: AI fallback, EU;
- RevenueCat: subscriptions, USA;
- Resend: account emails, USA;
- Cloudflare: bot protection, USA;
- Zoho: our mailbox, EU.
Apple and Google act as independent controllers for the app stores and Google Sign-In. Transfers abroad rely on the standard contracts of the Turkish Data Protection Board (KVKK Art. 9).
Retention
| Data | Kept for |
|---|---|
| Account and cloud data | Until you delete your account |
| Coach memory on our server | 7 days |
| Coach ratings and usage statistics | 13 months |
| Safety copies and encrypted backups | 30 days |
| IP address | 60 seconds; its irreversible hash 2 days |
| Content-free abuse counters | Up to 400 days |
Deleting your account and data
- In the app: Profile → Delete account. Your account and cloud data are deleted immediately; backups expire within 30 days.
- Without the app: corekut.com/hesap-sil.
- Deleting your account does not cancel your subscription; cancel it in the App Store or Google Play.
Your rights
You can exercise your rights under KVKK Art. 11 (access, rectification, erasure, objection, etc.) by writing to destek@corekut.com from your registered email. We reply within 30 days. You can withdraw your consents in the app: Settings → Privacy → "AI coach" and "Plan calculation".
Artificial intelligence
CoreKut's coach is an AI. Its answers may contain mistakes and are not medical advice. With your explicit consent, the coach sends your data to the AI provider only to generate answers. Under their API terms, the providers do not use it to train their models.
Google Sign-In
We request only the basic scopes openid, email and profile. We use the data received from Google only to create your account and recognize you. We do not use it for advertising, sell it, or send it to AI providers.
Children
CoreKut is for users aged 18 and over. If we learn that we process data of someone under 18, we delete it.
Website
corekut.com uses no cookies, analytics or ads, and keeps no visitor logs.
Security
- HTTPS everywhere.
- Row-level access rules in the database.
- Two-factor authentication for admin access.
- Encrypted backups, with keys kept off the server.
- Breach notification to the Board and to affected users within legal deadlines.
Changes and contact
We announce material changes in the app and, if you have an account, by email.
Contact: destek@corekut.com · Cumhuriyet Mahallesi, 1973 Sokak No: 18 Daire: 1, 09020 Efeler, Aydın, Türkiye