ZEEKY

PRIVACY POLICY

Version 1.6 — Last Updated: October 31, 2026

1. Introduction

As Rıza Türkmen ('Developer'), we care about your privacy when you use the Zeeky app ('App'). This Privacy Policy explains what personal data we collect, how we use it, who we share it with and how we protect it.

This policy has been prepared to meet our obligations under the Turkish Personal Data Protection Law No. 6698 (KVKK) and the European Union General Data Protection Regulation (GDPR). The data controller is Rıza Türkmen.

2. Data We Collect

2.1 Account Information

Full name
Email address
Password (only if you signed up with email; stored encrypted)
If you sign in with Apple or Google, the name and email address that provider shares with us
Sign-up date, language, currency and time zone preferences
Profile photo (optional; stored under an unguessable name that anyone with the link can open, and deleted together with your account)

2.2 Profile Information (Optional)

Date of birth and age, gender
Weight, height and weight goal
Lifestyle information: smoking and alcohol use, diet type, sport and sleep habits
Health information: blood type, chronic conditions, medications
Family and living situation: relationship status, children, who you live with, pets
Profession, working pattern, education level, income range
Interests, hobbies, favourite foods, music and genres
Short- and long-term goals, financial goals (monthly budget, savings goal)

All of this information is optional. Health information (blood type, chronic conditions, medications) is special category personal data; it is processed only when you enter it yourself and with your explicit consent. You can change or delete your profile information in the App at any time.

2.3 Activity and Chat Data

Daily activity entries (sport, social, food & drink, entertainment, travel, etc.), their durations, quantities and notes
Names of people you mention in your entries (people list)
Activity locations (only if permitted)
Chat history (your conversations with Zeeky)
Summary and reminder notes Zeeky keeps to help you better (memory); you can view and delete them on the Memory page in the App; sensitive details such as health conditions, medication, religion, political views or sexual orientation are not stored in memory
Your goals, suggestions and your responses to them (accepted / skipped)
Weekly summaries
Monthly reports (calculated on your device from your entries, not stored separately)

2.4 Financial Data

Income and expense entries, their categories and descriptions
Recurring transaction information
Categories you add yourself (name, icon, colour and subcategories); only you can see them

For amounts you enter in another currency: the original amount and currency and the exchange rate used for the conversion. Exchange rates are taken from European Central Bank data; no personal data is shared in the process.

Accounts: the name, type and currency you give the bank accounts, cash and credit cards you add; the balance or card debt you type; transfers between your accounts (e.g. cash withdrawals) and balance sync records (the balance Zeeky computed, the real balance you typed and the gap).

Bank screenshots (Zeeky Pro, optional): the screenshots you choose to add income and expenses from are sent to our AI provider OpenAI so that their rows can be read. Zeeky does not store the screenshots on its servers; nothing is kept once they have been read. Everything visible in a screenshot (transaction descriptions, the balance and, if shown, your name or account details) is passed to OpenAI. Only the entries you confirm (date, amount, title, category and the bank's description of the transaction) are saved to your account; card numbers, IBANs and account numbers are removed from the description before it is saved. From the entries you confirm, Zeeky learns which category (or, for a transfer, which of your accounts — e.g. a monthly transfer to the same account) you chose for a bank description or merchant, and uses it for later screenshots.

Zeeky never asks for or stores bank account numbers, IBANs, card numbers, banking passwords or access to your bank, and does not connect to your bank.

2.5 Entertainment & Viewing Data

Watched movies and series (title, genre, director, year, short plot)

This data is used to provide personalised movie and series recommendations. Movie information is enriched using OpenAI models.

2.6 Health Data (Apple HealthKit and Health Connect)

The following data is read only with your permission: on iPhone from the Apple Health app (HealthKit), on Android from Health Connect:

Daily step count
Walking distance
Active calories
Sleep duration
Heart rate

Zeeky only reads this data; it never writes anything to Apple Health or Health Connect. Health data is used to personalise the coaching service and your daily and weekly summaries. It is sent to our AI provider OpenAI only if you separately give explicit permission in the App; this permission is off by default and can be switched off in Settings at any time. Health data is not used for advertising or marketing, is not sold and is not shared with third parties for those purposes.

The use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements: it is used only for features shown to you in the App; it is not used for advertising, credit assessment or the sale of data; it is not transferred to others except as necessary for these features, for security or to comply with the law; and it is not read by humans except with your explicit consent, for security or to comply with the law.

2.7 Location Data

If you have granted location permission:

When you open the App, your approximate location (coordinates, city and country) is recorded once a day. It is used for content and notification timing that fit your time zone and country, and these records are kept as your location history.

When you add an activity, your current location can be attached to it.

Your location is not tracked continuously in the background. Location data is sent to OpenAI only if you separately give explicit permission in the App. Nominatim (OpenStreetMap) is used to turn coordinates into place names and Apple Maps (MapKit) to show maps; your account details are not sent with these requests. You can withdraw location permission in your phone's settings at any time.

2.8 Voice Data (Microphone)

When you use the voice message feature, your voice is converted to text by Apple's speech recognition service (SFSpeechRecognizer) on iPhone and by Google's on Android. The provider may do this on your device or on its servers, subject to its privacy policy. Your voice recording is not sent to or stored on our servers; only the resulting text is processed. Microphone and speech recognition permissions can be withdrawn at any time.

2.9 Notification Data

The OneSignal platform is used for notifications. Your account identifier, device push identifier and language are stored on OneSignal's servers. Notifications are delivered through Apple's push service on iPhone and Google's (Firebase Cloud Messaging) on Android. The evening and morning notifications are written by AI through our AI provider OpenAI, personalised on the basis of your entries (your activities, goals and the notes Zeeky keeps about you); other automatic notifications are built from predefined templates. Notifications may include your name, your activities and people named in your entries. Notifications shown on the lock screen never show amounts of money. Your health data is used in these texts only if you allow sharing health data. You can change your notification preferences in the App's Settings.

2.10 Technical and Usage Data

Device model, operating system and app version
The IP address you sign in from and your session is renewed from, the device/app identification string (user agent) and the country estimated from that IP address; sign-in times and method, and the times you open the App
In-app usage events (for example which feature was used or that the purchase screen was viewed); these events do not contain chat content
Technical records of AI calls (model used, duration, token count and cost); these records do not contain message content
Error and problem logs

2.11 Invite Programme

Your personal invite code
If you used an invite code: whose code it was, when you used it and whether the reward was given
The number of people you invited and the Pro time you earned

A person who invites others does not see in the App who those people are; they only see how many joined and how many months they earned. To give the reward, we only check that the invited person finished onboarding and made a first entry; the content of that entry is not read for this purpose.

3. How We Use Your Data and Legal Bases

Collected data is processed for the following purposes:

Providing the personalised AI coaching service, understanding and saving your chat messages and answering your questions on the basis of your past entries
Creating weekly summaries, suggestions and movie/series recommendations
Providing activity and financial tracking features
Sending you personalised notifications such as goal celebrations, habit and social reminders
Managing your subscription status
Running the invite-a-friend programme and adding the Pro time earned to your account
Ensuring security and preventing abuse
Improving app performance and fixing technical issues
Fulfilling legal obligations

Legal bases: data needed to provide the service is processed for the performance of our contract with you; health data, special category profile information, location data and sending health and location data to the AI are processed on the basis of your explicit consent; security and service improvement on the basis of our legitimate interests; records kept for accounting and regulatory reasons on the basis of legal obligations. You can withdraw your consent at any time.

4. Third-Party Services

We do not sell your data. Your data is shared only with the following service providers, and only as far as needed to provide the service:

4.1 Supabase

Supabase is used for the database, authentication and server infrastructure. Supabase is SOC 2 Type II certified. Your data is stored on servers in the European Union (Stockholm, Sweden). Privacy policy: supabase.com/privacy

4.2 OpenAI

OpenAI models are used for AI coaching, message understanding, suggestions, summaries, notification texts, movie information enrichment and reading income and expenses from bank screenshots. The following data is sent to OpenAI: your chat messages, activity and financial entries, the bank screenshots you choose when you use the screenshot feature and your merchant-category choices, goals, profile information and the notes Zeeky keeps about you (memory). Blood type, chronic conditions and medications, and memory notes with sensitive details, are never sent to OpenAI. Health (Apple HealthKit, Health Connect) and location data are sent only if you separately give explicit permission. Under its terms, OpenAI does not use data sent through its API to train its models and may keep it for a limited period (up to 30 days) to monitor abuse. Privacy policy: openai.com/policies/privacy-policy

4.3 Apple

Apple HealthKit (health data, only with your permission), Sign in with Apple, speech recognition (SFSpeechRecognizer), Apple Maps (MapKit) and App Store subscription payments run on Apple's infrastructure. Your payment details are not seen or stored by the Developer. Privacy policy: apple.com/legal/privacy

4.4 Google

If you choose to sign in with Google, authentication is handled by Google. On Android, Health Connect (health data, only with your permission), speech recognition, notification delivery (Firebase Cloud Messaging) and Google Play subscription payments run on Google's infrastructure. Your payment details are not seen or stored by the Developer. Privacy policy: policies.google.com/privacy

4.5 OneSignal

The OneSignal platform is used to send notifications. Privacy policy: onesignal.com/privacy

4.6 RevenueCat

The RevenueCat platform is used to manage subscription status. Your account identifier and App Store or Google Play purchase information are sent to RevenueCat. Privacy policy: revenuecat.com/privacy

4.7 Nominatim / OpenStreetMap

Nominatim (OpenStreetMap) is used to turn coordinates into place names. Your account details are not sent with these requests.

4.8 country.is

In the admin panel, the country.is service is used to find which country a sign-in IP address belongs to. Only the IP address is sent; your account details are not. Private and local network addresses are never sent.

5. Data Security

The following measures are taken to protect your data:

All data is transmitted over HTTPS/TLS-encrypted connections and stored encrypted on the servers
Passwords are hashed with the bcrypt algorithm
Database access is protected by Row Level Security (RLS); no user can access another user's data
The Developer accesses data only with authorised access and only when needed for support, security and running the service; for this, the admin panel shows a user's activity feed (sign-up, sign-ins, app opens, when messages and records were made) and, when needed, the content of single messages and records and the sign-in IP addresses and countries; opening a single item's content from the activity feed and viewing the sign-in list are logged
Voice recordings are not sent to our servers
Regular security updates are applied

No system is 100% secure. In case of a security breach, you will be notified within the legal timeframe.

6. Data Retention

Your data is kept for the following periods:

Account and profile information: until the account is deleted
Profile photo: until the account is deleted
Activity entries, chat history and memory notes: until the account is deleted
Financial data (including accounts, transfers, balance syncs and learned merchant-category choices): until the account is deleted
Bank screenshots: not stored; deleted once they have been read (OpenAI may keep them for up to 30 days to monitor abuse)
Health data: until the account is deleted
Location history: until the account is deleted
Movie/series viewing history: until the account is deleted
Notification history: until the account is deleted
Usage events: until the account is deleted
Invite records: until the account is deleted; when an account is deleted, the record is kept unlinked from that account so that invite counts and the reward cap stay correct
Sign-in IP addresses and countries: at most 180 days (the last 30 per user); deleted at once when the account is deleted
Admin access logs: until the account is deleted; when it is deleted, the link to your account is removed
Technical records of AI calls: kept anonymously, unlinked from your account, once the account is deleted
Subscription and payment records: for the period required by law; your personal details are removed from them when the account is deleted
Server technical logs: for the hosting provider's retention period (a few days)

You can delete your account at any time from the Settings page in the App. When the account is deleted, all of the data above is permanently deleted from our database. Records held by service providers (e.g. OneSignal, RevenueCat) are deleted according to that provider's retention rules.

7. Your Rights

Under KVKK and GDPR you have the following rights:

Right of access: you can request the data we hold about you
Right to rectification: you can ask for incorrect data to be corrected; you can also edit your profile and entries in the App
Right to erasure: you can delete your account and all your data from the Settings page in the App, or ask us to delete it
Right to restriction: you can ask for processing to be restricted
Right to data portability: you can request your data in a structured format
Right to object: you can object to processing
Right to withdraw consent: you can withdraw your permissions for health, location and sharing data with the AI at any time in the App and in your phone's settings

To exercise your rights, email info@zeeky.app. Requests will be answered within 30 days.

8. Children's Privacy

Zeeky is not intended for children under 13. If we become aware that we have collected data from a child under 13, we will delete it immediately. Users under 18 must obtain parental consent.

9. Local Storage

Zeeky uses local storage on your device for session management and to store your app preferences (e.g. theme, language). This data stays on your device only and is not shared with third parties.

The share images of the monthly report cards are created on your device; unless you choose to share a card, they are not sent anywhere and are not stored on our servers. Amounts in the image are hidden unless you show them. An image you share is subject to the rules of the app and the people you share it with.

10. International Data Transfers

Your data is stored in the European Union. Through OpenAI, OneSignal, RevenueCat, Apple and Google (if you sign in with Google or use Android), your data may be transferred outside the EU, in particular to the United States. These transfers are made with appropriate safeguards such as Standard Contractual Clauses under Article 46 GDPR and in line with the KVKK rules on international transfers.

11. Policy Changes

This Privacy Policy may be updated from time to time. Significant changes will be announced through an in-app notification or by email. The updated policy takes effect from the date it is published in the App.

12. Contact & Complaints

For privacy questions or complaints:

Email: info@zeeky.app
Data Controller: Rıza Türkmen
Website: zeeky.app

You may also submit KVKK applications to the Turkish Personal Data Protection Authority (kvkk.gov.tr). For GDPR complaints, you may contact the data protection authority of the relevant EU country.