KVKK Information Notice (Türkiye)
This is the information notice required by Article 10 of Türkiye's Personal Data Protection Law No. 6698 (KVKK). It is a translation; the Turkish text is the authoritative one. The full Privacy Policy describes the same facts in more detail.
1. Data controller
Harun Yazgan (an individual), İstanbul, Türkiye. Contact: support@harunyazgan.com.
2. Personal data processed
- Identity: your display name (optional); with Sign in with Google, the name on your Google account.
- Contact: your email address.
- Your content: island names, place names you type, dates, the weather you pick, notes, wishes, decorations, special days (a birth year only if you add one), Kraki feeding records.
- Images: photos you attach.
- Customer transactions: subscription status, store transaction identifiers, renewal date; feedback you send from the app.
- Security: a one-way hash of your password, hashes of sign-in and reset tokens, your Apple or Google account identifier, the push token and phone language if you allow notifications, crash reports (error type, a short message, a stack excerpt) and a few named product events linked to your pair.
Our Sea never collects your device location, advertising identifier, contacts, calendar or health data. We do not ask for special categories of personal data; please do not put such information in free-text fields or photos.
3. Purposes
- To create your account, keep you signed in and reset your password when you ask;
- to provide the app: store your content, share it with the person you paired with, and sync it between your devices;
- to verify your subscription and unlock its features;
- if you allow it, to tell you when your partner adds something;
- to find and fix bugs, keep the service secure and prevent abuse;
- to answer support requests and feedback;
- to meet legal obligations and handle legal matters such as content complaints, copyright notices and requests from authorities.
4. Legal bases (KVKK Art. 5(2))
- (c) Necessary to enter into or perform the contract: the account, content, pairing, sync, password reset, subscription and the notifications you turn on.
- (ç) Legal obligation: retention, notification and authority requests required by law.
- (e) Establishing, exercising or defending a right: disputes, content and copyright notices.
- (f) Legitimate interest: security, crash reports and product events — linked to your pair, not to you, and never containing anything you wrote.
We do not rely on your explicit consent for any of this.
5. How it is collected
Electronically, through the app: what you enter, technical data the app sends automatically (crash reports, product events, the push token if allowed), what Apple or Google provide when you choose to sign in with them, and subscription information the App Store / Google Play report through RevenueCat.
6. Recipients
We do not sell your data or share it with advertising or analytics companies. It is transferred only to:
| Recipient | Why | What they see |
|---|---|---|
| The person you paired with | Our Sea is a shared space for two | Everything in your shared sea, your display name and colour |
| Cloudflare, Inc. (US; global network) | Servers, database and photo storage | All stored data, hosted on our behalf |
| Apple | Sign in with Apple, App Store payments, iPhone notifications (APNs) | Your Apple account and payment details; for notifications the push token and generic text |
| Sign in with Google (if chosen), Firebase Cloud Messaging (if notifications are allowed), Google Play payments | Your Google account; the push token and generic text; the Play purchase record | |
| RevenueCat, Inc. (US) | Checks subscription purchases with the stores | Subscription status and purchase records, keyed by your Our Sea account id |
| Resend (US) | The password-reset email; delivering a copy of feedback to our support inbox | Your email address and the reset code; for feedback, your message and account details |
It may also be disclosed to public authorities legally entitled to request it, only where the law requires and only to the extent requested.
7. Transfers abroad
Every company above is based outside Türkiye (in the US or the EU), so your data is stored and processed abroad. Transfers abroad are governed by KVKK Article 9. The safeguard relied on for them is the standard contract published by the Personal Data Protection Board. As of the date at the top of this page, signing that contract with each of these companies and notifying it to the Kişisel Verileri Koruma Kurumu has not yet been completed; this page will be updated when it has.
8. Retention
As set out under “How long we keep it” in the Privacy Policy: your content until you delete it; sign-in tokens a week after expiry or a month after revocation; reset tokens once used or expired; invite codes a month after they stop working; crash reports and product events after 90 days; push tokens on sign-out, on account deletion, when reported invalid or after 90 days unused; feedback when you delete your account.
9. Your rights under KVKK Article 11
You may ask the controller (a) whether your personal data is processed, (b) for information about it, (c) for its purpose and whether it is used accordingly, (ç) who it is transferred to in Türkiye or abroad, (d) to correct it, (e) to erase or destroy it under KVKK Article 7, (f) for (d) and (e) to be notified to the recipients, (g) to object to an adverse result produced solely by automated analysis, and (ğ) for compensation of damage caused by unlawful processing.
10. How to apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, write to support@harunyazgan.com from the email address registered on your Our Sea account, with your full name, Turkish ID number (for foreigners: nationality and passport/ID number), a postal or email address for the reply, and your request. For registered electronic mail (KEP), secure e-signature, mobile signature or a written application, ask the same address for the current details. Requests are answered free of charge within 30 days; if a request is refused, the answer is insufficient or none arrives in time, you may complain to the Personal Data Protection Board under KVKK Article 14.