Face Mind – Personal Data Protection (KVKK) Notice and Privacy Policy

1. Data controller and scope

This notice has been prepared by İlmi Alem Astroloji Danışmanlık Ticaret Limited Şirketi (publisher of the Face Mind app; "Ilmialem") under the Turkish Personal Data Protection Law No. 6698 (KVKK) to inform the people who use the Face Mind mobile application.

Face Mind is a personal-development app that produces a character/temperament interpretation inspired by the classical firasat tradition from face and palm images, and offers daily reflections and mood tracking. It is not a medical, psychological or scientific diagnostic tool.

2. Processing of data on your device

Face and palm photos are processed only on your device. The measurements derived from the image (numeric scores in the 0–1 range such as symmetry, forehead ratio, chin shape, palm line density) are also computed on your device.

No photo, camera frame or biometric template ever leaves your device; nothing is uploaded to a server or shared with third parties. The face and palm frames taken during a scan are also deleted from the device right after the measurements are taken; they are not kept.

• Your profile photo and the photos of your loved ones are kept only in device storage, in the app’s own folder.
• Analysis history, mood records, self-accounting answers, badges and settings are stored in the app’s area on the device.
• Your data stays on your device and is not backed up: on Android, app backup (Google backup, device-to-device transfer) is turned off; on iOS, analysis, note and settings records are excluded from iCloud backup. On iOS only the profile and Loved Ones photos may be included in Apple’s encrypted device backup if you have it turned on. When you change phones, the data is not moved to the new device.
• The app uses no third-party ad network; no tracking is done for advertising purposes.

3. Optional AI service

If you give the "Personalised Text" consent, only the following data is sent to the AI service to write text for you (your nickname and photos are never sent): temperament percentages and personality axis scores; for the character report commentary also the numeric values of the face/palm measurements (scores in the 0–1 range such as symmetry, forehead ratio, palm line density); for the daily inspiration your recent mood choices (e.g. "calm", "tired"). If you ask for AI feedback on your weekly self-accounting, the answers you wrote that week are sent as well.

The texts are written by the Claude AI model of Anthropic PBC, acting as a data processor. Requests are forwarded to Anthropic through our server, which is hosted on Cloudflare, Inc. infrastructure. The servers of these providers are abroad, mainly in the USA, so the consent also covers this transfer abroad (see §8).

To reduce cost, our server caches anonymised and coarsened (rounded, bucketed) score profiles together with the text generated for them: for up to 180 days for character reports and up to 3 days for daily inspiration texts. The cache contains no nickname, photo, device identifier or any other personal data that identifies you; another user with the same coarsened profile may be shown the same text. Your weekly self-accounting answers and the feedback written for them are not stored; they are processed only while the reply is being generated.

No photo, raw image, biometric template, birth year or location is sent to this service. When you use a Premium feature (character report commentary, self-accounting feedback), the anonymous user ID randomly generated by RevenueCat is also sent to our server to verify your subscription; our server asks RevenueCat for the subscription status with it, does not store the ID and keeps only an irreversible hash of it (SHA-256) in a short-lived cache for at most 10 minutes. To limit abuse, your IP address is kept only as a request counter for at most about 10 minutes. If you do not consent, texts are produced from the on-device content pool and no data is sent.

You can withdraw the Personalised Text consent at any time under Settings › AI, and all your consents under Settings › Privacy › "Withdraw my consent".

4. Notifications and location

Morning/evening reminders are scheduled on the device as local notifications; no notification server is used.

If you choose to set reminders by prayer times, your approximate (coarse) location is read to calculate the times when you choose this mode and each time the app opens, so the times stay current; it is used only on your device. Location data is not stored and not sent anywhere. If you do not grant location permission or choose fixed-time reminders, location is not read.

5. Crash reports (Sentry)

Crash reports are optional and turned off by default. Only if you tick "Send anonymous crash reports (optional)" on the consent screen, or turn it on under Settings › Privacy, are app crashes and unexpected errors sent anonymously to the Sentry (Functional Software, Inc.) service. These reports contain the error message and technical error details, the app version, the device model and the operating system version.

Crash reports never include photos, screenshots, analysis scores, your nickname, text you have written or any other data that could identify you.

You can change this choice at any time with the "Send anonymous crash reports" switch under Settings › Privacy; while it is off, no reports are sent.

6. Categories of data processed and legal basis

Under Articles 5 and 6 of the KVKK:

• Face/palm measurements that may be biometric in nature — your explicit consent (KVKK Art. 6/2). The measurements are computed and stored on your device; only if you gave the Personalised Text consent are their numeric values sent to the AI service for the character report commentary (see §3).
• Nickname, birth year, notes, mood records — your explicit consent and necessity for providing the app (KVKK Art. 5/2-c); on your device.
• Numeric scores, mood choices and (if requested) self-accounting answers sent to the AI service — your explicit consent (Personalised Text consent, including the transfer abroad). The anonymous, coarsened score profiles kept in the cache cannot be linked to you.
• Approximate location — your explicit consent; used momentarily, not stored.
• Crash reports — your explicit consent (optional, off by default); contain no identity.
• Premium purchase and subscription records — establishment and performance of a contract (KVKK Art. 5/2-c); with a randomly generated anonymous user ID.
• Anonymous user ID for Premium verification and IP address to limit abuse — performance of a contract and legitimate interest (KVKK Art. 5/2-c, 5/2-f); only as a short-lived hash or counter.

7. Retention and deletion

Data kept on your device is stored until you delete it. The "Delete All My Data" option on the Settings screen irreversibly deletes analyses, history, profile, notes, settings, the photos kept by the app and the camera/image files the app left in its cache. Uninstalling the app also deletes all local data.

The mood choices and self-accounting answers sent in AI requests are not stored. Anonymised, coarsened score profiles and the text generated for them are cached for up to 180 days for character reports and up to 3 days for daily inspiration texts, and are then deleted automatically. The anonymous ID used for Premium verification is not stored; only its hash is kept for at most 10 minutes, and request counters tied to the IP address for at most about 10 minutes. Crash reports (if you turned them on) are kept for at most 90 days.

When you withdraw your consent under Settings › Privacy › "Withdraw my consent", no new data is sent to the AI service and consent is asked again before a new analysis; to delete the records on your device, use "Delete All My Data".

8. Transfer of data

Your data is not sold, rented or shared for advertising. Only the following service providers (data processors) are involved: (a) Anthropic PBC (Claude) for AI text, with your explicit consent; (b) Cloudflare, Inc. for hosting the server these requests pass through and the anonymous text cache; (c) Sentry for crash reports, only if you turned them on; (d) RevenueCat to verify your subscription status when you buy Premium and when you use Premium AI features. The servers of these providers may be located abroad, mainly in the USA; the transfer relies on your explicit consent under KVKK Art. 9.

Premium payments are collected by Google Play or the App Store; your card and payment details never reach us or RevenueCat. RevenueCat receives only a randomly generated anonymous user ID and the purchase and subscription records coming from the store; no photos, analysis results or nickname are sent.

9. Your rights (KVKK Art. 11)

By applying to the data controller you may exercise the following rights:

• To learn whether your personal data is processed and to request information
• To learn the purpose of processing and whether it is used in line with that purpose
• To know the third parties to whom it is transferred, domestically or abroad
• To request correction if it was processed incompletely or inaccurately
• To request its deletion or destruction
• To object to a result against you arising from analysis by automated systems
• To claim compensation if you suffer damage due to unlawful processing

10. Age limit and children

Face Mind is only for people aged 18 and over. Because biometric data is processed on the basis of explicit consent, users whose birth year shows them to be under 18 are not accepted at sign-up, and users are asked to declare that they are at least 18. If we become aware that data belonging to a user under 18 has been processed, we delete it immediately.

11. Changes and contact

When this notice is updated, the date inside the app is changed and, for significant changes, a notice is shown when the app opens.

Data controller: İlmi Alem Astroloji Danışmanlık Ticaret Limited Şirketi

For questions, requests and KVKK applications: omer@ilmialemorganizasyon.com. If you wish to submit your application in writing, write to this address and we will send you our postal address.

Last updated: October 13, 2026

12. Users in the European Economic Area, Switzerland and the United Kingdom (GDPR)

If you are in the EEA (EU countries, Iceland, Liechtenstein, Norway), Switzerland or the United Kingdom, your personal data is also processed under the General Data Protection Regulation (GDPR / UK GDPR). The controller is the company named in §1.

Legal bases: face/palm measurements may qualify as special-category (biometric) data, so they rely on your explicit consent (GDPR Art. 9(2)(a)). Personalised Text, approximate location and crash reports rely on your consent (Art. 6(1)(a)); Premium purchases and subscription verification on the performance of a contract (Art. 6(1)(b)); the short-lived IP counter used to prevent abuse on our legitimate interest (Art. 6(1)(f)). You can withdraw consent at any time; this does not affect the lawfulness of processing before withdrawal.

Your rights: access, rectification, erasure, restriction of processing, data portability and objection (Arts. 15–21). Because most data is kept only on your device, you can usually exercise these rights directly in the app ("Delete all my data", "Withdraw my consent"); for other requests, write to the email address in §11. You also have the right to lodge a complaint with the data protection supervisory authority in your country.

International transfers: the service providers listed in §8 may also process data in the United States. These transfers rely on safeguards provided for by the GDPR, such as the Standard Contractual Clauses (SCCs) offered by the providers or the EU-US Data Privacy Framework.

Automated decision-making: the character interpretations produced by the app are for personal development; no automated decision producing legal or similarly significant effects concerning you is made (Art. 22).