Chirp — Privacy Policy
Effective: 2026‑05‑05 Data Controller: Özer Subaşı (sole developer) · Istanbul, Türkiye Contact: chirp@ozersubasi.com
This policy explains how Chirp collects, uses, and protects personal data. It is GDPR (EU 2016/679) and Türkiye KVKK (Law No. 6698) compliant. Note: This is a v0.1.0 draft. Have a lawyer review before publishing on chirp.ozersubasi.com.
1. What we collect
Account info (via Sign in with Apple):
- Email address (or Apple’s relay address if you use Hide My Email)
- Name (only on first sign-in; you can edit later)
- Apple user identifier (a stable, anonymous ID)
Your baby’s records (you enter them):
- Baby name, birth date, gender
- Feeding, diaper, sleep, measurement, medication, vaccination, appointment logs
- Height, weight, head circumference
- Milestones, memories, photos
- Voice notes (Plus subscription only)
Family info:
- Email addresses of family members (you type them manually for invites — we never read your contacts)
- Family roles (parent, caregiver, etc.)
Payment:
- Apple processes all purchases. We never see your card. Through RevenueCat we only learn your subscription state (active / canceled / trial).
Device & usage:
- Anonymous device identifier (for push notifications)
- How often you use AI features (for cost tracking and rate limiting)
- Within your family, who logged what and when (audit trail)
What we do NOT collect:
- Location (the app never asks for it)
- Your contacts list
- Browsing or search history
- Any advertising or device-tracking identifiers
2. Why we process your data
Under GDPR Art. 6 and KVKK Art. 5/2, our legal bases are:
| Purpose | Legal basis |
|---|---|
| Create your account, sign you in | Contract performance |
| Store your baby’s records and share them with your family | Contract performance |
| Provide AI features (sleep prediction, voice log, weekly reports) | Contract + your explicit consent |
| Manage your subscription and bill you | Contract + legal obligation |
| Debug, prevent abuse | Legitimate interest |
| Comply with court orders | Legal obligation |
We do not advertise. We never sell or share data with ad networks, do not profile you for advertising, and have zero attribution SDKs.
3. Who we share with
We share data only with the following data processors, only to the extent the app needs to function:
| Provider | Purpose | Data location |
|---|---|---|
| Apple Inc. (USA) | Sign in with Apple, payments, push notifications, on-device speech recognition | USA |
| Cloudflare Inc. (USA) | Hosting and storage (R2) | Global edge, EU PoPs |
| Neon Inc. (USA) | Database | EU region (Frankfurt) |
| RevenueCat Inc. (USA) | Subscription state management | USA |
| Anthropic PBC (USA) | AI completions (transcript NLU, weekly reports) | USA |
| OpenAI L.L.C. (USA) | Backup AI provider | USA |
| Resend Inc. (USA) | Transactional email (welcome, family invites, billing failure) | USA |
International transfers: Some of these providers process data in the USA. Where we transfer data out of the EU/EEA, we rely on Standard Contractual Clauses (SCCs) and any provider-specific transfer mechanisms. AI providers: We contractually require Anthropic and OpenAI not to use your data for training their models (this is the default for both providers’ enterprise APIs).
4. How long we keep data
| Data | Retention |
|---|---|
| Account and baby records | Until you delete your account |
| Voice notes / photos | Until you delete your account (you can also delete individually) |
| AI usage log (tokens, cost) | 90 days (for billing audit) |
| Server access logs | 30 days |
What happens when you delete your account
When you delete your account in-app we anonymize your data, immediately and irreversibly:
- Permanently removed: your name, email, Apple identifier, baby names and photos, voice-note transcripts, and any free-text notes you wrote (notes on feeding/sleep/diaper/appointments, memories, appointment titles, doctor and location fields).
- Anonymously retained: numeric records — feeding amounts and durations, sleep durations, diaper counts, measurement values (weight/height), vaccination dates. These can no longer be linked to any individual; we keep them for aggregate statistics (e.g. “average sleep duration for babies 0–6 months”).
- If your family has other active members: their data is not affected; only your own free-text contributions are wiped, and family ownership is transferred to the next member.
This satisfies GDPR Art. 17 (“right to erasure”) and KVKK Art. 7: anonymized data, no longer capable of identifying a natural person, is not personal data.
If you sign in again with Apple, an entirely new account is created. Your previous data does not return.
5. Your rights
Under GDPR Art. 15–22 and KVKK Art. 11:
- Know what data we hold about you
- Access, correct, or delete your data
- Object to processing
- Port your data to another service
- Withdraw consent at any time
- Lodge a complaint with your country’s data protection authority (e.g. Türkiye KVKK Kurulu, your EU member state DPA)
Delete your account in-app via Settings → Account → Delete My Account. For other requests, email chirp@ozersubasi.com; we respond within 30 days.
6. Children’s privacy
Chirp is used by parents, not by infants. The app is rated 4+, but account creation and subscription are for adults 18+. You enter your baby’s data; that data is held under your family account, not under your child as a data subject.
7. Security
- All traffic is encrypted via HTTPS/TLS 1.3
- Database connections are server-to-server only with mTLS
- Session tokens are stored in iOS Keychain (Secure Enclave-backed)
- Personal data — photos, names, voice — is restricted to the minimum necessary engineering staff
- We notify you within 72 hours of any confirmed personal data breach (GDPR + KVKK obligation)
8. Changes to this policy
We will notify you of material changes via in-app notice and via email to chirp@ozersubasi.com. The effective date at the top is always current.
9. Contact
Data Controller: Özer Subaşı Email: chirp@ozersubasi.com Address: Istanbul, Türkiye
EU GDPR Representative (Art. 27): not designated; as a sole developer below the threshold for Art. 27 designation, all GDPR requests go to the address above.