Privacy Policy

1. Data controller

The Pumpfy application ("the App") is operated by Buğra Göksu ("the Company", "we"). We act as data controller under Turkish Personal Data Protection Law No. 6698 (KVKK) and the European Union General Data Protection Regulation (GDPR).

• Email: privacy@getpumpfy.app
• Web: https://getpumpfy.app

2. Personal data we collect

The App collects and processes the following personal data:

2.1 Data you provide

• Account details: Name and email address, provided through your Apple or Google account.
• Profile data: Year of birth, gender, height, weight, activity level, fitness goal, preferred training time.
• Nutrition data: Meals photographed or entered manually, calorie and macronutrient calculations, daily meal logs.
• Training data: Completed exercises, sets and reps, weights, session duration.
• Body measurements: Weight, body fat percentage, arm, chest, waist, hip and leg measurements.

2.2 Data collected automatically

• Device information: Device model, operating system version, app version, unique device identifier.
• Usage data: How often the app is opened, which features are used, session length.
• Crash reports: Crash logs and performance metrics (Firebase Crashlytics).
• Push notification token: Firebase Cloud Messaging (FCM) token, used to deliver notifications.

2.3 Photographs

The meal scan feature asks for camera access. Photos are sent to the AI service for calorie analysis only; they are not stored permanently on our servers. Once the analysis completes, the image is reduced to processed text data.

3. Purposes of processing and legal basis

4. Third-party service providers

We do not sell your personal data and do not share it for marketing. Data may be shared with the following providers only where technically necessary:

Each provider processes data under its own privacy policy. Review the relevant policy for details.

5. International data transfers

Through the providers listed above, your data may be processed on servers in the United States. These transfers rely on standard contractual clauses (SCC) and/or appropriate safeguards implemented by the processors, in line with KVKK art. 9 and GDPR art. 46.

6. Retention periods

• Account data: Kept while your account is active. Permanently deleted within 30 days of a deletion request.
• Nutrition and training logs: Kept while your account is active.
• Crash reports: Retained for 90 days in Firebase Crashlytics.
• Analytics data: Retained for 14 months in Firebase Analytics (anonymised).
• Meal photos: Not stored on the server after analysis; only the resulting text is saved.

7. Security

We apply the following measures to protect your data:

• All data in transit is encrypted with TLS/SSL.
• Data in Firebase Firestore is encrypted in transit and at rest.
• Firebase Security Rules restrict every user to their own data.
• Firebase App Check blocks unauthorised API access.
• AI API calls run server-side through Cloud Functions; API keys are never shipped in the client.

8. Your rights (KVKK art. 11 / GDPR art. 15-22)

You have the following rights regarding your personal data:

• Right to be informed: Learn whether your personal data is being processed.
• Right of access: Request a copy of the data being processed.
• Right to rectification: Ask for incomplete or incorrect data to be corrected.
• Right to erasure: Request deletion of your personal data, through Delete Account in the app or by writing to privacy@getpumpfy.app.
• Right to restriction: Ask for processing to be limited under certain conditions.
• Right to data portability: Receive your data in a structured, commonly used, machine-readable format.
• Right to object: Object to processing based on legitimate interest.
• Right to complain: File a complaint with the Turkish Personal Data Protection Authority (kvkk.gov.tr) or the relevant EU data protection authority.

To exercise these rights write to privacy@getpumpfy.app. Requests are answered within 30 days at the latest.

9. Children's privacy

Pumpfy is not directed at children under 13 and does not knowingly collect personal data from that age group. If we discover that a child under 13 has provided data, we delete it immediately. If you are aware of such a case, tell us at privacy@getpumpfy.app.

10. Cookies and tracking technologies

The mobile app does not use traditional cookies. The following SDKs may use device identifiers and similar technologies:

• Firebase Analytics: Anonymous usage statistics.
• Firebase Crashlytics: Crash reporting.
• Firebase Cloud Messaging: Push notification delivery.

Our website (getpumpfy.app) may use analytics cookies. You can manage these through your browser settings.

11. Breach notification

In the event of a security breach affecting your personal data, we notify the relevant data protection authority within 72 hours as required by KVKK and GDPR. Where the breach poses a high risk to your rights, we inform you directly as well.

12. Changes to this policy

This privacy policy may be updated from time to time. Changes are published on this page and the "Last updated" date is revised. For significant changes you are notified in the app or by email. Continuing to use the app after an update means you accept the new policy.

13. Contact

For questions, requests or complaints about this policy or your personal data:

• Email: privacy@getpumpfy.app
• Web: getpumpfy.app