Privacy Policy

This Privacy Policy explains how the Kunaz mobile app ("Kunaz", "the App", "we") collects, uses, stores and protects your personal data. Kunaz is operated by Eren Güneş under the Saintsun Software brand (individual developer). By using the App you accept this policy.

Kunaz is a nutrition, activity, sleep and fitness tracking app that processes health-related data. We therefore take privacy especially seriously.

1. Data Controller and Contact

For the purposes of the GDPR and Turkey's KVKK (Law No. 6698), the data controller is Eren Güneş (Saintsun Software).

• Address: İstasyon Mah. Kazım Karabekir Cad. No: 20 Daire: 27, 34940 Tuzla / İstanbul, Türkiye
• Contact / data requests: support@kunaz.tr

2. Data We Collect

Kunaz does not collect an advertising identifier (IDFA/GAID), does not run any third-party ad network, and does not sell your data for advertising.

Our website (kunaz.tr). When you visit kunaz.tr, our server keeps a standard access log: your IP address, browser information (user agent), the page requested and the time. In addition, without using cookies, the page tells the same server which kind of link you tap (for example App Store, Google Play or language selection) and, when you leave, how long the page was visible, how far you scrolled and the page language. We use this only to measure, in aggregate, whether the website and our social media and advertising links work, and to prevent abuse. No third-party analytics or advertising tools run on the website, no cookies are set, and this information is not linked to your app account. These logs are kept for at most 90 days and then deleted automatically. Legal basis: legitimate interest (KVKK Art. 5(2)(f), GDPR Art. 6(1)(f)). The website also shows our own recent social media posts and links to our Instagram, TikTok, YouTube, X, Threads and Facebook accounts. These posts and their images are served from kunaz.tr itself, so simply viewing the page sends nothing to those platforms; if you open one of these links, that platform's own privacy policy applies.

3. Data Processed Only on Your Device

The following are processed on your device and are not sent to our servers:

• Nutrition label scanning: the label photo is read on your device via OCR (Apple Vision); the image never leaves your device.
• Barcode scanning: the camera image is decoded on-device; only the barcode number is queried.
• Voice search: speech is transcribed on your device / by the operating system; only the resulting text is searched.

4. Why We Use Your Data

• Calculating your daily calorie balance, fat/muscle estimates and personalized reports (using scientific formulas).
• Providing nutrition, water, workout and sleep tracking.
• Optional AI features (food/exercise finding, coach comments, goal-look analysis and picture, age guess, app support chat, recipe comments).
• Notifications and reminders (only if you allow them).
• Security, abuse prevention, debugging and legal obligations.
• Usage statistics and measuring our own ad campaigns (installs and subscriptions), without an advertising identifier. Health data is never part of this.

5. Third-Party Services and Data Transfers

Some features, only when you use them, transfer limited data to trusted service providers:

Our servers and backups are hosted in Türkiye (Istanbul), so the data you enter is stored in Türkiye. Some of our service providers process data outside Türkiye, including in the United States. We are carrying out the standard contract process under Article 9 of KVKK with these providers and keep the data we transfer to a minimum: RevenueCat receives only a randomly generated account identifier and the store's purchase record; Cloudflare only delivers public exercise and food images and sees only your device's IP address. When you use an AI feature, the data described above for that feature is transferred to the provider's servers for processing; this transfer is also based on your choice to use the feature and your explicit consent, which the app asks for on its privacy screen. If you e-mail us, your message and our reply are stored by Google Workspace.

Sharing with a coach (Kunaz Max)

If you accept a coach's invite, that coach can see only the data types you chose on the consent screen; if you allowed it, they can also update your goals and measurements, assign programs, message you and set up appointments. Every change they make is notified to you and recorded. Your chats and the photos and PDF files sent in them are stored encrypted on our servers; messages are deleted after 60 days, or 30 days after the connection ends. Alerts your coach receives and the report PDFs they create are produced only from data you allowed; the PDFs are stored encrypted on the coach's device and on our servers; the server copy is deleted after 60 days, or 30 days after the connection ends. Your coach may be in another country. The coach agrees to use this data only for coaching; Kunaz does not verify a coach's title. You can withdraw your consent any time from Profile → My coaches, and their access ends at once. While an account deletion request is pending your coaches cannot access your data; when the account is deleted, connections, messages, appointments and related records are deleted too. Voice messages you record in chat with the microphone are stored encrypted in the same way and deleted on the same schedule; photos sent in chat are reduced in size and extra information inside them, such as location, is removed. Videos sent in chat (up to 30 seconds) are reduced in size on our servers and extra information inside them, such as location, is removed; they too are stored encrypted and deleted on the same schedule.

Sharing with friends

If you accept a friend request or an invite link, you become friends with that person: your friend can see your Home, Food, Activity and Profile pages read only, and you can see theirs; your friend can't change anything. Your friends and coaches can't see the pages you hide in Profile → Privacy and permissions, and alerts and reports sent to your coach don't use that data either. You can remove or block a friend any time, and their access ends at once. Invite links are valid for 14 days and can be used up to 25 times. When your account is deleted, your friendships and invite links are deleted too. If a friend or your coach wants to start a live workout on your behalf, you get a notification; the workout only starts if you approve it, runs on their phone and is saved to your Activity page. If you wear an Apple Watch, the approved workout also starts on your watch, and your heart rate and active calories from the watch are shown to the person running the workout only during that workout (only the latest value is kept with the session). You can turn these requests off entirely in Profile → Privacy and permissions. If you report a friend, your report is sent to the Kunaz team for review and that person is blocked.

Promo codes from Kunaz partners

If you use a Kunaz partner's promo code, the partner who owns the code sees you only with your masked name and username (e.g. A*** Y***); the date you used the code and the amounts of your later subscription payments are shared with them to calculate their share. When you delete your account, this information is deleted too.

6. Legal Basis (KVKK / GDPR)

• Explicit consent: health/fitness data (special category under KVKK Art.6; GDPR Art.9) and sending data to the AI provider when you use AI features.
• Performance of a contract: providing your account and core tracking functions.
• Legitimate interest: security, abuse prevention, service improvement.

How we collect it: electronically through the App: from what you enter, from the health platforms and devices you connect, and partly automatically while you use the App (for example crash reports).

You can withdraw your consent at any time by turning off the relevant feature or deleting your account.

7. Retention

We retain your data for as long as your account is active. When you delete your account, your data is flagged according to the in-app account deletion flow and is permanently deleted/anonymized within a reasonable period (subject to legal retention obligations).

Goal picture: when you use “Me at my goal”, your photo is sent to the AI provider only to be processed for that request. Neither your photo nor the picture created from it is stored on Kunaz servers. Both are kept only on your own phone, you can delete any result from the list at any time, and they are removed when you sign out. If you delete the app or change phone, that history is gone.

E-mails: messages you send to our addresses are kept only as long as needed to answer and follow up your request and to meet our legal obligations, and are then deleted. Please do not send health data, passwords or payment details by e-mail; you can manage your data within the app.

8. Your Rights

Under Article 11 of KVKK you have the right to:

• learn whether your personal data is processed and, if so, request information about it;
• learn the purpose of processing and whether the data is used for that purpose;
• know the third parties in Türkiye or abroad to whom it is transferred;
• request rectification if it is incomplete or inaccurate;
• request its erasure or destruction under the conditions in Article 7 of KVKK;
• request that such rectification or erasure be notified to the third parties to whom it was transferred;
• object to a result against you arising from analysis exclusively through automated systems;
• claim compensation if you suffer damage due to unlawful processing.

Under the GDPR you also have the right to access, rectify, erase, restrict processing of, object to and port your data. Send requests to support@kunaz.tr; we answer free of charge within 30 days at the latest. If your request is rejected or not answered, you may lodge a complaint with Türkiye's Personal Data Protection Board (KVKK Kurulu) or, in the European Union, with the data protection authority of your country. You can also delete your account and data from within the app.

9. Children's Privacy

Kunaz is intended for users aged 18 and over, and age verification is applied at sign-up. We do not knowingly collect data from children.

10. Security

We use TLS/HTTPS encryption in transit, access controls and industry-standard measures. While no method is 100% secure, we take reasonable technical and organizational measures to protect your data.

11. Changes

We may update this policy from time to time. For material changes we will notify you in the app or on this page. The "Last updated" date reflects the current version.

12. Contact

For questions: support@kunaz.tr