Version 2026-11-11 · DRAFT — needs legal review before release. The Turkish text is the binding one.

Under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK"), Ahmet Erkam Uçan (an individual; address: [ADRESİ BURAYA YAZ]; e-mail: [email protected]), as data controller, informs you as follows. Nücum is not a company but an independent one-person project; "we" in this text means that person.

1. What we process

Data	Examples	Source
Identity and contact	e-mail address, name when you sign in with Google	Sign-up / sign-in
Account and security	account id, sign-in times, device and app version, IP address (in security logs)	While you use the Service
Your content	plans, routines, focus sessions, journal pages, notes, thoughts, recordings, photos, sleep and mood entries, prayer/qada entries	What you enter
Transactions	purchase records (Google Play order number, product, date)	Google Play
Consent record	which version of which text you accepted, and when	This screen

Special categories: prayer/qada entries may reveal religious belief, and sleep and mood entries may be health-related (KVKK Art. 6). We process them only if you enter them, and only to show them to you.

Browser extension (Nücum focus): If you sign in to the extension, it reads and writes only what the focus screens need: focus sessions, the routine and activity list, its own look settings, a quick note. It has no access to your browsing history, open tabs or the sites you visit; it does not collect or send them. Sessions finished while offline wait only in that browser and are sent once when the connection is back. The sign-in key (refresh token) stays only in that browser's extension storage; signing out of the extension also revokes it on the server.

2. Purposes and legal bases

• Opening your account, verifying your sign-in, storing your content and syncing it between your devices — performance of the contract (Art. 5/2-c).
• Security logs, abuse prevention, backups — legitimate interest (Art. 5/2-f) and legal obligation (Art. 5/2-ç).
• Verifying purchases and keeping invoice/tax records — performance of the contract and legal obligation.
• Processing special categories and storing data abroad — your explicit consent (Art. 6, Art. 9).

We do not use your content for advertising, profiling or training AI models.

3. Who receives it, and where

Your data is stored with infrastructure providers that run the Service on our behalf (processors):

• Amazon Web Services EMEA SARL — servers, authentication (Amazon Cognito), file storage, e-mail; region: Frankfurt, Germany.
• Neon (Databricks) — database; region: Frankfurt, Germany.
• Google — sign-in only if you choose "Sign in with Google"; Google Play for purchases.

These providers are outside Türkiye. The transfer abroad relies on your explicit consent under KVKK Art. 9 and [the standard contracts notified to the Board]. Your data is encrypted in transit and at rest.

4. Retention

• Your content is kept while your account is open. If you delete your account, your content is permanently deleted within 30 days; copies in backups disappear when the backup retention (at most 30 days) runs out.
• Purchase and invoice records are kept for the periods the law requires (tax law: 5 years, Turkish Commercial Code: 10 years).
• Your consent records are kept for 10 years after account deletion, to prove consent.
• Security logs are kept for at most 14 days.

5. Your rights (KVKK Art. 11)

You may learn whether your data is processed, request information, learn the purpose and whether it is used accordingly, know the third parties it is transferred to, ask for correction or deletion, ask that those parties be notified, object to a result against you produced solely by automated systems, and claim compensation for damage. You can export all your data (Settings → Data → Export; JSON, CSV or Excel) and delete your account and data from inside the app (desktop: Settings → Connections and data → My account → Delete account; phone: Settings → Sync → Delete account; without the app: the nucumapp.com/account-deletion page). Send your application under KVKK Art. 11 and any other request to [email protected] from the e-mail address of your account, or in writing to [ADRESİ BURAYA YAZ] (as the Communiqué on the Procedures and Principles of Application to the Data Controller requires: name, surname, signature, address and your request). We answer free of charge within 30 days. You may also complain to the Personal Data Protection Board.

6. Explicit consent

By choosing "I accept", 1. I consent to my special-category data (if I enter it: prayer/qada, health-related sleep and mood entries) being processed only to be shown to me and synced between my devices, 2. I consent to my personal data being stored outside Türkiye (Germany) through the providers named above.

I know I can withdraw this consent at any time by deleting my account; the cloud service cannot be provided without it, but I can keep using the desktop app on my computer without a cloud account.

This website

• It uses no cookies, and there are no forms or email sign-ups.
• We may count visits with a counter that uses no cookies and does not identify you.
• The site is hosted on Amazon Web Services. The hosting may keep technical access logs (such as IP address and time) for security. We never use them for ads or profiling.