Privacy Policy
Last updated: August 17, 2026
🌐 Türkçe olarak oku
This Privacy Policy explains how the Merly app ("App") collects, uses, and
protects your personal data. By using the App, you are deemed to have accepted this policy.
Data Controller: Bahri Can Caymaz — Contact: hello@merly.app
1. Data We Collect
When you use the App, the following data may be collected:
- Identity information: Email address, username, name — including the name/email or hidden relay address provided by Apple when you sign in with Apple
- Habit data: Habits you create, completion logs, streak days
- Health data: Body measurements (weight, waist, arm circumference, etc.) — only if you enter them
- Apple Health data: Read only if you enable the Apple Health connection in Settings: step count, active energy (calories), exercise minutes, heart rate and weight. This data is read on your device and used to calculate your workout calories from real measurements and to show your progress. You can turn the connection off at any time. This data is never used for advertising or marketing and is never sold to third parties
- Nutrition data: Food logs, calorie tracking — only if you enter them
- Workout data: Exercise sessions, sets, reps — only if you enter them
- Journal / mood: Journal entries and mood logs — only if you enter them
- Subscription information: Subscription status, selected plan, and purchase entitlements. Your payment card details are never stored by Merly; payments are processed directly by the Apple App Store
- Social and progress data: Username, display name, avatar, level, XP, and streak information — see Section 2
- Profile photo: Only if you upload one. Uploading a photo is optional; if you don't, the drawn avatar created in the app is used instead. A photo you upload is visible to other registered users — see Section 2
- Workout and post photos: Only if you choose to attach a photo when sharing a workout or a post. Attaching one is optional; you can share without a photo — see Section 2.2
- Story photos: Only if you share one. Stories disappear automatically after 24 hours — see Section 2.2
- Camera access: Requested only if you choose to take a photo from inside the app. Only photos are captured; no video is recorded and microphone permission is never requested. Nothing is sent anywhere until you confirm that you want to share it
- Reports: When you report another user, a profile photo, a post, or a story; the reporting account, the reported content, and the reason you provide, if any — see Section 2
- Referral data: Referral code you use or share
- Device information: Expo Push Token for push notifications
2. How We Use Your Data
- To provide personalized habit tracking and statistics
- To power the AI-assisted Coach feature and journal analysis — for this purpose, your habit, nutrition, workout, body measurement, goal, water, and journal data, and — if you have enabled the Apple Health connection — that day's step count, active energy, exercise minutes and weight, is sent to our AI provider (primarily Groq, with Google Gemini as a fallback when Groq is unavailable) only to the extent necessary for the feature to function. This transfer happens only when you chat with the AI Coach; the data is not used for advertising or model training. If you turn the Apple Health connection off in Settings, this data is never transferred
- To send reminder notifications
- To improve the app experience
- To power social features by showing your username, display name, avatar (including your profile photo if you uploaded one), and in-app progress (level, XP, streak) to other registered users. This information may be shared not only with your friends but also with other registered users through general social features such as the leaderboard and user search. Your email address, notification token, and other private account data are never shared in this context
- To review and, where necessary, remove inappropriate content. When you report a user or a profile photo, we review that report; content that violates our rules may be removed and the account concerned may face enforcement action. Reports are not shown to other users
2.1. Profile Photos and Content Rules
Uploading a profile photo is entirely optional. A photo you upload becomes visible to other
registered users through social features and is technically served over a publicly accessible
link. For this reason, we recommend uploading only images you are comfortable sharing.
You can delete your photo at any time via Profile → tap your avatar → Remove Photo.
When removed, the file is deleted from our storage and your profile reverts to your drawn avatar.
Images that are unlawful, obscene, hateful, or that infringe the rights of others may not be
uploaded. Other users can report an inappropriate photo from within the app; reported content
is reviewed by us and removed if necessary. You can also use the block feature
if you prefer not to see a particular user.
2.2. Workout Photos, Stories, and the Camera
Attaching a photo is always optional. You can share your workouts and
posts without any photo at all.
Location data is stripped. Every photo you upload is resized and
re-encoded by the app before it leaves your device. That process removes the
EXIF metadata embedded in the file — including GPS coordinates, capture time,
and device information. In other words, a photo you share does not reveal
where it was taken.
Workout and post photos are kept in private storage. Unlike your
profile photo, these images are not served over a publicly accessible link. They are
shown only to users entitled to see the post, through signed links that expire
after one hour. Once a link expires, the image can no longer be accessed.
Stories disappear after 24 hours. After 24 hours a story
automatically stops being shown to other users, and the file itself is deleted from
storage. You can also delete it manually at any time before it
expires. Stories are likewise kept in private storage and served only through
time-limited signed links.
When you delete a post, the photos attached to it are deleted from
storage as well.
Camera. The in-app camera captures photos only. No video is
recorded, no audio is captured, and microphone permission is never requested.
An image you capture stays on your device until you confirm that you want to share it.
Illegal, obscene, hateful, or rights-infringing images may not be shared. Other users
can report a post or a story from within the app; reported content is reviewed by us
and removed where necessary.
3. Data Storage
Your data is stored on servers in the European (Frankfurt, Germany) region via Supabase infrastructure.
Any profile photo you upload is also kept in the file storage of that same infrastructure and is
served over a publicly accessible link so that it can be displayed in social features.
Workout/post photos and stories, by contrast, are kept in private storage
and served only through time-limited signed links — see Section 2.2.
All data is transmitted over an encrypted connection (TLS). Some third-party service providers listed
in Section 4 (e.g. AI and notification infrastructure) may process your data on servers in other countries;
such transfers take place under the respective provider's own privacy policy and security measures.
4. Third-Party Services
5. Your Rights (KVKK / GDPR)
Under Turkish Law No. 6698 (KVKK) and GDPR, you have the following rights:
- Access: The right to learn what data we hold about you
- Rectification: Requesting correction of inaccurate data
- Erasure: Requesting deletion of all your data — via the in-app "Delete My Account" option
- Portability: Requesting export of your data — hello@merly.app
- Objection: Objecting to certain data processing activities
- Legal basis: Your data is processed based on your explicit consent, the performance of our service agreement, and our legitimate interests
6. Account Deletion
To permanently delete your account and all your data, use the
Settings → Delete My Account option in the app.
This action is irreversible and all your personal data is removed from our systems. For active accounts,
your data is retained for as long as your account remains open; once your account is deleted, all
associated personal data is removed from our systems, except where retention is legally required.
7. Cookies
The mobile app does not use cookies. Session management is handled via secure local storage.
8. Children's Privacy
The App is not directed at individuals under the age of 13, and we do not knowingly collect data from this age group.
9. Changes
If we make material changes to this policy, we will make reasonable efforts to notify you through
appropriate means. The current version of this policy is always available at
merly.app/privacy.
10. Contact
For questions: hello@merly.app