Privacy Policy
Last updated: August 4, 2026
🌐 Türkçe olarak oku
This Privacy Policy explains how the Merly app ("App") collects, uses, and
protects your personal data. By using the App, you are deemed to have accepted this policy.
Data Controller: Bahri Can Caymaz — Contact: hello@merly.app
1. Data We Collect
When you use the App, the following data may be collected:
- Identity information: Email address, username, name — including the name/email or hidden relay address provided by Apple when you sign in with Apple
- Habit data: Habits you create, completion logs, streak days
- Health data: Body measurements (weight, waist, arm circumference, etc.) — only if you enter them
- Nutrition data: Food logs, calorie tracking — only if you enter them
- Workout data: Exercise sessions, sets, reps — only if you enter them
- Journal / mood: Journal entries and mood logs — only if you enter them
- Subscription information: Subscription status, selected plan, and purchase entitlements. Your payment card details are never stored by Merly; payments are processed directly by the Apple App Store
- Social and progress data: Username, display name, avatar, level, XP, and streak information — see Section 2
- Profile photo: Only if you upload one. Uploading a photo is optional; if you don't, the drawn avatar created in the app is used instead. A photo you upload is visible to other registered users — see Section 2
- Reports: When you report another user or a profile photo; the reporting account, the reported account, and the reason you provide, if any — see Section 2
- Referral data: Referral code you use or share
- Device information: Expo Push Token for push notifications
2. How We Use Your Data
- To provide personalized habit tracking and statistics
- To power the AI-assisted Coach feature and journal analysis — for this purpose, your habit, nutrition, workout, body measurement, goal, and journal data is sent to our AI provider (primarily Groq, with Google Gemini as a fallback when Groq is unavailable) only to the extent necessary for the feature to function
- To send reminder notifications
- To improve the app experience
- To power social features by showing your username, display name, avatar (including your profile photo if you uploaded one), and in-app progress (level, XP, streak) to other registered users. This information may be shared not only with your friends but also with other registered users through general social features such as the leaderboard and user search. Your email address, notification token, and other private account data are never shared in this context
- To review and, where necessary, remove inappropriate content. When you report a user or a profile photo, we review that report; content that violates our rules may be removed and the account concerned may face enforcement action. Reports are not shown to other users
2.1. Profile Photos and Content Rules
Uploading a profile photo is entirely optional. A photo you upload becomes visible to other
registered users through social features and is technically served over a publicly accessible
link. For this reason, we recommend uploading only images you are comfortable sharing.
You can delete your photo at any time via Profile → tap your avatar → Remove Photo.
When removed, the file is deleted from our storage and your profile reverts to your drawn avatar.
Images that are unlawful, obscene, hateful, or that infringe the rights of others may not be
uploaded. Other users can report an inappropriate photo from within the app; reported content
is reviewed by us and removed if necessary. You can also use the block feature
if you prefer not to see a particular user.
3. Data Storage
Your data is stored on servers in the European (Frankfurt, Germany) region via Supabase infrastructure.
Any profile photo you upload is also kept in the file storage of that same infrastructure and is
served over a publicly accessible link so that it can be displayed in social features.
All data is transmitted over an encrypted connection (TLS). Some third-party service providers listed
in Section 4 (e.g. AI and notification infrastructure) may process your data on servers in other countries;
such transfers take place under the respective provider's own privacy policy and security measures.
4. Third-Party Services
5. Your Rights (KVKK / GDPR)
Under Turkish Law No. 6698 (KVKK) and GDPR, you have the following rights:
- Access: The right to learn what data we hold about you
- Rectification: Requesting correction of inaccurate data
- Erasure: Requesting deletion of all your data — via the in-app "Delete My Account" option
- Portability: Requesting export of your data — hello@merly.app
- Objection: Objecting to certain data processing activities
- Legal basis: Your data is processed based on your explicit consent, the performance of our service agreement, and our legitimate interests
6. Account Deletion
To permanently delete your account and all your data, use the
Settings → Delete My Account option in the app.
This action is irreversible and all your personal data is removed from our systems. For active accounts,
your data is retained for as long as your account remains open; once your account is deleted, all
associated personal data is removed from our systems, except where retention is legally required.
7. Cookies
The mobile app does not use cookies. Session management is handled via secure local storage.
8. Children's Privacy
The App is not directed at individuals under the age of 13, and we do not knowingly collect data from this age group.
9. Changes
If we make material changes to this policy, we will make reasonable efforts to notify you through
appropriate means. The current version of this policy is always available at
merly.app/privacy.
10. Contact
For questions: hello@merly.app