Privacy Policy

1. Data controller

The data controller is Emre Aydın. For anything concerning your personal data, write to info@mutfakustam.com.

2. What we process

• Account details: email address, phone number (if you add one), username, first and last name, an irreversible hash of your password, and the identifier of your Google or Apple account if you sign in with one.
• Profile details: profile and cover photo, bio, links you add to your profile, language, country and unit preferences, and whether your account is private.
• Content you share: recipes and their photos, translations, comments, ratings, favourites, collections and chat room messages.
• Private messages: messages and photos you exchange with other users.
• Personal lists: shopping lists and meal plans.
• Connections: who you follow and who follows you, who you block, and reports you make.
• Device details: the app’s per-device identifier, device model and name, operating system and app version, language and time zone, and a push token so we can send you notifications.
• Technical records: IP address, time and type of each request, and error logs.
• Notification preferences: which notifications you want and your quiet hours.

We do not collect location data. Photos you upload are re-processed on our server and the location and device information embedded in them (EXIF) is removed. We show no ads and do no advertising or analytics tracking. The website does not use cookies.

3. Why we process it, and on what legal basis

• Providing the service: creating your account, signing you in, showing and delivering your recipes, comments and messages. Legal basis: the conclusion and performance of a contract (KVKK Art. 5/2-c).
• Security: protecting your account, limiting password attempts, preventing abuse and spam, reviewing reported content. Legal basis: legitimate interest (Art. 5/2-f).
• Notifications: telling you about messages, comments and follows. You can turn notifications off in the app and in your device settings. Legal basis: performance of a contract (Art. 5/2-c).
• Account emails: email verification, password reset and email change links. Legal basis: performance of a contract (Art. 5/2-c).
• Legal obligations: requests from competent authorities and cases required by law. Legal basis: being provided for by law and legal obligation (Art. 5/2-a, ç).

4. Who can see what

• Public: your username, name, profile photo, bio, published recipes, comments and chat room messages are visible to other users, and published recipes are visible to everyone on the website. If you make your account private, only followers you approve can see your profile.
• Private messages: only the people in the conversation can see them. If a message is reported, an authorised moderator may open it, solely to review that report.
• Your phone number, email address and shopping lists are never shown to other users.

5. Who we share it with

We do not sell your data or share it with anyone for advertising. To provide the service, only the data needed is shared with these service providers:

• Google (Firebase Cloud Messaging): your push token and the notification text, to deliver notifications to your phone.
• Google (Firebase Authentication): your phone number, to send it a verification code when you add or change it.
• Google and Apple: verifying your sign-in, if you choose to sign in with those accounts.
• Apple (Apple Push Notification service): to deliver notifications to iPhones.
• Our hosting provider: the provider of the servers where the data is stored.

Google’s and Apple’s servers are located outside Turkey, so using these services transfers the relevant data abroad. Such transfers are made in accordance with Article 9 of the KVKK. Information may also be disclosed to legally authorised public authorities on request, to the extent permitted by law.

6. How long we keep it

• Account and profile details are kept for as long as your account exists.
• Technical records (IP addresses and request logs) are deleted after 30 days.
• Notifications are deleted after 90 days.
• Session keys are deleted 7 days after they expire or you sign out.
• Email change records are deleted after 30 days.

7. Deleting your account

You can delete your account at any time with Delete account in the Profile section of the app. Deletion immediately removes your email address, phone number, Google and Apple links, name, bio, profile and cover photos, profile links, shopping lists, meal plan, follows, notifications and device records, and signs you out everywhere. Your username is replaced with a meaningless one, so nobody else can take it and pass themselves off as you.

Comments you wrote and messages you sent remain, without your name, so the conversations on the other side are not broken. When deleting, you can choose to delete your published recipes as well; otherwise they remain without an author shown. If you cannot access your account, write to info@mutfakustam.com.

8. Your rights

Under Article 11 of the KVKK you have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether it is used accordingly; to know the third parties it is transferred to; to request correction if it is incomplete or inaccurate; to request its deletion or destruction where the legal conditions are met, and that third parties it was transferred to are notified; to object to a result against you arising solely from automated analysis; and to claim compensation for damage caused by unlawful processing.

To let us verify your identity, send your request from the email address registered to your account to info@mutfakustam.com. Requests are answered free of charge within 30 days at the latest. If you find our answer insufficient, you may complain to the Turkish Personal Data Protection Board.

9. Children

Mutfak Ustam is not designed for children under 13 and we do not knowingly collect data from children under 13. If you learn that a child under 13 has created an account, write to us and we will delete it.

10. Security

Connections are encrypted (HTTPS/TLS). Passwords are stored irreversibly, and session and email link keys are stored only as hashes. Photo addresses cannot be guessed. No system is flawless; in the event of a breach we will notify those affected and the Board as the KVKK requires.

11. Changes

We may update this policy. The current version is always on this page, and we will also announce significant changes in the app.