Privacy Policy
Summary
- No email/password account. The app creates an anonymous, device-based identity (a hashed device ID and a numeric user ID) on our server.
- We store your product alerts, expense entries and, if you use it, your contact-form message. We do not collect precise location, contacts, photos or microphone data.
- Push notifications use Firebase Cloud Messaging; you can refuse notification permission.
- The app uses Google Analytics for Firebase (usage statistics) and shows ads through Google AdMob, which may use the advertising ID.
- We do not sell your data. You can ask us to delete your data at any time at info@gmdevhub.com.tr.
- The app is not directed to children under 13 (or under 16 where local law sets a higher age).
This privacy policy applies to the Aktüel Ürün Takip mobile app (Android package com.homesoft.aktueluruntakip, distributed on Google Play; it also covers any iOS version we publish on the Apple App Store). The app lets you follow supermarket leaflet (aktüel) products, campaigns and deals in Türkiye, set product alerts, keep a personal expense log and contact us through an in-app form.
This policy is written to be consistent with the Google Play Data Safety form and the Apple App Privacy details, with the EU/UK General Data Protection Regulation (GDPR) and with Türkiye's Law on the Protection of Personal Data No. 6698 (KVKK).
1. Who we are (data controller)
GM DevHub is the developer of the app and the data controller for the personal data described in this policy.
Website: gmdevhub.com.tr
Email: info@gmdevhub.com.tr
2. Data we collect
Aktüel Ürün Takip does not require a sign-up. The app creates an anonymous user identity tied to your device and stores it on our server.
2.1. Device and app identifiers
- A SHA-256 hashed device identity derived on the device from device attributes (brand, model, OS, hardware details and similar fields). Only the hash is used as the durable ID.
- A numeric user ID assigned by our backend.
- Operating system and device brand/model. This is not the Advertising ID.
This identity links your product lists, searches, alerts, expenses, notifications and online status to the same device.
2.2. Notification data
- A Firebase Cloud Messaging (FCM) token
- Platform, device brand/model
- Notification permission status
If you do not grant notification permission, we do not obtain an FCM token and send no push notifications; in-app content is still available.
2.3. Product alerts
We store your user ID and the product or search term you subscribed to. Deleting an alert removes that record from our server.
2.4. My Expenses
Titles, amounts and dates you enter in "Harcamalarım" (My Expenses) are stored on our server together with your user ID. You can edit or delete them in the app.
2.5. Search and operational logs
Product searches may be sent to our API together with your user ID. The app may also send product-view logs (for example popup product views), ad-load error logs and online/offline status for session management. We use these for service quality, debugging and abuse prevention.
2.6. Contact form (data you provide)
If you use the in-app contact form we process: name (optional), phone (optional), email (optional), subject, message text, platform, and the sender's IP address. We use this only to answer your request and keep a support record.
2.7. Usage statistics (Google Analytics for Firebase)
The app includes the Firebase Analytics SDK and collection is enabled. It is used to understand how the app is used and to improve it. The SDK collects, pseudonymously:
- a randomly generated app-instance ID (reset when you reinstall the app);
- events such as first open, app open, screen views, session start and engagement time;
- device and app information: model, operating system and version, language, app version, install and update events;
- approximate location (country/city) derived from your IP address. Google Analytics does not log or store IP addresses;
- where available and permitted by your device settings, the Advertising ID.
Google acts as our processor for this data (Google Ireland Limited for users in the EEA, UK and Switzerland; Google LLC elsewhere). Event-level data is kept in Google Analytics for at most 14 months. We do not use Analytics data to identify you. Details: firebase.google.com/support/privacy.
How to opt out: the app has no in-app analytics switch. You can email us and we will handle your request, delete your advertising ID or limit ad personalization in your device settings (Android: Settings > Google > Ads), or uninstall the app, which stops all collection.
2.8. Advertising (Google AdMob)
The app may show Google AdMob native and interstitial ads; ad placement can be turned on or off from our server settings. AdMob may process the Advertising ID, IP address, device and network information, ad interactions (impressions, clicks) and an approximate location inferred from your IP address, for ad serving, measurement, fraud prevention and, where allowed, personalization. The app does not request GPS/location permission.
Google Privacy Policy: policies.google.com/privacy
AdMob and ads data: support.google.com/admob/answer/6128543
2.9. Local storage
Your user ID, FCM token metadata and app preferences are stored on your device (sensitive values in encrypted storage). This is required for the app to work and is removed when you uninstall the app.
2.10. Data we do not collect
- Precise location (GPS), contacts, photo library or microphone data (sharing uses the system share sheet only when you start it)
- Payment card details (there are no in-app purchases)
- Health, biometric or government-ID data
- A name or email-based account (no mandatory sign-in)
2.11. Data at a glance
| Data type | Collected | Purpose | Shared with |
|---|---|---|---|
| Device / other IDs (hashed device ID, user ID, FCM token, app-instance ID) | Yes | App functionality, notifications, analytics | Our server; Google (FCM, Analytics) |
| Advertising ID | Yes (via AdMob and, where available, Analytics) | Advertising, measurement | Google AdMob |
| App activity (screen views, searches, product views, online status) | Yes | Functionality, analytics, debugging | Our server; Google Analytics |
| Diagnostics (ad-load errors, device/OS info) | Yes | Debugging, quality | Our server; Google |
| Name, email, phone, message | Only if you submit the contact form | Customer support | Our server / email infrastructure |
| User content (alerts, expenses) | Yes, if you use these features | App functionality | Our server |
| Approximate location (from IP) | Yes, by Google SDKs only | Ads, analytics | |
| Precise location, financial data, contacts, photos | No | - | - |
All data is encrypted in transit (HTTPS). Data is linked to your anonymous identity, not to your real-world identity.
3. Third-party services
| Service | Purpose | Data | Policy |
|---|---|---|---|
| Our API (mobil.aktueluruntakip.com.tr) | Products, alerts, expenses, contact form, user identity | Sections 2.1 to 2.6 | This policy |
| Firebase Cloud Messaging (Google) | Push notifications | FCM token, device info | firebase.google.com/support/privacy |
| Google Analytics for Firebase (Google) | Usage statistics | Section 2.7 | firebase.google.com/support/privacy |
| Google AdMob / Google Mobile Ads | Ad serving and measurement | Section 2.8 | policies.google.com/privacy |
| Google Play services / Apple App Store | Distribution, updates, advertising ID | Store account and device data (handled by the store) | policies.google.com/privacy |
4. Why we process data and legal bases
| Purpose | Legal basis (GDPR / KVKK) |
|---|---|
| Show products, deliver alerts, store your expenses | Performance of the service you request (GDPR Art. 6(1)(b); KVKK Art. 5/2-c) |
| Push notifications | Consent, given through the device notification permission (GDPR Art. 6(1)(a); KVKK Art. 5/1) |
| Support requests | Legitimate interests and performance of your request (GDPR Art. 6(1)(f), (b); KVKK Art. 5/2-f) |
| Security, abuse and error detection | Legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5/2-f) |
| Usage statistics (Firebase Analytics) | Legitimate interests in improving the app (GDPR Art. 6(1)(f); KVKK Art. 5/2-f). You may object, see section 8 |
| Advertising that funds the free app | Legitimate interests; you can limit personalization in device settings |
| Legal obligations | GDPR Art. 6(1)(c); KVKK Art. 5/2-a, ç |
5. Advertising ID, tracking and your choices
- Android Advertising ID: the app uses the Google Advertising ID through AdMob (and, where available, Analytics) and declares the Android advertising-ID permission. You can reset the ID, delete it or opt out of ads personalization in Android settings. If you delete it, AdMob receives a zeroed value.
- iOS (App Tracking Transparency): the app does not show the ATT prompt and does not access the IDFA. We do not track you across other companies' apps and websites as defined by Apple.
6. Sharing, sale and international transfers
- We do not sell your personal data. We do not share it for marketing purposes. California residents: under the CCPA/CPRA we do not "sell" personal information; Google AdMob may use advertising identifiers to serve ads, which some laws treat as "sharing" for advertising. You can opt out by limiting ads personalization in your device settings or by emailing us. We do not knowingly use or disclose sensitive personal information to infer characteristics about you.
- We share data with the processors listed in section 3 and, where legally required, with courts and authorities.
- Our server runs in Türkiye / Europe. Google services may process data in other countries, including the United States. Transfers rely on Google's EU Standard Contractual Clauses and the Data Privacy Framework, and are carried out in line with KVKK Art. 9.
7. Where data is stored and for how long
| Data | Retention |
|---|---|
| Device identity and user record | While you use the app; deleted or anonymized within 30 days of a deletion request |
| Alerts and expenses | Until you delete them or a deletion request is completed (within 30 days) |
| Search / product-view / ad-error logs | Up to 12 months, then deleted or anonymized |
| Contact-form submissions (incl. IP address) | Up to 12 months after the request is closed, unless the law requires longer |
| FCM token | While notifications remain active; removed on deletion request |
| Firebase Analytics event data | At most 14 months at Google |
| Advertising data | Governed by Google's retention periods |
The app API runs at https://mobil.aktueluruntakip.com.tr/.
8. Your rights and data deletion
Under GDPR (if it applies to you), KVKK Art. 11 and similar laws, you have the right to: learn whether your data is processed and request information; access and obtain a copy; request correction; request deletion or anonymization; object to processing based on legitimate interests; request restriction; data portability where applicable; withdraw consent at any time (for example, by turning off notification permission); and be informed of third parties to whom data is transferred.
How to apply: email info@gmdevhub.com.tr with the subject "Aktüel Ürün Takip - data request". We reply within 30 days at the latest, free of charge in general. Because your identity is anonymous, we may ask for extra information (for example device model and approximate install date) to find your record.
Deleting your data: the app does not use an account, so there is no sign-up to close. Email us (web route) and we will delete or anonymize the server data linked to your user ID: alerts, expenses, device and notification records. You can also delete individual alerts and expenses yourself inside the app. Uninstalling the app alone does not remove server records, so please email us if you want them deleted. Data held by Google (ads, analytics) is managed through your Google account and device ad settings.
Complaints: you may complain to a data protection authority: in Türkiye the Personal Data Protection Authority (KVKK), kvkk.gov.tr; in the EU/UK, the authority in your country of residence.
9. Children's privacy
The app is for a general audience and is not directed to children under 13 (or under 16 where your country sets a higher digital consent age). We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it.
10. Security
Traffic between the app and our servers uses HTTPS. Sensitive local values are kept in encrypted device storage. Access to server data is restricted. No method of transmission or storage is 100% secure.
11. Changes to this policy
We may update this policy. The current version is always published at this URL with the "Last updated" date above (5 November 2026). Material changes may also be announced in the app. Continued use after an update means you accept the revised policy.
12. Contact
GM DevHub
Website: gmdevhub.com.tr
Email: info@gmdevhub.com.tr