Privacy Notice (KVKK) and Privacy Policy

1. Data Controller

The data controller for your personal data is Yürek Labs, which operates the Vibeloy service ("we"). Contact: yureklabs@gmail.com or the contact form on vibeloy.dev.

2. Personal Data We Process

The following categories of data are processed while you use the Service:

• Identity and contact data: full name, e-mail address, account language.

• Account data: your password (stored only as an irreversible bcrypt hash), your Google account ID if you sign in with Google, e-mail verification status, session cookie.

• App project data: the app name, developer/company name, the app's contact/support e-mail, store links, marketing copy, screenshots and Screenshot Studio designs, the data categories you select in the privacy policy form, your AdMob publisher ID and app-ads.txt content that you enter into the Service.

• Keystore Vault data: the signing keys and passwords you upload. They are stored encrypted with AES-256-GCM on the server, are accessible only from your account and are never exposed to agents or MCP tools.

• Payment and subscription data: the customer and subscription IDs, subscription status and period end date passed to us by our payment provider Lemon Squeezy for Premium purchases. Your card details are never collected or stored by the Service.

• Technical and security data: IP address (for rate limiting, abuse prevention and contact-form records), CAPTCHA solutions, server logs, browser/language preference.

• Contact form data: your message, the e-mail address you optionally leave, and your IP address.

• API / MCP access tokens: hashes of the access tokens you create and their last-used timestamps.

3. Purposes and Legal Bases

Your personal data is processed for the following purposes and on the following legal bases under Article 5 of the KVKK and Article 6 of the GDPR:

• Creating your account, authentication, providing the Service and hosting the content you generate (privacy policy, marketing/support pages, app-ads.txt) on your behalf — necessary for the conclusion or performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6/1-b).

• Sending essential service notifications (e-mail verification, trial/subscription expiry warnings, security and material service changes) — performance of the contract and legitimate interest (KVKK Art. 5/2-c, f; GDPR Art. 6/1-b, f).

• Managing the Premium subscription and billing — performance of the contract and legal obligation (KVKK Art. 5/2-c, ç; GDPR Art. 6/1-b, c).

• Securing the Service, preventing abuse, spam and fraud, rate limiting — legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6/1-f).

• Responding to contact and feedback requests — legitimate interest and fulfilling your request (KVKK Art. 5/2-f; GDPR Art. 6/1-f).

• Complying with legal obligations (e.g. hosting-provider obligations under Turkish Law No. 5651, tax and accounting rules, requests from competent authorities) — legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6/1-c).

• Processing data with service providers located abroad (Section 5 below) — the explicit consent you give at sign-up and/or other transfer conditions provided by law (KVKK Art. 9).

We do not send marketing e-mails; should such communication be planned in the future, separate explicit consent will be obtained and every message will include an opt-out option (Turkish Law No. 6563).

4. How Personal Data Is Collected

Your data is collected electronically, by fully or partly automated means, through the sign-up, login and contact forms, the dashboard and Screenshot Studio, requests you make via the MCP/REST API, Google sign-in (Firebase Authentication) and Lemon Squeezy payment notifications (webhooks).

5. Recipients and International Transfers

Your personal data is shared, only to the extent necessary to provide the Service, with the following service providers acting as processors:

• Vercel Inc. (USA) — application hosting, server logs and file (Blob) storage.

• Neon Inc. (US/EU regions) — database hosting.

• Vercel Web Analytics — cookieless, aggregated visit statistics at page-view and country/device level; no individual profiles are created.

• Google LLC (USA) — Firebase Authentication for Google sign-in; Google AdSense ads on public pages (see Section 8).

• Resend Inc. (USA) — delivery of transactional e-mails.

• Lemon Squeezy LLC (USA) — Premium payments and subscription management (merchant of record).

Because these providers' servers are located outside Türkiye, your data is transferred abroad. Transfers rely on the explicit consent you confirm at sign-up and/or other safeguards provided under Article 9 of the KVKK and, for GDPR purposes, on standard contractual clauses concluded with the respective providers. Your data may also be shared with competent public authorities where legally required. Your data is never sold to third parties.

Information you choose to publish on your hosted pages (e.g. yourapp.vibeloy.dev), such as the app name, developer name, support e-mail, privacy policy content and screenshots, is by definition public.

6. Retention

Your account data is kept for as long as your account is open. When you delete your account or request deletion, the account, app projects, hosted pages, screenshots and Keystore Vault records are erased within 30 days at the latest. Invoice and payment records are kept for the period required by tax law (10 years); contact-form records and security logs for up to 2 years; rate-limiting and CAPTCHA records for up to 24 hours. Statutory retention periods are reserved.

7. Data Security

Passwords are hashed with bcrypt, Keystore Vault contents are encrypted with AES-256-GCM, all traffic is protected with TLS, access tokens are stored only as hashes, and signing secrets are never exposed to agents/MCP tools. Nevertheless, no method of transmission or storage is completely secure. In the event of a data breach, the Personal Data Protection Board and affected users are notified as soon as possible in line with Article 12 of the KVKK.

8. Cookies and Advertising

The Service uses a strictly necessary session cookie to keep you signed in and ALTCHA for bot verification; these are required for the Service to work and do not need consent. Your browser's local storage is used to keep drafts in the free tools on your device and is not sent to us.

Google AdSense ads may be displayed on our public pages (tools, guides, blog). Google may use cookies and similar identifiers to serve and measure ads; for visitors in the European Economic Area, the United Kingdom and Switzerland, personalised ads are shown only with consent. How Google uses data: https://policies.google.com/technologies/partner-sites — you can manage ad personalisation at https://adssettings.google.com. No ads are shown in the dashboard or on hosted app pages.

9. Hosted Content and Responsibility

Vibeloy hosts the privacy policies, marketing and support pages created by users as a hosting provider within the meaning of Turkish Law No. 5651. The respective app owner is solely responsible for the content, accuracy, currency and legal compliance of those pages and for the data processing they describe; Vibeloy has no obligation to review them. If you are an end user of a hosted app, please direct requests about your data to the contact address given in that app's policy. Notices of unlawful content may be sent to yureklabs@gmail.com.

10. Your Rights as a Data Subject

Under Article 11 of the KVKK you have the right to learn whether your personal data is processed, to request information if so, to learn the purpose of processing and whether the data is used accordingly, to know the third parties to whom it is transferred domestically or abroad, to request correction of incomplete or inaccurate data, to request erasure or destruction under Article 7 of the KVKK, to request that these actions be notified to recipients, to object to a result to your detriment arising from analysis exclusively by automated systems, and to claim compensation for damage caused by unlawful processing. Under the GDPR you additionally have the rights to data portability and to restriction of processing.

You can send requests to yureklabs@gmail.com from the e-mail address registered to your account. Requests are handled free of charge as soon as possible and within 30 days at the latest. If your request is refused or you find the response insufficient, you may lodge a complaint with the Turkish Personal Data Protection Board (kvkk.gov.tr); if you are located in the EU, with the supervisory authority of your country.

11. Changes

This notice may be updated to reflect changes to the Service or to legislation. The current version is always published on this page; material changes are notified to the e-mail address registered to your account. The "last updated" date at the top indicates the version.