Privacy Policy

OYE TEKNOLOJİ ANONİM ŞİRKETİ ("Oye Teknoloji", "we", "us" or "our") builds focused iOS and Android apps and operates the website at oyeteknoloji.com. This Privacy Policy explains what information we collect, how we use it, and the choices you have when you use our apps and website (together, the "Service"). This policy is also our privacy notice under Turkish Personal Data Protection Law No. 6698 ("KVKK").

Information we collect

We aim to collect as little as possible. Depending on the app and the features you use, this may include:

• Information you provide. Details you enter directly — such as an email address when you contact us or content you create inside an app.
• Usage & device data. Analytics about how the Service is used, plus basic device information (device model, operating system version, app version, language and region) to help us fix bugs and improve performance.
• User content. Photos, recordings, text or other content you choose to process inside an app. Where an app processes this on your device, it stays on your device unless a feature explicitly requires uploading it.

Permissions we request and why

Our apps request only the permissions below that the particular app needs, and only when you use the feature that needs it. If you decline, the rest of the app keeps working; only that feature is unavailable. We do not use permissions in the background unless you explicitly turn on a feature that does so (for example, Decky's App Lock runs in the background once you enable it), and we do not use or sell data obtained through these permissions for advertising.

• Camera. Used when you take a photo or scan something: for example a meal photo, a barcode or an ingredient label, or a new photo for an AI feature.
• Photos. Used to let you pick a photo from your library to process, or to save images and videos you create in the app to your library. We only process the photos you select.
• Photos and content processed by AI. When you use an AI feature (for example generating an image from a photo, analysing a meal or creating music), the photo, audio or text you choose is sent to our servers and our AI service providers to produce the result. This content is used only to produce the result you asked for; it is not used for advertising and is not sold.
• Microphone. Used for features that need sound, such as recording a sound or practising pronunciation. Recording happens only when you start it.
• Speech recognition. Used in Decky to check your pronunciation by turning what you say into text with your device's own speech recognition service.
• Location. Used for location-based features, such as prayer times and qibla direction, the UV index where you are, or nearby cell towers. Your location may be sent to the relevant service provider to fetch this information. We do not use your location to track you, build a profile or advertise.
• Motion and magnetic sensors. The magnetometer is used in features such as the metal and stud detectors, and compass and motion sensors in compass features. Sensor readings are processed on your device to run the feature.
• Notifications. Used to send reminders and alerts, for example injection reminders in OneShot and the daily word reminder in Decky. You can turn notifications off at any time.
• Apple Health and Health Connect. Used in OneShot to show your steps, calories and weight and to log your meals; details are in the OneShot section below.
• Screen Time (iPhone), Usage access and display over other apps (Android). Only for Decky's optional App Lock feature; details are in the Decky section below.

You can revoke permissions at any time in Settings on iPhone, or in Settings > Apps > Permissions on Android.

Face and biometric data

Where an app works with photos that contain faces (for example baby prediction or outfit changing), the photo you upload is used only to produce the result you requested. We do not extract a biometric template from your face, we do not use face data to identify or verify you, and we do not sell it. Uploaded photos and generated results are kept for the period described in the "AI photo, video and music apps" section below.

OneShot: GLP-1 Weight Tracker

This section describes the additional data practices of our app OneShot: GLP-1 Weight Tracker ("OneShot") on iOS and Android. OneShot does not require an account: your data is linked to a random identifier created on your device, not to your name or email address.

Information you enter

To track your treatment, OneShot stores the information you enter on our servers: profile details (such as gender, height, weight, goal weight and unit system), your GLP-1 medication, dose and injection schedule, shot logs, side effects, weight entries, food and water logs, and the progress photos you choose to add, which are kept in private storage.

Health data from Apple Health and Health Connect

If you give permission, OneShot connects to Apple Health on iPhone and to Health Connect on Android:

• Data we read. Steps, active calories burned, body weight and nutrition (calories consumed).
• Data we write. The calories of the meals you log in OneShot are saved as nutrition entries. When you edit or delete a meal in OneShot, we update or remove the matching entry.
• How we use it. To show your activity, weight and calorie trends, daily goals and walk progress in the app, and to generate the personal insights described below.
• Storage. Daily totals of steps, active calories, weight and calories consumed are stored on our servers, linked to your random device identifier, so that your history stays available in the app.
• Sharing. We do not sell health data, use it for advertising or send it to analytics providers. It is shared only with the service providers listed below, and only to run OneShot's features.
• Your control. You can revoke access at any time in the Health app on iPhone or in Health Connect settings on Android, and you can delete the data we store at any time as described below.

OneShot's use and transfer of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements. Information from Apple HealthKit is not used for advertising or data mining and is not sold.

AI features

OneShot uses Google's Gemini API for its AI features. When you analyze a meal photo or a food description, that photo or text is sent to process your request. To create your weekly and personal insights, nutrition targets and weight-loss estimates, relevant OneShot data — which can include your profile details, shot logs, food logs and the daily health totals described above — is sent to the Gemini API. This data is used only to produce the result shown to you in the app.

Service providers used by OneShot

• Supabase. Database, private file storage and server functions.
• Google Gemini API. Meal analysis and personal insights.
• Google Firebase. Push notifications.
• FatSecret and Open Food Facts. Food search and barcode lookup; only your search terms or the scanned barcode are sent.
• Adapty, the Apple App Store and Google Play. Subscriptions and payments.
• Mixpanel. Usage analytics about how the app is used; health data is not sent.

Deleting your data

In OneShot, open Settings and choose Delete Account. This permanently removes everything we store for your device identifier, including your logs, daily health totals, insights and progress photos. Data saved in Apple Health or Health Connect stays there and can be managed in those apps. You can also ask us to delete your data by emailing the address below.

Decky: English Word of the Day

This section describes the additional data practices of our vocabulary app Decky (also listed as "Decky: Spanish Word of the Day" and under other localized names) on iOS and Android. Decky does not require an account: when you first open the app, an anonymous identifier is created automatically and your data is linked to it, not to your name or email address. Decky shows no ads and does not use an advertising identifier.

Information we store

• Learning progress. Your answers to word cards, each word's review schedule, your placement test result and level, your streak, and the words you liked or have already seen.
• Settings. Your level, daily word limits, reminder time, time zone, and the language you learn and see meanings in.
• Product usage events. Which onboarding steps you completed, whether you granted a permission, when the premium screen was shown or closed, and similar events, so that we can improve the app. If you report an AI example sentence, the sentence you reported is stored with the report.

This information is stored on our servers, linked to your anonymous identifier, so that your daily word deck can be prepared and your progress is kept.

App Lock

App Lock is optional. It keeps the apps you choose locked until you finish that day's words.

• On iPhone, App Lock uses Apple's Screen Time frameworks. Apple gives Decky only anonymous tokens for the apps you choose, so Decky cannot see which apps they are.
• On Android, App Lock asks for Usage access and for permission to display over other apps. Decky uses them only to detect when an app you chose to lock is opened and to show its lock screen over it. The list of apps on your phone, the apps you choose and your app usage are processed only on your device and are never sent to us or to anyone else.

AI example sentences

Decky uses Google's Gemini API to write example sentences for words. Only the word, its meaning, the level and the language are sent; no personal information, nothing you type and nothing you say is included. Generated sentences are saved and may be shown to other users learning the same word.

Pronunciation practice and reminders

When you practice pronunciation, your phone's own speech recognition service turns what you say into text on your device, and Decky compares it with the word. Decky does not receive or store your voice. Daily reminders are scheduled on your device.

Subscriptions

Payments are handled by the Apple App Store and Google Play; we never see your payment details. Our subscription provider, Adapty, receives your purchase history and subscription status, device identifiers such as its own profile ID, and technical diagnostic logs from its software. On iPhone, Adapty may also use your IP address to determine your country; on Android this is turned off.

Service providers used by Decky

• Supabase. Database and server functions.
• Google Gemini API. Example sentences.
• Adapty, the Apple App Store and Google Play. Subscriptions and payments.

These providers process data only on our behalf, to run Decky's features. We do not sell your data or share it for advertising.

Deleting your data

In Decky, open Profile and tap Contact us. This prepares an email to info@oyeteknoloji.com that already includes your Device ID; write that you want your data deleted and send it. We delete your anonymous account and everything linked to it — learning progress, settings and usage events — within 30 days, and ask Adapty to delete your subscription profile. Purchase records kept by Apple or Google are governed by their policies. Uninstalling Decky removes the data stored on your device.

AI photo, video and music apps

This section covers our apps that create content with AI, such as Reve, baby prediction, Faceless Video and AI Music.

• Data sent. The photos you upload, the text you write and the settings you choose are sent to our servers and our AI service providers to produce the result.
• Retention. Uploaded content and generated results are kept for as long as needed to provide the Service and show your history in the app. You can ask us to delete them at any time.
• Share links. When you share content with a share link (for example a song in AI Music), anyone with the link can view it. To remove a share, write to us and we will take it down.
• Deletion. You can ask for your data to be deleted by writing to info@oyeteknoloji.com; we complete requests within 30 days.

Advertising

Some of our free apps may show ads through Google AdMob. AdMob may use your device's advertising identifier (IDFA on iPhone, advertising ID on Android), your IP address and basic device information to serve and measure ads. On iPhone, the advertising identifier is used for personalised ads only if you allow app tracking (App Tracking Transparency); if you don't, non-personalised ads are shown. Where the law requires it, such as in the European Economic Area and the United Kingdom, we ask for your consent before showing personalised ads. On Android you can reset or delete your advertising ID in Settings > Google > Ads. We never use health data or content you upload to AI features for advertising.

How we use information

• To provide, maintain and operate the features of the Service.
• To diagnose problems, prevent abuse and keep the Service secure and stable.
• To understand, in aggregate, how the Service is used so we can improve it.
• To respond to your questions and support requests.
• To comply with legal obligations that apply to us.

Legal bases for processing

We process personal data under Articles 5 and 6 of KVKK on the following bases:

• Performance of a contract. To provide the features you request, manage your subscription and keep your data in the app.
• Legitimate interest. To keep the Service secure, fix bugs and improve our apps through aggregate usage analytics.
• Legal obligation. To keep records the law requires and respond to official requests.
• Explicit consent. For special categories of personal data such as health data (for example OneShot's Apple Health and Health Connect data) and photos containing faces, for ad personalisation, and for transfers of data abroad. You can withdraw your consent at any time; this does not affect processing carried out before withdrawal.

How information is shared

We do not sell your personal information. We may share information with trusted service providers who help us operate the Service (for example, analytics, crash reporting or cloud hosting), and only to the extent needed to perform those services. We may also share aggregated or anonymized data that cannot reasonably be used to identify you. We may disclose information if required to do so by law or to protect the rights, safety and property of Oye Teknoloji, our users or others.

Third-party services

The Service relies on third parties — including Apple (App Store and in-app purchases), Google (Google Play and in-app purchases) and analytics or crash-reporting providers — that have their own privacy policies governing how they handle data. We encourage you to review the policies of any third-party service you interact with through the Service.

Data retention

We keep information only for as long as needed to provide the Service and for the purposes described in this policy, unless a longer retention period is required by law. When information is no longer needed, we delete or anonymize it.

Security

We use reasonable technical and organizational measures, including encryption in transit where appropriate, to protect information against unauthorized access, loss or misuse. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Your choices and rights

• You can adjust permissions (camera, photos, notifications and more) at any time in your device settings.

Under Article 11 of KVKK you have the right to:

• learn whether your personal data is processed and, if so, request information about it;
• learn the purpose of processing and whether it is used for that purpose;
• know the third parties in Türkiye or abroad to whom it is transferred;
• ask for it to be corrected if incomplete or inaccurate, or deleted or destroyed under the conditions of KVKK, and for these actions to be notified to third parties it was transferred to;
• object to a result against you arising solely from automated analysis;
• claim compensation for damage caused by unlawful processing.

Send requests by email to info@oyeteknoloji.com. We respond free of charge within 30 days. If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Board. If you live in the European Union, you can exercise your GDPR rights at the same address.

Users in the European Union and the United Kingdom

If you live in the European Economic Area (EEA) or the United Kingdom, your personal data is also protected under the General Data Protection Regulation (GDPR) and the UK GDPR. The company responsible for the processing described in this policy is OYE TEKNOLOJİ ANONİM ŞİRKETİ; you can reach us at info@oyeteknoloji.com.

• Legal bases. We process your data on the basis of the performance of a contract (Art. 6(1)(b) GDPR), our legitimate interests (Art. 6(1)(f)), legal obligations (Art. 6(1)(c)) and your consent (Art. 6(1)(a)). Special categories of data, such as health data and photos containing faces, are processed only with your explicit consent (Art. 9(2)(a)).
• Your rights. You have the right to access your data, to request its rectification or erasure, to request restriction of its processing, to object to processing based on legitimate interests and to direct marketing, to receive your data in a structured, machine-readable format and to request its transfer to another service (portability), and to withdraw your consent at any time.
• Right to lodge a complaint. You may lodge a complaint with the data protection supervisory authority in the country where you live or work, or where the infringement took place. In the United Kingdom, this authority is the Information Commissioner's Office (ICO).
• International transfers. Your data is transferred outside the EEA and the United Kingdom, in particular to Türkiye and the United States. We carry out these transfers on the basis of the European Commission's Standard Contractual Clauses, the relevant addendum for the United Kingdom and, where applicable, the EU-U.S. Data Privacy Framework.
• Retention. We keep your data for as long as necessary for the purposes described in this policy; if you stop using the app and request deletion, we delete it within 30 days. Records we are legally required to keep (for example, accounting records) are kept for the statutory period.
• Automated decision-making. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
• Age. In your country, the age of consent for digital services may be up to 16; if you are under that age, you may use the Service only with your parent's permission.

Users in the United States

This section is for users who live in California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other U.S. states with similar privacy laws.

• Categories of data we have collected in the last 12 months. Identifiers (random device ID, advertising ID, IP address); commercial information (purchase and subscription status); internet and network activity (app usage events); location (only in features that require location, approximate or precise); audio and visual information (photos and recordings you upload); health information (data you enter in OneShot or that we receive from Health apps); and inferences drawn from these. The sources of this data, the purposes for which it is used and the parties with whom it is shared are described in the relevant sections of this policy.
• Sensitive personal information. We use sensitive information, such as health data and precise location, only to provide the feature you request; we do not use it to infer characteristics about you.
• Sale and sharing. We do not sell your personal information for money. However, in our free apps that show ads, the use of your advertising ID and device information by our advertising partners (Google AdMob) for personalised ads may be considered "sharing" or a "sale" for targeted advertising under some state laws. To opt out, you can decline or turn off app tracking permission on iPhone, delete your advertising ID on Android, or send us an email with the subject "Do not sell or share my personal information". We never sell health data or share it for advertising.
• Your rights. You may have the right to know about and access the personal information we have collected about you, to request its correction or deletion, to receive a copy in a portable format, to opt out of sale, sharing or targeted advertising, and to limit the use of sensitive information. We will not treat you differently for exercising these rights.
• Making a request. You can send your requests to info@oyeteknoloji.com. To verify your identity, we may ask for your device ID from the app. An authorised agent may make a request on your behalf. We respond to your request within 45 days. If we deny your request, you may appeal our decision by writing to us; if your appeal is denied, you may contact your state's attorney general.

Consumer health data policy (Washington, Nevada and similar states)

This section is prepared for "consumer health data" within the scope of the Washington State My Health My Data Act, Nevada SB 370 and similar laws, and covers the OneShot app.

• Health data we collect. Height, weight and goal weight; the GLP-1 medication you use, its dose and your injection schedule; injection logs and side effects; food, water and calorie logs; progress photos; and, if you give permission, steps, active calories, weight and nutrition data from Apple Health or Health Connect.
• Source. We receive this data directly from you and from Apple Health or Health Connect where you give permission.
• Purpose and use. We use it so that you can track your treatment, to show your trends and goals, and to generate personal insights in the app.
• Parties we share it with. We share it only with the service providers that run OneShot (Supabase, Google Gemini API and Firebase), and only for these purposes. We do not sell health data or share it with advertising or analytics providers.
• Consent. We collect and share consumer health data only with the consent you give in the app. You can withdraw your consent at any time.
• Your rights. You have the right to access your health data and the list of parties with whom it has been shared, to withdraw your consent, and to request deletion of your data. In OneShot, you can delete all your data via Settings > "Delete Account", or write to info@oyeteknoloji.com. We respond to your request within 45 days; if it is denied, you may appeal, and if your appeal is denied, you may contact the Washington State Attorney General's Office.

Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. Our apps that track health or process photos with AI are intended only for users aged 18 and over. If you believe a child has provided us with personal information, please contact us and we will delete it.

Transfers of data abroad

We operate from Türkiye. The servers of the providers we use to run the Service (Supabase, Google, Mixpanel, Adapty and the others named in this policy) are located abroad, mainly in the European Union and the United States, so your personal data is transferred abroad. We carry out these transfers in line with Article 9 of KVKK, relying on the safeguards provided for by applicable law and, where required, your explicit consent. Providers process your data only on our behalf and for the purposes described in this policy. We require them to protect your data with the same or greater level of protection described in this policy.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and post the new version on this page. Your continued use of the Service after changes take effect means you accept the updated policy. Material changes will also be announced in the app, and we will ask for your consent again for processing based on explicit consent.

Contact us

If you have any questions about this Privacy Policy or your information, email us at info@oyeteknoloji.com.

← Back to home