Upnex Privacy Policy
Effective EFFECTIVE_DATE · Türkçe KVKK Aydınlatma Metni: WEBSITE/kvkk
Upnex reminds you before new episodes of the shows you follow. This policy explains what personal data Upnex processes, why, who it goes to, and your rights. We collect as little as the service needs. Upnex has no ads and no tracking, and never sells your data.
1. Who is responsible
Data controller: CONTROLLER_NAME, CONTROLLER_ADDRESS, Turkey
Contact for privacy questions and requests: SUPPORT_EMAIL
2. What we process and why
| Data | Why | Legal basis (KVKK) |
|---|---|---|
| Account: email address, password (stored only as a secure hash), sign-in method, account ID, and your name if you sign in with Google or Apple | Create and secure your account; sign you in; greet you by name | Contract, KVKK 5(2)(c) |
| Alerts: the shows you track (by TVmaze ID) and your reminder settings; notification preferences | Provide the service: work out when to remind you | Contract |
| Push notifications: your phone's push token, platform (Android/iOS) and time zone | Deliver reminders, with air times in your local time | Contract |
| Reminder log: which reminders were sent to you and when | Never send the same reminder twice | Contract |
| Emails: your email address and a one-time code | Confirm your email, reset your password | Contract |
| Subscription status: whether you have Pro, and purchase and renewal status from Google Play or the App Store | Unlock Pro | Contract; tax and accounting records: legal obligation, KVKK 5(2)(ç) |
| Crash reports: a random account ID (never your email or name), device model, operating system and app version, and technical details of the error | Find and fix bugs | Legitimate interest in a working, secure app, KVKK 5(2)(f). You can turn this off (section 7) |
| Security logs: sign-in events, including IP address, kept by our database provider | Prevent abuse and keep accounts secure | Legitimate interest |
Providing account data is necessary to use the features that need an account (setting alerts). You can browse shows without an account.
We do not collect: location, contacts, photos, camera, microphone, advertising IDs or payment card details. Payments are handled entirely by Google Play or Apple. We make no automated decisions that have legal or similarly significant effects on you.
3. Data that stays on your phone
Your sign-in session is stored on your phone, encrypted (AES-256) with a key kept in the phone's secure keystore. Small settings (onboarding completed, notification preferences) are stored locally too. None of this is used for tracking. These are strictly necessary to run the app, so no consent is needed.
4. Show information from TVmaze
Show data comes from TVmaze (Netherlands). To load it, the app contacts TVmaze directly, so TVmaze receives your phone's IP address and what you search for, like any website you visit. We send TVmaze no account information. See TVmaze's privacy policy.
5. Who receives your data
We use service providers (processors) that act only on our instructions, under data processing agreements:
| Provider | What for | Location |
|---|---|---|
| Supabase | Database, sign-in, server functions | EU (Frankfurt, Germany) |
| Sentry | Crash reports | EU (Germany) |
| Resend | Sending sign-up and password emails | RESEND_REGION |
| Expo (650 Industries) | Delivering push notifications | USA |
| Google (Firebase Cloud Messaging) / Apple (APNs) | Delivering notifications to your phone | USA / worldwide |
| Cloudflare | Storing encrypted backups (unreadable without our offline key) | R2_LOCATION |
| GitHub | Running the nightly backup job | USA |
| RevenueCat (once purchases launch) | Managing subscription status | USA |
If you choose Sign in with Google or Apple, that company handles the sign-in under its own privacy policy and sends us your email address, your name (if you allow it) and a verification token. Google Play and Apple process your payments as independent controllers.
Our website has no accounts, cookies, analytics or ads. Cloudflare hosts it and processes visitors' IP addresses to deliver and protect the pages. Fonts load from Fontshare (Indian Type Foundry), and the show search sends what you type directly to TVmaze, so both see your IP address. Your theme choice stays in your browser.
We never sell or rent your data, and never share it for advertising. We disclose data to authorities only when the law requires it.
6. International transfers
Some providers are outside Turkey, in the EU and the USA. For these transfers under Turkish law (KVKK Art. 9) we rely on standard contracts in the form set by the Personal Data Protection Board where the provider signs them. See the Turkish notice for details. You can request a copy of the safeguards at SUPPORT_EMAIL.
7. Your choices
- Crash reports: turn off Settings → Share crash reports in the app.
- Notifications: choose which reminders you get per show, turn off alert types in Settings → Notifications, or turn notifications off in your phone's settings.
- Delete your account at any time in the app (Settings → Account details → Delete account), or request it at WEBSITE/delete-account.
8. How long we keep data
| Data | Kept |
|---|---|
| Account, alerts, preferences, subscription status | Until you delete your account (alerts: until you remove them, or until the show ends) |
| Push token | Until you sign out on that phone, delete your account, or the token stops working |
| Reminder log | 60 days |
| Push delivery tickets | 2 days |
| Crash reports | Up to 90 days (per Sentry's retention) |
| Security logs | As briefly as our database provider allows (currently about 1 day for request logs) |
| Encrypted backups | 30 days, then deleted automatically |
| Tax and accounting records for purchases | As long as tax law requires |
9. Security
- All connections are encrypted (HTTPS/TLS).
- In the database, every user can reach only their own data (row-level security).
- Passwords are stored only as hashes.
- Backups are encrypted before they leave our systems.
- If a personal data breach puts your rights at risk, we'll notify the authorities within 72 hours and inform you as the law requires.
10. Your rights
You have the right to:
- access your data and get a copy (portability)
- have it corrected, deleted or restricted
- object to processing based on legitimate interest, such as crash reports
- withdraw consent where we rely on it
Email SUPPORT_EMAIL from the address on your account, so we can verify it's you. We reply within 30 days, free of charge.
You can also complain to the Turkish data protection authority, Kişisel Verileri Koruma Kurumu (https://www.kvkk.gov.tr).
11. Children
Upnex is not directed at children. You must be 16 or older to create an account. If we learn that a child under 16 has created an account, we delete it.
12. Changes
If we change this policy, we'll update the date at the top. If a change is significant, we'll also tell you in the app before it takes effect.
13. Contact
CONTROLLER_NAME · SUPPORT_EMAIL · CONTROLLER_ADDRESS