Privacy Policy & KVKK Illumination Notice

1. Data Controller, Scope & Non-Medical Wellness Statement

Data Controller (under KVKK Art. 3/1-ı and GDPR Art. 4(7)): Fuat Tarik İSLAM (TengrX). Official postal and notice address: İzmir, Türkiye. Data protection and privacy contact email: hello@tengrx.com. “MewBite” is a product and software brand operated by the data controller.

This Policy reflects the exact production source code and data flows of the MewBite iOS application (local Apple SwiftData storage, Supabase PostgreSQL database, and Deno Edge Functions) and the mewbite.tengrx.com web property.

NON-MEDICAL WELLNESS STATEMENT: MewBite is NOT a regulated medical device under the US Federal Food, Drug, and Cosmetic Act (21st Century Cures Act § 3060), the EU Medical Device Regulation (MDR 2017/745), or the Turkish Medicines and Medical Devices Agency (TİTCK) Medical Device Regulation. All calorie, macronutrient (protein, carbohydrates, fat, sugar, fiber), Basal Metabolic Rate (BMR), Total Daily Energy Expenditure (TDEE), Body Mass Index (BMI), intermittent fasting windows, hydration, and workout metrics processed in the Service are intended solely for general wellness, fitness awareness, and self-tracking; they never constitute medical diagnosis, clinical nutrition therapy, or physician advice.

2. Data That Stays Exclusively on Your Device (Local-First Architecture)

In accordance with Privacy by Design and by Default (GDPR Art. 25), MewBite is engineered with a local-first architecture. You may use the app in Guest Mode (AuthService.markGuestMode()) without signing in; in Guest Mode, no profile, goal, economy, or workout rows are synced to our Supabase cloud tables.

Even when you sign in with Apple or Google, the following data remains stored exclusively inside your device’s sandboxed storage (local Apple SwiftData container with cloudKitDatabase: .none in the iOS Application Support directory, and local UserDefaults) and is NOT uploaded to our Supabase cloud database:

• Daily Meal Diary & Food Items (MealEntryModel, MealItemModel, MealEntryOriginModel): Every meal you log, its individual food items, gram/piece quantities, timestamps, and meal types (breakfast, lunch, dinner, snack, late_snack).
• Captured Meal Photos (Application Support/CameraMeals): Food photographs captured with the camera or selected from your photo library are stored only on your local device disk for your visual log; they are never archived in Supabase Storage or any cloud bucket.
• Hydration & Water Logs (WaterIntakeModel): Individual daily water intake records and timestamps.
• Historical Weight Entries (WeightEntryModel): Your time-series weight log history and local progress charts (only your current weight and target weight are stored in user_profiles if signed in).
• Intermittent Fasting State & History (FastingStore): Your chosen fasting protocol (e.g., 16:8, 18:6, 20:4), active fasting start/end timestamps, and historical fasting sessions.
• Saved Recipes & Local Exercise Logs (Application Support/SavedRecipes, WorkoutPlanStore, ExerciseLogStore): Recipes saved on your device, generated weekly workout split templates, and local exercise logs.
• Virtual Pet (Mew) Vitality & Care State (CompanionVitalityStateModel, CompanionCareEventModel, CompanionPendingFeedingRetryModel): Real-time mascot mood, feeding states, and local care events.
• AI Coach Chat History (ChatMessage): Your conversation thread with the AI Coach is held locally on your device and is not persisted in a server-side chat database.

Local files stored in your device’s Application Support or Documents directories may be included in your personal iOS device or iCloud backups if you have enabled iCloud Backup under your own Apple Account. Those backups are controlled exclusively by you and Apple and are inaccessible to us.

3. Categories of Personal & Special-Category Health Data Processed

Depending on the features you choose to use, we process the following categories of personal data:

• Identity & Authentication Data: If you choose to sign in via Sign in with Apple or Google OAuth, we process your unique account UUID (Supabase Auth id), email address (or Apple Private Relay email address), authentication provider identifier (apple or google), and the first name or nickname you provide for in-app personalization.
• Physical, Biometric-Adjacent & Health/Nutrition Data (Special Category Data under KVKK Art. 6 & GDPR Art. 9): Age (age_years), biological sex / gender selection (male, female, nonBinary), height (height_cm), current weight (weight_kg), target weight (target_weight_kg), physical activity level (sedentary, lightlyActive, moderatelyActive, veryActive, extraActive), fitness goal type (lose, maintain, gain, muscle), pace intensity (slow, moderate, aggressive), dietary preference (diet_preference), primary motivation, daily calorie and macro targets (protein, carbs, fat, fiber, sugar, water, steps), meal descriptions, and guided workout volume/calorie metrics.
• Visual & Audio Input Data (Transient Processing): Compressed base64 JPEG food photos (image_base64) submitted for AI nutritional estimation and speech-to-text transcripts generated when you log a meal or exercise by voice.
• In-App Economy & Gamification Data: MewCoin balance, daily/weekly challenge completion records (reward_ledger), unlocked mascot cosmetics, and active outfit loadout (coin_state).
• Subscription, Transaction & Referral Verification Data: Pseudonymous app user identifier (app_user_id), subscription product identifier (product_id), Apple original transaction identifier (original_transaction_id), entitlement status (trial, active, renewal, cancellation, refund), and referral qualification records. Your credit/debit card numbers, billing address, and Apple Pay details are processed exclusively by Apple (StoreKit) and are never shared with us.
• Device, Telemetry & Product Analytics Data: Pseudonymous installation identifier (distinct_id), operating system and version (iOS), device hardware model, app version and build number, device locale ($locale), screen view events, and aggregate feature interaction events.
• Customer Experience & Support Data: Voluntary in-app experience ratings (rating) and written feedback (feedback), or support emails sent by you to hello@tengrx.com.

Under KVKK Article 6 and GDPR Article 9, information concerning an individual’s physical health, metabolism, dietary habits, and body composition may constitute Special Category Personal Data (health data). We process such data solely when you actively input it or grant permission, based on your explicit consent, and strictly for delivering your personalized nutrition, fasting, and fitness calculations.

4. Exact Supabase Database Architecture, Tables & Server Functions

In full compliance with the principle of transparency (KVKK Art. 4/2-a; GDPR Art. 5/1-a), below is the complete inventory of PostgreSQL tables and Deno Edge Functions in our Supabase backend, including exact columns and Row-Level Security (RLS) controls:

• auth.users (Authentication Identity Table): Managed by Supabase Auth for users who opt into Sign in with Apple (using PKCE SHA-256 nonce verification) or Google OAuth. Stores the user UUID, email address, identity provider metadata, and session timestamps.
• public.user_profiles (User Profile Table — RLS Protected): Stores cloud-backed onboarding and profile settings for signed-in users. Columns: id (UUID primary key referencing auth.users(id) ON DELETE CASCADE), name, sex, age_years, height_cm, weight_kg, target_weight_kg, activity_level, goal_type, intensity, diet_preference, motivation, has_completed_onboarding, app_language, units, created_at, updated_at. Protected by PostgreSQL RLS policy user_profiles_owner (auth.uid() = id) so only the authenticated owner can read or write their row.
• public.daily_goals (Daily Nutrition & Activity Targets Table — RLS Protected): Stores daily targets for signed-in users. Columns: user_id (UUID primary key referencing auth.users(id) ON DELETE CASCADE), calories_target, protein_g, carbs_g, fat_g, fiber_g, sugar_g, water_goal_liters, steps_goal, updated_at. Protected by RLS policy daily_goals_owner (auth.uid() = user_id).
• public.coin_state & public.reward_ledger (MewCoin Economy & Append-Only Ledger Tables — RLS Protected): Tracks earned MewCoins across daily/weekly challenges (reward_ledger: user_id, id idempotency key, kind, amount, source_id, created_at, received_at) and mascot inventory/loadout (coin_state: user_id, balance, owned_item_ids, loadout JSONB, claimed_challenge_ids). Server-side triggers (validate_reward_ledger and sync_coin_state_balance) verify claims against public.challenge_reward_catalog.
• public.workout_sessions (Guided Workout Sessions Table — RLS Protected): Backs up completed in-app workout sessions for signed-in users. Columns: id (session UUID), user_id (UUID referencing auth.users(id) ON DELETE CASCADE), day_title, focus, started_at, ended_at, duration_seconds, exercise_count, total_sets, total_reps, volume_kg, calories (bounded 0–5000 kcal), created_at. Protected by RLS policy workout_sessions_owner (auth.uid() = user_id).
• public.nutrition_training_items (De-Identified Nutrition Calibration Table — Closed to Direct Client Access): Written via the nutrition-train Edge Function when an AI-reviewed meal entry is saved, to calibrate portion-unit rules. Columns: id, source ('ios_ai_review_save'), entry_id, item_id, meal_type, locale, name, original_name, normalized_name, amount, unit ('g', 'ml', 'pcs'), base_amount, base_unit, calories_kcal, protein_g, carbs_g, fat_g, sugar_g, base_calories_kcal, base_protein_g, base_carbs_g, base_fat_g, base_sugar_g, confidence, created_at, client_created_at. This table contains NO user_id, NO name, NO email, and NO photos; furthermore, when you delete your account, all rows matching your device’s entry_ids are purged.
• public.referral_users, public.referrals & public.referral_rewards (Referral Program Tables — Closed to Direct Client Access): Accessed solely via service-role Edge Functions (claim-referral, referral-status, process-referral-rewards, revenuecat-webhook) to validate friend referrals and grant promotional subscription entitlements.
• public.experience_reviews (In-App Experience Feedback Table): Accessed via the submit-review Edge Function when you voluntarily submit an in-app rating (user_id = pseudonymous review UUID, rating, feedback).

5. Artificial Intelligence (AI) Processing, OpenAI Sub-Processing & AI Disclaimers

MewBite uses artificial intelligence to power camera meal recognition, voice/text food and exercise parsing, the AI Nutrition & Fitness Coach (Mia, Alex, and Nova personas), and Chef Mew recipe generation. AI requests are routed through our stateless Supabase Edge Functions (analyze-entry and ai-coach) with HTTP caching disabled (cache-control: no-store).

What Data Is Sent During AI Requests:

• Camera Meal Photo Analysis (analyze-entry): When you snap or pick a food photo, a compressed base64 JPEG string (image_base64) and your app language code (locale) are sent to analyze-entry, which forwards the image prompt to the OpenAI Chat Completions API (default model: gpt-4o-mini). OpenAI returns estimated food item names, quantities (g, ml, pcs), calories, macros (protein, carbs, fat, sugar), and a confidence score. Your photo is processed transiently in memory and is NEVER saved to Supabase Storage or any cloud database.
• Voice & Text Meal / Exercise Logging (analyze-entry): When you log by voice or text, speech is transcribed into text and only the text string (text), language code (locale), and timestamp (now) are sent through analyze-entry to OpenAI (gpt-4o-mini) to produce a structured EntryEnvelope JSON. Raw voice audio files are never uploaded to our database.
• AI Coach — Mia, Alex, Nova & Chef Mew (ai-coach): When you send a message in AI Coach or ask for a recipe, AICoachService sends your active chat thread (messages) along with a live grounding snapshot (AICoachContext: display name, sex/persona selection, age, height, current/target weight, BMI, BMR, TDEE, goal type/intensity, activity level, diet preference, motivation, daily calorie/macro/water/step targets, today’s consumed/burned/remaining calories and macros, text summaries of today’s logged meals and exercises, active workout plan summary, and recent multi-day energy balance trend) through ai-coach to OpenAI (gpt-4o-mini).

No Foundation Model Training on Your Personal Data: Under OpenAI’s enterprise API data usage policies, data submitted via the OpenAI API is NOT used by OpenAI to train or improve its foundation models (OpenAI may retain API inputs transiently for up to 30 days solely for automated abuse and safety monitoring before deletion). We do not store your meal photos, voice recordings, or AI Coach chat logs on our servers for model training.

CRITICAL AI ACCURACY, ALLERGEN & CLINICAL SAFETY WARNING: AI vision and language models generate probabilistic statistical estimates and can make mistakes (“hallucinate”). Photo analysis cannot see hidden cooking oils, butter, sauces, dressings, sugars, internal fillings, or exact food density. AI outputs CANNOT reliably detect or guarantee the absence of allergens (peanuts, tree nuts, gluten/wheat, dairy/lactose, eggs, soy, fish, shellfish, sesame, sulfites), cross-contamination, or food spoilage, and must NEVER be relied upon for insulin dosing, diabetes management, renal diets, food allergy safety, or clinical medical decisions.

6. Apple HealthKit Integration & Strict Apple Guideline 5.1.3 Covenants

With your explicit permission, MewBite integrates with Apple’s HealthKit framework (HKHealthStore via HealthKitProvider.swift) on iOS. Connecting Apple Health is completely optional.

Apple Health Data Types Requested to Read (typesToRead): Step count (stepCount), body weight (bodyMass), active energy burned (activeEnergyBurned), workouts (workoutType), flights climbed (flightsClimbed), heart rate (heartRate), walking + running distance (distanceWalkingRunning), dietary water (dietaryWater), and dietary energy consumed (dietaryEnergyConsumed).

Apple Health Data Types Requested to Write/Share (typesToShare): Body weight (bodyMass), completed in-app workout sessions (workoutType with associated activeEnergyBurned and external UUID metadata), dietary water (dietaryWater), active energy burned (activeEnergyBurned), and dietary energy consumed (dietaryEnergyConsumed).

Strict Compliance with Apple App Store Review Guideline 5.1.3 (Health and Health Research):

• Zero Advertising or Marketing Use: No data obtained from Apple HealthKit—and no health, nutrition, fasting, biometric, or fitness data entered in MewBite—is EVER used for advertising, targeted marketing, retargeting, or use-based data mining, nor is it ever shared with advertising platforms, data brokers, or information resellers.
• Never Sold: We never sell, rent, lease, or trade your HealthKit data or health/nutrition records to any third party.
• No Third-Party AI Model Training: Data read from Apple HealthKit is never used to train third-party artificial intelligence models.
• Preservation of Your Apple Health Store: When you delete your MewBite account, samples previously written to Apple Health remain safely inside your iPhone’s Apple Health app under your control, where you can view or delete them at any time.

7. iOS System Permissions & Hardware Access

MewBite requests iOS system permissions strictly on a just-in-time basis when you invoke the corresponding feature. You can revoke any permission at any time in iOS Settings → MewBite:

• Camera (NSCameraUsageDescription): Used solely when you take a photo of a meal for AI calorie and macro estimation. Never accessed in the background.
• Microphone (NSMicrophoneUsageDescription): Used solely when you hold or tap the microphone button to log a meal or exercise by voice.
• Speech Recognition (NSSpeechRecognitionUsageDescription): Used to transcribe your spoken meal or exercise log into text.
• Photo Library (NSPhotoLibraryUsageDescription / PHPicker): Used when you select an existing meal photo from your library or save a progress/share card.
• Notifications (UNUserNotificationCenter): Used to schedule local meal reminders, hydration prompts, fasting window alerts, and streak notifications.
• Apple Health (NSHealthShareUsageDescription / NSHealthUpdateUsageDescription): Used to read and write the specific HealthKit metrics listed in Section 6.

MewBite does NOT request access to your Contacts, precise GPS location (CoreLocation), Bluetooth peripherals, or cross-app advertising identifier (IDFA / App Tracking Transparency).

8. Purposes & Legal Bases for Processing (KVKK Arts. 5–6 & GDPR Arts. 6–9)

We rely on the following specific legal bases under Turkish KVKK Law No. 6698 and the EU/UK GDPR for each processing activity:

• Performance of a Contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)): Providing core app calculations, optional Apple/Google authentication, cloud backup and restore (user_profiles, daily_goals, coin_state, reward_ledger, workout_sessions), referral reward verification, Premium subscription entitlement validation via Apple/RevenueCat, and responding to user support requests.
• Explicit Consent for Special-Category Health & Nutrition Data (KVKK Art. 6(3)(a); GDPR Art. 9(2)(a)): Processing your physical attributes (age, sex, height, weight, target weight), dietary goals, meal photos, voice/text food logs, AI Coach health/nutrition conversations, and Apple HealthKit metrics. By inputting these values or granting permission to the relevant feature, you provide explicit consent for us to process them solely to deliver that feature to you.
• Consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)): Optional iOS hardware permissions (Camera, Microphone, Speech Recognition, Photo Library, Notifications) and voluntary in-app experience reviews (experience_reviews).
• Compliance with Legal Obligations (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)): Fulfilling data subject access, rectification, and erasure requests, executing in-app account deletion (App Store Guideline 5.1.1(v), KVKK Art. 7, GDPR Art. 17), maintaining statutory tax/consumer records, and responding to lawful orders from competent courts or authorities.
• Legitimate Interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)): Protecting backend security, preventing reward/referral fraud (validate_reward_ledger and monthly referral cap enforcement), maintaining de-identified food unit guardrails (nutrition_training_items), debugging crashes, and conducting privacy-preserving product analytics hosted in the European Union (api-eu.mixpanel.com).

9. Managing & Withdrawing Your Consents and Permissions

Where processing is based on your consent or explicit consent, you have the right to withdraw your consent at any time with future effect (KVKK Art. 5/1, Art. 6(3)(a); GDPR Art. 7(3)). Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

• iOS Hardware & System Permissions: Toggle Camera, Microphone, Speech Recognition, Photos, and Notifications at any time in iOS Settings → MewBite.
• Apple Health (HealthKit) Permissions: Granularly enable or disable each read/write metric in the iOS Health app → Sharing → Apps → MewBite.
• Cloud Sync & Account Connection: Use MewBite in Guest Mode, sign out from the Profile screen, or permanently erase all cloud and local records using the in-app “Delete Account / Start Fresh” button.
• On-Demand AI Features: Camera scanning, voice logging, and AI Coach requests only transmit data when you actively submit a photo or message.

10. Age Limits, Children’s Privacy & Medical / Eating-Disorder Safeguards

Children’s Privacy & Minimum Age (13+): MewBite is rated 13+ on the App Store and is not directed to children under the age of 13. In compliance with the US Children’s Online Privacy Protection Act (COPPA), GDPR Article 8, and KVKK, we do not knowingly collect personal data from children under 13. Where local law requires a higher age of digital consent (between 13 and 16 across EU Member States, or under 18 for minors under Turkish law), you may only use consent-based features with the verifiable consent and supervision of your parent or legal guardian. If a parent or guardian believes a child has provided personal data without required consent, please contact hello@tengrx.com and we will promptly delete the data.

18+ Requirement for Calorie Restriction, Intermittent Fasting & AI Coach: Growing children and adolescents have distinct nutritional and metabolic needs. Calorie deficit targets, intermittent fasting timers, and AI Coach guidance are designed exclusively for adults aged 18 and older.

Eating Disorders & Medical Contraindications: You must NOT use calorie restriction or intermittent fasting features in MewBite if you are pregnant, breastfeeding, trying to conceive, underweight, have a current or past diagnosis or symptoms of an eating disorder (such as anorexia nervosa, bulimia nervosa, binge eating disorder, orthorexia, or ARFID), or have Type 1 or Type 2 diabetes, hypoglycemia, cardiovascular disease, renal/hepatic disease, or take prescription medications affected by meal timing. If you experience distress around food or body image, please stop using the app immediately and consult a qualified healthcare professional.

11. Recipients, Sub-Processors & Independent Controllers

We do NOT sell or rent your personal data, and we do NOT share your data with third-party advertising networks or data brokers. Personal data is shared solely with the following service providers (sub-processors) and platform operators to deliver the Service under strict contractual confidentiality and data-protection obligations:

• Supabase, Inc. (Cloud Database, Authentication & Serverless Edge Functions): Hosts PostgreSQL tables (auth.users, user_profiles, daily_goals, coin_state, reward_ledger, workout_sessions, referral_*, experience_reviews, nutrition_training_items) and executes serverless Edge Functions.
• OpenAI, L.L.C. / OpenAI Ireland Ltd. (AI Inference Sub-Processor): Processes transient requests forwarded by our analyze-entry and ai-coach Edge Functions (default model: gpt-4o-mini) to return food/macro estimates and AI Coach responses. API inputs are not used to train OpenAI models.
• Mixpanel, Inc. (EU Data Residency Product Analytics — api-eu.mixpanel.com): Processes pseudonymous app usage events and onboarding/subscription funnel metrics exclusively through Mixpanel’s European Union servers (https://api-eu.mixpanel.com and https://eu.mixpanel.com). Meal photos, voice audio, AI Coach conversations, and user email addresses are never sent to Mixpanel.
• RevenueCat, Inc. (Subscription & Entitlement Infrastructure): Validates App Store subscription receipts, trial status, and referral promotional entitlements using a pseudonymous app_user_id.
• Apple Inc. & Google LLC (Independent Controllers / Platform Providers): Apple provides App Store distribution, StoreKit billing, Sign in with Apple authentication, Apple Push Notification service (APNs), and on-device HealthKit/iCloud services under Apple’s own privacy policy. When you choose Sign in with Google, authentication is performed via Google OAuth. In addition, Google Analytics 4 (GA4) may be used on the public mewbite.tengrx.com website for aggregate web traffic measurement.
• Cloudflare, Inc. & Vercel Inc. (Web Hosting, Edge CDN & Security): Hosts and secures mewbite.tengrx.com, static assets, AEO/SEO documentation endpoints, and referral invite links.
• Competent Public Authorities & Courts: Strictly when required by binding applicable law or enforceable judicial order.

12. International Data Transfers (KVKK Art. 9 & GDPR Arts. 45–46)

Because several of our technology providers (Supabase, OpenAI, Mixpanel EU, RevenueCat, Apple, Google, Cloudflare, Vercel) operate cloud infrastructure located outside Türkiye—primarily in the European Union / European Economic Area (EEA) and the United States—using cloud sync, AI analysis, subscriptions, or analytics involves cross-border transfers of data outside Türkiye and/or the EEA.

Transfers from Türkiye under KVKK Article 9 (as amended by Law No. 7499 effective 1 June 2024): Cross-border transfers from Türkiye are carried out in accordance with the tiered regime of amended KVKK Article 9: (i) on the basis of an adequacy decision issued by the Turkish Personal Data Protection Board (“Board”) where available; (ii) in the absence of an adequacy decision, provided that one of the legal bases in KVKK Articles 5 or 6 exists and data subjects have enforceable rights and effective legal remedies in the destination jurisdiction, via Standard Contracts published by the Board (KVKK Art. 9(4)(c)) or other appropriate safeguards; or (iii) where applicable, under the exceptional/incidental transfer provisions of KVKK Article 9(6), including your explicit consent after being informed of potential risks (Art. 9(6)(a)) or necessity for the performance of the service contract between you and us (Art. 9(6)(b)).

Transfers from the EU/EEA, UK & Switzerland under GDPR Articles 45 & 46: Transfers outside the EEA/UK rely on European Commission adequacy decisions (including the EU–US Data Privacy Framework for certified US vendors) or the European Commission’s Standard Contractual Clauses (SCCs — Commission Implementing Decision (EU) 2021/914), supplemented by TLS encryption in transit and strict data minimization. Mixpanel telemetry is routed directly to Mixpanel’s EU data residency endpoint (api-eu.mixpanel.com).

You may request further details or a summary of our international transfer safeguards at any time by contacting hello@tengrx.com.

13. Retention Schedule & One-Tap In-App Account Deletion (delete-account)

In accordance with KVKK Articles 4/2-d and 7, the Turkish Regulation on the Deletion, Destruction or Anonymization of Personal Data, and GDPR Articles 5(1)(e) (storage limitation) and 17 (right to erasure), we retain personal data only for as long as necessary to fulfill the purposes set out in this Policy:

• On-Device Data (SwiftData, UserDefaults, Local Meal Photos & Recipes): Remains on your device until you delete specific entries, run the in-app “Delete Account / Start Fresh” action, or uninstall the app.
• Cloud Account & Sync Tables (auth.users, user_profiles, daily_goals, coin_state, reward_ledger, workout_sessions): Retained while your account remains active and permanently deleted immediately when you trigger account deletion.
• Transient AI Requests (analyze-entry & ai-coach): Not cached or stored in our database. OpenAI’s transient API abuse-monitoring logs are automatically purged according to OpenAI’s API retention schedule (up to 30 days by default).
• Referral, Review & Calibration Records (referral_users, referrals, referral_rewards, experience_reviews, nutrition_training_items): Purged automatically for your device’s app_user_id, review_user_id, and entry_ids when you execute in-app account deletion.
• Legal Compliance & Dispute Records: Statutory correspondence regarding formal privacy requests or legal claims is retained only for applicable statutory limitation periods and then destroyed.

One-Tap In-App Account & Data Deletion Architecture (Apple App Store Guideline 5.1.1(v) Compliance): You can permanently delete your account and all associated cloud and local data directly inside the MewBite app (Profile / Settings → Delete Account / Start Fresh) without needing to send an email or contact support. When triggered, AccountDeletionService.swift and our delete-account Edge Function execute the following verified cascade:

• 1. Remote Cloud Database Purge First: To prevent half-deleted state if your network drops, the server deletion runs first and deletes all rows belonging to your user UUID across reward_ledger, workout_sessions, coin_state, daily_goals, and user_profiles.
• 2. Supabase Storage Object Removal: Calls the account_storage_objects(uuid) RPC and deletes every storage object owned by your user ID across all Supabase Storage buckets.
• 3. Pseudonymous & Calibration Row Removal: Deletes your referral_users record (which cascades to referrals and referral_rewards), your experience_reviews rows, and all nutrition_training_items rows matching your device’s meal entry_ids.
• 4. Third-Party Vendor Profile Erasure: Calls the RevenueCat v2 Customer Deletion API (DELETE /v2/projects/{project}/customers/{app_user_id}) and dispatches an official GDPR Data Deletion request to Mixpanel’s EU API (POST https://eu.mixpanel.com/api/app/data-deletions/v3.0/ with compliance_type: 'GDPR').
• 5. Auth Identity Removal: Permanently deletes your user record from Supabase Auth (DELETE /auth/v1/admin/users/{userId}).
• 6. Complete Local Device Wipe: Once the server confirms deletion, the app wipes all local SwiftData models, deletes local meal photos (Application Support/CameraMeals) and saved recipes (Application Support/SavedRecipes), clears workout/fasting stores, cancels pending notifications, signs out of the iOS Keychain session, wipes the app’s UserDefaults domain, and mints a fresh anonymous UUID.

Important Note on Subscriptions: Deleting the app or deleting your MewBite account does NOT automatically cancel an active Apple App Store subscription. To stop recurring billing, you must cancel your subscription in iOS Settings → [Your Name] → Subscriptions (or at apps.apple.com/account/subscriptions).

14. Technical & Organizational Security Measures (KVKK Art. 12 & GDPR Art. 32)

We implement technical and organizational safeguards under KVKK Article 12 and GDPR Article 32 to protect your data against unauthorized access, alteration, disclosure, or destruction:

• Encryption in Transit & Secure Session Storage: All network communication between the iOS app, mewbite.tengrx.com, Supabase, OpenAI, RevenueCat, and Mixpanel EU is encrypted using modern TLS (HTTPS). Authentication tokens are stored in the iOS Keychain.
• PostgreSQL Row-Level Security (RLS): Every user-synced table in Supabase enforces strict RLS ownership policies (auth.uid() = id / user_id). Referral and nutrition calibration tables have RLS enabled with direct client access closed, allowing writes only through authenticated or service-role Edge Functions.
• Zero Client-Side Secret Keys: Sensitive API credentials (OPENAI_API_KEY, SUPABASE_SERVICE_ROLE_KEY, REVENUECAT_SECRET_API_KEY, MIXPANEL_GDPR_OAUTH_TOKEN) are never embedded in the iOS client binary and reside strictly in server-side Edge Function environment variables.
• Personal Data Breach Notification: In the event of a personal data breach likely to affect your rights and freedoms, we will notify the Turkish Personal Data Protection Board (KVKK Art. 12/5) and/or the competent EU/UK supervisory authority within 72 hours of becoming aware of the breach (GDPR Art. 33) and notify affected users without undue delay when required (GDPR Art. 34).

15. Website (mewbite.tengrx.com), Cookies & Public AEO/Markdown Endpoints

When you visit mewbite.tengrx.com, the following rules apply:

• Strictly Necessary Locale Cookie (mewbite-locale): When you switch languages between English (/en) and Turkish (/tr), we store a first-party functional cookie named “mewbite-locale” (1-year duration, SameSite=Lax) to remember your language preference.
• Web Analytics & Infrastructure Logs: We may use Google Analytics 4 (GA4) on mewbite.tengrx.com to understand aggregate page traffic and site performance, and our edge hosting providers (Cloudflare / Vercel) process standard HTTP access logs (IP address, user-agent, timestamp, requested path) for security, DDoS mitigation, and locale routing. We do not use third-party behavioral advertising cookies or social media tracking pixels on the website.
• Client-Side Interactive Demos: The interactive Macro & Meal Score Lab (MacroScoreLab) and procedural mascot canvas (MewCompanionStage) on mewbite.tengrx.com execute entirely inside your browser’s local memory (client-side JavaScript and HTML5 Canvas); any slider values or interactions you test on the website are never transmitted to a backend database.
• Public Editorial Hubs & AEO Endpoints: Our nutrition guides, fasting protocols, recipes, Q&A pages, articles, /llms.txt, /feed.xml, and .md (Markdown) routes contain public editorial content only and never expose any user’s personal data.

16. Automated Decision-Making & Profiling (KVKK Art. 11/1-g & GDPR Art. 22)

We do NOT engage in automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you within the meaning of GDPR Article 22 (such as credit scoring, insurance underwriting, or automated denial of service).

Daily calorie/macro targets (BMR/TDEE formulas), meal quality scores, and AI Coach suggestions are transparent assistive calculations based on the parameters you provide, and you can override or edit your goals and meal logs at any time. You always retain the right under KVKK Article 11(1)(g) to object to any outcome analyzed exclusively through automated systems.

17. Your Privacy Rights, Application Procedure & Supervisory Authorities

Your Rights under KVKK Article 11 (Türkiye): You have the right to apply to the data controller to: (a) learn whether your personal data is processed; (b) request information if your personal data has been processed; (c) learn the purpose of processing and whether your data is used in accordance with that purpose; (ç) know the third parties to whom your personal data is transferred domestically or abroad; (d) request rectification if your personal data is incomplete or inaccurate; (e) request deletion or destruction of your personal data under the conditions set forth in KVKK Article 7; (f) request notification of rectification or deletion operations to third parties to whom your personal data has been transferred; (g) object to the occurrence of a result against you by analyzing the processed data exclusively through automated systems; and (ğ) claim compensation if you suffer damage due to unlawful processing of your personal data.

Your Rights under EU/UK GDPR (Articles 15–22) & US State Privacy Laws (CCPA/CPRA): If you are located in the EEA, UK, or Switzerland, you have the right of access (Art. 15), rectification (Art. 16), erasure / “right to be forgotten” (Art. 17), restriction of processing (Art. 18), data portability in a structured, commonly used, machine-readable format (Art. 20), objection to processing based on legitimate interests (Art. 21), and withdrawal of consent at any time (Art. 7(3)). If you are a California resident (CCPA/CPRA) or resident of another US state with comprehensive privacy legislation, you have the right to know and access the categories and specific pieces of personal information collected, the right to request deletion, the right to correct inaccurate information, the right to opt out of the “sale” or “sharing” of personal information for cross-context behavioral advertising (note: we NEVER sell or share personal information for behavioral advertising), and the right to non-discrimination for exercising your privacy rights.

How to Exercise Your Rights & Response Timeline: You can exercise your right to erasure immediately at any time using the in-app “Delete Account / Start Fresh” button. For all other requests, please write to hello@tengrx.com or send a signed written application to İzmir, Türkiye in accordance with the Turkish Communiqué on the Principles and Procedures for Application to the Data Controller. Please include only the minimum identifier needed to locate your record (such as your sign-in email or in-app user ID); never send passwords or sensitive medical documents. We will respond to all verifiable requests free of charge as soon as possible and within thirty (30) days at the latest (KVKK Art. 13/2; GDPR Art. 12(3)).

Right to Lodge a Complaint with a Supervisory Authority: Under KVKK Article 14, if your application is rejected, if you find our response insufficient, or if we do not respond within 30 days, you may lodge a complaint with the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu — kvkk.gov.tr, Nasuh Akar Mah. 1407. Sok. No:4, 06520 Çankaya/Ankara, Türkiye) within 30 days of learning of our reply and in any event within 60 days from the date of your application. If you reside in the EU/EEA, the UK, or Switzerland, you also have the right to lodge a complaint at any time with your national Data Protection Supervisory Authority (GDPR Art. 77).

18. Changes to This Policy, Effective Date & Language Priority

We may update this Policy when we introduce new features, change sub-processors, or adapt to regulatory updates. The current version date (2026-10-19) is always displayed at the top of this page. We will notify you of material changes within the app or on our website, and where a new processing activity requires your explicit consent, we will request that consent before processing begins.

This Policy is published in Turkish and English. For users in Türkiye and matters governed by KVKK Law No. 6698, the Turkish version shall prevail in the event of any discrepancy; nothing in this clause limits mandatory protections available to you under the laws of your country of residence.