Privacy Policy

Effective date: May 8, 2026 · Last updated: May 8, 2026

This Privacy Policy explains how Clovy Yazılım Teknolojileri A.Ş. ("Clovy Health", "we", "us", "our") collects, uses, and shares information about you when you use the Glyco mobile application ("Glyco", "the App"). We are committed to protecting your privacy in accordance with the Turkish Personal Data Protection Law (KVKK No. 6698) and the EU General Data Protection Regulation (GDPR), where applicable.

1. Who we are

Glyco is operated by Clovy Yazılım Teknolojileri A.Ş., a company registered in Türkiye with its principal place of business in Ankara. For privacy-related questions, contact us at support@clovyhealth.com.

2. Information we collect

2.1 Account information

Email address (when you create an account via Supabase Auth)
Encrypted password (stored by Supabase, never visible to us)
A unique user identifier generated by Supabase

2.2 Health and fitness data

Glyco is a diabetes management tool. To provide its features, we collect health-related information that you choose to enter, including:

Diabetes type, duration since diagnosis, and treatment goals
Body statistics (height, weight, age, gender) for personalized targets
Blood sugar readings (mg/dL) and timing labels (fasting, post-meal, etc.)
Photos of your meals and the AI-generated nutritional analysis (calories, carbs, protein, fat, glycemic index, etc.)
Carb, protein, sugar, and blood sugar limits you configure

Health data is treated as a special category of personal data under KVKK and GDPR and receives heightened protection.

2.3 Purchase information

Subscription status, plan type (monthly / annual / free trial), and entitlement state
App Store transaction identifiers (received from RevenueCat)

We do not collect or store credit card numbers or other payment instruments. All payments are processed by Apple and never reach our servers.

2.4 Device and usage data

Device model, operating system version, and app version
Apple Vendor ID (IDFV) and, with your consent, the Advertising Identifier (IDFA)
App interactions (which screens you view, which features you use)
Crash reports and diagnostic logs (no personal content)

2.5 Marketing attribution data

If you grant App Tracking Transparency permission on iOS, we collect the Advertising Identifier (IDFA) and limited install attribution data (campaign source, click identifiers) to measure the effectiveness of our marketing. You can revoke this permission at any time in Settings → Privacy & Security → Tracking.

3. How we use your information

To provide, operate, and improve Glyco's features (meal scanning, blood sugar tracking, insights)
To personalize content (target ranges, recommendations) based on your profile
To process subscriptions and verify entitlements
To diagnose technical issues and prevent abuse
To measure marketing campaign performance (only with your explicit ATT consent)
To communicate with you about service updates and respond to support requests

4. Third-party services

We share data with the following processors under contractual agreements that require them to safeguard your information:

Service	Purpose	Data shared	Privacy policy
Supabase	Authentication, data storage	Email, user ID, health logs, profile	supabase.com/privacy
Fal.ai	AI-powered meal photo analysis	Meal photo (transient, not retained)	fal.ai/privacy-policy
RevenueCat	Subscription management	User ID, transaction identifiers	revenuecat.com/privacy
Adjust	Marketing attribution (with ATT consent)	IDFA, install timestamps, campaign IDs	adjust.com/privacy
Amplitude	Product analytics	Pseudonymized user ID, in-app events	amplitude.com/privacy
Apple	App distribution, payments, push notifications	Apple ID, transaction data, device tokens	apple.com/privacy

We do not sell your personal data to third parties.

5. Data retention

We retain your account and health data for as long as your account is active. When you delete your account from Profile → Delete Account, we permanently remove your account and associated data within 30 days. Anonymized analytics events that cannot be linked back to you may be retained longer for product improvement.

6. International data transfers

Some of our processors are located outside Türkiye and the EU. Data transfers are protected by Standard Contractual Clauses or equivalent safeguards, as required by KVKK and GDPR.

7. Your rights

Under KVKK and GDPR you have the right to:

Access the personal data we hold about you
Correct inaccurate data
Request deletion of your data
Object to or restrict certain processing
Receive your data in a portable format
Withdraw consent for ATT-based tracking at any time
Lodge a complaint with the Turkish Personal Data Protection Authority (KVKK Kurumu)

To exercise these rights, email support@clovyhealth.com. You can also delete your account directly inside the App at any time.

8. Children's privacy

Glyco is intended for users 18 years of age or older. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

9. Security

We implement administrative, technical, and physical safeguards designed to protect your information. Communications between Glyco and our servers are encrypted in transit using TLS. Stored data is encrypted at rest by our infrastructure providers. Despite these safeguards, no system is completely secure, and we cannot guarantee absolute security.

10. Health disclaimer

Glyco provides educational and informational content only. It is not a medical device and does not provide medical advice, diagnosis, or treatment. Always consult a qualified healthcare professional before making decisions about your health. Glyco's analyses (including AI meal estimates and blood sugar impact predictions) are estimates only and may not be accurate for your individual physiology.

11. Changes to this Policy

We may update this Privacy Policy from time to time. The "Effective date" above indicates when the latest version took effect. Material changes will be communicated through the App or via email.

12. Contact

Clovy Yazılım Teknolojileri A.Ş.
Üniversiteler Mah. İhsan Doğramacı Bul. No: 31 İç Kapı No: 23
Çankaya / Ankara 06800, Türkiye
support@clovyhealth.com