Privacy Policy

1. Data controller

Your personal data is processed by 4wise, the publisher of the 5n1k app, as data controller:

[ŞİRKET UNVANI]
[ADRES]
Trade registry (MERSİS) / tax no.: [MERSİS/VERGİ NO]
Email: privacy@5n1k.io

2. What we process and why

Account

Reading 5n1k requires Sign in with Apple or Google sign-in. When you sign in we store:

• an app user id (a random id we generate);
• your display name (Apple shares it only at the first sign-in, and you may choose not to share it);
• your email address, whether it is verified, and whether it is an Apple “Hide My Email” relay address;
• your account id at the sign-in provider (the Apple/Google “subject”);
• if you use Apple, your Apple refresh token — encrypted (AES-256-GCM). It is kept only so we can revoke the connection at Apple when you delete your account;
• your language/region setting (locale) and when the account was created and last used.

Your password, the contents of your Apple or Google account, your contacts and your photos never reach us.

Devices and sessions

• Device record: a random install id the app creates on first launch, the platform (iOS/Android) and the app version. It is not an advertising identifier and is not linked to other apps.
• Session record: when it was created and last used, and the first and last IP address it was used from. We store only a one-way hash of the session token, never the token itself.
• An account can stay signed in on at most 2 devices; signing in on a third signs out the least recently used one.
• Sessions expire after 30 days without use, and you have to sign in again after 90 days at the latest.
• While the sign-in screen is open, the app holds a temporary (anonymous) session tied to the device record; it is upgraded to your account when you sign in.

We use this data to keep your account securely signed in, enforce the device limit and prevent abuse (such as automated attacks). To prevent abuse, your IP address and install id are also used in short-lived rate-limit counters kept for at most 24 hours.

Subscriptions and purchases

Premium is bought through the Apple App Store or Google Play; they take the payment and we never see your card details. We use RevenueCat to validate purchases and unlock Premium. RevenueCat receives your app user id (the same as our user id) and the purchase/receipt data the store provides (product, dates, renewal and cancellation status, store country and similar).

Reading content

The app requests stories from our servers for the memory (country) and language you pick. These requests carry your session; we do not build a profile of what you read. Some archival films and audio may play directly from their source (e.g. Wikimedia Commons, Internet Archive); in that case that service sees your IP address and standard connection data.

Server logs

Our servers keep standard technical logs (time, request path, status code, IP address) for debugging and security. They are kept for at most 30 days.

3. Data that stays on your device

• Notifications: the daily story notification is scheduled on your device as a local notification. Your notification time and preferences stay on the device. We do not collect push notification tokens today.
• Reading preferences: app language, home memory and appearance (light/dark) are stored on your device.
• Your session token and install id are kept in the device's secure storage (the Keychain on iOS).

4. What we don't do

• We show no ads and collect no advertising ID (IDFA/AAID).
• We use no third-party analytics, tracking or advertising SDKs.
• We do not sell your data or share it with anyone for advertising or marketing.
• We do not track you across other companies' apps and websites, so we don't ask for App Tracking Transparency permission.
• We don't ask for location, contacts, photos, microphone or camera access.

5. Content and AI

Our editorial team writes the stories from public sources with AI assistance (Anthropic Claude). No user data is sent to AI providers; content production is entirely separate from your use of the app.

6. Service providers and international transfers

Some of these providers are outside Türkiye and the European Economic Area, mainly in the United States, so your data is transferred internationally. We rely on appropriate safeguards under Article 9 of the Turkish KVKK and Chapter V of the GDPR (such as standard contractual clauses and adequacy decisions). Providers process data only on our behalf and on our instructions.

7. Legal bases

• Performance of a contract (KVKK art. 5/2-c; GDPR art. 6(1)(b)): your account, sessions and purchases.
• Legal obligation (KVKK art. 5/2-ç; GDPR art. 6(1)(c)): records required by law.
• Legitimate interests (KVKK art. 5/2-f; GDPR art. 6(1)(f)): security, abuse prevention, server logs.

8. Retention

• Account data: until you delete your account.
• Sessions: valid for at most 90 days; IP addresses are cleared when the account is deleted.
• Rate-limit counters: at most 24 hours.
• Server logs: at most 30 days.
• Purchase records: Apple, Google and RevenueCat may keep transaction records under their own legal obligations and policies.

9. Deleting your account

In the app, go to Settings → Your account → Delete account. For security you confirm once more with Apple or Google; deletion then happens immediately: all your sessions are revoked, the Apple connection is revoked, your RevenueCat customer record is deleted, your sign-in methods are deleted, and your name, email, locale and session IP addresses are cleared. All that remains is a closed account record with no personal data. Details: Account deletion.

Deleting your account does not cancel a store subscription; cancel it separately in App Store or Google Play settings.

10. Your rights

Under KVKK art. 11 and GDPR arts. 15–22 you can ask whether we process your data, access it and get a copy, have it corrected, erased or restricted, object to processing, receive it in a portable format, and learn which third parties it was transferred to.

Send requests from your account's email address to privacy@5n1k.io. We reply within 30 days. If you are not satisfied, you can complain to the Turkish Personal Data Protection Authority (KVKK) or, if you live in the EU/UK, to your local data protection supervisory authority.

11. Children

5n1k is not directed to children under 13, and we do not knowingly collect personal data from anyone under 13. If you become aware of such a case, write to us and we will delete the account.

12. Security

All connections are encrypted with TLS. We store only hashes of session tokens, keep Apple tokens encrypted and restrict access to our servers. No system is perfect; if a breach occurs we will inform you and the competent authority as the law requires.

13. This website

5n1k.io uses no cookies, analytics or tracking, and loads no external fonts or scripts. It is hosted on Cloudflare, which briefly processes your IP address and standard request data to serve the page and block attacks.

14. Changes

When we update this policy we change the date above and announce material changes in the app.

15. Contact

For any privacy question: privacy@5n1k.io