CanSayNo Privacy Policy
Last updated: 8 November 2026
This policy explains how your personal data is processed when you use the CanSayNo mobile app (the "App"). It serves as the privacy notice under the EU General Data Protection Regulation ("GDPR"). It is also the information notice under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK").
1. Controller
- Controller: Alperen Faki (individual developer)
- City: Bursa, Türkiye
- Email: info@factech.app
2. Data we process
| Data | Examples | Source |
|---|---|---|
| Account data | First name, last name, email address, password (stored only as an irreversible hash) | You, at sign-up |
| Practice content | Messages you write in practices, the AI character's replies, evaluation scores and feedback | Created while you use the App |
| Progress data | Number of practices, streak, points (XP), level, badges, daily usage count | Created while you use the App |
| Subscription data | Subscription product, status, start/end dates, store transaction IDs | App Store / Google Play via RevenueCat. We never receive your card details. |
| Security logs | IP address, device/browser information (user agent), device name, sign-in attempts, session records | Created automatically when you sign in and use the App |
We do not collect location, contacts, photos, microphone data or advertising identifiers. The App contains no ads, analytics or tracking tools. We do not sell your data or share it for advertising.
Reminder notifications are scheduled entirely on your device. Your preference and reminder time stay on the device and are not sent to us.
Tip: Avoid writing real people's names, health information or other sensitive details in practices. Scenarios are fictional and do not need real details.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6 · KVKK Art. 5/2) |
|---|---|
| Creating your account, signing you in, sending verification and password reset codes | Performance of a contract (6(1)(b) · 5/2-c) |
| Running practices with the AI character and evaluating them | Performance of a contract (6(1)(b) · 5/2-c) |
| Showing your progress, streak and badges | Performance of a contract (6(1)(b) · 5/2-c) |
| Recognising and maintaining your premium subscription | Performance of a contract (6(1)(b) · 5/2-c) |
| Account security and abuse prevention (rate limits, suspicious sign-in detection) | Legitimate interests (6(1)(f) · 5/2-f) |
| Legal obligations and potential disputes | Legal obligation; establishment, exercise or defence of legal claims (6(1)(c), 6(1)(f) · 5/2-ç, 5/2-e) |
4. Who we share data with (international transfers)
We share only what is needed to run the App:
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Anthropic PBC (Claude) | Generating character replies and evaluations | Your practice messages and scenario information. Your name and email are not sent. | USA |
| RevenueCat Inc. | Managing subscription status | Your numeric account ID, subscription and transaction data | USA |
| Apple / Google | In-app purchases | The store runs the purchase and processes payment details | USA / EU |
| Hetzner Online GmbH | App server and database | All data described here | Germany (EU) |
| Brevo SAS | Verification and password reset emails | Your email address, name, one-time codes | France (EU) |
Anthropic states that it does not use data sent through its API to train its models and retains it only for a limited period.
Transfers outside your country are made with appropriate safeguards: standard contractual clauses and the providers' data processing agreements.
Apart from the providers above, your data is disclosed to competent authorities only when the law requires it.
5. Retention
- Account, practice, progress and subscription data: Kept while your account exists. When you delete your account, this data is deleted immediately and permanently.
- Sign-in attempts and security logs: Kept for up to 90 days. Sign-in records tied to your email address are also removed when you delete your account.
- Backups: Deleted data is purged from backups within 30 days.
- Store records: Apple's and Google's purchase records are subject to their own policies.
6. Your rights
You have the right to:
- Access your data and get a copy. In the App, go to Profile › Account › Download my data (in the app: Profil › Hesap bilgileri › Verilerimi indir) to export everything as a JSON file instantly.
- Rectify inaccurate data. You can change your name and email in the App.
- Erase your data. You can delete it yourself in the App via Profile › Account › Delete my account (in the app: Profil › Hesap bilgileri › Hesabımı sil).
- Object to processing or ask for its restriction.
- Data portability.
- Seek compensation for damage.
- Lodge a complaint with your data protection authority.
Send requests to info@factech.app from the email address registered to your account. We reply within 30 days.
7. Security
- Connections are encrypted (HTTPS).
- Passwords are stored as irreversible hashes.
- Session keys are kept in your device's secure storage.
- Failed sign-ins and code attempts are limited.
- AI service keys live only on the server and are never shipped in the App.
8. Age
The App is not intended for anyone under 16. If we learn that an account belongs to someone under this age, we delete it.
9. Changes
When we update this policy, the "Last updated" date changes. We announce significant changes in the App or by email.