Loop — Privacy Policy

Last updated: April 29, 2026 Effective date: April 29, 2026

1. Data Controller

The Loop application ("Loop", "we", "us", "our") is developed independently by Dilay Demirgan.

• Data Controller: Dilay Demirgan (Clinical Psychologist)
• Contact: neuropathapps@gmail.com
• Address: Ankara, Türkiye

This Privacy Policy is prepared in accordance with the Turkish Personal Data Protection Law No. 6698 (KVKK) and the European Union General Data Protection Regulation (GDPR).

2. Personal Data We Collect

Loop collects the following categories of personal data:

2.1. Identity and Account Information

• Email address (required for registration)
• Display name (optional)
• Year of birth (optional, for content personalization)

2.2. Health Data (Special Category Personal Data)

Considered special category data under KVKK Art. 6 and GDPR Art. 9:

• Menstrual period start dates
• Cycle length (days)
• Period duration (days)
• Birth control method (pill, IUD, condom, other, none)
• Daily mood and energy levels
• Social need levels
• Health-related free-text notes

2.3. Sexual Life Data (Special Category Personal Data)

• Intercourse records (protected / unprotected)
• Libido level

2.4. Psychological Data (Special Category Personal Data)

• Cognitive Behavioral Therapy (CBT) session responses
• Thought, emotion, and behavior records
• Phase-based personal observations

2.5. Technical Data

• Device operating system type (iOS version)
• Push notification token (to send notifications)
• Anonymous in-app error and performance logs

2.6. Data We Do NOT Collect

• We do not collect location (GPS) data
• We do not request access to phone contacts, photos, or camera
• We do not use the advertising identifier (IDFA)
• There are no third-party tracking cookies
• There are no social media account integrations

3. Purposes and Legal Bases for Processing

Important: Your health, sexual life, and psychological data are processed only with your explicit consent. You may withdraw consent at any time and delete your account to remove all your data.

4. Data Sharing

4.1. Third-Party Service Providers (Data Processors)

4.2. Partner Mode (Optional)

If you enable Partner Mode, only the fields you select (e.g., phase, energy, advice text) are shared with your linked partner. Your menstrual dates, symptoms, notes, and sexual life data are never shared.

4.3. What We Will Never Share

• Your data is not sold or rented to advertisers or data brokers.
• Your data is not shared with health insurers, employers, or third-party researchers.
• Your data is not used for marketing by third parties.

4.4. Legal Obligations

We may share limited data with authorities upon court order or legal obligation. In such cases, we will inform you as soon as legally permitted.

5. Data Retention

• Active account data: Retained as long as your account is active.
• After account deletion: All personal data is permanently deleted within 30 days.
• Data retained for legal obligations: Tax-related billing data may be retained for up to 10 years if applicable (not currently relevant since Loop is free).
• Anonymized statistics: May be retained indefinitely (not linked to your identity).

6. Data Security

• All data transmission is encrypted with TLS 1.3.
• Data is stored in Supabase Postgres databases with at-rest encryption (AES-256).
• Row Level Security (RLS) policies ensure each user can only access their own data.
• Your passwords are stored as bcrypt hashes by Supabase; we never see them in plain text.
• In case of a data breach, we notify the relevant Data Protection Authority within 72 hours and inform affected users.

7. Your Rights

Under KVKK Art. 11 and GDPR Articles 15-22, you have the following rights:

• Right to information: Learn what data is being processed
• Right of access: Request a copy of your data
• Right to rectification: Correct inaccurate data
• Right to erasure ("right to be forgotten"): Delete your account and all data
• Right to restriction of processing
• Right to data portability: Download your data in a machine-readable format
• Right to object: Withdraw your consent
• Right not to be subject to automated decision-making

How to Exercise Your Rights

1. In-app: Settings → Delete My Account (instant deletion)
2. By email: Send your request to neuropathapps@gmail.com (response within 30 days)
3. Complaint: You may contact the Turkish Data Protection Authority (kvkk.gov.tr) or your local data protection authority in EU countries.

8. Children's Privacy

Loop is intended for users aged 17 and over. We do not knowingly collect data from individuals under 17. If we discover that an account belongs to someone under 17, we will delete it immediately.

9. International Data Transfers

Your data is primarily processed on Supabase servers in Frankfurt, Germany. Due to the push notification infrastructure (Apple APNs), your notification token may be transferred to Apple's servers in the USA. This transfer is conducted under GDPR Standard Contractual Clauses (SCC).

10. Cookies and Local Storage

The Loop mobile app does not use cookies. We use local storage only to keep your login session on your device (this never leaves your device). The Loop website uses only essential cookies required for basic functionality.

11. Policy Changes

If we make changes to this policy, we will notify you in-app and via email. We provide 30 days' notice for material changes. You can always view the current policy on this page.

12. Medical Disclaimer (Important)

Loop is not a medical device and does not replace professional health advice. Cycle predictions are based on statistical models and may not be 100% accurate. Loop is not a contraceptive app — please use doctor-approved methods to prevent pregnancy.

13. Contact

For privacy-related questions:

Data Controller: Dilay Demirgan Email: neuropathapps@gmail.com Address: Ankara, Türkiye

Turkish Data Protection Authority: kvkk.gov.tr European Data Protection Board: edpb.europa.eu