Privacy Policy - HeartScape

1. Controller

Serhat Altin
Email: serhat@serhataltin.com

This policy explains how the app "HeartScape - Couple Memories" (iOS and Android, hereinafter "HeartScape" or "the app") processes personal data, in accordance with the EU General Data Protection Regulation (GDPR).

2. Data we process

• Account data: When you sign in with Google, Apple or email and password, Firebase Authentication processes your name, email address and a user ID.
• Profile data: Information you enter yourself, such as display name, profile photo, birthday, relationship start date, your partner's name, favourite activities and a city/location used for location-based features.
• Content: Photos, memories with an optional location (map), comments, special dates and reminders, coupons, love letters, journal entries, mood entries, appreciation notes, bucket list items, challenges, quiz and game answers, rituals and gamification stats (XP, badges).
• Technical data: Push notification token, crash reports and device information required for security and stability (see section 5).
• Purchase data: Subscription status and transaction data via RevenueCat. Payment details are processed exclusively by Apple or Google and are not visible to us.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) for providing the app and your account; our legitimate interest in a secure and stable app (Art. 6(1)(f) GDPR) for crash reports and App Check; your consent (Art. 6(1)(a) GDPR) for optional permissions.

3. Sharing with your partner

HeartScape is a private app for two people. Your content is shared only with the partner you have connected with (via invite code). It is never public and is not shared with other users.

4. Device permissions (optional)

• Calendar: Read-only access to import dates. Only the events you select are copied into the app; nothing is written to your calendar.
• Location: To show your location on the map and tag memories with a place.
• Photos and camera: To add photos to memories and your profile. Only the photos you pick are uploaded.
• Push notifications: To notify you about your partner's activity and reminders. A Firebase Cloud Messaging token is stored for this purpose.

You can grant or revoke these permissions at any time in your device settings. The app remains usable without them, with the related features unavailable.

5. Service providers (processors)

Google Firebase

We use Firebase by Google (Google Ireland Ltd. / Google LLC) for Authentication, Cloud Firestore (database), Cloud Storage (photos), Cloud Functions (backend logic, region europe-west), Cloud Messaging (push notifications), Crashlytics (crash reports) and App Check (protection against misuse). Data may be processed in the USA; Google is certified under the EU-U.S. Data Privacy Framework and uses Standard Contractual Clauses. More information: Firebase Privacy

Google Maps Platform

For map display and place search, location data and search queries are sent to Google Maps. More information: Google Privacy Policy

RevenueCat

RevenueCat manages subscriptions (HeartScape Premium) and receives your user ID and purchase data. Payments are processed only by Apple or Google. More information: RevenueCat Privacy Policy

Apple / Google Sign-In

If you sign in with Apple or Google, their official sign-in services pass your name and email address to Firebase Authentication. Their policies also apply: Apple, Google.

Shorebird

Shorebird delivers app code updates. Only technical device information needed for the update (e.g. app version, platform) is processed, no personal content.

6. No ads, no tracking

HeartScape shows no ads, does not track you across apps or websites, and does not sell your data.

7. Retention and account deletion

We store your data as long as your account exists. You can delete your account at any time in the app under Settings → Delete account. This deletes your account and the associated data. Alternatively, you can request deletion by email to serhat@serhataltin.com. Crash reports are deleted automatically after a limited period by Firebase Crashlytics.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you
• rectification of inaccurate data
• erasure of your data
• restriction of processing
• data portability
• object to processing
• withdraw consent at any time with effect for the future
• lodge a complaint with a data protection supervisory authority

To exercise these rights, contact serhat@serhataltin.com.

9. Minimum age

HeartScape is intended for users aged 16 and over. We do not knowingly process data of children under 16.

10. Security

All data is transmitted encrypted via HTTPS/TLS. Database security rules ensure that only you and your connected partner can access your content.

11. Changes

We may update this policy from time to time. Changes are published on this page; for significant changes we will inform you in the app. See also our Terms of Use.