KVKK Disclosure Notice

1. Data Controller

Under KVKK Article 10/1(a)

This disclosure notice has been prepared pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") to inform you about how your personal data is processed.

2. Personal Data Processed

Under KVKK Article 10/1(b)

2.1 Identity and Contact Data

2.2 App Usage Data

2.3 Health and Body Data (Special Category)

2.4 Data Not Collected and the Optional iOS Exception

The purpose of optional Meta ad measurement on iOS is to measure and optimize Only Fasting ad campaigns through install, app-open and session events. The stated legal basis for this processing is your explicit consent given via the iOS tracking permission, separate from usage analytics and health consent. Only with this permission, the device advertising identifier (IDFA), install, app-open and session events, and device model, OS and app version, language/locale, time zone, screen size, carrier/network information (including IP address), and the SDK's own anonymous app-install ID are transferred to Meta Platforms Ireland Ltd. / Meta Platforms, Inc. These data are transferred abroad, to Ireland and the USA, on the same consent. Only Fasting does not pass health, meal or coach-chat content, account IDs, email addresses, or subscription and purchase events to the Meta SDK. Automatic content and purchase logging are disabled. Refusing leaves the app usable and does not initialize this measurement SDK. You can withdraw permission in iOS Settings → Privacy & Security → Tracking.

3. Purposes of Processing Personal Data

Under KVKK Article 10/1(b)

• Service provision: Running the fasting tracking, water tracking, and nutrition tracking features
• Account management: User account creation, authentication, synchronization across devices
• Sending notifications: Fasting start/end reminders, water reminders
• AI-assisted analysis: Before starting a food-text, food-image, or activity analysis request, the mobile client checks the account's AI-processing setting. While the setting is on, calorie/nutrient estimates are produced from food photos and descriptions, and burned-calorie estimates are produced from the activity description and body weight
• Movement feature: Carrying out the Movement screening, not offering a movement plan for certain responses, showing a prompt to rest or to seek a professional opinion, adapting the choice and amount of movement, and keeping the session and progress history
• Weekly AI insight: Creating a weekly text by sending the weekly metrics listed one by one in Section 6.2 to Google Gemini, only while the AI-processing choice is on
• Health synchronization: While the app control and the related system read permissions are on, reading supported activity, body, sleep, and resting heart-rate data through Apple Health (iOS) or Health Connect (Android) and showing it in app features, and, while the AI-processing setting is on, producing the premium weekly digest in Section 6.2
• Writing to the health platform: While the account-level write control is on and the related system write permissions have been granted, exporting logged meal energy and macros, water, and manual weight data to Apple Health / Health Connect
• Subscription management: Carrying out Premium membership transactions
• App improvement: Developing the app using account-linked usage events; this sending can be turned off in the settings
• Bug fixing: Identifying technical problems through crash reports; this sending can be turned off in the settings
• Social features: Providing friendship, challenge, and community features
• Momo Coach (AI chat): Answering your questions based on your own records, passing answers through automated safety checks, checking and improving the quality and safety of answers, preventing misuse and enforcing the usage limits, and keeping the encrypted chat record for the establishment, exercise, or protection of a right (Section 6.6)
• Optional iOS Meta ad measurement: Measuring and optimizing Only Fasting ad campaigns through install, app-open and session events, only with explicit consent given via iOS tracking permission (Section 2.4)

4. Processing Grounds and Product Controls

Existing stated grounds and the controls present in the app

5. Processing of Special Categories of Personal Data

Under KVKK Article 6

Within the scope of our app, the following data is considered "special categories of personal data":

• Health data: Weight, height, body mass index (BMI), body fat percentage
• Nutrition data: Calorie intake, macronutrient values (protein, carbohydrate, fat)
• Fasting data: Records of the fasting process and physiological state (hunger, energy level)
• Movement screening data: Reported pain and the body region of the pain, joint limitations, doctor restriction, pregnancy or postpartum indicator, body measurements, readiness responses, and rule reason codes
• Movement session data: Planned and actual movements, duration, effort rating, session outcome, date, progress history, and recorded rule reason codes
• Health platform data: Supported steps, active energy, workouts, weight, height, sleep, and resting heart-rate data read with permission through Apple Health / Health Connect; meal energy/macros, water, and manual weight entries exported to the platform while the separate write control and the system permission are on
• Momo Coach chat data: Health-related information you share in the chat and the record summary sent to the model; processed only with the separate explicit consent given for Momo Coach (Section 6.6)

The Movement information/acceptance is recorded with its version and date. The account-level AI-processing setting is recorded separately. The core fasting timer and the water reminder can be used without these features.

Storage location: The Movement profile, readiness records, and session history are stored, linked to the account, in the server database hosted by Supabase (EU/Frankfurt). Account-linked local copies may also exist on the device so that the app can work.

Retention period: Movement records are kept until the account is deleted. Deleting the account deletes these records together with the account. No shorter automatic retention period is applied to Movement records.

6. Data Processing with Artificial Intelligence (AI)

Data sent, data not sent, and the controls in the app

6.1 Data Sent in Food and Activity Analysis

6.2 Data Sent in the Weekly Analysis

To create the weekly text, the following fields are sent to Google Gemini:

• Week information: weekKey, weekStart, weekEnd, daysCovered, coveredThrough, and tz
• Steps: Daily step series with date and weekday, average, goal, number of days the goal was reached, and low days with date/weekday/steps
• Active calories: Average active calories
• Sleep: Average hours, average bedtime minute, and number of days with data
• Meals: Total and daily average meals, snack count, late-night meal count and days, macro split, average daily kcal, evening calorie percentage, and the daily evening-percentage series
• Calorie balance: Calorie goal, daily intake and difference from the goal with date and weekday, and the average difference
• Water: Average ml, goal, number of days the goal was met, evening share, average minute of the first log, and morning share
• Fasting: Number of fasts started and completed, average actual and target hours, completion rate
• Weight: Start, end, change, goal, and number of logs
• Daily Movement and totals: movement.byDay[].date, weekday, minutes, neutral outcome, effort, and plannedMinutes; movement.daysMoved; movement.totalMinutes
• Movement outcomes and effort distribution: movement.outcomes.completed, partial, skipped, and rest; movement.effortDistribution.reported; the counts for ratings 1, 2, 3, 4, and 5 in movement.effortDistribution.byRating
• Movement effort at a comparable dose, if available: movement.effortAtComparableDose.dose.plannedMinutes, level, and volumeStep; previousAvg, currentAvg, delta, previousSamples, currentSamples, direction, and lookbackDays
• Movement progression: movement.progression.levelStart, levelEnd, and each levelChanges[].date, from, and to; volumeStepStart, volumeStepEnd, and each volumeStepChanges[].date, from, and to
• Movement/step correlation, if available: movement.correlations.steps.movementDaysAvg, nonMovementDaysAvg, difference, movementSamples, and nonMovementSamples
• Movement/fasting-hours correlation, if available: movement.correlations.fasting.avgHoursAtMovement, sampleDays, longFastDays, and longFastThresholdHours
• Movement/sleep correlation, if available: movement.correlations.sleep.beforeAvgHours, afterAvgHours, afterMinusBeforeHours, and sampleDays
• Meal plan: Planned and completed counts and adherence rate
• Request context: The derived count of field groups with data (dataDomains), the requested output language/locale, and static system instructions

6.3 Data Not Sent in the Weekly Analysis

Identification risk: Although direct identity information is not sent, exact dates, time zone, and language/locale information can contextually help to single out the person.

6.4 Retention and Provider Terms

Only Fasting does not store the weekly Gemini request text as a separate user record. Temporary retention, logging, and model use on Google's side are subject to Google's service settings and the applicable provider terms; this text gives no commitment about a specific period or about model training.

6.5 Automated Operations

Calorie estimation with AI is an automated decision-making mechanism. However:

• The results are estimates only and do not constitute medical advice
• The user can edit the results manually
• AI analysis is entirely optional; manual entry is always possible

The Movement feature uses a separate rule-based screening. Depending on the responses, it may not offer a plan, or it may show a message to rest or to seek a professional opinion. These Movement decisions are not produced by Google Gemini.

6.6 Momo Coach (AI Chat)

Momo Coach is an optional chat feature for Premium users aged 18 or older, where available; it requires age confirmation, separate explicit consent, and the AI-processing setting to be on. With each message, the following is sent to our AI providers listed here: the message you write, up to the last three questions and answers of the same chat, a summary of your records (water, meals, calories, fasting, weight trend, meal plan, Apple Health / Health Connect totals if connected, and weekly insight results, for today, the last 7 days, and a 28-day total), your goals, diet-type and allergy selections, the date, time zone, and app language. Your name, email, profile photo, direct user or account ID, and free-text meal names and notes are not sent. The detailed list is in Section 2.4 of the Explicit Consent Text.

Retention and access: Unlike the weekly analysis, Momo Coach conversations are stored. For every request, the message, the answer or the fixed message shown, the record summary sent to the model, the model's raw output, the automated safety decisions, and technical details are kept in an encrypted record. Only authorized persons can access the record, for the Momo Coach purposes in Section 3, and every access is logged. The records are not sold and are not given to third parties to train AI models. The periods are in Section 9.

Deletion and withdrawing consent: You can delete your visible chat history at any time in the app with "Delete chat history"; this does not delete the encrypted Momo Coach record, which remains until the end of its retention period. You can withdraw your Momo Coach consent at any time in the app; after that, no new Momo Coach message is sent to our AI providers listed here.

7. Parties to Whom Personal Data Is Transferred

Under KVKK Article 10/1(c)

8. Transfer of Data Abroad

Under KVKK Article 9

8.1 Transfer Services and Controls in the App

8.2 Transfer Limits

• The data in Section 6.1 is transferred to Anthropic or Google (Google as fallback) for meal text and photo analysis, to Google for menu scanning, nutrition-label photo extraction, QR-menu PDF/text extraction and activity estimates, and the data in Section 6.2 to Google for weekly analysis
• No direct user or account ID, name, or email is added to the weekly Gemini request
• Raw pain, body region, raw readiness/body values, reason codes, rest reasons, readiness energy, qualification data, and recent insight free text are excluded from the weekly request
• Exact dates, time zone, and language/locale information remain in the weekly request and can contextually help to single out the person
• In Momo Coach, the data in Section 6.6 is transferred to our AI providers listed here with each message; no direct user or account ID, name, or email is added
• Optional iOS Meta ad measurement: For the data, recipients, stated consent basis, transfer abroad and withdrawal, see Section 2.4 and the Meta row in Section 8.1.

9. Data Retention Periods

Under KVKK Article 7

Data already received by Meta is processed under Meta's own policy and is not deleted by us; you can exercise your rights with Meta and withdraw tracking permission in iOS Settings → Privacy & Security → Tracking.

10. Your Rights as a Data Subject

Under KVKK Article 11

Pursuant to Article 11 of Law No. 6698, you have the following rights:

11. Children's Data

Only Fasting is not an app intended for children. You must be at least 13 years old to create an account and use the app. If you are between 13 and the age of digital consent in your country, you may use the app only with the consent of your parent or legal guardian.

We do not knowingly collect personal data from children under 13. If we learn that such data has been collected, we delete it without delay. If you believe a child has given us personal data, notify us at privacy@onlyfasting.com.

Health note: fasting and calorie restriction can be harmful to children and adolescents who are still growing.

12. Data Breach Notification

If your personal data is obtained by others through unlawful means, in accordance with KVKK Article 12/5 and the Personal Data Protection Board's decision on data breach notification:

• We notify the Personal Data Protection Board no later than 72 hours after becoming aware of the situation.
• We notify the affected data subjects without undue delay and within the shortest reasonable time, explaining the nature of the breach, its possible consequences, and the measures taken.
• For users in the EU/EEA, we also fulfill the notification obligations under GDPR Articles 33 and 34.

13. Contact

This disclosure notice was last updated on October 18, 2026. You will be informed by an in-app notification if it is updated.