Privacy Notice

1. Introduction & Data Controller

This Privacy Notice explains what personal data "Heltrum — Life Operating System" (the "App") collects, how it is processed, and what rights you have. Please read it before you start using the App.

The Data Controller is:

İlkay Doğu Eyiçalış — developer/operator of the "Heltrum" app (individual)

Contact: support@heltrum.com

Country: Turkey

2. Categories of Data We Process, and Where They Are Stored

Where each category of data is stored depends significantly on your membership tier, so we specify this for each category below:

• a) Identity & Contact: name, username, email, age, gender, profile photo. Always stored on our servers (Supabase), since your account and social features require it.
• b) Health Data (sensitive category): Water intake, medication/lab records, mood and menstrual-cycle records. Some records remain on-device on Free/Lite; related Pro features may sync records to Supabase. Health measurements read from Apple Health, Health Connect and Android on-device step recording are processed on-device and not sent to Heltrum servers. A yes/no value showing whether the daily step goal was completed may be linked to your account and synced across devices without including the measurements themselves.
• c) Physical Information & Goals: height, weight, your goals. Stored on our servers as part of your account profile.
• d) Financial Data: Income, expenses, investments, savings goals and recurring transactions. Some records remain on-device on Free/Lite and may sync on Pro; certain features, such as portfolio positions, may be server-stored when used.
• e) Fitness Data: Workout programs, set/rep/rest records and body measurements. Some measurements are local-first and may sync on Pro; records such as workout history, programs or custom exercises may be server-stored when their features are used.
• f) Social Data: your followers/following, group memberships, group messages, posts, comments, profile photo. Because this data is inherently shared with other users, it always lives on our servers and cannot be fully offline.
• g) Technical Data: device/OS information, in-app usage logs, push token, language and currency preference.

3. Health sources, permissions and purposes

With permission, Heltrum reads only steps, heart rate, resting heart rate, sleep sessions and available sleep stages from Android Health Connect; it does not write data. These readings display daily steps/goal progress, health summaries and sleep information. With Android Physical activity permission, steps may also be read from Google Play services' on-device Recording API, which provides access to up to 10 days within an active recording subscription.

On iPhone, with permission, Heltrum reads steps, heart rate, resting heart rate and sleep from Apple Health, and steps from the motion sensor. It does not write to Apple Health. Source measurements are processed on-device, not sent to Heltrum servers or advertising/analytics services. Only a yes/no daily step-task completion value may be synced with the account.

Consent can be withdrawn under Profile → Health Data & Consents; Health Connect permission under Health Connect → App permissions → Heltrum; Android Physical activity permission under Settings → Apps → Heltrum → Permissions; Apple Health and motion permissions in iPhone settings.

4. Games and leaderboards

Game scores, personal bests and ranking information may be processed to provide games and available friends/global leaderboards. Displayed account/profile elements and scores may be visible to other users of the relevant leaderboard. Account-linked information may be stored on servers to the extent required by the feature.

5. Processing of Sensitive Health Data

Health-related data is treated as sensitive personal information. Heltrum processes cycle/health records and permitted Apple Health/Health Connect measurements with separately obtained in-app explicit consent and the required system permissions for the relevant feature. This notice alone is not a consent request. You can withdraw consent under Profile → Health Data & Consents and revoke platform permissions in device settings. Deletion of local data and accounts is explained in the Privacy Policy.

6. Purposes of Processing

Your data is processed to: create and secure your account; provide personalized calculations (calorie/macro targets, cycle predictions, budget analysis, fitness/health scores); power cross-device sync on the Pro tier; power social features (friends, groups, posts); send reminders and notifications; measure service quality and fix bugs; and meet legal obligations. We do not sell your personal data.

7. Legal Basis

Your data is processed on the basis of contract performance and our legitimate interest in operating the App. Sensitive health data is processed based on your explicit, freely given consent.

8. How Data Is Collected

Your data is collected when you fill in the sign-up form, enter data within the App (cycle, fitness, finance, health records, etc.), connect a third-party service such as Apple Health or Health Connect, and through your general use of the App.

9. Third Parties & Data Sharing

To operate the App, limited data is shared with the following overseas service providers:

• Supabase Inc. — database, authentication and file storage. Besides account/profile and social data, records for certain fitness, nutrition and portfolio features may be stored when used; supported Pro features may also sync. Apple Health/Health Connect measurements are not sent to this service.
• RevenueCat Inc. — subscription/purchase management; only your anonymous user identifier (a randomly generated ID) and subscription status are shared — no directly identifying information such as your email or name is sent to this provider.
• Apple Inc. — App Store payments and iOS platform services. Apple Health data are read on-device by Heltrum and not sent to Heltrum servers.
• Expo — a push token, notification title and body may be processed to deliver notifications.
• Sentry — crash/error and technical diagnostics.
• PostHog — basic usage analytics.
• Google Mobile Ads (AdMob) — ad delivery and performance measurement on Free; the advertising SDK may process device/advertising identifiers, approximate location and ad interactions.

We do not sell your personal data. The service providers identified above may process the relevant categories to deliver the stated services, and disclosures may occur where legally required. Applicable cross-border transfer requirements apply. Heltrum does not send Apple Health/Health Connect measurements to advertising or analytics services.

10. Retention Period

Server data may be retained while your account is active and to the extent needed for the relevant feature. Account deletion starts removal of account-linked data on Heltrum servers and clears Heltrum local data on the device used for deletion. Data held only locally on a different device cannot be remotely deleted. Legally retained third-party transaction records remain subject to the third party's policies.

11. Data Security

We protect your data using reasonable technical and administrative safeguards, including access controls, encryption, and row-level security policies. No method of transmission or storage is 100% secure.

12. Your Rights

Depending on your location, you may have the right to: know whether your data is processed; request information about that processing; learn who your data is shared with; request correction of inaccurate data; request deletion; object to decisions based solely on automated processing; and seek redress for damages from unlawful processing. These rights are consistent with GDPR (for EU/EEA residents), CCPA (for California residents), and equivalent protections elsewhere.

13. How to Exercise Your Rights

You can exercise these rights directly from Profile > Account Settings in the App, or by emailing support@heltrum.com. Requests are handled free of charge, generally within 30 days.

14. Account Deletion

You can permanently delete your account and all associated personal data at any time from the Profile screen. This action is irreversible.

15. Changes to This Notice

This Notice may be revised to reflect legal or App updates. The current version is always available from your Profile screen.