Privacy Policy

1. Data Controller

İlkay Doğu Eyiçalış — developer/operator of the Heltrum mobile app. Contact: support@heltrum.com · Country: Turkey

2. Data We Collect

• Account & Profile: name, username, email, age, gender, height, weight, profile photo, selected app categories, and profile/achievement fields. Account and profile data are stored on Heltrum's servers (Supabase).
• Health & Cycle Data: water intake, medications, lab results, mood, menstrual/cycle dates, daily cycle entries and cycle settings. Some records are device-only on Free/Lite; on Pro, relevant features may send data to Supabase for cross-device sync and backup.
• Apple Health Data: steps, heart rate and sleep data read by Heltrum are not sent by Heltrum to Heltrum servers or to Heltrum's third-party service providers; they are read and processed on the device.
• Fitness Data: body measurements, workout programs, custom exercises, completed sets, weight/repetitions/RIR and workout history. Some measurements are local-first and may sync on Pro; some features such as workout history, programs or custom exercises may be server-stored when used.
• Nutrition Data: macro/meal logs, saved meal templates and user-added foods. Macro and saved-meal data may be server-stored. Foods added by users may be included in a shared search catalog and visible to other users.
• Financial Data: income/expense records, goals, recurring transactions, saved stock calculations and portfolio positions. Some financial data are device-only on Free/Lite and may sync on Pro; some features such as portfolio positions are server-stored when used.
• Social Data: posts, comments, follows, groups, group memberships/messages, direct messages, cheers, blocks and content/user reports are server-stored. Content you choose to share may be visible to other users depending on the social feature.
• Support & Feedback: feedback/report text and related account identifiers, name and email may be stored on our servers for support purposes.
• Assistant & Voice Input: Heltrum Assistant's written command/intent parsing is rule-based and performed on-device; it is not sent to an external AI model. Records created through Assistant actions follow the normal storage rules of the relevant feature. If you use voice input, speech recognition may be processed by the device/operating-system speech recognition service according to platform settings.
• Technical & Usage Data: push notification or registration tokens, platform information, basic app lifecycle/usage events, performance information and crash/error reports. On Android, Google Firebase Cloud Messaging (FCM) may process a device registration token and notification payload as necessary to deliver push notifications.
• Advertising Data: when Google Mobile Ads (AdMob) is used on the Free tier, Google may process IP-derived approximate location, device or advertising identifiers, ad impression/interaction data, product interactions and performance/diagnostic data. Ad personalization and tracking are subject to device/operating-system settings and applicable permission or consent choices.
• Downgrading from Pro: records previously synced to our servers while on Pro are not automatically deleted when you move to Free/Lite and may remain until account deletion or another applicable deletion action.

3. Android — Health Connect (optional)

With separate in-app explicit consent and the required Android permissions, Heltrum reads only step count, heart rate, resting heart rate, sleep sessions and sleep stages (where available) from Health Connect. It does not write to Health Connect. This information is used to display daily steps and goal progress, health summaries and sleep information in the app.

The data is processed on the device. It is not sent to Heltrum servers or advertising or analytics services, sold, or used for advertising. Use of information received from Health Connect is subject to the Health Connect permissions policy, including its Limited Use requirements.

You can revoke permission under Health Connect → App permissions → Heltrum on your phone. Related consent and permissions can also be managed under Profile → Health Data & Consents in Heltrum.

4. Android — on-device step recording (Physical activity)

When you grant Physical activity permission and recording is activated, the on-device Recording API provided by Google Play services records step counts. Heltrum reads the recording to display daily steps and steps from recent days. Recording begins after permission is granted and the recording is activated; the active recording subscription keeps up to 10 days of on-device data.

Step counts are not sent to Heltrum servers or used for advertising or analytics. You can revoke access in Settings → Apps → Heltrum → Permissions → Physical activity.

5. iPhone — Apple Health and motion data

With separate in-app explicit consent and the required system permissions, Heltrum reads step count, heart rate, resting heart rate and sleep data from Apple Health and step counts from the iPhone motion sensor. It does not write to Apple Health. These data are processed on the device and are not sent to Heltrum servers.

Revoke Apple Health access under Settings → Health → Data Access & Devices → Heltrum, or motion access under Settings → Heltrum → Motion & Fitness.

6. Step-task information linked to an account

When you reach your daily step goal, only a yes/no value indicating that the daily step task was completed may be saved to your account and synchronized across devices. This record does not include the actual step count, heart rate or sleep data.

7. Explicit consent and withdrawal for health data

The relevant health data are not read without separately obtained explicit consent in the app and the required platform permissions. You can withdraw consent at any time under Profile → Health Data & Consents and manage system permissions through the device settings above.

8. Games and leaderboards

Your game scores, personal bests and ranking information may be processed to provide games, show your progress and operate available friends/global leaderboards. The user identity/profile elements and scores displayed on a leaderboard may be visible to other users of that leaderboard. Actual visibility depends on the relevant app screen and account settings.

9. Why We Process Your Data

We process data to operate your account and selected features, provide personalized calculations, enable sync and backup, power social features, deliver notifications, respond to support requests, measure service quality, fix errors, display advertising on the Free tier, protect the service and meet legal obligations. Heltrum does not sell your personal data.

10. Third-Party Service Providers

• Supabase Inc. — database, authentication and file storage.
• RevenueCat Inc. — subscription management; Heltrum uses an in-app user identifier (Supabase UUID) and subscription status. Heltrum does not send RevenueCat the name/email profile fields for this integration.
• Apple Inc. — App Store payments, Apple Health integration and iOS platform services. Payments and operating-system services are also subject to Apple's own terms and policies.
• Google LLC / Google Play — Android platform and store services, including Google Play distribution and store-based payment services where applicable.
• Google Firebase Cloud Messaging (FCM) — Android push notification delivery. A device registration token and notification payload may be processed as necessary to route and deliver notifications to the user's device.
• Expo — push notification infrastructure and related application services. A device push token and notification title/body may be transmitted as necessary to provide notification delivery.
• Sentry — crash/error reporting and technical diagnostics. Heltrum's configuration disables session replay and default PII sending.
• PostHog — basic usage analytics. Heltrum's configuration disables session replay, screen capture and detailed touch capture.
• Google Mobile Ads (AdMob) — advertising on the Free tier and advertising/performance measurement; the Google Mobile Ads SDK may process device identifiers, IP-derived approximate location, advertising data, product interactions and technical diagnostic/performance data.
• Operating-system speech recognition services — only when voice input is used; processing of speech data depends on the device, operating system and the user's platform settings.

We expect service providers that receive user data to process it only as needed to provide the relevant service and to provide protections consistent with this policy and applicable data-protection requirements.

11. Social Features

Posts, comments, profile information, group content and other social content you share may be visible to other Heltrum users depending on the feature. Heltrum provides user blocking and user/content reporting mechanisms. Report records are processed for moderation and safety.

12. International Transfers

Service providers such as Supabase, RevenueCat, Apple, Expo, Sentry, PostHog and Google may process data outside Turkey or in infrastructure located in multiple countries. Relevant data categories may therefore be transferred internationally depending on the service used. Applicable legal requirements and each provider's data-processing terms apply to those transfers.

13. Retention & Deletion

While your account is active, server data may be retained for as long as reasonably necessary to provide the relevant feature. When you use Delete Account from the Profile screen, Heltrum initiates deletion of your authentication account, profile record, account-linked health/cycle, fitness, nutrition, financial, social and feedback records stored on Heltrum servers, and your profile-photo files stored in Heltrum Storage. Once the deletion flow completes, the account can no longer be used to sign in.

If you cannot access the app, you may initiate an account-deletion request through https://heltrum.com/en/delete-account or by contacting support@heltrum.com from the email address registered to your account.

Heltrum local app data on the device used to delete the account is also cleared. Data that exists only locally on another device and was never transmitted to Heltrum servers cannot be remotely erased; it is removed when app data is cleared or the app is uninstalled on that device. Records held independently by third parties, such as Apple App Store, Google Play or subscription-provider transaction records that a provider must retain, may remain subject to that provider's retention policy and legal obligations.

14. Security

We use access controls, Supabase row-level security (RLS), HTTPS/TLS encrypted connections and user-scoped Storage access rules. No system can provide an absolute guarantee of security.

15. Your Rights & Permissions

You may request access to, correction of, or deletion of your data and, where applicable, withdraw permissions or consent you previously granted. Account deletion is available from the Profile screen and through Heltrum's external account-deletion process. Apple Health and other operating-system permissions can be managed in the relevant device settings. Contact support@heltrum.com for privacy requests.

16. Children & Age Requirement

Heltrum is not designed for children under 13. If applicable law, country/store rules or a specific feature requires a higher age threshold or parental/legal-guardian permission, that higher requirement applies.

17. Changes

We may update this policy as our data practices or services change. The current version will remain available on our website and from the Profile/Privacy area of the app.