This policy explains how the Askeo mobile app processes your personal data. It is written to meet both the Turkish Personal Data Protection Law No. 6698 (KVKK) and the European Union General Data Protection Regulation (GDPR).
Mikail Kara
Address: Binevler Mahallesi, 81058 Nolu Sokak, Bina No: 1, Şahinbey / Gaziantep, Türkiye
Email: destek@askeoapp.com
Data protection requests: kvkk@askeoapp.com
Askeo is a health and fitness app. A significant part of what we process is special category personal data (health data) under KVKK art. 6 and GDPR art. 9, and it is processed only with your explicit consent.
| Category | Data | Why |
|---|---|---|
| Account | Email address, password hash, account creation date | Authentication and access to your account |
| Profile and goals | Age, sex, height, weight, target weight, target date, activity level, training experience, training location, weekly training days | Calculating your daily calorie and macro targets, building your programme |
| Health (special category) | Injury or pain notes, food allergies and dietary preferences, body measurements, body fat percentage, progress photos, sleep, stress, digestion and energy ratings, fasting records | Building the plan safely and personalising coaching advice |
| Nutrition | Meal entries, food photos, barcode scans, water intake, supplement records, shopping list | Food analysis and daily tracking |
| Food search | The term you type when searching for a food, and the catalogue entry you pick from the results for that search | Improving how search results are ranked: which entry people mean when they search a term can only be measured this way |
| Training | Session records, set/rep/weight data, programme and calendar, post-session feedback | Progress tracking and programme adaptation |
| Device health data | Steps, sleep, active calories and weight from Apple Health / Health Connect (only if you grant permission) | Energy balance and recovery assessment |
| Chat | Messages you write to the AI coach and the coach's replies | Providing the coaching service and remembering the conversation |
| Social (optional) | Display name, public profile, who you follow and who follows you, activities you share and likes | Only if you choose to use the social features |
| Device identifier | An irreversible SHA-256 hash of your device's system identifier (the raw identifier never leaves your device) | Tying the free AI allowance to a device: a second account opened on the same phone does not receive a new free allowance |
| Subscription | Subscription status, plan type, renewal date | Managing access to Premium features |
| Technical | App version, error logs, request counters | Troubleshooting, abuse prevention and quota enforcement |
Your payment details never reach us. Card and billing information is processed solely by the Apple App Store or Google Play; we only see whether your subscription is active.
Data minimisation: We request access only to the health data types listed above: steps, sleep, active calories and weight (read); water and nutrition entries (write). We use this data only for the stated core features — energy balance, recovery assessment, goal tracking, and logging water and meals. We do not access or request any health data type that is not necessary for those purposes.
Granular consent: Each health data type is presented as a separate permission in the Health Connect / Apple Health system screen. You may grant some and refuse others; the app works without the permissions you refuse. You can withdraw any permission at any time from your device's Health Connect / Health settings, and further syncing of that data type stops when you do.
Prohibited uses: Your health data is never used for advertising or marketing, never sold, and never used for or shared for credit scoring, insurance, employment or similar decisions.
Your food photos and the messages you write to the coach are sent to AI models through OpenRouter so that they can be analysed. These requests do not identify you: your name, email address and account ID are not sent to the model.
AI responses are generated automatically and do not constitute automated decision-making producing legal effects. Every change to your goals is put to you for approval.
We use a data processing configuration with the model providers under which the data we send is not used for model training.
To prevent abuse of the free AI allowance, we store an irreversible hash of your device's system identifier. The raw identifier never leaves your device and cannot be reconstructed from the hash; the hash is not used for advertising, tracking or profiling, and is not shared with anyone.
| Party | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | European Union (Frankfurt) |
| OpenRouter | AI analysis and coaching responses | United States |
| RevenueCat | Subscription validation | United States |
| Apple / Google | Payments, notifications, device health data | United States / EU |
| Open Food Facts | Product lookup by barcode or product name | EU — only the barcode or search text is sent; no account or health data |
Open food data and licensing. Packaged product information may come from Open Food Facts, a database licensed under ODbL 1.0. Nutrient composition values come from USDA FoodData Central; food names in other languages use the CC0-licensed structured labels of Wikidata. Attribution and licence links for all three sources are shown in the app's “Data sources and licences” screen. No personal data of yours is sent to these sources, and we neither request nor store Open Food Facts product images.
Transfers outside Türkiye rely on your explicit consent under KVKK art. 9; under the GDPR, Standard Contractual Clauses (SCCs) apply.
We do not share your data with anyone for advertising purposes and we do not sell it. The app contains no advertising network.
Under KVKK art. 11 and GDPR arts. 15–22 you have the right to access, rectify and erase your data, to restrict processing, to data portability and to object. You may withdraw your explicit consent at any time.
You can delete your account directly in the app: Profile → Settings → Delete Account. Deletion cannot be undone.
For any other request, write to kvkk@askeoapp.com; we respond within 30 days at the latest.
You also have the right to complain to the Turkish Personal Data Protection Authority (kvkk.gov.tr) or to the data protection authority of your EU member state.
Askeo is for users aged 18 and over. We do not knowingly collect data from anyone under 18. If we become aware of such an account, we delete the account and its data.
Data is protected with TLS in transit and stored encrypted on the server. The database is protected by row level security (RLS) policies: each user can access only their own data.
Breach notification: If a breach affecting your personal data is detected, we notify the competent supervisory authority within the deadlines set by KVKK and the GDPR (within 72 hours under GDPR art. 33). Where the breach poses a high risk to your rights and freedoms, you are additionally informed in the app or by email.
If we make a material change to this policy, you will be informed in the app. The current version is always published at this address.
Askeo does not diagnose, does not prescribe treatment and is not a substitute for a doctor or dietitian. Consult a health professional for your health decisions.