Privacy Policy

Last updated: 12 September 2026 · Effective date: 12 September 2026

This policy explains what personal data Mom's Diary processes, on which legal bases, and what your rights are under the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Data Controller 2. Data We Collect 3. Purpose and Legal Bases 4. Sharing with Third Parties 5. Retention 6. Security 7. Your Rights 8. EU Representative (GDPR Art. 27) 9. International Transfers 10. Children's Privacy 11. Changes 12. Contact

1. Data Controller

The controller responsible for the processing of your personal data is the sole proprietor "Anne Defteri" (Mom's Diary), an individual sole proprietorship (şahıs işletmesi) established in Türkiye, operating under the trade name "Anne Defteri" — the legal name of the Mom's Diary app. For any data protection matter you can reach us at privacy@annedefteri.com.

2. Data We Collect

Account data: name, e-mail, password (hashed)
Baby data: date of birth, gender, weight, height, head circumference
Health records: sleep, feeding, diaper, vaccine, medication, allergy records
Content: photos, community posts, private messages
Technical data: device type, app version, anonymous crash reports, IP address (rate limiting)
Subscription data: payment status (no card numbers are stored by us)

3. Purpose and Legal Bases

Your personal data is processed for the following purposes:

Service delivery — baby tracking, reminders, community access. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
Health tracking — growth charts, vaccine calendar. Legal basis: your explicit consent (GDPR Art. 9(2)(a), collected at sign-up).
Security — fraud prevention, rate limiting, 2FA. Legal basis: legitimate interest (GDPR Art. 6(1)(f)).
Service improvement — crash reports, anonymous usage statistics. Legal basis: legitimate interest (GDPR Art. 6(1)(f)).

Your data is not sold. It is shared only with the following service providers:

Apple — App Store payments, push notifications (APNs)
Firebase Cloud Messaging — Android push notifications (currently unused)
Anthropic (Claude API) — your AI assistant queries; subject to Anthropic's privacy policy
Sentry — anonymous crash reports
Legal obligation — in the case of a court order or legal request, we may share with the competent authority, only to the extent required.

5. Retention

Active account data: for as long as your account is open
Deleted account: permanently deleted within 30 days after soft-delete
AI conversations: automatically deleted after 30 days
Support requests: 2 years
Payment records: 10 years, as required by applicable commercial and tax law

6. Security

All communication is encrypted via TLS 1.3
Sensitive fields (health, e-mail, phone) are encrypted with AES-256 in the database
libsodium (X25519) is used for end-to-end encrypted private messages
Passwords are hashed with bcrypt; plaintext is never stored
2FA (TOTP) is available for all accounts
Backups are kept encrypted

7. Your Rights

Under the GDPR, you have the following rights:

Right to know whether and how your data is processed (access)
Export of your data in ZIP format — from the app (data portability)
Right to have incorrect data corrected (rectification)
Right to delete your account (all data is permanently deleted within 30 days) — from the app or via privacy@annedefteri.com (erasure)
Right to restrict processing and to object to processing
Right to compensation for damage caused by unlawful processing
Right to lodge a complaint with your local data protection authority

8. EU Representative (GDPR Art. 27)

Because the controller is an individual established in Türkiye (outside the EU) and offers the App to users in the Union, we appoint a representative in the EU in accordance with GDPR Article 27. You may exercise your rights under this policy by contacting that representative. Representative details: [EU representative name, address and contact — to be completed].

9. International Transfers

Our servers are located in the EU. Data sent to third-party providers (Apple, Anthropic, Sentry) may be transferred outside the EU under the providers' own transfer mechanisms (standard contractual clauses / adequacy decisions). You may request a copy of this information from us at any time.

10. Children's Privacy

Mom's Diary is designed for parents and caregivers aged 18 and over. Baby data recorded in the app is stored with the parent's consent and in the parent's name. If we discover that a user under 18 has created an account, the account is deleted immediately.

11. Changes

When we update this policy, we state the new "last updated" date at the top of the page and, for material changes, send an in-app notification. Continued use of the app after material changes means you accept the new terms.

12. Contact

For questions, requests and complaints: privacy@annedefteri.com

Data controller: Mom's Diary (Anne Defteri). Questions about your data protection rights in the EU may be directed to your local supervisory authority.