Privacy policy

This text explains what the Shimba app does with your personal data. It is also the information notice under Turkish Law No. 6698 on the Protection of Personal Data (KVKK).

Data controller

The data controller for your personal data is Emirhan Filiz. You can send your questions and requests to destek@shimba.app.

Your data stays on your device first

Everything you enter — your quit date, your daily cigarette and pack details, your journal (mood and craving) entries, your goals — is written to this device first. The app's core function (how long you haven't smoked, what you've gained, how your health has progressed) is calculated entirely on the device.

If no server address is configured or you haven't signed in, the app runs entirely locally with its core functions and your account-linked data (journey, journal, goals) does not leave the device. Only the app's crash reports and content-free usage statistics are sent — to the service providers listed below — whether or not you are signed in.

What data is processed if you create an account

You can create an account so that your data can be moved to another device. In that case, the following data is also stored on the server:

• Identity: your email address (verified with a one-time code) or the identity that comes from your Google account.
• Journey data: quit date, cigarettes smoked per day, cigarettes per pack, pack price, relapse records (date and count).
• Personal profile: your name, your birth year, your reasons for quitting, the sentence you tell yourself, the profile picture you chose.
• Journal entries: mood, sub-emotions, confidence level, craving reason and outcome, goals achieved.
• Subscription status: the date until which Premium is valid.

Because your mood and craving entries relate to a health behavior, they are treated as sensitive data and protected accordingly.

Data that never leaves the device

The free-text note in your journal entries does not leave the device. This is the most private data in the app; it is never sent for syncing or to the AI, and stays only on this device.

"AI Coach" (artificial intelligence)

If you use this feature, the messages you write and the following summary information — so that you can be given a suitable answer — are passed to the AI provider: your smoke-free streak and record, the number of cigarettes you haven't smoked, the money you've saved, your reasons for quitting, the promise you made to yourself, your most frequent craving reasons (only reason and count) and, if you took the dependence test, your result level. Your journal notes and your individual answers in the test are not sent.

Purposes of processing

Your data is processed for these purposes: running the app and performing its calculations; moving your data between devices and backing it up; offering you personalized reminders and motivational content; managing your account and keeping it secure.

We do not use your data for marketing, advertising or profiling.

Legal basis

Journey and personal profile data are processed so that the service can be provided (performance of a contract and legitimate interest). For the sensitive mood/journal data and for storing data on infrastructure abroad, your explicit consent is the basis — if you don't choose to create an account and sync, this data does not leave your device.

Who it is shared with

Your data is shared only with the following service providers we work with to provide the service:

• Supabase: server and database infrastructure; data is hosted in the European Union (Germany).
• Resend: sending the sign-in code by email; only your email address and the code are passed on.
• Anthropic: the AI provider that generates the "AI Coach" answers (USA); only the information listed above and your messages are passed on.
• Google Play / App Store: subscription payments are taken through the store; your card details never reach us.
• RevenueCat: gets your subscription status from the store and links it to your account (USA); your account ID and purchase records are passed on.
• Sentry: error reports when the app crashes (EU); your account ID, device model and the technical details of the error are passed on.
• PostHog: usage events to understand how the app is used (EU); your account ID and event names such as "journal entry added" or "paywall opened" are passed on. PostHog derives an approximate location (country, city) from the connection's IP address; your precise location is never collected.

Transfers abroad are made within the framework permitted by KVKK. There are no ads in the app. The content of your journal notes and your mood and craving entries is never sent to Sentry or PostHog.

Retention period

Your data is kept for as long as your account is open. When you delete your account, all your data on the server and on the device is permanently deleted.

Your rights (KVKK Art. 11)

By applying to the data controller, you can request to: learn whether your personal data is processed; request information about it if it has been processed; learn the purpose of processing and whether it is used in line with that purpose; know the third parties in Turkey or abroad to whom it has been transferred; request correction if it has been processed incompletely or incorrectly; request its deletion or destruction; request that correction/deletion be notified to the third parties it was transferred to; object to a result against you arising from the analysis of the processed data exclusively by automated systems; and request compensation if you suffer damage due to unlawful processing.

You can send your requests to destek@shimba.app.

Deletion and sign-out

• Delete your account: from Settings > Account details you can permanently delete your account and all associated data — both from the server and from this device.
• Sign out: when you sign out, your data on this device is deleted (after a final backup attempt). If you sign in with another account, the old data on the device is also deleted.

Changes

This text is updated as processes or the legal framework change. When there is an important change, you will be notified within the app.

Health indicators are general and at the population level; they are not medical advice. The sources are listed on the "Medical basis" page.