Zinde

Privacy Policy

Gizlilik Politikası

Effective Date: June 6, 2026
Last Updated: August 2, 2026

1. Who We Are

Zinde is a social fitness and sport application ("App") operated by Ege Kırtık ("we", "us", or "our"), an individual developer established in the Republic of Türkiye.

If you have questions about this Privacy Policy or about how we handle your personal data, please contact us:

  • Privacy inquiries: krtk.eg3@gmail.com
  • Data protection contact: krtk.eg3@gmail.com
  • Postal address: available upon written request via the contact e-mail above

This Privacy Policy applies to the Zinde iOS application and the backend services that support it (collectively, the "Service"). It does not apply to third-party websites or services that may be linked from within the App.

2. Data We Collect

We collect personal data in the following categories. All collection is linked to your account unless explicitly stated otherwise.

2.1 Account and Profile Data

When you create an account or update your profile, we collect:

  • Name and display name (required for account creation)
  • Email address (required; used for authentication, account recovery, and service communications)
  • User identifier (a UUID generated at account creation; used as your persistent identifier across all Services)
  • Username (chosen by you; must be 3–30 characters, lowercase alphanumeric plus underscores)
  • Profile biography (optional, free text)
  • Profile photo (optional; stored in our user-avatars storage bucket)
  • Sport disciplines and skill preferences (optional)
  • Role (user, brand manager, venue partner, organiser, moderator, or admin — assigned by the Service)

2.2 Fitness and Health Data

When you use workout planning or session tracking features, we access and store:

  • Workout history sourced from Apple HealthKit — workout type, duration, start/end time, calorie data, and heart rate data where available. HealthKit data is read solely to verify workout proof submitted to the Pulse feed and to populate your plan performance metrics. We do not share HealthKit data with third parties.
  • Body metrics (weight, height) if you choose to enter them for training plan personalisation.
  • Plan and session records — workout plans you create, individual session logs, stage completion events, and exercise metrics. These are stored in our Supabase database under tables plans, plan_sessions, and plan_metrics.

2.3 Usage Data

We collect data about how you use the Service:

  • Product interaction data — which features you use, screens you visit, buttons you tap, and the frequency of those actions. This is used to improve the App and understand feature adoption. This data is processed by PostHog (see Section 4.6) and is linked to your account identifier.
  • Performance and diagnostic data — app performance metrics (launch time, navigation timing), crash reports, and MetricKit diagnostics. This data is linked to your account. MetricKit payloads are stored against your user identifier in our metric_payloads table, and crash reports captured by PostHog are attributed to your identified profile. It is used solely to maintain and improve App stability, and is never used for advertising or tracking.
  • Coarse location — your approximate area, not a persistent record of your movements. When you open the Lounge radar, your device's approximate coordinates (requested at reduced, ~100-metre accuracy) are sent with the query so the server can rank nearby venues, lounge rooms, and tournaments by distance. The coordinates are used only to answer that request; they are not stored against your account and are not retained after the query is served.

2.4 User-Generated Content and Media

When you post to the Pulse social feed, participate in Lounge rooms, or upload tournament content, we collect and store:

  • Pulse posts — text, photos, and videos you submit as workout proof or social updates, stored in the proof-media and story-media storage buckets.
  • Comments and reactions — text responses and respect (like) signals.
  • Lounge room messages — text messages sent in group rooms, stored in lounge_room_chat.
  • Tournament chat messages — text messages sent in Arena tournament channels, stored in arena_chat_messages.
  • Direct messages — private 1-to-1 text conversations, stored in direct_messages and conversations.
  • Audio data — if you record audio as part of media uploads.
  • Arena highlights — tournament-related media stored in the arena-highlights bucket.
  • Room assets — photos or media shared in Lounge rooms, stored in room-assets.
  • Message attachments — files shared in direct messages, stored in msg-attachments.

Before any user-generated text content (Pulse posts, comments, Lounge messages, direct messages) is stored, it is passed through a content moderation check. See Section 4 (Third-Party Processors) for details on how this works.

2.5 Game Account Data (Optional)

If you choose to link your Riot Games account (League of Legends / Valorant) to your profile:

  • Riot ID (game name and tag line, e.g. PlayerName#EUW)
  • PUUID (Riot's persistent account identifier)
  • Ranked statistics — your ranked tier, division, LP, wins, and losses
  • Champion mastery — your top champion mastery scores
  • Summoner data — summoner level and profile icon ID

This data is fetched from the Riot Games API via our server-side proxy (riot-proxy edge function) and stored in your profile. Linking a Riot account is entirely optional.

2.6 Purchase History and Subscription Data

When you subscribe to Zinde Pro or make in-app purchases:

  • Apple transaction identifiers (transactionId, originalTransactionId) — verified server-side via Apple's App Store Server API to confirm entitlement.
  • Subscription status — tier (free/pro), plan ID (monthly/annual), expiry date, renewal status, and Apple environment (Sandbox/Production).
  • Promo code redemptions — if you use a promotional discount code, the redemption event and associated discount details are recorded.

All payment processing is handled by Apple. We do not receive or store credit card numbers or payment method details. Transaction identifiers received from Apple are used solely to verify and manage your subscription entitlement.

2.7 Device and Push Notification Data

  • APNs device token — your device's Apple Push Notification service token, stored to deliver push notifications to your device. Stored in the push_tokens table along with your device model, locale, timezone, app version, and environment (production/sandbox). Because this token is a device-level identifier held against your account, it is disclosed as a "Device ID" on our App Store privacy label.
  • Device model — used to tailor notification content and diagnose platform-specific issues.

2.8 B2B Portal Data (Brand and Venue Partners)

If you use the App as a brand manager or venue partner:

  • Brand profile data — brand name, description, logo, category, and contact information, stored in arena_brands and related tables and the brand-media storage bucket.
  • Venue data — venue name, postal address, contact e-mail and contact phone number, geographic coordinates of the venue, court details, operating hours, pricing, and booking records, stored in venues, venue_courts, venue_bookings, and related tables; venue photos in the venue-media bucket.
  • Identity and business verification documents — to verify a venue, club, or brand application we ask the applicant to upload supporting documents. Depending on the application type these may include a national identity document, tax certificate and tax number, business licence, trade registry gazette, signature circular, sports facility certificate, or association registry extract. Documents are stored in the partner-documents bucket and are accessible only through short-lived (10-minute) signed URLs, to the applicant and to our review staff. They are used exclusively to verify the legitimacy of a partner application and are never used for advertising, profiling, or any other purpose.

These fields are collected only from users who apply for a brand or venue partner role. If you use Zinde as an ordinary athlete, none of the data in this section is collected from you.

2.9 Device Battery Status

The App may read your device's battery level, charging state, and Low Power Mode status in order to adapt its own behaviour — for example to reduce the update frequency of a Live Activity, simplify 3D avatar rendering, or warn you before a long workout session that your battery is low.

Battery status is read on your device and is used to make on-device decisions. We do not store battery readings in our database and we do not share them with any third party. If a battery reading is ever included in an aggregate performance or crash diagnostic, it is handled under the diagnostic-data rules in Section 2.3 and the retention period in Section 5, and it is never used for advertising, profiling, or tracking. Reading battery status does not require any iOS permission prompt.

3. How and Why We Use Your Data (Legal Bases under GDPR Article 6)

Purpose Data Used Legal Basis (GDPR Art. 6)
Account creation and authentication Name, email, user ID Contract (Art. 6(1)(b)) — necessary to provide the Service
Delivering core app features (workout plans, social feed, tournaments, lounge rooms) Profile data, fitness data, UGC, location Contract (Art. 6(1)(b))
Subscription management and Pro entitlement verification Purchase history, transaction IDs Contract (Art. 6(1)(b))
Sending push notifications you request APNs device token, device model Contract (Art. 6(1)(b)) — you initiate push permission
Verifying brand, club, and venue partner applications Business contact details, postal address, identity and business verification documents Contract (Art. 6(1)(b)) and Legitimate Interests (Art. 6(1)(f)) — preventing fraudulent partner listings
Content moderation (preventing harassment, illegal content) UGC text content Legitimate Interests (Art. 6(1)(f)) — maintaining a safe community; required by App Store Guidelines
Riot Games profile linking (optional) Riot ID, game statistics Consent (Art. 6(1)(a)) — you explicitly connect your account
App stability, performance monitoring, crash reporting Crash data, performance data, diagnostics Legitimate Interests (Art. 6(1)(f)) — maintaining and improving App quality
Adapting app behaviour to device conditions Battery level, charging state, Low Power Mode Legitimate Interests (Art. 6(1)(f)) — preserving battery and delivering a usable experience
Product analytics (feature usage, adoption) Product interaction data Legitimate Interests (Art. 6(1)(f)) — improving the Service
Compliance with legal obligations (GDPR Art. 17 erasure audit, App Store Guidelines 5.1.1(v)) Deletion audit log (hashed email only) Legal Obligation (Art. 6(1)(c))
Responding to user data export requests under GDPR Art. 15 All personal data Legal Obligation (Art. 6(1)(c))

We do not use your data for automated decision-making that produces legal or similarly significant effects without human review.

4. Third-Party Processors

We share personal data with the following third-party processors. All processors are engaged under data processing agreements or equivalent legal instruments.

4.1 Supabase (Database and Backend Hosting)

What is shared: All personal data described in Section 2 is stored on infrastructure operated by Supabase, Inc. This includes your account data, social graph, fitness records, UGC, messages, push tokens, subscription records, and all media files stored in Supabase Storage.

Purpose: Database hosting (PostgreSQL), file storage, authentication (GoTrue), and real-time data synchronisation.

Location: AWS eu-central-1 (Frankfurt, Germany) — inside the European Economic Area.

DPA / Privacy documentation: https://supabase.com/privacy

4.2 Apple Inc.

What is shared: Apple processes subscription transactions via StoreKit 2 and the App Store Server API. We receive cryptographically signed transaction payloads (JWS) from Apple and verify them using Apple's certificate chain. We also send your APNs device token to Apple's push notification infrastructure to deliver notifications.

Purpose: In-app purchases, subscription lifecycle management, Apple Sign-In authentication, and push notification delivery.

Privacy documentation: https://www.apple.com/legal/privacy/

4.3 Google LLC

What is shared: If you sign in using Google Sign-In, your Google account email address and OAuth tokens are processed by Google. We receive only a verified email address and user identifier from Google; we do not receive your Google profile photo or contacts.

Purpose: OAuth authentication (Google Sign-In).

Privacy documentation: https://policies.google.com/privacy

4.4 Riot Games, Inc.

What is shared: If you optionally link a Riot Games account, we send your Riot ID (game name and tag line) or PUUID to the Riot Games API (tr1.api.riotgames.com and europe.api.riotgames.com) via our server-side proxy. This request is made on your behalf and is rate-limited to 60 requests per 5-minute window per user.

Purpose: Fetching your League of Legends / Valorant ranked statistics and champion mastery to display on your profile.

Note: Riot account linking is entirely optional. If you do not link an account, no data is sent to Riot.

Privacy documentation: https://www.riotgames.com/en/privacy-notice

4.5 OpenAI (Content Moderation)

What is shared: When you submit user-generated text content (Pulse posts, Pulse comments, Lounge room messages, or direct messages), that text content is sent to the OpenAI Moderation API (api.openai.com/v1/moderations) for classification. The text is submitted without any identifier linking it to your account; OpenAI receives only the raw text string and returns a moderation decision.

Purpose: Proactive content moderation — detecting and blocking content that violates our Community Guidelines (hate speech, harassment, solicitation of harm) before it is stored or displayed to other users.

Note: OpenAI moderation is only active when a MODERATION_OPENAI_API_KEY is configured in our server environment. Our content moderation system first applies a local keyword filter; OpenAI is invoked as a second pass for nuanced classification. If OpenAI is unavailable, content receives a soft_warn decision (held for human review) rather than being automatically approved.

Privacy documentation: https://openai.com/policies/privacy-policy

OpenAI API data usage policy: https://openai.com/policies/api-data-usage-policies

4.6 PostHog (Product Analytics and Error Tracking)

What is shared: Product interaction events (screen views, application lifecycle events such as app open and backgrounding, and specific in-app actions), unhandled crash and error reports, your Zinde user identifier, your account role, and whether your e-mail address is verified. Events also carry technical context generated by the PostHog SDK, including an anonymous device-level identifier, app version, and build environment.

Purpose: Understanding which features are used and how, measuring retention, and detecting and diagnosing crashes so we can fix them.

Location: PostHog US Cloud (us.i.posthog.com), United States.

What is explicitly NOT shared: We do not send PostHog your name, e-mail address, profile photo, message contents, post contents, HealthKit or fitness data, body metrics, location, or verification documents. Session replay is disabled and no advertising identifier (IDFA) is ever collected or transmitted.

Note: Because PostHog events are keyed to your Zinde user identifier, this analytics data is linked to your account. If you wish to object to product analytics on legitimate-interest grounds (GDPR Art. 21), contact krtk.eg3@gmail.com and we will exclude your identifier from analytics processing.

Privacy documentation: https://posthog.com/privacy

5. Data Retention

We retain personal data for as long as necessary to provide the Service and fulfil the purposes described in this Policy.

Data Category Retention Period
Account profile (name, email, username, bio) Until account deletion, then purged within 30 days
Fitness data (plans, sessions, metrics) Until account deletion, then purged within 30 days
Pulse posts and comments Until deleted by user or account deletion, then purged within 30 days
Direct messages, Lounge messages, and tournament chat Until account deletion, then purged within 30 days
Media files (avatars, proof media, story media, highlights) Until account deletion, then purged from storage within 30 days
Push tokens Rotated automatically by the OS; removed on account deletion
Subscription records (transaction IDs, entitlement history) 7 years (financial/tax record requirement)
Identity and business verification documents Until the partner relationship ends or the application is withdrawn, then purged within 30 days; rejected applications purged within 30 days of the decision
Account deletion audit log Indefinitely (compliance — contains only hashed email, not plaintext; no content)
Crash and performance diagnostics 90 days
Product analytics events (PostHog) 12 months
Coarse location coordinates Not retained — used only to answer the proximity query that carried them
Device battery status Not retained — read on device only
Content moderation decisions 12 months

When you delete your account, we initiate a cascaded purge of your personal data from all active tables and storage buckets. An immutable audit record containing only a SHA-256 hash of your email address and the deletion timestamp is retained for legal compliance purposes; this record contains no personal content.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data.

6.1 Rights Under GDPR (EEA / UK Residents)

  • Right of access (Art. 15): You may request a copy of all personal data we hold about you.
  • Right to rectification (Art. 16): You may correct inaccurate or incomplete personal data via your Profile settings.
  • Right to erasure (Art. 17): You may permanently delete your account and all associated data.
  • Right to restriction of processing (Art. 18): You may request that we restrict processing of your data in certain circumstances.
  • Right to data portability (Art. 20): You may request your data in a machine-readable format.
  • Right to object (Art. 21): You may object to processing based on legitimate interests. To object to product analytics, contact us at krtk.eg3@gmail.com.
  • Right to withdraw consent (Art. 7(3)): Where processing is based on consent (e.g. Riot account linking), you may withdraw consent at any time.
  • Right to lodge a complaint: You have the right to lodge a complaint with your local supervisory authority (e.g. the Information Commissioner's Office in the UK, or your national data protection authority in the EU).

6.2 Rights Under CCPA (California Residents)

  • Right to know: You may request disclosure of the categories and specific pieces of personal information we collect, the purposes for collection, and the third parties with whom we share it.
  • Right to delete: You may request deletion of personal information we have collected from you.
  • Right to correct: You may request correction of inaccurate personal information.
  • Right to opt out of sale or sharing: We do not sell your personal information and do not share it for cross-context behavioural advertising. There is nothing to opt out of under this right.
  • Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.

6.3 Rights Under KVKK (Türkiye)

If you are located in Türkiye, you have rights under the Personal Data Protection Law No. 6698 ("KVKK"), Article 11, which closely parallel the GDPR rights above — including the right to learn whether your personal data is processed, to request information about that processing, to request correction or deletion, and to object to results produced exclusively by automated analysis. You may exercise these rights via the in-app tools described below or by contacting krtk.eg3@gmail.com.

6.4 How to Exercise Your Rights In-App

Export your data: Open the App → Profile → Settings (Control Center) → Data & Storage → Export My Data. This triggers a GDPR Art. 15 data export; you will receive a download link valid for 24 hours.

Delete your account: Open the App → Profile → Settings (Control Center) → Account → Delete Account. You will be asked to confirm. Upon confirmation, your account and all associated personal data are permanently and irreversibly deleted.

Update your profile data: Open the App → Profile → Edit Profile to update your name, bio, photo, and sport preferences.

Disconnect Riot account: Open the App → Profile → Game Connections → Disconnect.

Contact us directly: For requests that cannot be completed in-app, or for any privacy question, email krtk.eg3@gmail.com. We will respond within 30 days (GDPR) or 45 days (CCPA) of receipt of a verifiable request.

7. International Data Transfers

Our primary backend infrastructure is operated by Supabase and is hosted in AWS eu-central-1 (Frankfurt, Germany), inside the European Economic Area. Your account data, fitness records, messages, media files, and verification documents therefore remain within the EEA at rest.

Some of the processors listed in Section 4 are established outside the EEA and process a limited subset of your data in the United States. Specifically:

  • PostHog (Section 4.6) — product interaction and crash events keyed to your user identifier, processed in the United States.
  • Apple, Google, OpenAI, and Riot Games — processed in the United States and other jurisdictions, as described in their own privacy documentation linked above.

Where such transfers occur, we rely on:

  • Adequacy decisions issued by the European Commission, where applicable (including the EU–US Data Privacy Framework where the recipient is certified); or
  • Standard Contractual Clauses (SCCs) as adopted by the European Commission (implementing Decision (EU) 2021/914), incorporated into our data processing agreements.

You may request a copy of the relevant transfer mechanism by contacting krtk.eg3@gmail.com.

8. Children

Zinde is rated 12+ on the Apple App Store. The Service is not directed at children under the age of 13 (or under 16 in the EEA, where applicable). We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without verifiable parental consent, we will delete that data promptly. If you believe a child has provided us with personal data, please contact krtk.eg3@gmail.com.

9. Tracking and Advertising

We do not engage in cross-site or cross-app tracking. Our PrivacyInfo.xcprivacy manifest declares NSPrivacyTracking = false, and every data type on our App Store privacy label is declared as not used for tracking.

We do not request App Tracking Transparency (ATT) permission, and the App never accesses the advertising identifier (IDFA). The App contains no advertising SDK and no attribution SDK. We do not use your data for targeted advertising, we do not share data with advertising networks or data brokers, and we do not sell personal information as defined by the CCPA or any similar state law.

Our analytics processor (PostHog, Section 4.6) is configured as a first-party analytics tool: session replay is disabled, no advertising identifier is collected, and the data is not combined with data from other companies' apps or websites.

If we ever introduce advertising or attribution, we will update this Policy, request ATT permission, and update our App Store privacy label accordingly — before any such processing begins.

10. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

  • All data in transit is encrypted using TLS.
  • Data at rest in Supabase is encrypted at the storage layer.
  • Row-Level Security (RLS) policies on all database tables ensure each user can only access their own data (or data explicitly shared with them).
  • Verification documents are stored in a private bucket and are reachable only via signed URLs that expire after 10 minutes.
  • Authentication tokens are JWS-signed by Apple (for IAP) and verified against Apple's certificate chain before granting subscription entitlements.
  • Administrative RPCs require server-side role verification and are protected against privilege escalation.

No security system is impenetrable. If you discover a security vulnerability, please disclose it responsibly to krtk.eg3@gmail.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via an in-app notification and update the "Last Updated" date at the top of this document. Your continued use of the Service after the effective date of a revised Policy constitutes acceptance of that Policy. If you disagree with any change, you may delete your account at any time.

12. Contact Us

For any questions, requests, or concerns regarding this Privacy Policy:

  • Email: krtk.eg3@gmail.com
  • Data protection contact: krtk.eg3@gmail.com
  • Operator: Ege Kırtık, Republic of Türkiye

This document was last reviewed on August 2, 2026.