Privacy policy
This policy explains which personal data the DrawGuidance app, developed by KarApplication, and this website process, why, who we share it with, how long we keep it and what your rights are. It also serves as the privacy notice required by the Turkish Personal Data Protection Law No. 6698 (KVKK).
1. Data controller and contact
The data controller is the app's developer, KarApplication. For any privacy question or request: support and contact form or ahmetkar.1258@gmail.com.
2. Data we collect
The app's core features work without an account. By default your drawings, notes, 3D shapes, images and what the on-device AI learns stay only on your device.
| Data | When and from where |
|---|---|
| Account data: your Google account email address and whether it is verified, first name, last name, display name, profile photo link, Google/Firebase account ID, the Google account creation date; the birth date you enter; the time and version of your acceptance of the Terms of Use and the privacy notice. | When you sign in with Google and create an account (Firebase Authentication), and in account settings. |
| Synced content: drawings you sync with your account and related details (such as name and date), profile settings, and "Drawing Challenge" progress in kids mode. | When syncing while signed in. Drawings you do not sync are never sent to the server. |
| Purchase status: subscription plan (Free/Premium), status, start and end dates, Google Play order ID and purchase token. We never see your card or payment details. | When you buy Premium; the status is verified with Google Play Billing. |
| Advertising data: Google AdMob may process the advertising ID (Android advertising ID), IP address and device information to serve and measure ads. In the EEA and the UK, personalized ads are shown only with your consent. | On the Free plan, when ads are shown to accounts aged 13 or over. |
| Error reports: the error message and stack trace, the screen involved, app and Android versions, device model, app language, a random installation ID, the last few actions and an optional note you write; your account ID if you are signed in. | When the app catches an error or crashes, and when you use "Report a problem". By default you are asked every time; in Settings > Error reports you can choose "Send automatically" or "Don't send". |
| Feedback and support: your message and email address; for in-app feedback, device information (device model, Android version, app version, language). The forms on this website also store your browser information (User-Agent) and an irreversible hash of your IP address; the raw IP address is not stored. | When you send feedback from the app or use the support or deletion form on this website. |
This website uses no cookies, analytics or tracking scripts. The hosting provider (Vercel) may keep standard access logs for security and operations.
3. Purposes and legal bases
- Creating your account, verifying your identity, managing your session and syncing your data across devices (performance of a contract; KVKK 5/2-c, GDPR 6(1)(b)).
- Age-appropriate use: applying child protections based on birth date (legal obligation and legitimate interest).
- Verifying Premium subscriptions and granting their benefits; keeping purchase records as required by law (contract and legal obligation).
- Offering the Free plan with ads (legitimate interest; consent where required).
- Fixing errors and improving the app (reports you choose to send; legitimate interest).
- Answering support and deletion requests and preventing abuse (legitimate interest and legal obligation).
- Keeping consent records as evidence in possible disputes (establishment, exercise or defense of legal claims).
We do not sell your data or use it for any purpose other than those above.
4. Children and kids mode
- The app has a simple kids mode for children under 13.
- Children under 13 may use an account only with the permission and under the supervision of a parent or guardian.
- No ads are shown to accounts under 13 (based on birth date) or on kids canvases. Ad requests are sent to Google tagged as child-directed.
- We do not ask children for more data than the service needs.
- Parents or guardians can request deletion of their child's account on the account deletion page.
5. Third parties and transfers
- Google (Firebase Authentication, Sign in with Google): authentication.
- Google AdMob and Google's User Messaging Platform (UMP): ads and ad consent. Details: How Google uses information from sites or apps that use its services.
- Google Play Billing: subscription purchases and verification. Google processes the payment.
- The app's server: profile, synced content, subscription status, error reports and support records are stored in our own server's database.
- Vercel: hosting of this website.
- Slack: notifying the team about new support and deletion requests; only a partially masked email (e.g. a***@gmail.com) and the subject are sent.
- Requests from legally authorized public authorities are reserved.
These providers may operate servers outside your country; transfers are made in accordance with KVKK article 9 and applicable data protection law.
6. Retention
- Account data and synced content: while your account exists; deleted immediately when you delete the account.
- Error reports: those linked to your account are deleted with it; others are kept for up to 2 years.
- Purchase and subscription records: for the period required by tax and commercial law (up to 10 years); unlinked from you when the account is deleted.
- Google Play subscription notifications: 180 days.
- Support messages: 2 years. Deletion requests: 1 year, as proof that they were handled.
- Data on your device: stays on your device until you uninstall the app or clear its data.
7. Account and data deletion
You can delete your account in the app under Settings > Account settings > Delete account or on the account and data deletion page, which lists exactly what is deleted and what is kept. Deleting your account does not cancel a Google Play subscription; cancel it in Google Play > Payments & subscriptions.
8. Security
All traffic between the app and the server is encrypted with HTTPS. The server only accepts valid identity tokens signed by Google, and database access is limited to authorized people. The website forms do not store raw IP addresses and are rate-limited against abuse.
9. Your rights
Under KVKK article 11 and other applicable law (such as the GDPR) you have the right to:
- learn whether your personal data is processed and request information about it,
- learn the purpose of processing and whether it is used accordingly,
- know the third parties in your country or abroad to whom it is transferred,
- request correction of incomplete or inaccurate data,
- request erasure or destruction and notification of this to third parties who received the data,
- request a copy of your data and object to processing; withdraw consent where processing is based on consent,
- object to an outcome against you arising from analysis by automated systems,
- claim compensation for damage caused by unlawful processing,
- lodge a complaint with the Turkish Personal Data Protection Authority or your local data protection authority.
Send your requests via the support and contact form or ahmetkar.1258@gmail.com. Requests are answered free of charge within 30 days at the latest. You can reset or delete your advertising ID in Android settings.
10. Changes
We may update this policy. For significant changes we will inform you in the app and ask for your consent again where needed. The current version is always on this page.