1. Who We Are

Zemberek ("Zemberek", "we") is a collection-management, watch-recognition / market-value research and invitation-only community app for watch collectors. This policy explains which personal data is processed while you use the app, why, who it is shared with, and your rights.

Data controller: Tolga Polat, Esentepe Mahallesi, Gökçedağ Sokak No:9 Daire:2, Kartal / İstanbul 34870. Contact: destek@zemberek.app

2. Data We Collect

Account

• Sign in with Apple: the unique user identifier Apple provides, your name and email address (or Apple's private relay address if you choose "Hide My Email"). We do not store passwords.

Your collection

• Watch details (brand, model, reference, price, notes, dates), watch photos, documents (warranty, invoice, etc.), "Today" wear records and wrist photos, value history. This data is stored on your device and on cloud servers linked to your account.

Scanning and search

• Scan counter and scan history (recognised brand/model), the search queries you type.

Community (if you are a member or have applied)

• Profile: username, display name, country, short bio, profile photo.
• Posts: photo, caption, brand/model and optional value; comments, likes, follows and saves, members you block, reports you file, notifications.

Membership application (only if you applied)

• The brand, model and serial number of the watch you apply with; four verification photos taken with the camera (watch/box/certificate/handwritten note together, certificate, wrist, box); optional short introduction, Instagram and referral; your explicit-consent record (date and text version).

Purchases

• Your Premium subscription status. Your payment details (card, etc.) are processed by Apple and never reach us. The subscription is validated by verifying Apple's signed receipt on our server. Apple also notifies our server of subscription events (renewal, cancellation, expiry, billing issue, refund); we keep the event type, product, expiry date and a record linked to your account.

Technical data

• App version, device model and iOS version, last seen and login count; whether an internet connection was available.
• Error logs: error code and message, time, your account identifier (e.g. an AI or search service failing, no internet, a search with no results).
• Crash reports and usage statistics (Firebase): may be linked to your account number; your email address and name are not sent to this service.
• Notification token: if you allow notifications, the notification token Apple issues to your device and the app language are stored on our server so we can send you push notifications. You can turn notifications off at any time in iOS Settings > Notifications > Zemberek.

We do not collect: advertising identifier (IDFA), precise location, contacts, microphone. We do not track you for advertising.

3. How We Use Data

• To create your account, provide your collection and sync it across devices (performance of the contract).
• To perform watch recognition and market-value research; to apply your usage entitlement and fair-use limits.
• To operate the community: review membership applications, display posts, handle reports and abuse (legitimate interest; explicit consent for application photos).
• To verify and provide your Premium subscription.
• If you allow it, to send you notifications: the result of your membership application and community interactions (likes, comments, follows, mentions). Notifications contain no advertising.
• To detect errors, keep the app stable and secure, and prevent fraud (legitimate interest).
• To comply with legal obligations.

We do not sell your data or use it for advertising.

4. Service Providers and Third Parties

We use the following providers to run the app. Each receives only the data needed for the relevant operation:

• Apple: Sign in with Apple, subscription (StoreKit) validation and subscription event notifications (App Store Server Notifications), and delivery of push notifications to your device (Apple Push Notification service). The notification text and token pass through Apple for this delivery.
• Supabase: authentication, database, file storage and server functions (our cloud infrastructure). Servers are on AWS Frankfurt (eu-central-1), Germany — hosted within the European Union.
• Anthropic (Claude): when you use watch scanning, the photo you take is sent to Anthropic's AI service to identify the watch; we do not store it for that purpose.
• SerpAPI: for text search and market-value research, your search text (e.g. brand/model) is sent to this service.
• Exchange-rate service: called to get rates; contains no personal data.
• Google Firebase: crash reports and usage statistics (may be linked to your account number; email and name are not sent).

Your data is hosted in Germany (EU); some providers (e.g. AI, search and analytics/crash services) may be located outside Türkiye and the EU, e.g. in the US. Your data may therefore be transferred abroad; we make such transfers with the safeguards required by KVKK and applicable law and send these services only the data needed for the operation. Your collection and photos are not sent to AI / search services for permanent storage.

We do not share your data with other third parties unless legally required (e.g. a court order).

5. Community: What Others Can See

• Approved members can see your username, display name, country, bio, profile photo and posts.
• Who you follow and who follows you (the followers / following lists) is visible to approved members. Members who blocked you or whom you blocked do not appear in each other's lists.
• A post always shows the watch's brand and model; you can hide the value.
• Your email address, Apple identifier, serial number, application photos and error records are never shown to other members.
• Only the authorised reviewer sees your application photos and serial number (via time-limited links, in private storage).
• You can report content that breaks the Community Rules and block members. Reports are reviewed by us; content may be removed and accounts suspended.

6. Retention

• Account and collection data: until you delete your account.
• Membership application photos and serial-number text: permanently deleted 30 days after approval, 14 days after rejection or withdrawal (photos are deleted immediately on withdrawal), and at most 60 days if undecided. To prevent fake/duplicate applications we keep an irreversible hash of the serial number, the decision and its date.
• Error logs: at most 12 months for diagnostics; your records are deleted when you delete your account.
• Subscription event records: at most 12 months; when you delete your account the record is detached from your account and becomes anonymous.
• Free scan allowance safeguard: to prevent the free scan allowance from being reset by deleting and re-creating an account, when you delete your account only your scan count for the current month is kept under an irreversibly encrypted (salted hash) key; it contains no name, email or other personal data and is deleted automatically at the end of the month.
• Notification token: until you sign out or delete your account; device records not seen for 180 days and tokens Apple reports as invalid are deleted automatically. Records in the sending queue are kept for at most 14 days.
• Community content: until you delete it or your account is deleted.
• Data subject to a legal retention obligation is kept for that period.

7. Security

• Data is encrypted in transit (TLS) and at rest (disk-level encryption); per-user access rules (Row Level Security) are enforced in the database.
• Sensitive files such as application photos are kept in private, non-public storage and viewed only by the authorised reviewer through short-lived links.
• The app offers an optional Face ID / Touch ID lock.

No system is absolutely secure; in case of a breach we notify as required by applicable law.

8. Children

Community features are for ages 18 and over. We do not knowingly collect personal data from children under 13. If you believe we have, write to destek@zemberek.app and we will delete it.

9. Your Rights

Under Article 11 of Turkish Law No. 6698 (KVKK) (and GDPR where applicable) you have the right to:

• learn whether your data is processed and request information,
• request correction or deletion,
• object to processing and withdraw your explicit consent,
• learn the third parties your data is transferred to,
• lodge a complaint with the supervisory authority.

Write to destek@zemberek.app; after verifying your identity we reply within 30 days at the latest.

10. Deleting Your Account and Data

You can delete your account at any time via Profile > Account > Delete Account. Deletion permanently removes your collection, photos and documents, community profile and content (including your follow relationships), membership application photos, error records and login records, and cannot be undone. Subscription event records are detached from your account and become anonymous. Your Sign in with Apple link is also removed. If you only withdraw your membership application, the photos you uploaded are deleted immediately.

11. Changes

We may update this policy. Significant changes are announced in the app; the date of the current version appears at the top of this page.

12. Contact

For any privacy or personal-data question, request or complaint: destek@zemberek.app