Privacy Policy
Your privacy is fundamental to Blisswell. This policy explains what information the Calm Anxiety: Blisswell app ("the app", "we", "us") processes, how we use it, who we share it with, and the rights you have over it. Because anxiety is a personal subject, we designed the app to process as little data as possible.
1. Who we are
The app is operated by GMY Bilişim Sanayi ve Ticaret Ltd. Şti., the data controller for the purposes of applicable data protection law, including the EU General Data Protection Regulation (GDPR) and Turkey’s Personal Data Protection Law No. 6698 (KVKK).
For any privacy question or request, contact us at support@blisswell.app.
2. Information we process
a. Account information
When you create an account we process your email address and the account ID (uid) issued by Firebase Authentication. Your password is stored one-way encrypted by Firebase; we cannot see it.
b. Subscription and payment information
We process your subscription status, plan (monthly/yearly), period dates and the payment provider’s subscription reference. Payments made on the web are processed by iyzico; your card details never reach us and are not stored by us. For store purchases, Apple or Google processes the payment details; to verify subscription status, RevenueCat processes a randomly generated user ID (never your email address) and purchase records (product, dates, subscription status). Before you sign in, that ID is a random value created on your device; once you sign in, it becomes your account’s random ID and your purchases are linked to your account.
c. Emails
To send service emails such as the welcome email, a password-reset link and a cancellation confirmation, your email address is processed through Resend. We do not send marketing email.
d. Technical data
To host and secure the website and web app, Cloudflare processes IP addresses, browser information and request logs. Depending on your cookie consent, site usage and payment events are measured; see the Cookie Policy.
e. App updates
When the mobile app opens it contacts the update service (Expo / EAS Update); to deliver updates, this connection processes a random identifier specific to this installation of the app, your IP address, and the app version and platform. This identifier is not your device’s hardware or advertising ID, and nothing you write is sent.
3. Data that stays only on your device
The steps you complete, the answers you give, your assessment answers, your plan and check-in results, your journal and mood entries, your personal maps, your Calm Now records and your preferences are stored only on your device. They may relate to your health; they are not sent to our servers, so we do not process or see them.
This data does not sync between devices. You can export it in the app before changing devices. If you use iCloud or a device backup, your device backup may include this data; it is held by the relevant platform (for example under your Apple Account), not by us.
4. How we use information
- To create your account and authenticate you
- To set up and manage your subscription and unlock premium content
- To send service emails (welcome, password reset, cancellation confirmation)
- To keep the service secure, prevent abuse and fix problems
- To comply with legal obligations (tax, commercial and consumer law)
We do not use your data for third-party advertising and we do not sell it.
5. Legal bases
- Contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)): account, subscription and payment processes
- Legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)): invoice and accounting records
- Legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)): security, preventing abuse and delivering app updates
- Explicit consent (KVKK Art. 5/1 and 6/2; GDPR Art. 9(2)(a)): health-related records you keep on your device, and measurement that depends on cookie consent
6. Who we share data with
We share data only with service providers that operate the app on our behalf, under confidentiality and data-protection obligations and only as far as needed:
| Provider | Purpose |
|---|---|
| Google Firebase | Authentication and storage of account and subscription status |
| iyzico | Processing of payments and subscriptions made on the web (Türkiye) |
| Apple / Google Play | App distribution and payments made through the stores |
| RevenueCat | Subscription management and entitlement verification (random user ID, linked to your account once you sign in) |
| Expo (EAS Update) | Delivering app updates (random installation identifier, IP address, app version and platform) |
| Resend | Sending service emails |
| Cloudflare | Hosting, security and network infrastructure |
We may disclose information to the authorities if required by law, or to protect the rights and safety of our users or the public.
7. International transfers
Our providers may process data outside Türkiye and outside your own country, mainly in the United States and in European Union/European Economic Area countries (Google, Apple, RevenueCat, Expo, Resend, Cloudflare). Transfers rely on KVKK Art. 9 and GDPR Chapter V mechanisms, such as standard contractual clauses, and on the necessary safeguards.
8. Retention
- Account and subscription data: while your account is active and for up to 30 days after it is deleted
- Invoice and accounting records: 10 years, as required by law
- Security logs: up to 2 years
- Records on your device: on your device until you delete them or remove the app
When the period ends the data is deleted, destroyed or anonymised.
9. Security
We use industry-standard measures such as encryption in transit and access controls. No method of transmission or storage is completely secure, but we work continuously to protect your data.
10. Your rights
Under KVKK Art. 11 and the GDPR you have the right to access, correct, delete, restrict or object to the processing of your data, to data portability and, where processing is based on consent, to withdraw consent. Send requests to support@blisswell.app; requests are concluded within 30 days at the latest. You can export or delete the records on your device inside the app.
If your request is rejected or not answered in time, you have the right to lodge a complaint with the Turkish Personal Data Protection Board (or your local data-protection authority). For deletion steps see the delete-account page.
11. Children
Calm Anxiety: Blisswell is for adults aged 18 and over and is not directed to anyone under 18. If you believe a minor has given us data, contact us and we will delete it.
12. Changes to this policy
We may update this policy from time to time. Material changes are shown by updating the “Last updated” date above and, where appropriate, through an in-app notice.
13. Contact
GMY Bilişim Sanayi ve Ticaret Ltd. Şti.
Email: support@blisswell.app