Privacy Policy

1. Data we collect

• Account information: email address, name, and a secure (bcrypt) hash of your password. If you sign in with Google we also receive the URL of your profile picture; if you sign in with Apple we receive your email (which may be Apple's private relay address) and, on first sign-in, your name.
• Child profile: your child's name, age, date of birth, siblings, interests, real fears, family values, cultural tone, Turkish-language support needs, and the hero you choose (name and type). This is used to personalize the stories.
• Parent note: when creating a story you may optionally write a short note (for example, what your child experienced that day). It is used to shape that night's story.
• Generated content: the story texts and the narration files (MP3) the app produces.
• Story bible: a record of your child's story world (hero, characters, places, ongoing adventures) so each night builds on the last.
• Usage and quota data: how many stories and narrations you have generated, which voice you prefer, which platform (iOS or Android) you use.
• In-app events: basic usage events such as opening the app, opening a story, starting audio playback, or viewing the purchase screen. We keep these on our own server to improve the product and delete them after 90 days.
• Subscription and payment data: which plan you bought, its start and end date, the amount paid, currency, store (App Store or Google Play), and country code. We never see or store your card details. Payment is handled entirely by Apple or Google.
• Device and notification data: a device identifier generated by the app (to prevent abuse) and, if you allow notifications, a push token.
• Advertising identifier: only if you give permission. See section 4.
• Feedback and communication: feedback messages you send from within the app, and the reason you give when deleting your account.

What we do not collect: your location, contacts, browsing history, photos, or microphone. Your IP address is held only temporarily in memory for rate limiting and is never written to the database.

2. Why we use your data

• To create your account and let you sign in.
• To generate stories personalized for your child (their name, interests, and values are woven into the story).
• To narrate the story and store the audio so you can play it again.
• To make each night's story connect to the previous one.
• To manage your subscription and generation quota (abuse prevention).
• To find and fix errors, and to improve the product by seeing which features actually help.
• To send you service emails (password reset, verification code, monthly progress summary, subscription notices).
• Advertising measurement: to measure whether the ads we run to promote the app actually work. Only with your permission (section 4).

What we never do: We do not sell your data. We do not use your child's profile, stories, or fears for ad targeting, and we do not send them to ad networks. We do not show ads inside the app.

3. Third-party services

We rely on outside providers to run Masalevi. Each receives only the data it needs to do its job, all of them work under a data-processing agreement, and none of them may use your data for their own purposes. Below is what is sent, and why:

• AI text provider: generates the story text. Your child's name, age, interests, fears, family values, story bible, and your parent note (if any) are sent to the model.
• Narration providers: turn the story into audio. A different provider is used depending on the voice you pick; each receives the story text (which contains your child's name).
• Email delivery service: delivers the emails we send you. The content of the email passes through it; the monthly progress email contains your child's name and a short summary of their story journey.
• Subscription management service: tracks which plan you bought and whether your subscription is still active. Your user ID is sent.
• Apple and Google: process payments (App Store and Google Play billing) and verify your identity via Sign in with Apple and Sign in with Google.
• Meta (Facebook): advertising measurement. Only with your permission, and only event names (for example: you registered, you subscribed) together with your advertising identifier. Your child's information and story texts are NOT sent to Meta. See section 4.
• Error reporting service: tells us why the mobile app crashed. It is configured not to send personal data; what is sent is the error message, stack trace, device model, and OS version.
• App delivery and notification service: distributes app updates and relays push notifications (push token).
• Hosting and backup providers: run our server and database; the nightly database backup is stored with a separate provider over an encrypted connection (section 5).
• Messaging service: feedback you send from the app and the reason you give when deleting your account are relayed to our team's private channel so they reach us immediately. No child profile or story text is sent there.

International transfers: some of these providers are located outside Türkiye (primarily in the United States and the European Union), so your data is processed abroad to the extent the service requires it.

We do not give your data to anyone outside these providers, and we never sell it.

If you want to know exactly which providers we work with, you can ask for the current list at any time at support@masalevi.app and we will share it.

4. Advertising measurement and your permission

There are no ads inside Masalevi. However, we do run ads on other platforms (such as Instagram and Facebook) to promote the app, and we need to measure whether those ads actually work. For this, the mobile app includes Meta App Events.

• What is sent: only event names and the purchase amount. For example "registration completed", "first story created", "paywall viewed", "subscribed".
• What is NOT sent: your child's name, age, fears, profile, story texts, or audio. None of this is ever sent to any advertising service.
• Advertising identifier and consent: on iPhone you are asked for tracking permission when the app opens. If you decline, your advertising identifier (IDFA) is not shared with Meta. You can withdraw this permission at any time under iOS Settings → Privacy & Security → Tracking. On Android you can reset or delete your advertising ID under Settings → Google → Ads.

5. Storage, backups, and security

Data is stored in an access-restricted database on a persistent disk at our hosting provider; audio files are written to the same disk. Passwords are stored as irreversible (bcrypt) hashes, never in plain text. All connections use HTTPS. Only the administrator has access to the data; users can only see their own.

Backups: to protect against data loss, a full copy of the database is taken every night and stored with a separate backup provider over an encrypted connection. This copy includes account details, child profiles, and story texts; audio files are not backed up. When you delete your account, your data is removed from the live database immediately, and older backup copies expire on rotation.

6. Story links you share

When you share a story, we generate a long, unguessable random link for it. Anyone who has that link can read the story without signing in, and the story text contains your child's name. The link is hidden from search engines, but once you have shared it (for example, into a chat group) there is no way to take it back. The link stays valid until you delete your account. Please keep this in mind when sharing a text that contains your child's name.

7. Note about children

The person who opens the account is the parent or the adult responsible for the child. The parent enters the child's information, and it is used solely to personalize that child's stories. The app does not target children directly, does not collect data directly from children, and never uses children's data for advertising; children's data is tied to the parent's account.

8. Retention and deletion

We keep your data for as long as your account exists. In the app you can permanently delete your account, all child profiles, all stories, and all audio via Settings → Delete my account. This cannot be undone.

What remains after deletion: to prevent the free trial from being claimed over and over, a record of the trial granted to your device (a device identifier and the number of grants) is kept after account deletion. That record contains no name, email, child information, or stories. Payment records may also be retained where required by law and accounting obligations.

9. Your rights

Under GDPR and Turkish data protection law (KVKK), you always have the following rights:

• Access: to know what data is held in your account.
• Rectification: to correct inaccurate information.
• Erasure: to delete your account and data (section 8).
• Portability: we will send you what is stored in your account on request.
• Objection and withdrawal of consent: you can withdraw advertising-measurement consent (section 4), notifications, and website analytics at any time.

To exercise these rights, write to support@masalevi.app and we respond within 30 days at the latest.

10. Website cookies and analytics

On our marketing website (masalevi.app) we use Google Analytics 4 to see, in aggregate and anonymized form, how many people visit, which countries they come from, and how the pages are used.

• Analytics cookies are loaded only if you choose "Accept" in the cookie banner shown on your first visit (Google Consent Mode v2). If you choose "Decline", no analytics cookie is written.
• We show no ads on the site, and site analytics are not used for ad targeting.
• Google's privacy policy: policies.google.com/privacy

The mobile app uses no cookies. Measurement and error reporting in the mobile app are described in sections 3 and 4.

11. Policy updates

If this policy changes in a significant way, we will notify you at your registered email address and update the "Last updated" date on this page.

12. Contact

For any question, request, or privacy concern: support@masalevi.app