KVKK disclosure — MotiveX

1. Data controller

Your personal data is processed by Mustafa Evleksiz ('MotiveX') as data controller within the scope described below.

2. Categories of personal data processed

MotiveX processes the following categories:

• Identity and contact: email, Apple/Google Sign-In identifiers, display name.
• Health and fitness (KVKK Art. 6 special category): HealthKit data including steps, active energy, distance, heart rate, sleep — processed on-device; aggregated metrics may sync to Firestore.
• Activity records: streaks, XP, mood entries, achievements.
• AI interactions: MotiveKoç chat messages and the minimal activity context sent to Gemini.
• Social: friends, duels, leaderboard position.
• Financial: subscription/purchase status (no card numbers — handled by Apple).
• Location: route traces stored locally on your device only; not uploaded.
• Diagnostics: crash and error logs.
• Local device data: preferences, route files, App Group storage.

3. Processing purposes

Your data is processed to:

• Provide the core service — tracking, gamification, AI coaching.
• Manage account, subscription and social features.
• Detect errors, ensure security, and improve performance.
• Fulfil legal obligations.

4. Legal bases (KVKK Art. 5 and 6)

Processing is based on:

• Art. 5/2-c: necessary for the establishment or performance of a contract (service delivery).
• Art. 5/2-ç: necessary for compliance with a legal obligation.
• Art. 5/2-f: legitimate interest (security, error detection, improvement).
• Art. 6/2 (explicit consent for special category): HealthKit health/fitness data processing — explicit consent is granted when you allow HealthKit permission in iOS. You can withdraw at any time via iOS Settings → Health → Data Access.

5. Special-category data notice

HealthKit data (steps, active energy, distance, heart rate, sleep) is sağlık/fitness verisi and qualifies as special-category data under KVKK Art. 6. MotiveX processes this data only for tracking, gamification and recovery scoring, and never uses it for advertising or AI model training.

6. Transfers (KVKK Art. 8 and 9)

Your data may be transferred to the following service providers, most located outside Turkey (including the United States). International transfers rely on your explicit consent and/or appropriate safeguards:

• Google Firebase — backend, auth, sync, app check, remote config — outside Turkey.
• Google Analytics for Firebase — usage analytics — outside Turkey.
• Google (Gemini API) — MotiveKoç AI responses — outside Turkey.
• Google Sign-In — authentication — outside Turkey.
• RevenueCat — subscription management — outside Turkey.
• Upstash (Redis) — metric cache — outside Turkey.
• Apple (Sign in with Apple, StoreKit, HealthKit) — auth, billing, health data — outside Turkey.

7. Collection method

Your personal data is collected electronically — via in-app forms, HealthKit permission grants, AI conversations, and automated event logs.

8. Data subject rights (KVKK Art. 11)

Under Art. 11 you have the right to learn whether your data is processed, request information, know its purpose and whether it is used in accordance with that purpose, learn the third parties it is shared with, request correction of incomplete or wrong data, request deletion or destruction when the conditions are met, request that these be notified to recipients, object to automated decisions, and seek compensation for damages.

9. How to apply

Two ways to exercise your rights:

• In-app: Settings → Data & Privacy / Danger Zone → Reset App → Delete All (account + cloud); Reset Local (device only).
• Email: mustafa@mustafaevleksiz.com — under the Communiqué on Application Procedures and Principles to the Data Controller.

10. Response time

Applications are answered within 30 days at the latest.