Last updated: 13 September 2026 · pre-publication draft
Data controller: Ayberk Kolcu (individual developer)
Contact / postal address
Kazimdirki mah 184 sok no 5 Bornova İzmir 35100
Poometry keeps your bowel journal on your device. You do not have to create an account. Poometry transmits journal content when you enable synchronization or export and share it. Operating-system backup limitations are explained below. During synchronization, journal content is encrypted on your device; encrypted blocks are sent to the server, but the decryption key is not. Account, subscription, optional community country counts and technical error reports are separate data flows described below.
We do not sell journal content or use it for advertising. If you choose to share a report, you choose its recipient.
| Data | Purpose | Location |
|---|---|---|
| Bowel entries (form, time, symptoms, notes) | App functionality | Encrypted on your device |
| App preferences (language, theme, lock) | Preserve your settings | Your device |
| Encryption keys | Open your data | Your device's secure storage (Keychain / Keystore) |
In the synchronization design, the key that opens journal content is not sent to our server. The server stores that content encrypted; account and transaction information is processed separately as explained below. Content you voluntarily include in a support request is outside this protection; do not send us health entries, photos or your recovery key.
Your local journal's primary protection is encryption using a key held in secure storage bound to your device. On iOS, the app asks the operating system to exclude its persistent stores from backups. Android configuration includes rules excluding app stores from cloud backups and device-to-device transfers.
These settings do not guarantee that data will never appear in any backup; they do not delete old iCloud or computer backups. When changing devices, do not rely only on an operating-system backup: without the local key on the new device, the journal cannot be opened. Files you export and optional encrypted synchronization are separate operations.
| Data | Purpose |
|---|---|
| Opaque account identifier | Pair your devices |
| Provider identifier (Apple / Google) | Enable sign-in |
| Email that may appear in the provider's sign-in proof | Associate it with the sign-in account |
| Encrypted data blocks | Transfer between devices |
| Entry identifier, update and deletion time | Determine the newer version |
| Session refresh records and single-use sign-in checks | Secure sign-in, session revocation and replay prevention |
Journal fields such as form, symptoms, pain, notes and color are inside the encrypted block. Technical information such as entry identifiers, sizes and synchronization times may be processed outside it. Encryption does not eliminate every risk, including compromise of your device or account.
Our sign-in method does not request name or email permission from Apple. If the provider's verified sign-in proof contains an email, the backend may store it in the account record; email is not used to automatically merge accounts from different sign-in methods. During Apple browser sign-in on Android, the short-lived sign-in record contains the Apple account identifier; the name, email and provider token are not written to that temporary record.
Community participation is off by default. You do not need to participate to keep a journal, create an account or use synchronization. A separate participation choice is available to signed-in users who have previously synchronized at least one entry. You select and confirm the country yourself; this feature does not use GPS, infer a country from your IP address or automatically assign a country from your device language or region.
If you participate, all your account's previously synchronized and future synchronized, non-deleted entries contribute to the public entry total for the country you select. This is not a count of people or independently verified physical events; synchronizing the same entry again does not count it twice. Participation does not itself enable synchronization or upload entries stored only on your device.
The server stores your country code, participation preference, version of the notice you accepted and server-recorded acceptance time linked to your account identifier. Technical version information prevents conflicting choices from different devices, and participation is bound to the current synchronization history. This information is not anonymous. Journal form, symptoms, notes and other content remain encrypted and are not decrypted for the community counter.
Public results contain only a country code and the total active entries contributing to that country. They do not expose account identifiers, a list of people, an individual's entry list, journal content or precise entry times. However, small country totals and changes of a single entry may allow someone with other information to infer participation or recording activity. We therefore do not promise absolute anonymity.
You can withdraw participation from the community screen. After the server successfully saves this change, your entries are excluded from the next count query; an offline or failed request is not a completed withdrawal. A synchronized entry is removed from the count when its deletion reaches the server; deleting it only on your device while the deletion has not yet synchronized does not immediately change the public total. Completed cloud account deletion also removes the account's participation record. Confirming a different country moves your account's current contribution to that country. We cannot retract totals that others have already viewed, saved or copied.
Withdrawal clears the country, accepted notice version and acceptance time in the active participation record; a technical version record may remain for conflict control. Backups may retain previous participation information under the backup and retention limits below. Managed restoration prevents old participation from being automatically reactivated; contributing again requires a new participation choice.
When you open subscription options, RevenueCat processes an opaque purchase identifier and store purchase history to verify Pro access. If you are not signed in, our server generates a random purchase identifier without creating a Poometry account or asking for a name or email. A billing-only credential is kept in your device’s secure storage; it does not grant access to journal records. If you are signed in, your Poometry account identifier is used. Its dashboard provides subscription verification and revenue statistics. Poometry does not send your journal entries, symptoms, notes, name or email to RevenueCat. The App Store or Google Play manages payment methods; Poometry does not ask for card details.
Account identifiers and purchase history are not anonymous data. Restoring purchases verifies access using the store account used for the original purchase; it does not require a Poometry account or start a new subscription. Signing out does not cancel a store subscription.
Poometry does not ask for a name, date of birth, gender, phone number, address or profile photo for your journal profile. It does not request location or contacts permission. The country you select and confirm for optional community participation is processed for the separate purpose explained above. Automatic device-identifier collection is disabled in the RevenueCat configuration; the app does not call advertising-identifier collection or advertising-attribution methods. This is not a claim that Apple/Google accounts or services receiving connections process no technical data of their own.
Poometry does not separately ask you to enter an email when creating an account. If you email support, your email address and request content are processed to provide support.
This version does not take or upload photos or perform image analysis.
Daily reminders are optional. If enabled, your chosen time and notification preference are stored on your device; its operating system schedules notifications. This feature does not send journal content to a remote notification server. Notification text does not contain your form, symptoms or notes. You can disable reminders in the app and manage notification permission in device settings. Your device settings control notification visibility on the lock screen.
We do not use behavioral or advertising analytics SDKs. RevenueCat subscription and revenue statistics are separate from this statement.
Technical error reports are optional and off by default. If you consent and the service is configured, sanitized JavaScript error reports are sent to Sentry. Disabling consent in Settings stops new reports.
Reports may contain a limited error type, line/column information within the app bundle, event time and identifier, app version/build, platform name and an allowed screen name. Journal content, free-form error messages, account identifiers, device models or identifiers, screenshots, touch history and session recordings are not sent. Native crash, performance and automatic session channels are disabled. Reporting does not start in development builds.
The app does not add an IP field to error reports; the service receiving an internet connection may see the IP address at the network level. Sanitizing app reports does not mean the provider's infrastructure processes no connection data.
API operational logs contain technical information such as request identifier/time, HTTP method, registered route template, status code and duration; health content, raw request bodies and authorization headers are not written to application logs.
To limit excessive requests, the server processes a pseudonymous counter key derived from the connection IP address using a secret key, a request count and a window end time. Raw IP addresses, sign-in tokens and journal content are not written to the counter table. The counter window is one minute; expired records are cleaned regularly in bounded batches. Cleanup interruptions may extend storage, and these records may be subject to database backup retention. This is not anonymization; its purpose is to prevent abuse and excessive load.
If you subscribe, Apple or Google collects payment, not us. You do not enter a card number or payment method in the app. RevenueCat processes purchase history and subscription transaction information; the backend stores current access status, expiration time and transaction identifiers used to prevent duplicate notifications. Not receiving your payment method does not mean purchase history is not processed.
You can cancel through your App Store or Google Play account; after cancellation, access continues until the end of the paid period.
There is none. Health data is not used for advertising, and no data is sent to third-party advertising networks.
When you share a summary or export file, you choose the destination. JSON/CSV, PDF or image files may leave your device; the receiving app processes them under its own terms. Poometry cannot delete a recipient's copy. Temporary sharing files created by the app are cleaned when sharing returns; after an interruption, cleanup is attempted again on the next launch.
Under Turkey's personal data protection law (KVKK), you have rights to learn whether your data is processed, its purposes and its recipients; to request correction of inaccurate information and deletion where the conditions apply. You can request notification of these actions to recipients, object to an adverse result arising solely from automated analysis, and seek compensation for damage caused by unlawful processing. The KVKK data subject rights page explains these rights. Use the contact methods below to submit requests; we may need to securely verify your identity and the scope of your request.
Where the GDPR applies, you may also exercise the rights of access, rectification, erasure, restriction, objection and data portability, subject to their applicable conditions. Where processing relies on consent, you may withdraw it; withdrawal does not affect the lawfulness of processing before withdrawal. You have the right to complain to the competent data protection supervisory authority. The GDPR explains the applicable conditions.
| Right | How |
|---|---|
| View your data | View each entry in the app |
| Export your data | Settings → Export your data (JSON or CSV) |
| Delete the local journal | Settings → Delete data on this device |
| Delete your cloud account | Settings → Account → Delete cloud account |
| Request deletion without app access | Account deletion request and email route on the support page |
Local deletion clears the journal and local keys on this device. It does not remove your cloud account, journals on other devices, previously shared files or store subscription.
Cloud account deletion is separate. Success is not shown until provider checks and server deletion complete; network or provider problems may leave the operation pending, and you can check its status on the same screen. Cloud account deletion does not automatically delete other devices' local journals or cancel store subscriptions. We can also process support requests after verifying identity; sending a request email does not mean deletion is complete.
Your on-device journal remains until you delete it. When deleting an individual entry, a deletion record without content may be retained to communicate the deletion to other devices. Completed cloud account deletion removes the account, encrypted blocks, sessions and subscription cache from the active database; RevenueCat customer cleanup is part of this flow. Stores retain their own payment records under their own rules.
To prevent a deleted account from returning from an old backup, a limited deletion safety record containing the account identifier and operation time is retained; it contains no journal content, email or token. This record is also protected in a verification store separate from the application database. Because it contains the account identifier, it is not anonymous data. The current Supabase Pro plan provides access to the last seven days of daily database backups. This does not mean separately exported files or all copies at other services are deleted in seven days. The current system does not automatically delete deletion safety records on a fixed schedule. They are retained to block deleted accounts restored from older backups; normal account deletion does not remove this protection record. Operational conditions for safely retiring separate exported backups together with their safety records will be finalized before publication.
Transaction receipts used to prevent duplicate subscription notifications are deleted in bounded maintenance batches once they are more than 30 days old. This does not mean subscription or store payment history is deleted after 30 days; maintenance interruptions and backups may extend retention.
The support mailbox uses Titan. Titan automatically deletes email 30 days after it is moved to Trash or Spam; this period does not automatically start for a support request in the inbox. The provider's deletion explanation describes this distinction. The retention and deletion procedure after support requests are closed, and error-report retention under the current Sentry plan, will be finalized before publication. Keeping an old backup does not mean active account deletion destroys all backup files simultaneously.
The account and encrypted synchronization database runs on Supabase in Ireland (eu-west-1). The independent deletion safety record and recovery access control use a separate Supabase project in the same region. This safety record contains limited account and operation metadata, not journal content or encryption keys. Access to the former Cloudflare Workers/Durable Objects deletion service has been disabled; this does not mean its historical records have been deleted.
The API runs on Supabase Edge Functions. The database region is not a guarantee that every API request or subprocessors' processing stays in the same country. Cloudflare Pages continues to serve the product and policy website; technical request information associated with those web connections may be processed separately.
Expo EAS is used to distribute app packages and updates. Receiving an app update does not upload journal entries to Expo; the provider may process network information associated with the download connection and technical update-request information.
RevenueCat is used for subscriptions and entitlement verification; Apple App Store and Google Play for payments; and Sentry for technical error reports enabled by separate consent. The Sentry organization's data storage region is the European Union. Server-side data scrubbing and the setting to prevent IP address storage for new error events are enabled for Poometry. This does not mean that IP addresses are never processed during network connections. Support requests are received through the email service for the contact address below. These services may process data in different countries. The providers' exact contracting entities, subprocessors, retention periods and applicable transfer safeguards will be finalized before publication. Encrypting journal blocks does not anonymize account and payment metadata.
These static pages contain no behavioral analytics, advertising scripts or third-party font loading. Hosting and network services serving the pages may process technical information such as connection IP address, request time and requested URL. Opening an external support or store link is subject to that service's own terms.
Poometry is for people aged 18 and over. Age confirmation is requested during onboarding.
Bowel form, symptoms and journal notes are health data. We request separate explicit consent to store your journal and calculate personal summaries on your device under KVKK Article 6(3)(a). Where the GDPR applies, the bases are Articles 6(1)(a) and 9(2)(a). Reading this privacy notice does not itself grant consent.
Identity and transaction details necessary to create your account and provide your subscription are processed for entering into or performing the service contract under KVKK Article 5(2)(c), and GDPR Article 6(1)(b) where applicable. Limited technical security records are restricted to legitimate interests balanced against your rights (KVKK Article 5(2)(f); GDPR Article 6(1)(f)). This does not authorize using health content for other purposes.
Technical error reports and participation in community country counts are separate optional choices, off by default. Local health-data consent is not blanket consent to cloud synchronization, public participation or marketing. You may withdraw consent; withdrawal does not retrospectively affect processing lawfully based on previous consent. Export and deletion routes are explained above. Removing cloud copies requires the separate cloud account deletion process.
International-transfer safeguards are assessed separately from the processing basis. A checkbox alone is not used as the safeguard for regular cloud transfers. A provider's standard data processing agreement does not establish that the Turkish transfer annexes have been executed. Completing the applicable contractual scope and transfer safeguards remains an open pre-release item.
We respond to data-rights requests as soon as possible and within 30 days. We may proportionately verify your identity and request scope; do not send health records or an identity-card photograph for a routine request.