Turkey Privacy Notice

Last updated: October 16, 2026

This notice is prepared under Turkish Personal Data Protection Law No. 6698 (KVKK), Article 10, to inform users about data processing activities carried out by VelNotes.

1. Data Controller

Data controller: Yunus İşlegel, the individual developer who publishes VelNotes (App Store seller: YUNUS ISLEGEL), Türkiye. Contact: support@velnotes.com
Website: https://velnotes.com/

2. Collection Methods

Personal data may be collected electronically through app usage, the website, direct email communication, subscription verification, iCloud notebook sync, and user-initiated backup/export workflows.

3. Personal Data Categories

The current mobile app does not require a VelNotes account and does not create an email profile or sign-in-provider record. The app and website do not offer a support form that asks for a name, email address, or phone number. If the user chooses to write from their own email app, the sender address, subject, and message content are processed as part of ordinary email delivery. A random Support ID is kept in the device Keychain, contains no name or email, and is not sent automatically; it may be associated with the correspondence if the user sends the prepared email. Account and cloud data left from earlier versions is described in 3.1; the accountless release does not use those records for notebook access or Pro entitlement. Usage/transaction data may include notebook operations and backup activity. Device/security data may include request timestamps, IP address, user-agent, and security logs for the website. For website analytics, country/region distribution may be measured using country code inferred from request headers (with Accept-Language fallback when needed). To preserve the selected website language (Turkish, English, Spanish, Portuguese, Japanese, Arabic or French), the page may read a language value from the URL and, where preference cookies are allowed, a local on-device preference record; no separate server-side language profile is created. Where voice and Video to Text features are used, user-approved transcription output may be processed as notebook content. During local video import, the audio track of the supported media file the user chose may be extracted on device; VelNotes does not download videos from YouTube or third-party links. When iCloud Backup is enabled, a backup archive may be refreshed automatically after local changes or manually by the user in that user's iCloud Drive area. It is not sent to a VelNotes server; Apple protects it under the Apple Account and iCloud settings, and end-to-end encryption depends on Advanced Data Protection. In VelNotes 2.1 and later, iCloud Sync is on by default when iCloud Drive is available; notebooks and folders reach the user's devices on the same Apple Account through the user's own iCloud Drive, are not sent to VelNotes servers, and sync can be turned off from the cloud icon on Home. Sync also keeps earlier notebook versions in the user's iCloud Drive. Backup and data export payloads may include limited technical metadata for restore-safety checks. Pages captured through camera/document-scanner flows, images imported from the photo library, and image/video exports saved to the photo library at the user's request may also be processed as related content data. Device-local biometric lock checks using Face ID / Touch ID or device passcode fallback are handled on the device; VelNotes does not access, store, or transmit biometric template data to its servers. Website admin access may use Google/Firebase authentication only for authorized administrators; that administrator session is not a mobile-app account. When Math help is on (always with the same en-US model) and for device/language combinations not directly supported by the operating system, VelNotes uses Google ML Kit Digital Ink; its model is downloaded once from Google over Wi-Fi only. Recognition runs on the device; handwriting and recognized text are not sent to Google or VelNotes. The SDK sends Google technical diagnostics (a random installation ID, device model, OS and app version, recognition language, and usage events with performance and error data); Google says it uses them for diagnostics and usage analytics and that the installation ID is not meant to identify a person or device; VelNotes does not receive them. To check for a new version, the app sends Apple's App Store lookup service (itunes.apple.com) a request that contains only the app's ID.

Handwriting assistance uses a main model and an on-device fallback recognition system. On devices that require a download, the main model for your selected language is prepared automatically over Wi-Fi on first use and stored on the device. If the model is not ready or Wi-Fi is unavailable for the initial download, the fallback system continues recognition; accuracy can differ and results should be checked. When Wi-Fi becomes available, the app automatically resumes model preparation. A ready model is not downloaded again for each use; recognition works on the device without internet access.

3.1 Account and cloud data left from earlier versions

Earlier account-based versions of VelNotes (1.x) may have created the following in Google Firebase: email address, display name, username, profile-photo link, sign-in provider, last sign-in time, device/session IDs, a push token and subscription status; for accounts that used Pro cloud sync, also notebook and page content, uploaded images/PDFs and sharing records. These records are stored on Google Firebase servers (Firestore: EU; Storage and Authentication: USA), and a backup copy is kept in an archive in the EU. The current app does not use these records or create new ones. We will delete them after giving former users advance notice so they can export their data, and we will announce the deletion date on this page. To have yours deleted sooner or to get a copy, email support@velnotes.com from your account's address.

4. Local-first Backup Notice

Notebook data you own is processed local-first. When iCloud Backup is enabled, a safety copy may be refreshed automatically after local changes or manually by the user; a restore check starts enabled by default when no active local notebook exists and can be turned off. Data export is user-initiated and governed by the destination the user selects.

5. Processing Purposes

Data is processed for service delivery, subscription management, notebook editing, iCloud notebook sync and backup, new-version notices, subscription validation, security and anti-abuse controls, device-permission-based local notifications, user support, and legal compliance.

6. Legal Bases

Processing may rely on legal bases including contractual necessity, legal obligations, protection/exercise of rights, legitimate interests, and explicit consent when required.

7. Data Transfers and Sub-processors

Data may be transferred to infrastructure/service providers such as Apple, iCloud Drive and website/admin infrastructure depending on user action and technical workflow. Firebase/Google infrastructure may be used for authorized administrator Google sign-in, the web admin panel, site configuration, admin media management, storage of the account and cloud data left from earlier versions (see 3.1), and consented web analytics; support messages are not sent to Firebase and reach us only if the user sends an email. This does not mean the iOS app has a notebook account or automatic notebook-content transfer. In the current production version, content recognition and audio/video transcription do not use an external provider; they run on the device. International transfer may occur.

Service providers and recipients: Apple Inc. (StoreKit 2, Speech.framework, iCloud Drive for sync and backup, and the App Store version check, which sends only the app's ID — USA, under Apple Developer Program License Agreement). Google LLC (ML Kit Digital Ink — model download and basic technical diagnostics for Math help and for handwriting recognition on device/language combinations not directly supported by the operating system; handwriting and recognized text are not transferred — USA). Google processes these diagnostics for its own diagnostics and usage-analytics purposes, so it is a separate recipient rather than a processor acting for VelNotes. Google/Firebase, on behalf of VelNotes, for authorized administrator sign-in, web admin panel, site configuration, admin media management, storage of the account and cloud data left from earlier versions, and consented web analytics (Google Firebase servers, USA and EU).

International transfers: The servers of these providers are outside Türkiye, mainly in the USA and the EU, so personal data is transferred abroad when the services above are used. For transfers from the EU/EEA to Google LLC in the USA, Google LLC's certification under the EU-U.S. Data Privacy Framework applies. Data the user keeps in iCloud and purchases made through the App Store are handled by Apple under the user's Apple Account and Apple's own privacy policy.

8. Voice Recording Storage Notice

When voice recording starts, an audio file is created in the app's on-device recording storage (VoiceRecordings folder, as an .m4a file). A saved recording stays there until you delete it in the app; unfinished recording files may be cleaned up automatically. If the user exports the file, retention is governed by the selected destination. Audio/video transcription uses on-device speech recognition provided by the operating system when supported; on unsupported devices this feature cannot be used. Video to Text works only with supported local media files and within the in-app duration limit. Transcription output is generated automatically and may contain mistakes. In the default flow, raw audio/video files are not uploaded to VelNotes servers as notebook content.

9. Retention

Data is retained for the period necessary for processing purposes and legal requirements. Data deletion requests trigger cleanup flows for relevant support/operational records. Each move to Trash writes a new deletion timestamp. Restore clears it, and deleting the item again restarts the 30-day period from the latest deletion. Unless permanently deleted earlier, an item may remain locally and, when enabled, in the iCloud backup until the 30-day boundary. On the first eligible app maintenance run at or after expiry, it is removed locally and excluded from new backups; it is removed from the iCloud archive when that archive is read or refreshed. If the device, app, or iCloud is unavailable, this completes on the next eligible run. In VelNotes 2.1 and later, iCloud Sync keeps earlier notebook versions in the sync folder in the user's own iCloud Drive; these are currently not deleted automatically, are not sent to VelNotes servers and are not deleted when sync is turned off. The user can remove them by deleting VelNotes data in iCloud storage settings; this also removes the iCloud safety backup. Security and anti-abuse logs (including IP address and user-agent) may be retained for limited periods under legitimate-interest and legal-obligation grounds. Sent support emails may remain in the mailbox and the email providers' ordinary retention or backup systems for the time needed to answer and meet legal obligations; they enter deletion flows when no longer needed. Account and cloud data left from earlier versions is kept as described in 3.1. Free-tier local notebook data may be lost on uninstall/device-loss unless a backup exists. iCloud backups remain under the user's Apple account control, and the restore check reads from that same user-controlled iCloud area. Exported archives remain under the user's selected destination.

10. Rights Under KVKK Article 11

Under KVKK Article 11, you have the right to: (a) learn whether your personal data is processed; (b) request information about it if it has been processed; (c) learn the purpose of the processing and whether the data is used in line with that purpose; (d) know the third parties in Türkiye or abroad to whom it has been transferred; (e) request correction if it is incomplete or inaccurate; (f) request its deletion or destruction under the conditions in KVKK Article 7; (g) request that the actions under (e) and (f) be notified to the third parties to whom the data has been transferred; (h) object to a result against you that arises from analysis of the data exclusively by automated systems; and (i) claim compensation for damage you suffer because of unlawful processing.

Requests may be submitted to support@velnotes.com with sufficient identity verification details.

11. Data Breach Notification Procedure

In the event of a personal data breach, notification will be made to the relevant Data Protection Authority within 72 hours in accordance with KVKK Article 12/5 and GDPR Article 33. If the breach poses a high risk to users' rights, affected people with known contact details will be notified directly; otherwise notice will be provided through an appropriate method such as the website or an in-app notice as soon as reasonably possible. Contact: support@velnotes.com

12. Cookie Note

velnotes.com uses strictly necessary storage and consent-based optional categories. Website analytics, used only with consent, counts visits by page, referring site and country/region, using a random visitor ID stored in the browser; the country code is inferred from request headers, without requesting browser geolocation access. Choices can be changed or withdrawn at any time via Cookie settings. See Cookie Policy for details.