This notice was prepared under Article 10 of Turkey's Personal Data Protection Law No. 6698 (KVKK), the law Celvora operates under. For a plain-language summary, see the Privacy page; this page contains the full information the law requires.
1. Data controller
For requests and questions to the data controller of the Celvora app: kvkk@celvora.app
When the app moves into a company, the data controller will change and this notice's version will be increased.
2. Personal data processed
Identity and contact data: your name, email address, and (with Google) profile photo URL from your Google or Apple account. If “Hide My Email” is chosen with Apple, the email address is an alias generated by Apple. Your password never reaches Celvora. If you start without an account, none of this is collected; if you link an account later, the name and email your provider shares are added.
Special-category health data: your emotion entries and their intensities, your journal texts (the event, the thought that went through your mind, the reframe), AI analysis results and thinking-trap findings, your worry and night notes, your good things entries, your restedness scores, your daily activity entries, the contents of your coping card, your prediction tests (what your anxiety predicted and what actually happened), and — if you use the quitting module — your quit goal and urge entries.
Third-party data you enter: if you write a loved one's name and phone number on your coping card, that information is stored too. You are expected to inform that person before entering their data.
Technical and preference data: notification subscription details, your reminder time preferences, your theme preference, your language and timezone preference, your subscription status. When you start without an account, a one-way digest of your network's IP address is created to limit abuse; the raw IP address is not stored and the digest is deleted within 24 hours.
Data not collected: location, advertising ID, analytics or tracking cookies, your device's address book or contacts. The cookies we use are functional only: one that keeps you signed in, one that remembers your language, and a short-lived one that notes which public page you came from when creating an account, without linking it to you.
Data about your state of mind is health data within the meaning of Article 6 of the law; even just selecting an emotion falls under it. It is therefore processed in the most protected category.
3. Purposes of processing
Providing the service: storing your entries, building the history and insights screens, preparing the weekly mentor note.
AI-assisted analysis: finding thinking traps in the text you wrote, offering a reframing prompt, and scanning for crisis signals.
Safety: showing support resources when what you wrote contains signals of self-harm.
Sending reminder notifications and managing subscription status.
Meeting legal obligations.
Your data is not used outside these purposes. It is not processed for advertising, not profiled for marketing, and never sold under any circumstances.
4. Legal basis
Your health data is processed only on the basis of your EXPLICIT CONSENT (Article 6/2). The only parties who may process health data without explicit consent are healthcare personnel under confidentiality obligations and authorized health institutions; Celvora is not one of them.
Your identity and technical data are processed on the legal bases of forming and performing the contract, and legitimate interest (Article 5).
If you don't consent, the app cannot be used — because the data processed is the app itself. You can withdraw your consent at any time; withdrawing means your account and all your data are deleted. There is no in-between state.
5. Transfer abroad
Celvora does not run its own servers; it uses the service providers below. Because all of these providers are located outside Turkey, your data is transferred abroad (Article 9).
Database — Neon Inc. (on Amazon Web Services infrastructure, Frankfurt/Germany): all your entries are stored here.
Hosting — Vercel Inc. (US-based; app functions run in the Frankfurt region): rendering pages and handling requests.
Authentication — Google LLC (US) and Apple Inc. (US): sign-in with Google or Apple.
AI analysis — Google LLC (US): your journal texts are sent to the Gemini AI service for analysis. For the weekly mentor note your journal texts are not sent; only the numeric summary, at most one sentence you marked, and that week's good things entries go.
About the AI provider's free tier
The provider's free service tier is currently in use. On this tier, the provider may use the text sent to it and the responses it produces to improve its own services, and this content may be reviewed by the provider's human reviewers. The text sent contains no name, email address, or anything identifying you. When the paid tier is adopted, this section will be removed and the notice's version increased.
The legal basis for the transfer is the explicit consent you gave on the consent screen. Work on completing data processing agreements with the providers and adopting the safeguard mechanisms required by law is ongoing.
6. Collection method
Data is collected directly from you: the entries you write into the app with your own hands, and the account information the provider shares when you sign in with Google or Apple. No data is bought from third parties and no enrichment from outside sources is done.
7. Retention period
Your data is kept for as long as your account exists. When you delete an entry it is truly deleted, not archived. When you delete your account, all your data is deleted at once and permanently. If you use Celvora without an account and don't open the app for 12 months, your entries can no longer be reached, so they are all permanently deleted; if you have a Plus subscription, those 12 months start counting after your subscription ends. If you sign out without linking an account, your entries are deleted right away.
Deletion happens immediately; the data also drops out of technical backups within at most 7 days. During that period backups are kept only for disaster recovery and are never read or used.
8. Your rights under KVKK Article 11
To learn whether your personal data is processed, and to request information if it is.
To learn the purpose of processing and whether the data is used in line with it.
To know the third parties, in Turkey or abroad, to whom your data is transferred.
To request correction of incomplete or inaccurate data.
To request deletion or destruction of your data. You don't need to ask anyone for this: you can delete your account and all your entries yourself from the "Your data" section on the Settings page.
To object to a result against you arising from analysis of your data solely by automated systems.
To request compensation if you suffer damage due to unlawful processing of your data.
You can send your requests to kvkk@celvora.app. Your application is resolved within 30 days at the latest.
9. Effective date and version
Version 2026-08.2 · Effective date: August 25, 2026. When the text changes, the version increases and the consent screen is shown again.
This app is not a healthcare service
Celvora does not diagnose, does not treat, and does not take the place of therapy. If you are in an emergency, call your local emergency number.