Privacy Policy

1 What we collect

• Account details: You can only sign in with Apple or Google. From them we receive your name, your email address (Apple's relay address if you choose "Hide My Email") and your profile photo, if you have one. Your account also holds the username and display name you choose, any profile photo you upload, and your device's time zone so reminders fire at the right time.
• What you save: Links, notes, images you upload, collections, favorites and reminders. When you save a link we fetch the page's public title, description and image to show a preview. To bring forgotten saves back to you, we also record when you last opened an item and how many times.
• Search history: Your last 10 searches are stored on our server so they're available on all your devices. They are deleted with your account.
• Sharing, blocking and reports: Which collections you share and with whom, public links you create, users you block, and reports you submit (reason, optional note, and the collection and user concerned).
• Notification token: So we can send you push notifications, your device's push token, platform and language are stored on our server. They are deleted when you sign out or delete your account.
• Subscription status: Whether Premium is active, which plan, and when it expires. Your payment details (card etc.) never reach us; Apple handles payment.
• Usage and diagnostics: Statistics such as which screens are opened and which features are used (Firebase Analytics), and, when the app crashes, the crash log, device model and iOS version (Firebase Crashlytics). This data is not linked to your account identity.
• Security and error logs: For every request to our server we log the IP address, device/browser information (user agent), request path, status code, duration and, if you're signed in, your user ID. For your sign-in sessions we keep the device name, IP address and user agent. These logs exist for security and debugging and are deleted after 30 days.

What we don't collect: your location (even when the app shows a saved place on a map, your location isn't sent to us), your contacts, your advertising identifier (IDFA), or Face ID data. Face ID checks happen entirely on your device; no biometric data ever reaches us.

2 Why we use it

• To run the service: creating your account, syncing your saves across devices, sharing, reminders and notifications, and recognising Premium. (Legal basis: performance of our contract with you.)
• Security and moderation: preventing abuse, reviewing reports, and finding and fixing bugs. (Legal basis: legitimate interests.)
• Improving the product: seeing, in aggregate, which features get used. (Legal basis: legitimate interests.)
• Legal obligations: responding to lawful requests from the authorities. (Legal basis: legal obligation.)

We never use your data for advertising, profiling or sale.

3 Where your data is stored

Your account, your saves, the images you upload and the other data listed above are stored in a PostgreSQL database on our own servers in Hetzner's data center in Nuremberg, Germany (EU). Your content is not stored in Firebase.

The service providers listed below (Google/Firebase, RevenueCat, Apple) may process the data they handle in countries outside the EU and Turkey, including the United States. This is necessary for the service to work, and we only share with each provider what it needs for its own function.

4 What others see when you share

• Sharing with a person: when you send someone a collection, they see your display name, your username and the collection's contents. Other users can send you shares using your username.
• Public links: anyone who has the link can see the collection and your display name, even without an account. You can revoke a link at any time and it stops working immediately. Collections in the Hidden Vault can't have a public link.
• When you report something: the report is stored on our server and emailed to our moderator, who reviews it within 24 hours. The person you report never sees who reported them. Blocking someone doesn't notify them either.

5 Service providers we use

• Firebase Authentication (Google): verifies Sign in with Apple and Google. Your name, email address and a user ID are held here.
• Firebase Analytics (Google): shows us, in aggregate, how the app is used. No advertising identifier (IDFA) is used and no tracking for advertising purposes takes place, which is why the app never asks for tracking permission (App Tracking Transparency).
• Firebase Crashlytics (Google): collects the crash log, device model and iOS version when the app crashes, purely so we can fix bugs.
• Firebase Cloud Messaging (Google): delivers notifications such as share requests and reminders to your device, using your device's push token.
• RevenueCat: verifies your App Store subscription and tells us whether Premium is active. RevenueCat receives your user ID and purchase history, not your payment details.
• Apple (App Store, Sign in with Apple) and Google (Sign in with Google): sign-in and payment are handled by these companies under their own privacy policies.
• Hetzner: the German data center that hosts our servers. It provides the infrastructure and does not access your data.
• Error monitoring: we may use Sentry to monitor server errors. If so, Sentry receives error details only; sending personal data is switched off.

We don't share data with anyone else. If the law requires it, we disclose only what a lawful request from the authorities covers.

6 Cookies

The app doesn't use cookies, so it has no cookie settings either.

somineapp.com uses a strictly necessary cookie that remembers your language choice for a year. Google Analytics cookies (names starting with _ga) are used for visitor statistics only if you consent; if you decline they are not loaded. You can change your choice at any time in the cookie preferences.

7 How long we keep it

• Account details, saves, collections, shares, reminders, notifications, search history, blocks and reports: for as long as your account exists. They are deleted immediately when you delete your account.
• An item you delete first moves to Recently Deleted; it is erased for good when you delete it from there or delete your account.
• Notification token: deleted when you sign out or delete your account.
• Security and error logs (IP address, user agent): 30 days.
• Data held by Firebase Analytics, Crashlytics and RevenueCat follows those providers' retention periods.

8 Security

All traffic between the app and our server is encrypted with HTTPS (TLS). Your session keys are kept in the iOS Keychain on your device. Collections in the Hidden Vault aren't downloaded to your device until you unlock them with Face ID, and they never appear in the widget or in notifications. Even so, no transmission over the internet can be guaranteed 100% secure.

9 Your rights

Under the GDPR and Article 11 of the KVKK you have the right to:

• Access: find out what data we hold about you and get a copy.
• Export: download all your saves and collections as JSON or CSV from Profile > Export your data (free).
• Correction: change your name, username and profile photo in Profile > Account Info.
• Deletion: delete your account and all your data permanently and immediately from Profile > Account Info > Delete Account. This erases your data on our server, your Firebase sign-in account and your notification token, and, if you signed in with Apple, revokes somine's Apple sign-in authorization. See the Account Deletion page for details. Deleting your account does not cancel an App Store subscription; cancel that separately in your iPhone's Settings > [your name] > Subscriptions.
• Object and restrict: object to processing based on legitimate interests, ask which third parties received your data, and challenge outcomes that work against you.
• Complain: if you're not satisfied with our answer, you can lodge a complaint with the data protection authority in your EU country or, in Turkey, with the Personal Data Protection Board (kvkk.gov.tr).

Send requests to [email protected]. We reply within 30 days at the latest.

10 Age requirement

somine is for people aged 13 and over. It is not directed at children under 13, and we don't knowingly collect data from them. If you learn that a child under 13 has created an account, let us know and we'll delete the account and its data.

11 Changes to this policy

We update this policy as the app changes. If a change is significant, we'll tell you in the app. The date of the current version is shown in the "Last updated" line at the top of this page.