KVKK (Turkish data protection) notice

The legally binding versions of this text are Turkish and English.

Version: 2026-11-10

This notice explains, under Turkish Personal Data Protection Law No. 6698 ("KVKK") Article 10, which personal data is processed when you use the Karapp Müzik app and the musicapp.karapplication.store website, and why. The Turkish version is authoritative.

1. Data controller

Karapp Müzik developer Ahmet Kar (App Owner). Contact: ahmetkar.1258@gmail.com.

2. Data processed

• Account (only if you sign in with Google or Apple): name, email address, profile photo URL, Firebase user ID; birth date (only for the age limit, encrypted); version and time of your KVKK and terms consents; (if you choose) your app settings; device make/model (encrypted), app version, last sign-in time.
• Advertising (everyone): device and app information, approximate location derived from your IP address, ad interactions; with your permission, the advertising ID (Android advertising ID / iOS IDFA).
• Security (everyone): app and device security state (e.g. repackaged app, root/jailbreak, debugger), anonymous app/device instance ID, approximate location and network operator derived from your IP address; app attestation tokens.
• Website contact form: name, email, message, language and an irreversible hash of your IP address.

Your music files, library, playlists, other files on your phone, contacts and microphone data are not processed and never leave your phone.

3. Purposes

• To create your account, sign you in, back up your settings and restore them on another device,
• To verify the age limit and keep consent records as a legal obligation,
• To show ads so the app can be offered for free, cap ad frequency and prevent ad fraud; with your consent, to personalize ads,
• To keep the app and accounts secure: detect modified apps and attack tools, and ensure only the genuine app can reach the account backend,
• To answer contact and support requests and fix errors.

4. Legal grounds

KVKK Art. 5/2-c (performance of a contract: account, settings sync, support), Art. 5/2-ç (legal obligation: consent records), Art. 5/2-f (legitimate interest: security, fraud prevention, non-personalized ads) and Art. 5/1 (explicit consent: personalized ads and use of the advertising ID). You can withdraw your consent at any time in Settings → Privacy → Ad preferences.

5. Transfers

• Google LLC / Google Ireland Ltd. (Firebase Authentication, Cloud Firestore, App Check; Google AdMob): account, verification and advertising services. Under AdMob, Google may also act as an independent controller for advertising data.
• Apple Inc. (Sign in with Apple, App Attest): sign-in and app verification.
• Talsec (Aheaditec s.r.o., Czechia, EU) (freeRASP): security detection.
• Vercel Inc. and Neon Inc. (website hosting and database): contact form records.

These providers' servers may be located abroad (EU and USA); transfers are made with the safeguards required by KVKK Art. 9 and, where necessary, based on your explicit consent. Data is not sold.

6. Retention

Account data is kept while the account exists; "Delete account" in the app permanently deletes all your account data and sign-in record in the cloud. Contact form records are deleted within 12 months at the latest. Retention of advertising and security data is subject to the respective provider's policies.

7. Your rights (KVKK Art. 11)

You have the right to learn whether your data is processed, request information, learn the purpose, know the recipients, request correction or deletion, object, and claim compensation for damages. Send requests to ahmetkar.1258@gmail.com; they are answered within 30 days at the latest.