Summary
- Documents you open, edit or create (UDF, DOCX, PDF) are processed only on your device. Document contents and file names are never sent to any server, and we have no access to them.
- No account. We do not ask for your name, email address or phone number.
- The free tier shows Google AdMob ads. Your advertising ID is used for personalised ads only with your permission.
- Subscriptions are bought through the Apple App Store / Google Play and verified with RevenueCat. We never see your card details.
- The app contacts Firebase Remote Config only to check whether an update is required. No analytics or crash-reporting SDK is used.
This Privacy Policy explains how personal data is processed when you use the Kalem mobile app (the “App”) and the website at https://kalem-udf.netlify.app (the “Site”), in line with Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”), the EU General Data Protection Regulation (“GDPR”) and Apple App Store and Google Play requirements. The Turkish version is the original; in case of conflict the Turkish version prevails, except where mandatory law requires otherwise.
1. Data controller
The App and the Site are provided by Mobilect Apps, based in Türkiye, who is the data controller under KVKK and GDPR.
Contact: info@mobilectapps.com.tr
2. Data processed on your device (never reaches us)
- Documents: stored in the App’s private storage on your device. Opening, editing, pagination, find/replace, PDF and DOCX conversion, DOCX import and printing all happen on the device.
- Drafts and version history: autosave drafts and (Premium) document versions are kept on the device only.
- Preferences and counters: theme, view settings and the free tier’s daily document counter are kept on the device.
- File and camera access: the App accesses only files you pick or send to it via “Open in / Share”; it does not request broad storage permission. If you choose to insert a picture from the camera or photo library, only that picture is added to your document, on your device.
- Signed documents: signer details of an e-signed document are read on the device for display only.
- Backups: we do not send documents to any cloud backup. When changing devices, export and move your documents yourself.
Because this data is never transmitted to us, we cannot view, copy, delete or share it. No document content — including any special categories of personal data your documents may contain — is processed by us.
3. Third-party services and the data they process
Limited data is shared with the services below in order to provide the free tier, verify subscriptions and keep the App secure. Document contents and file names are never sent to any of them.
3.1 Advertising — Google AdMob and User Messaging Platform (UMP)
The free tier shows ads via Google AdMob (Google Ireland Limited / Google LLC). AdMob may process the following to serve and measure ads, prevent fraud and, if you consent, personalise ads:
- Advertising identifier (IDFA on iOS, only if you allow tracking; Advertising ID on Android), IP address and approximate location derived from it (no precise location),
- Technical information such as device model, operating system, language and app version,
- Ad interactions (impressions, clicks, rewarded-ad completion) and ad-request diagnostics.
Consent: Where required — including the EEA, the UK, Switzerland and Türkiye — we ask for your choice with Google’s UMP consent form. On iOS, access to the advertising identifier requires Apple’s App Tracking Transparency (ATT) permission. If you decline, only non-personalised (contextual) ads are shown. You can change your choice at any time in the App under Settings › Privacy › Ad preferences (Ayarlar › Gizlilik › Reklam tercihleri).
Premium subscribers see no ads, and the ads SDK does not request ads for them.
How Google uses data: policies.google.com/technologies/partner-sites
3.2 Purchases and subscriptions — Apple, Google and RevenueCat
- Payments are taken by Apple (App Store) or Google (Google Play) through your own account. They act as independent controllers for payment processing. We never see or store your card or payment details.
- We use RevenueCat, Inc. (USA) as a processor to verify subscription status. RevenueCat receives: a random anonymous app user ID generated by the App, purchase receipts and transaction details (product, dates, renewal and trial status), country and currency, platform, app version and IP address.
- We do not link this ID to your name, email address or Apple/Google account details.
RevenueCat privacy policy: revenuecat.com/privacy
3.3 Version check — Firebase Remote Config
At launch the App downloads configuration values such as the “minimum supported app version” from Google’s Firebase Remote Config (Google LLC), so that we can ask you to update when a critical fix is released. This request sends the Firebase installation ID (a random, app-specific identifier), app ID and version, platform, OS version, language/region and IP address. Firebase Analytics, Crashlytics and other analytics tools are not used; no document, usage or behavioural data is sent to Remote Config.
Firebase privacy information: firebase.google.com/support/privacy
3.4 Support emails
If you email us, your email address, your name (if provided) and your message are processed solely to answer you. Our email provider is Google (Gmail). We never ask you to send documents; please do not attach documents containing personal or confidential information.
3.5 Platform statistics
If you allow it in your device settings, Apple and Google provide developers with aggregated, anonymous crash and usage statistics (e.g. install counts, crash rates). These do not identify you and contain no document content.
We do not sell personal data and do not build any profile based on document content.
4. Purposes and legal bases
| Purpose | Data | KVKK basis | GDPR basis |
|---|---|---|---|
| Purchasing, verifying and restoring subscriptions | Anonymous user ID, receipt, country/currency | Performance of contract (Art. 5/2-c) | Art. 6(1)(b) |
| Showing and measuring non-personalised ads in the free tier | IP, device information, ad interactions | Legitimate interest (Art. 5/2-f) | Art. 6(1)(f); consent where required |
| Personalised ads | Advertising ID (IDFA/AAID), ad interactions, approximate location | Explicit consent (Art. 5/1) — via UMP and ATT | Art. 6(1)(a) |
| App security, fraud and abuse prevention | IP, device information, transaction records | Legitimate interest (Art. 5/2-f) | Art. 6(1)(f) |
| Determining whether an update is required | Firebase installation ID, app version, platform, IP | Contract and legitimate interest (Art. 5/2-c, f) | Art. 6(1)(b), (f) |
| Answering support requests | Email address, name, message | Contract and legitimate interest (Art. 5/2-c, f) | Art. 6(1)(b), (f) |
| Legal obligations and defending legal claims | Relevant records | Legal obligation; establishing, exercising or defending a right (Art. 5/2-ç, e) | Art. 6(1)(c), (f) |
Personal data is collected automatically and electronically through the SDKs of the services above, and through the emails you send us. No decision producing legal effects is made about you based solely on automated processing.
5. Recipients and international transfers
Personal data is shared only with the providers listed above (Google — AdMob, UMP, Firebase and Gmail; RevenueCat; Apple and Google payment services; Netlify for the Site) and with competent public authorities where required by law.
These providers’ servers are located outside Türkiye, mainly in the United States and the European Union. Transfers are made under KVKK Article 9 on the basis of appropriate safeguards such as the standard contracts announced by the Turkish Personal Data Protection Board or, for occasional transfers where such safeguards are not available, the exceptions in Article 9/6 (e.g. necessity for the performance of a contract, explicit consent). For transfers governed by the GDPR we rely on European Commission adequacy decisions (such as the EU–US Data Privacy Framework) and standard contractual clauses.
6. Retention
- Documents, drafts, preferences: remain only on your device until you delete them or uninstall the App. We hold no copy.
- Advertising data: subject to Google’s retention periods (policies.google.com/technologies/retention).
- Subscription records (RevenueCat): kept for the duration of the subscription and afterwards as long as needed for disputes and legal obligations; deleted on request (see Data deletion).
- Firebase Remote Config: installation IDs are retained according to Google’s Firebase rules.
- Support emails: kept for up to 2 years after the request is resolved, then deleted.
7. Your rights
Under KVKK Article 11 you may ask whether your data is processed and request information about it; learn the purpose of processing and whether it is used accordingly; know the third parties in Türkiye or abroad to whom it is transferred; request rectification of incomplete or inaccurate data; request erasure or destruction under Article 7 and notification of these actions to recipients; object to a result against you arising exclusively from automated analysis; and claim compensation for damage caused by unlawful processing.
Under the GDPR, if you are in the EU/EEA you also have the rights of access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interests, and to withdraw consent at any time. You may lodge a complaint with your local supervisory authority; in Türkiye, with the Personal Data Protection Board (KVKK).
How to exercise them: email info@mobilectapps.com.tr stating your identity and request. Because there are no accounts, for subscription-related requests we may ask for your App Store order ID or Google Play order number (starting with “GPA.”) to locate your records. We respond within 30 days, generally free of charge.
8. Your choices
- Ad consent: in the App, Settings › Privacy › Ad preferences.
- iOS tracking permission: iPhone Settings › Privacy & Security › Tracking › Kalem.
- Android advertising ID: Settings › Privacy › Ads (or Settings › Google › Ads) › Delete advertising ID.
- Remove ads entirely: subscribe to Premium.
- Delete all local data: uninstall the App. To cancel a subscription see Support.
9. Children
The App is designed for legal professionals and adults. It is not directed at children under 13 (or under 16 where required by local law in the EU), and we do not knowingly collect their personal data. If you believe we have, contact info@mobilectapps.com.tr and we will delete it.
10. Security
Documents are kept in the App’s private, OS-protected storage. Communication with third-party services uses TLS encryption. Because we store no documents, there is no server-side document leak risk. We recommend protecting your device with a screen lock and keeping it up to date. No method is perfectly secure; if we become aware of a breach we will notify the authority and affected persons as required by KVKK Article 12 and the GDPR.
11. Website
The Site is hosted by Netlify, Inc. (USA). When you visit, Netlify’s server logs briefly record your IP address, browser type, requested page and time to deliver and secure the service. The Site uses no cookies, no analytics or ad trackers, serves its own fonts and loads no third-party content.
Netlify privacy policy: netlify.com/privacy
12. Changes
We may update this policy as the App or the law changes. If we add a new processing activity (e.g. an analytics tool), the policy will be updated beforehand; material changes will be announced in the App or on the store listing. The date at the top shows the current version.
13. No official affiliation
Kalem is compatible with UDF (UYAP) files. It is not an official app and is not affiliated with the Ministry of Justice of the Republic of Türkiye. The App does not connect to UYAP or any government system and sends no data to them.
14. Contact
Mobilect Apps · Türkiye
Email: info@mobilectapps.com.tr