Privacy Policy

1. Data Controller and Scope

This Privacy Policy explains how personal data is processed within the HeyMom mobile application ("App") under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), the EU General Data Protection Regulation ("GDPR") and other applicable legislation.

• Data Controller: HeyMom
• Contact: erhanertoren10@gmail.com
• Web: heymom.web.app

By using the App, you acknowledge that you have read, understood and accepted this policy. If you do not agree with the App's data processing activities, please refrain from using the App.

2. Data We Collect

A) Account and Profile

• Email, full name, date of birth (optional)
• City / avatar / profile photo (optional)
• Role (mother / father / partner)
• Mode preference (pregnancy, newborn, period, pregnancy planning); when you switch modes, the previous mode's data is archived and remains linked to your account
• Multiple pregnancy (twins/triplets) information (if entered)
• Before you register, the App may create a temporary anonymous session identifier for session continuity and anonymous statistics; once you sign up, this session is linked to your account

B) Health and Tracking Data

• Pregnancy: last menstrual period / estimated due date and the pregnancy week calculated from them, weight, blood pressure, water, vitamins/medication, appointments, craving logs, birth plan, postpartum records
• Doctor report notes, attachments and photos (stored in Firebase Storage)
• Contraction timer, kick counter, breathing/Kegel exercise sessions
• Newborn: baby name, birth date, feeding, sleep, diapers, growth (weight/height/head circumference and percentiles), fever, vaccinations and vaccination reminders, solid foods, "memorable firsts"
• Period and planning: cycle calendar, basal body temperature (BBT), ovulation/LH tests, breast self-exam records, cycle insights (if the mode is selected)
• Mood logs and previously entered symptom / postpartum screening (EPDS) records (although new entries are no longer offered for these features, your historical data is retained until you delete it or your account is deleted)
• "Notes to My Baby" content

C) AI Interaction Data

• Questions sent to AI assistants and your chat history (stored on the server linked to your account so it can sync across your devices)
• Optionally uploaded images (lab/test results, baby stool, ultrasound, baby/parent face)
• Long-term AI memory (ai_memory): on Premium, health-related persistent facts (e.g. allergies, chronic conditions) may be automatically extracted from your chats and stored
• Weekly AI credit counter, bonus credits and usage/spend records

D) Family and Partner Data

• familyId, partnerId, invite code
• In-family messages, reminders, love notes
• Shared pregnancy/newborn data from the partner

E) Forum and Community

• 4 collections: posts, posts_en, posts_newborn, posts_newborn_en
• Likes, blocked users, moderation reports

F) Entertainment Module Usage

• Horoscope, Chinese calendar, Rh gender prediction, celebrity matcher
• Baby face prediction (PRO), ultrasound AI commentary (PRO) uploaded images

G) Usage, Analytics and Errors

• App events (login, sign-up, AI usage, screen views, screen-time tracking) — collected both in Google Firebase Analytics and in HeyMom's own analytics infrastructure (with context fields such as platform, version, language, mode and pregnancy week)
• Error reports (error message, platform, version, user ID) — stored in HeyMom's own infrastructure
• Gamification (badges, points), notification history

H) Device and Local Storage

• Platform, language, version, theme, notification preferences
• AI chat cache (on device), AsyncStorage app preferences
• Tracking summaries prepared for widgets and Apple Watch (on device / in the App Group container)
• The Memory Book, belly photo series and newborn keepsake photos are stored only on your device; they are never uploaded to the cloud

I) Purchase and Referral

• Premium subscription status, RevenueCat purchase records
• Promo code usage, influencer referral code usage and commission/referral records

J) Advertising and Attribution

• AppsFlyer, Meta and TikTok campaign attribution together with Apple Search Ads (AdServices) attribution data (used to measure campaign performance)
• Web/QR download measurement (e.g. campaign QR codes): daily counters that contain no personal identifiers

3. Processing Purposes and Legal Basis

Personal data is processed under the legal bases set out in KVKK Article 5 / GDPR Article 6:

• Account creation, authentication and management (performance of contract)
• Provision of pregnancy/newborn/menstrual tracking services (performance of contract)
• General information via AI assistants (explicit consent)
• Doctor Journal + "Ask Your Doctor" AI question generation (explicit consent)
• Family/partner sharing (explicit consent)
• Forum, entertainment, gamification (explicit consent)
• Bug fixing, quality and statistics (legitimate interest)
• Serving ads and — where you grant App Tracking Transparency (ATT) permission on iOS — personalized advertising (explicit consent)
• Campaign attribution measurement (AppsFlyer, Meta, TikTok, Apple Search Ads)
• Subscription and influencer/promotion program management
• Compliance with legal obligations

Health data is a special category of personal data, processed only with explicit consent and strictly to the extent necessary. The App does not provide any medical service, diagnosis or treatment.

4. AI and Data Processing

AI assistants are powered by a third-party cloud AI model (Anthropic Claude API) accessed through Firebase Cloud Functions.

• AI requests are transmitted via HTTPS
• Sent: your question, your mode and pregnancy/newborn week, relevant tracking context summaries (e.g. numeric summaries such as weight/blood pressure/sleep), profile and mood context and — on Premium — information from your long-term AI memory (ai_memory)
• Name, surname, email, national ID and other directly identifying data are not sent to the AI
• Your AI chat history is stored on our servers linked to your account for cross-device sync and weekly summary generation; it is deleted together with your account. Chats are not permanently retained on Anthropic's side
• The App may generate automatic weekly summaries from your chat and tracking data; depending on your sharing preferences, these summaries may be shared with your partner
• Requests for medical diagnoses/prescriptions are automatically blocked, and a medical disclaimer is appended to AI outputs
• AI responses are fully automated; no HeyMom personnel reviews chat content
• Anthropic commits not to use data received via API for model training

5. AI Visual Analysis (Vision) Services

The App offers optional visual analysis features such as lab/test result analysis, baby stool analysis, ultrasound commentary/gender prediction, baby face prediction and parent face matching.

• Uploaded images are sent securely via HTTPS to Anthropic's vision API through Firebase Cloud Functions
• Images sent for AI analysis are not permanently stored in the server database (report/ultrasound photos you yourself add to the Doctor Journal, however, are stored in Firebase Storage linked to your account)
• The textual result may be saved into the doctorReports collection at your request
• Images are never shared with third parties or used for marketing

6. Family and Partner Data Sharing

• A family link is established when the user generates an invite code and the other party accepts
• Once the link is established, most of your tracking data is shared with your partner by default: appointments, kicks, weight, blood pressure, medication/vitamins, water, doctor reports, baby notes, contractions, cravings, the weekly AI summary, birth plan, postpartum records and newborn records (feeding, sleep, diapers, growth, fever, vaccinations, solid foods)
• Intimate reproductive health data (basal body temperature, ovulation tests, breast self-exams, Kegel and breathing sessions) is OFF by default
• Every sharing item can be individually enabled or disabled from the "Sharing Preferences" screen; your partner may receive a notification when you log data
• Shared data may be displayed on your partner's phone, widgets and Apple Watch
• If the mother's account is Premium, the partner's account may also benefit from ad-free use and AI access (family premium)
• The link may be dissolved anytime; family/messages/reminders/loveNotes are deleted upon dissolution
• Unauthorized data viewing or misuse by a partner is not HeyMom's responsibility
• You are responsible for any data exposure resulting from sharing the invite code with third parties

7. Storage, Retention and Security

• Data is stored on Google Firebase (Firestore, Auth, Storage)
• Firestore security rules isolate user data
• Passwords are encrypted by Firebase Auth; HeyMom never accesses user passwords
• Communication is encrypted via HTTPS / TLS
• Error reports are only visible to the development team

Retention Periods

• Account and health data: until account is deleted
• Family documents: deleted immediately when the link is dissolved
• Usage analytics: up to 24 months
• Error reports: up to 90 days
• AI chat history: linked to your account, until the account is deleted (on-device cache 24 hours)
• AI long-term memory (ai_memory): until it is deleted together with the user's account
• Account deletion: data (including roughly 40 data sets, stored files and forum content) is deleted immediately; it is destroyed from backup systems within 30 days at the latest
• Financial/commission records are stripped of personal identifiers (anonymized) and retained for the period required under tax and other applicable legislation

8. International Data Transfers

• Google Firebase (USA) — authentication, storage, analytics (EU-US DPF certified)
• Anthropic (USA) — AI text and visual analysis (no direct identifiers sent)
• Apple / Google — app distribution, subscriptions, Apple Search Ads attribution
• RevenueCat (USA) — subscription management
• AppsFlyer (USA/Israel) — mobile campaign attribution measurement
• Meta / TikTok — campaign attribution and conversion measurement
• Google AdMob (USA) — ad serving
• Expo / EAS (USA) — build and OTA updates

Transfers are carried out under KVKK Article 9 and GDPR Articles 44-49 within the framework of the providers' adequate protection commitments. Data is not sold to third parties for commercial purposes.

9. Data Breach Notification

• The Turkish Personal Data Protection Authority will be notified within 72 hours
• Required notifications to GDPR supervisory authorities will be made
• Affected users will be informed via in-app notification and/or email
• The nature of the breach, affected data types and measures will be explained

10. Third-Party Services

• Firebase (Google) — Auth, Firestore, Storage, Cloud Functions, Analytics
• Anthropic Claude API — AI text and visual analysis
• Google AdMob — banner and rewarded ads
• Apple In-App Purchase / Google Play Billing, RevenueCat
• AppsFlyer, Meta (Facebook SDK), TikTok Events, Apple Search Ads — campaign attribution
• Expo / EAS — build, OTA updates and push notification infrastructure
• Store/shopping links inside the App (e.g. Anne Pazarı) redirect to third-party sites; transactions on those sites are subject to the respective site's terms

Error reports are not sent to any third-party crash service; they are kept in HeyMom's own infrastructure. Each service has its own privacy policy. HeyMom is not responsible for outages or policy changes of third-party services.

11. Local Storage, Widgets and Apple Watch

The App does not use web cookies. Locally stored data: theme, language, notification preferences, onboarding status, mode selection, avatar, AI cache, medical disclaimer acceptance, daily tracking counters, and the Memory Book / belly photo series / newborn keepsake photos (never uploaded to the cloud). Cleared when you delete your account or sign out.

Widgets and Apple Watch: The tracking summaries you choose (e.g. pregnancy week, last feeding, cycle day, partner information) may be displayed on your phone's lock/home screen widgets and on your paired Apple Watch. This data is stored in the shared on-device container (App Group) and is cleared on sign-out. Keep in mind that anyone who can see your device's screen can also see this information; you can manage or turn off widget content from the App's settings.

12. User Rights (KVKK Art. 11 / GDPR Art. 12-23)

• Learn whether your data is processed
• Request information about processed data
• Learn the purpose of processing
• Know the third parties to whom data has been transferred
• Request correction of incomplete/inaccurate data
• Request deletion or destruction
• Object to outcomes of automated processing
• Claim compensation

How to exercise:

• Access: Profile > Privacy & Security > Download My Data (JSON)
• Deletion: Profile > Privacy & Security > Delete My Account (or Data Deletion Request)
• Correction: Profile > Edit
• Request: erhanertoren10@gmail.com

Requests are answered within 30 days. If rejected, you may file a complaint with the Turkish Personal Data Protection Authority.

13. Children's Privacy

HeyMom is not designed for individuals under 18. We do not knowingly collect data from anyone under 13. If detected, data is deleted immediately. Parents/legal guardians may contact erhanertoren10@gmail.com.

14. Advertising Policy

• Free users are shown banner and rewarded ads through Google AdMob
• If you do not grant Tracking Permission (App Tracking Transparency) on iOS, ads are served non-personalized; if you grant it, personalized ads may be shown. You can withdraw the permission at any time from your device settings
• Identifier-free contextual keywords may be attached to ad requests to improve the relevance of the ads shown
• Premium subscribers (and partners covered by family premium) enjoy an ad-free experience
• A bonus AI credit can be earned by watching an ad; this produces ad interaction data
• AppsFlyer, Meta, TikTok and Apple Search Ads attribution is used for campaign measurement

15. Influencer Referral, Promotions and Campaigns

• Referral-code-based system; purchases made with a code use special discounted packages (discount rates may change)
• Referral code usage data (code, date, conversion) is stored server-side for commission verification; it is stripped of personal identifiers when the account is deleted
• Download measurement for promo codes and physical-product campaigns (e.g. QR code campaigns) is done with counters that contain no personal identifiers
• HeyMom is not responsible for misuse of codes shared by influencers

16. Policy Changes

This privacy policy may be updated as the product evolves. Significant changes will be communicated via in-app notification or email. Continued use constitutes acceptance.

17. Contact

• Email: erhanertoren10@gmail.com
• Web: heymom.web.app