Privacy Policy

Version 5 · 20 October 2026

This policy describes what personal data the BiteMix app and our website handle, why, who receives it and how long it is kept, in line with the General Data Protection Regulation (GDPR) for users in the European Union.

1. Who we are and how to contact us

  • Controller: Barış Görgün, an individual (sole operator).
  • Contact is by e-mail only: [email protected]. No postal address is published.
  • The service is offered in Türkiye and the European Union.

2. What data we collect

  • Anonymous identifier. The app has no registration, account creation or sign-in. On first launch the app automatically creates an anonymous Firebase identifier (uid); no name, e-mail, phone number, address or ID document is requested or stored. Your cloud data is linked to this anonymous identifier.
  • Subscription information. The app contains a subscription flow. The subscription is managed by Apple/Google and RevenueCat.
  • User-generated content and messages. The app has chat input. Forum content is also stored in the cloud. The forum uses a pseudonym (assigned by the server, changeable by the user), not a real name.
  • Free-text fields. What you type into free-text fields such as the chat, growth notes and the forum is processed as typed; we encourage you not to write information that identifies you in these fields.
  • Photos and images. The app does not let users upload photos or images and does not use the camera or the photo library. Recipe images are the app's own content.
  • Notification data. The app uses the push notification capability. A notification (FCM) token is stored.
  • Records about your baby and your use of the app. Entered by the parent and stored in the cloud: growth records (weight, height, head circumference, notes), vaccination records, teething records, developmental milestones, favourites, weekly plans and usage counters.
    • No name, e-mail or directly identifying information is stored in the cloud; these records are tied only to a randomly generated anonymous identifier (uid).
    • This identifier does not directly identify you, but it is a persistent identifier bound to your device. The data is therefore pseudonymous rather than fully anonymous: we treat it as personal data and your rights apply. Some of these records, such as growth measurements, can relate to a child's health.
  • Usage analytics data. Analytics data is processed and kept for at most 14 months.
  • There is no tracking in the app and no commercial messaging.
  • Data handled on our website is described separately in section 8.
  • Anonymous identifier: to link your cloud data to it.
  • Subscription information: to manage your subscription.
  • Chat text: to produce recipes and chatbot answers.
  • Notification token: to deliver push notifications.
  • Usage analytics: to keep the service secure and to improve it.
  • Recipes and chatbot answers are AI-generated content produced with Google Gemini and may contain errors.

Legal bases (the operator's assessment, not legal advice):

  • Service delivery (cloud records, subscription, notifications): performance of a contract, Art. 6(1)(b) GDPR.
  • Transfer of data to Gemini for the AI features: your consent, Art. 6(1)(a) GDPR; without consent these features stay off.
  • Security and usage analytics: legitimate interests, Art. 6(1)(f) GDPR.

4. Who we share it with

  • Google (Gemini). Gemini is called only after you have given explicit consent. It receives the baby's age, allergens, diet preference, growth measurements (height, weight, head circumference) and the text you type into the chat. The baby's name is not sent. You can withdraw consent on the Profile screen; if consent is declined the AI features are turned off and the rest of the app remains usable.
  • Google Firebase. Cloud data is kept in Firestore linked to the anonymous Firebase uid.
  • Apple, Google and RevenueCat. Subscriptions are managed by these parties.
  • Cloudflare. Our website is hosted on Cloudflare infrastructure.
  • Safeguards for transfers outside the EU: Transfers to Google, RevenueCat and Apple rely on the safeguards set out in those providers' own data-processing terms; please see the providers' privacy policies for details.

5. Where and how long it is kept

  • Cloud data is stored in Firestore in the European multi-region (eur3) and kept until you delete it.
  • Local data stays on your device only and is removed when you delete the app. Because the anonymous identifier is also kept in the Keychain, cloud data remains reachable with the same identifier after reinstalling.
  • Deletion: the app currently has no menu that deletes cloud data. A deletion request is made by e-mail to [email protected]. Because cloud data is tied to a random anonymous identifier that is not shown in the app, we may be unable to tell from an e-mail which records are yours; in that case we may ask you for additional information in order to assess the request. Local data is removed by deleting the app. Deleted forum content is removed from publication (soft delete).
  • Forum reports are kept for at most 12 months after resolution; analytics data for at most 14 months.
  • A subscription is managed by Apple/Google and RevenueCat; deleting data does not cancel it, so it must be cancelled separately.

6. Your rights and how to use them

Under the GDPR you have the right to:

  • access your personal data,
  • have inaccurate data rectified,
  • have your data erased,
  • restrict processing,
  • object to processing based on legitimate interests,
  • receive your data in a portable format,
  • withdraw consent at any time, without affecting processing before the withdrawal,
  • lodge a complaint with the data protection supervisory authority of your place of residence.

Consent for the AI features can be withdrawn on the Profile screen.

To use a right, write to [email protected]. The app currently has no menu that deletes cloud data, so deletion requests are also made by e-mail; because cloud data is tied to a random anonymous identifier, we may ask you for additional information to assess the request. We answer requests within 30 days at the latest.

7. Children, changes to this policy, effective date

  • The product is aimed at parents; the parent enters the data. It is not directed at children.
  • When this policy changes, the updated version is published on this site and material changes are announced in the app.
  • Effective date and last update: 27 October 2026.

8. Our website

  • Our website (bebegimilklokma.com) uses no cookies.
  • Two browser storage items are used: your language preference (localStorage, only to remember the site's language) and a random per-session visit ID together with a campaign source tag (sessionStorage, deleted when the tab is closed). There is no cross-site tracking.
  • On the server we keep visit and store-button click statistics. These records contain: time, language, country code (provided by Cloudflare), only the domain name of the referring site, campaign tag, browser information (user agent), a bot flag and the per-session visit ID. Your IP address is not stored in these records.
  • These statistics are kept as aggregate statistics that do not directly identify a person; no automatic deletion period is currently set, and deletion requests are handled by e-mail.
  • The site is hosted on Cloudflare infrastructure.
  • Legal basis (the operator's assessment, not legal advice): legitimate interests in measuring use of the site and store referrals, Art. 6(1)(f) GDPR.