Privacy notice

1. Controller

The Untillo service is provided by [legal entity / natural person, name and address to be set with the lawyer]. Contact address beta@untillo.com [a separate privacy address will be opened before release].

2. Personal data we process

Account

email address (at the authentication provider) and its keyed digest (for recipient lookup), display name, public key, the encrypted key backup derived from your password that we cannot open, time zone, the city chosen for the sky and the weather (it goes to the weather provider from our server). For a weather-bound letter we also store the watched station's identifier and the observation line that opened the letter. Both are public aviation data and carry nothing about you.

Letter

encrypted body (we cannot open it), sender and recipient identity, the condition's type and parameters (date, chosen point and radius, city), the deadline (only for place-bound letters and treasure hunts, sky conditions have none), status, opening time and reason.

Phone

during verification the number is passed to the SMS provider. Only its keyed digest is stored on the server.

Reports and restrictions

report text, the letter concerned, blocking and lock-closing decisions.

Device

notification ID (Firebase Cloud Messaging).

Error record

the stack trace produced when the app closes unexpectedly or shows an error without knowing its cause, the device's technical state, and the error code shown on screen. Details on the security page.

Closed test list

email address, platform, language, the source tag of the signup link (if any), the status on the list (active, left, bounced, reported) and the delivery and bounce events reported by the email provider.

Site visits

the number of home page views per day and source tag. Not tied to an identity or an IP address.

Condition vote (site)

the code of the condition voted for, the time rounded to the hour and the page language, the text of a suggested idea, a daily view count. Not tied to an identity or an IP address [to be confirmed with the lawyer that this is not personal data].

Technical logs

infrastructure providers' access logs (IP address, time) [retention and scope to be verified in provider agreements].

3. How it is collected

• Through what you enter when you sign up for and use the app.
• Through records the app produces by itself. These are the notification ID and the error record.
• Through the forms on this site. These are the closed test list, the condition vote and the idea form.
• Through a daily counter on the home page. The counter holds only the day and the source tag of a shared link (for example ?k=twitter). The tag stays in your browser's session storage until the tab is closed and is not a cookie. If you join the closed test or vote in the meantime, the tag is written to that record too.
• In the condition vote, which candidates you voted for is kept in your own browser's local storage so the same candidate is not counted twice. This record is never sent to us.
• Through the delivery, bounce and complaint events our email provider reports.

No cookie is used and there is no third-party analytics tool. An address on the closed test list counts as confirmed once the download link in the invitation email is tapped. That only shows the address works and is not a condition for staying on the list. To limit abuse, a keyed digest of the voting IP address is kept in a one-hour counter and never written to the vote.

4. Purposes and legal basis

Data is processed to provide the service (storing the letter, monitoring and opening the condition, notifications), to secure accounts and prevent abuse (phone verification, reports, blocking, rate limits), to find the app's faults (error records) and to run the closed test list (welcome and invitation emails, unsubscribing, marking bounced addresses). The basis is performance of a contract, legitimate interest and, where needed, consent (Turkish KVKK art. 5, GDPR art. 6 where applicable) [basis for the phone number and the closed test to be confirmed with the lawyer].

5. Retention

• Account data is kept until the account is deleted. Deletion becomes permanent thirty days after the request. Letters you sent remain with their recipients (encrypted with the recipient's key).
• The phone digest of an account that reached the report threshold is kept for twelve months even after deletion.
• Report records remain, anonymised.
• Error records are deleted after at most 30 days.
• Condition votes, ideas and the daily view count carry no identity and are not deleted on a schedule. The IP digest kept for rate limiting is deleted within a day.
• An address on the closed test list is kept until the person leaves the list or the address bounces permanently. A left or bounced address is deleted within 30 days. The whole list is deleted within 12 months of the app's release. It is deleted at any time on request.
• The daily home page view count carries no identity and is not deleted on a schedule.

6. Recipients and where they are

Supabase

database, authentication and server functions. Frankfurt, Germany (European Union).

Sentry

error records. European Union region.

Resend

sending email [data region to be verified in the agreement].

Google (Firebase Cloud Messaging)

notifications [data region to be verified in the agreement].

Vercel

this site [data region to be verified in the agreement].

Cloudflare

the treasure hunt page av.untillo.com and the domain [data region to be verified in the agreement].

Geoapify

address search while writing a letter. The search text goes there, results are not stored [data region to be verified in the agreement].

MET Norway

weather data. Our server asks only for the chosen city's location, which is not tied to anyone. Norway.

Apple

TestFlight invitations in the iOS closed test.

SMS provider

phone verification. Turned off today [if it is turned on, the provider will be named here].

Servers are located abroad. The transfer falls under KVKK art. 9 [basis (consent or adequacy decision) to be set with the lawyer].

7. Your rights

Under KVKK art. 11 (and the GDPR where applicable) you may learn whether your data is processed, request information, learn the purpose and the third parties it is transferred to, request correction and deletion, object, and claim damages. Requests go to the address above. You can delete your account in the app or on the account deletion page.

8. Children

The service is not directed at people under [18 or 13, to be asked] years of age.

9. Changes

Changes to this text are published on this page. Significant changes are announced in the app.