Privacy Policy

This Privacy Policy explains how Korvelis, (“Korvelis”, “we”, “us”, or “our”), collects, uses, stores, discloses, and protects personal data when you use the Korvelis mobile application and related services (together, the “Service”).

For questions or privacy requests, contact [email protected].

1. Data controller

Korvelis determines the purposes and means of processing personal data described in this policy and acts as the data controller where applicable.

Controller contact:

Korvelis [email protected]

2. Personal data we process

The data processed depends on the features you use and the choices you make.

Account and profile data

• authentication identifier;
• email address and Sign in with Apple information made available by Apple;
• display name, username, biography, avatar, and profile visibility;
• account state, preferences, and authentication/session records.

Fitness and body information

• workouts, exercises, sets, repetitions, load, duration, training volume, routines, and training history;
• bodyweight, height, age or age-related onboarding input, recovery context, and progress information you choose to provide;
• coaching observations, program selections, training preferences, and readiness-related inputs;
• optional records read from Apple Health when you grant the relevant permission: bodyweight, steps, Apple exercise time, cardio fitness (VO2 max), resting heart rate, running speed, sleep analysis, workouts, heart rate, and heart-rate variability.

Most detailed workout, routine, body, recovery, and coaching records are designed to remain local-first on your device and, where enabled, in your private Apple iCloud/CloudKit storage. Raw workout sessions and sets are not uploaded to the Korvelis social backend merely because you record a workout.

Social and community data

• profile information visible according to your settings;
• workout summaries, captions, photos, and visibility choices you publish;
• follows, follow requests, likes, saved posts, comments, replies, and related timestamps;
• reports, blocks, moderation records, sanctions, and appeals;
• notification preferences and notification history.

Published workout summaries can include selected exercise names and aggregate statistics. A workout photo is uploaded only when you choose to attach and publish it.

Device, service, and diagnostic data

• push-notification device token, app environment, bundle identifier, and notification settings;
• technical request information that infrastructure providers may process, such as IP address, timestamps, response status, and security logs;
• privacy-filtered diagnostic records that you explicitly export or provide for support;
• crash or error information you choose to share with Korvelis or Apple.

Korvelis does not currently use third-party advertising SDKs or sell personal data.

3. How data is collected

We collect data:

• directly from you when you create an account, complete onboarding, record training, edit your profile, publish content, communicate with us, or use community features;
• from Apple when you use Sign in with Apple, iCloud/CloudKit, Apple Health, notifications, or other Apple services after granting relevant permission;
• automatically through normal service requests, security controls, and server logs; and
• from other users when they interact with your public or permitted content, follow you, mention your content in a report, or otherwise use community features involving you.

4. Purposes and legal grounds

We process personal data for the following purposes and, where applicable, legal grounds under Turkish Personal Data Protection Law No. 6698 (“KVKK”):

• Provide and perform the Service: authenticate users, preserve account state, record workouts, operate routines, deliver requested coaching functions, synchronize permitted data, publish selected content, and provide community features. This processing is necessary to establish or perform the user relationship and provide requested functionality.
• Honor your choices and permissions: process optional Apple Health information, photos, camera access, notifications, and optional profile or publishing information when you actively enable or use those features. Where required for health data or another special category of personal data, processing depends on your explicit consent or another lawful condition under applicable law.
• Secure the Service: prevent fraud, abuse, unauthorized access, spam, and technical attacks; investigate errors; protect users; and maintain integrity. This supports our legitimate interests in operating a safe and reliable service, provided those interests do not override your fundamental rights and freedoms.
• Moderate community activity: receive reports, apply blocks, review potentially harmful content, enforce community rules, maintain sanctions and appeals, and preserve necessary audit records. This supports performance of the Service, safety obligations, legal claims, and legitimate interests in protecting the community.
• Communicate with you: deliver authentication codes, important account or security messages, requested notifications, support responses, and material service notices. This is based on providing the Service, your notification choices, and applicable legal obligations.
• Comply with law and establish legal claims: respond to lawful requests, maintain records required by law, enforce agreements, and protect legal rights.

We do not use Apple Health data for advertising, marketing profiles, or sale to data brokers.

5. Apple Health

Apple Health is optional. If you grant the relevant permission, Korvelis may read only these approved record types for private fitness and coaching features:

• bodyweight;
• step count;
• Apple exercise time;
• cardio fitness (VO2 max);
• resting heart rate;
• running speed;
• sleep analysis;
• workouts;
• heart rate; and
• heart-rate variability.

If you separately turn on Live workout metrics on Apple Watch, the Watch may also read active-energy records created during that active Korvelis workout. The Watch uses a HealthKit strength-training session to show current heart rate and cumulative active energy inside the active Korvelis Watch app and the corresponding foreground workout screen on your paired iPhone. These values come from Apple Watch and HealthKit; Korvelis does not estimate or invent them.

Live heart rate and active energy are temporary active-workout presentation data. Korvelis does not add them to your sets, workout history, Coach evidence, posts, share cards, profile, analytics, diagnostics, notifications, complications, widgets, Live Activities, Dynamic Island, Lock Screen, Siri, Shortcuts, or App Intents. Turning the feature off, unavailable metrics, or a denied permission does not prevent you from recording a Korvelis workout.

Korvelis does not request Apple Health height, body-fat, dietary, route, blood, reproductive-health, medication, mindfulness, or clinical-record access in the currently approved scope. Active-energy access is limited to the separately enabled live Apple Watch workout feature described above.

Apple controls each Health permission through system settings. Korvelis cannot determine every individual read-permission decision; it can only report whether requested groups return readable records, no readable records, or an error. You may review or revoke Apple Health access in system settings at any time.

If you separately enable workout export, Korvelis may write a completed Korvelis workout to Apple Health as a traditional strength-training workout. The export includes the authoritative workout start, end, and duration with duplicate-prevention metadata. It does not export sets, repetitions, load, notes, heart rate, routes, or calories. When live Watch metrics are enabled, the Watch HealthKit session may instead save the one Apple Health workout and its Apple-collected samples. Korvelis uses stable duplicate-prevention metadata so the live Watch session and ordinary export do not create two Health workouts for the same Korvelis workout. Health denial or export failure never removes or rolls back the workout saved in Korvelis.

Disconnecting Apple Health inside Korvelis stops Health checks for the current Korvelis account and clears protected temporary Health cache and request state. It does not revoke permission in Apple settings, delete records owned by Apple Health, delete Korvelis workout history or manual bodyweight, or erase the local receipts used to reconcile workout exports.

Readable Health records can support private trends, but Korvelis remains authoritative for workout structure and history. A manual Korvelis bodyweight entry takes precedence over imported Health bodyweight on the same evaluation day. Health data and source metadata are not automatically published to the community, shared through Live Activities or complications, or uploaded to the Korvelis social backend.

Apple Health data is treated as sensitive information. Do not include health information in a public caption, comment, photo, or profile unless you intentionally want it to be visible to the selected audience.

6. Local storage and private iCloud sync

Detailed training data is stored locally using Apple platform storage. When private CloudKit synchronization is available and enabled for your Apple account, Apple may synchronize eligible local records within your private iCloud database. Korvelis cannot directly browse your private CloudKit database in the same way it can access data you intentionally submit to the Korvelis social backend.

Apple Health query cursors and source/device provenance retained by Korvelis are account-scoped local state and are not uploaded through Korvelis CloudKit, social, or analytics paths.

Deleting the app may remove local data from that device but does not necessarily delete data retained in your private iCloud account. You control iCloud through Apple settings.

Live Activities and system surfaces

When you explicitly start a workout and Live Activities are enabled, Korvelis may provide Apple system surfaces such as the Lock Screen and Dynamic Island with limited local workout status, including timers, exercise names, and set progress. This information can be visible while your device is locked. Korvelis does not use remote ActivityKit push updates in the currently approved scope, and Live Activity state is not uploaded to the Korvelis social backend.

You can disable Live Activities through iOS settings. Disabling them does not prevent Korvelis from recording, recovering, or completing the workout inside the app. Protect access to your device and review your system notification and Live Activity privacy settings if you do not want workout details visible on system surfaces.

7. Data shared through community features

Profile and social content is visible according to the audience and relationship controls available in the Service. Public content may be viewed, copied, captured, or reshared by other users outside Korvelis. We cannot control copies made by others before content is removed.

Private and followers-only controls reduce intended visibility but cannot eliminate every risk of unauthorized copying or disclosure. Review content carefully before publishing.

8. Service providers and recipients

We disclose only the data reasonably necessary for providers to perform services for Korvelis. Relevant recipients may include:

• Apple: Sign in with Apple, Apple Health permission handling, private iCloud/CloudKit synchronization, push notifications, operating-system services, and App Store distribution;
• Supabase and its infrastructure providers: authentication, database, private media storage, access control, and backend operations;
• email delivery providers: delivery of authentication codes and essential account messages;
• authorized Korvelis personnel and contractors: support, security, operations, and moderation on a need-to-know basis; and
• public authorities, courts, or professional advisers: when disclosure is legally required or reasonably necessary to establish, exercise, or defend legal rights.

We require service providers to process data under appropriate confidentiality, security, and data-protection obligations.

9. International transfers

Apple, Supabase, email delivery providers, and their infrastructure may process data in countries outside Turkey. Where personal data is transferred internationally, Korvelis will use a transfer method and safeguards required by applicable law, including KVKK requirements where they apply.

The exact processing location can depend on provider configuration and infrastructure. Contact [email protected] if you need more information about relevant provider categories or transfer safeguards.

10. Retention and deletion

We retain personal data only for as long as reasonably necessary for the purposes described in this policy, including to provide the Service, maintain security, resolve disputes, enforce agreements, and comply with legal obligations.

• Local data remains on your device until you delete it, delete the app, erase the device, or the app removes it through an available feature.
• Private CloudKit data is retained under your Apple account and Apple settings.
• Remote account and profile data is generally retained while your account is active.
• Published and social data is retained until you delete it, request account deletion, or it is removed under moderation or legal processes.
• Security, moderation, appeal, transaction, and audit records may be retained longer where necessary to prevent abuse, document decisions, resolve disputes, or comply with law.
• Deleted data may remain for a limited period in protected backups or logs before being securely overwritten, unless longer retention is legally required.

To request deletion of your Korvelis account and associated remote personal data, contact [email protected] from the email associated with your account. We may request information needed to verify identity. Deleting the app alone does not delete the remote account.

11. Security

We use technical and organizational measures intended to protect personal data, including authentication boundaries, row-level access controls, private media storage, short-lived media access links, restricted administrative access, and local-first storage for detailed training records.

No system is completely secure. Protect access to your device, Apple account, and email, and contact us if you suspect unauthorized access.

12. Your rights

Subject to KVKK Article 11 and other applicable law, you may have rights to:

• learn whether your personal data is processed;
• request information about processing;
• learn the purpose of processing and whether data is used consistently with that purpose;
• learn the recipients to whom personal data is transferred domestically or internationally;
• request correction of incomplete or inaccurate data;
• request deletion or destruction where legal conditions are met;
• request notification of correction, deletion, or destruction to relevant recipients;
• object to a result against you produced exclusively through automated analysis; and
• request compensation where unlawful processing causes damage.

Depending on the law that applies to you, additional rights may include access, restriction, objection, portability, or withdrawal of consent. Withdrawing consent does not affect processing already performed lawfully before withdrawal.

Send requests to [email protected]. Please describe your request and the account involved. We may verify your identity and respond within the period required by applicable law. You may also lodge a complaint with the Turkish Personal Data Protection Authority or another competent authority.

13. Children

The Service is not intended for a child who cannot legally consent to these practices or enter the Terms without a parent or legal guardian. If you believe a child’s personal data has been processed improperly, contact [email protected].

14. Changes to this policy

We may update this policy to reflect product, provider, legal, or operational changes. We will update the effective date and provide additional notice when required. Material changes will not be applied retroactively where prohibited by law.

15. Contact

Privacy questions, rights requests, and complaints may be sent to:

Korvelis [email protected]