PRIVACY POLICY.
IN PLAIN WORDS
- Your matches, notes and photos are private. Nobody else can see them unless you share a card yourself.
- We keep what the app needs to work, store it on our own servers in Germany, and never sell it or use it for ads.
- We use anonymous usage analytics to improve the app. They never include your notes, names, email or photos.
- Delete your account in the app and everything goes with it.
1. Who we are
Krampo is an iPhone app for logging the football matches you watch, made in Türkiye. The app and this website (getkrampo.com) are run by [Operator legal name], [registered address], Türkiye (“Krampo”, “we”, “us”).
We are the data controller (veri sorumlusu) for your personal data under the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, where it applies to you, the EU and UK General Data Protection Regulation (“GDPR”). Contact us at [email protected].
2. What we collect
Your account
- Email and password if you sign up with email. Passwords are stored only as a secure hash by our database provider; we can’t read them.
- Sign in with Apple: a user identifier from Apple, the email Apple gives us (which can be a private relay address if you chose “Hide My Email”), and your name if you choose to share it.
- Your profile: the display name you type, your club, and the year you started supporting them (optional).
Your log
- Entries: the match, your rating, your note, where you watched (stadium, pub, home or abroad, and any detail you type such as a stand, a pub or an area), which side you were for, your man of the match, and the stickers you placed.
- Photos you add to an entry, after any filter you applied.
- Watch mates: the names of the people you add, and which matches you watched with them. You type these names, or pick them from your contacts (see section 3). They are visible only to you.
- Matches added by hand: the team, competition and ground names you type, the date and the score.
- Settings: the leagues you follow, your reminder preferences and the upcoming matches you plan to watch.
Technical data
- Server logs: when the app talks to our servers, our providers record technical data such as your IP address, the time of the request and the result. We use these only to keep the service running and secure.
- Analytics: see section 6.
3. What stays on your iPhone
Krampo asks for a permission only when you use the feature that needs it, and you can change it any time in the iPhone’s Settings.
- Camera and Photos: to take or pick a photo for an entry. To show you the photos taken during a match first, the app looks at the dates of photos on your iPhone; this happens on the device. Only the photo you pick is uploaded.
- Contacts: to find the people you watch with by name. The search happens on your iPhone, and only the name you pick is saved. Nothing else from your contacts is read or uploaded.
- Microphone and speech recognition: to dictate a note. Where your iPhone supports it, speech is turned into text on the device. Otherwise Apple’s speech recognition service processes the audio under Apple’s privacy policy; Krampo never receives or stores the audio.
- Notifications: for full-time reminders, if you turn them on.
The app also keeps a copy of your log on your iPhone so it opens quickly and works offline. It is removed when you sign out or delete your account.
4. What we don’t do
- No advertising, no ad tracking, and no advertising identifier (IDFA). Krampo never asks to track you across apps.
- We don’t sell or rent your personal data, and we don’t share it with anyone for their own marketing.
- Your log isn’t public. There are no profiles, followers or public feeds. A share card is an image you choose to post yourself; once you post it, the place you post it to handles it under its own terms.
5. Why we use it (legal bases)
| Purpose | Data | KVKK | GDPR |
|---|---|---|---|
| Create your account, run your log, its stats and sync between your devices | Account, profile, log, settings | Art. 5(2)(c) – necessary for the contract | Art. 6(1)(b) – contract |
| Send sign-up and password emails | Art. 5(2)(c) | Art. 6(1)(b) | |
| Keep the service secure and fix problems | Server logs | Art. 5(2)(f) – legitimate interest | Art. 6(1)(f) – legitimate interests |
| Understand how the app is used and improve it | Analytics | Art. 5(2)(f) | Art. 6(1)(f) |
| Answer your messages and requests | Email, what you write to us | Art. 5(2)(c), (f) | Art. 6(1)(b), (f) |
| Meet legal obligations | As required | Art. 5(2)(ç) | Art. 6(1)(c) |
Your notes, photos and watch-mate names are content you write. They may mention other people or reveal personal opinions; please don’t add anything about someone else that they wouldn’t want kept.
6. Analytics
We use Google Analytics for Firebase to count how the app is used: for example, how many matches are logged, how long logging takes, and which screens people open. This helps us decide what to improve.
- What is sent: named events with fixed values (for example “match logged”, “at the stadium”, “has a photo: yes”, “note length: 41–100 characters”), screens viewed, your club and the number of leagues you follow, plus device data that Firebase collects automatically: an app instance identifier, the iOS vendor identifier (IDFV), device model, iOS and app version, language, and approximate country derived from your IP address.
- What is never sent: your notes, watch-mate names, email address, photos, or anything else you type.
- The advertising identifier isn’t collected, and Google signals and ads personalization are turned off.
- When you delete your account, the app resets its analytics identifier.
7. Who processes it for us
We use these providers to run Krampo. They process your data only on our instructions and under data processing agreements.
| Provider | What for | Where |
|---|---|---|
| Hetzner Online GmbH | The servers that run our database, sign-in and photo storage, and store their encrypted backups | Germany (EU) |
| Google LLC (Firebase) | Anonymous usage analytics | United States and other countries |
| Apple Inc. | Sign in with Apple, push notifications, speech recognition when not on the device, the App Store | United States and other countries |
| Cloudflare, Inc. | Hosting this website | Global network |
| Resend, Inc. | Sending sign-up and password emails | EU sending region (Ireland); US company |
We may also disclose data if the law requires it, for example to a court or a public authority, or to protect our rights. If Krampo is ever sold or merged, your data would move to the new operator under this policy, and we would tell you first.
8. International transfers
Your log is stored in the EU. Some providers above are based in the United States or work globally, so your data may be processed outside Türkiye and outside the EU/UK. We rely on the safeguards the law provides: for Türkiye, standard contracts under Article 9 of KVKK; for the EU/UK, the European Commission’s standard contractual clauses, the UK addendum, or the EU–US Data Privacy Framework where a provider is certified. Ask us for a copy of the relevant safeguards.
9. How long we keep it
- Your account and log: for as long as you have an account. Deleting an entry, a photo or a watch mate removes it straight away.
- After you delete your account: removed from our live systems immediately; copies in encrypted backups are deleted within about 5 weeks.
- Server logs: up to [90] days.
- Analytics: event-level data is kept for 2 months, then only aggregated reports that don’t identify you.
- Emails you send us: as long as needed to answer, and up to [2] years after.
10. Deleting your account
In the app, go to You › Settings › Delete account and everything in it. This deletes, immediately and permanently:
- your account, email and sign-in details;
- your profile, club and followed leagues;
- every entry, note, rating, sticker and photo;
- your watch mates and matches added by hand;
- your reminder settings and plans;
- the copy on your iPhone, and the app’s analytics identifier.
It can’t be undone. If you want to keep your log, use Settings › Export your log first (a CSV file of your matches and notes). If you signed in with Apple, you can also stop using Apple ID with Krampo in your iPhone’s Settings. If you can’t open the app, email us from the address on your account and we’ll delete it for you.
11. Your rights
Under Article 11 of KVKK and, where it applies, Articles 15–22 of the GDPR, you can:
- find out whether we process your data, and get a copy of it;
- ask us to correct it, or to delete it;
- receive your data in a portable format;
- object to processing based on our legitimate interests (including analytics), or ask us to restrict it;
- learn who we transfer it to, in Türkiye or abroad;
- object to a result that goes against you and comes only from automated processing (Krampo makes no such decisions);
- claim compensation if you are harmed by unlawful processing.
You can do most of this in the app: edit or delete anything, export your log, or delete your account. For anything else, including a full copy with your photos, email [email protected] from the address on your account. We answer free of charge within 30 days.
You can also complain to a regulator: in Türkiye, the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, kvkk.gov.tr); in the EU, the data protection authority where you live; in the UK, the Information Commissioner’s Office (ico.org.uk). We’d appreciate the chance to fix things first.
12. Children
Krampo isn’t made for children. You must be at least 13 to use it, and at least 16 if you live in the EU or UK (or the age set by your country, if different), unless a parent or guardian agrees. If you believe a child has given us data, contact us and we’ll delete it.
13. Security
Data is encrypted in transit (HTTPS) and at rest. Each user’s rows and photos are protected by access rules on the database, so one account can’t read another’s. Access to production systems is limited to the people who run Krampo. No system is perfectly secure; if a breach affects your data, we’ll tell you and the regulators as the law requires.
14. Changes to this policy
If we change this policy, we’ll update the date at the top. If a change matters for how your data is used, we’ll tell you in the app before it takes effect.
15. Contact
[Operator legal name], [registered address], Türkiye. Email: [email protected].