Privacy Policy
Boylu is a posture and stretching routine app published by MelberLabs LLC (Wyoming, USA; "we", "us"). This policy explains what data the app handles, where it stays, and what you can do about it. The short version: almost everything stays on your phone, nothing is sent to a server unless you create an account, and your posture photos never leave your device.
1. Data that stays on your device
When you use Boylu without an account, the following is stored only in the app's private storage on your phone and is never transmitted to us:
- your goal, birth year, height, hours sitting per day and unit preference;
- your routine history (which days and moves you completed, duration);
- your height measurements and notes;
- posture check results (score, angles, apparent-height estimate);
- posture photos, only if you switch on "Keep photo" (off by default). Photos are stored in the app's protected storage, excluded from cloud backup and device-to-device transfer, and deleted when you delete the check;
- settings such as reminders, voice guidance and language.
Posture detection runs entirely on the device (Apple Vision on iOS, Google ML Kit on Android). The photo is not uploaded, not analysed by any external service and not used for any purpose other than showing you the result.
2. Data we process on our servers
We run a small API (hosted by Amazon Web Services in Frankfurt, Germany) that is used only for the purposes below.
| Purpose | Data | Retention |
|---|---|---|
| Anonymous device session (needed for purchases) | random install identifier, device identifier, platform, app version, country and language of the request | until the account or device is deleted; inactive anonymous devices are removed after 18 months |
| Optional account | e-mail address and a hashed password, or your Apple sign-in identifier (we never see your Apple password) | until you delete the account |
| Sync across devices (only with an account) | measurements, routine history and posture check results (numbers only; never photos) | until you delete the data or the account |
| Subscription verification | store transaction identifiers, product, status and dates received from Apple or Google | 10 years after the last transaction, anonymised after account deletion (legal and tax obligations) |
| Product analytics | a short list of in-app events (for example "onboarding done", "paywall viewed") linked to your pseudonymous user id, with app version and country | 13 months |
| Crash reports (only if enabled in the build) | stack traces, device model, OS version; no e-mail, no file paths, no photos | 90 days (Sentry) |
| Security logs | IP address, request time, rate-limit counters | 30 days |
3. Apple Health
If you switch on "Write height to Apple Health" (off by default), Boylu writes your height measurements to the Health app. Boylu does not read any Health data. Data written to Health is never used for advertising, never sold, and never sent to us or to any third party.
4. Advertising measurement (Meta)
We advertise Boylu on Meta platforms. To know whether an advertisement led to an install or a subscription, the app can include the Meta SDK. It is only started if all of the following are true: you are 18 or older, and on iOS you allowed tracking in the App Tracking Transparency prompt, or on Android you tapped "Allow" on our ad-measurement screen. In that case Meta receives your device advertising identifier and two events: "trial started" and "subscribed", with the price and currency. Meta never receives your height, posture, photos, measurements or any health-related data. If you decline, the SDK is never started and the app works exactly the same. You can change your choice at any time in Settings → Privacy (iOS: in the system Settings under Privacy → Tracking). Meta's processing is described in the Meta Privacy Policy; we enable Meta's Limited Data Use setting.
5. Third parties
- Apple App Store / Google Play process payments and subscriptions; we receive only transaction data, never your card.
- Amazon Web Services (Frankfurt) hosts our API and database.
- Resend sends verification and password-reset e-mails.
- Sentry receives crash reports, if enabled.
- Meta, only as described in section 4.
We do not sell personal data and we do not share it with data brokers.
6. Legal bases (GDPR / UK GDPR / KVKK)
Performance of the contract (account, sync, subscriptions); our legitimate interests (security, fraud prevention, product analytics, crash reporting); your consent (advertising measurement, Apple Health writing, reminders); legal obligations (tax and accounting records).
7. International transfers
Our servers are in the European Union. Apple, Google, Sentry and Meta may process data in the United States under standard contractual clauses or the EU-US Data Privacy Framework. For users in Türkiye, data is transferred abroad on the basis of your explicit consent given in the app where required by the KVKK.
8. Your rights
You can access, correct, export or delete your data at any time. Delete account in Settings → Account removes your account, measurements, routine history and posture checks from our servers within 24 hours and wipes the app on that device; purchase records are kept anonymised as required by law. You can also write to us (section 11). You have the right to object to processing based on legitimate interests, to withdraw consent at any time and to lodge a complaint with your supervisory authority (for example the ICO in the UK or the KVKK Board in Türkiye).
9. Children
Boylu is for people aged 16 and over. The app asks for your birth year and does not continue if you are younger. Advertising measurement is never offered to anyone under 18.
10. Security
Connections use TLS. Passwords are stored with Argon2id. Purchases are verified server-side with Apple and Google. Photos are stored with full file protection on iOS and excluded from backups on both platforms. Our logs never contain e-mail addresses, file paths or request bodies.
11. Contact
MelberLabs LLC, 30 N Gould St, Sheridan, WY 82801, USA · melberlabs@gmail.com
Türkiye contact (KVKK): İbrahim Melikşah Köse, Türkiye · melberlabs@gmail.com
12. Changes
We will post changes here and update the effective date. For material changes we will also notify you in the app.