Privacy Policy

In short

Eşik is a symptom tracking and personal insight app created for women navigating perimenopause and menopause. We treat personal health data with the utmost discretion and care.

• App Name: Eşik
• Developer: FA Apps
• Contact: hello@faapps.io

Our privacy model is straightforward: By default, your health data stays entirely on your device. We do not display ads, we do not sell your data to advertising networks or data brokers, and we never profile you for marketing.

Guest mode & on-device data

You can use Eşik immediately in Guest Mode without creating an account.

• Local storage: Logged symptoms (hot flashes, night sweats, bleeding and cycle days, sleep duration, mood, freeform personal notes, etc.) remain entirely local on the user's device by default.
• No server transmission in guest mode: In guest mode, no health data is transmitted to any server; your records remain stored exclusively within the protected local sandbox on your device (SwiftData).
• On-device removal: In Guest Mode, Settings → Data → "Delete all my data" permanently erases all your records on this phone (including your profile and appointment prep); exporting first is offered, and app preferences and your subscription stay. Deleting the app from your device also permanently removes all locally stored records.

Apple Health integration

Eşik connects with Apple Health solely upon your explicit and optional consent.

• Read-only access: Eşik reads limited data from Apple Health (sleep analysis, bleeding, hot flashes and night sweats) exclusively with the user's explicit consent, and suggests entries to you.
• Nothing is added without you: Suggested entries are added to your Eşik log only when you confirm them. If you use an account, confirmed entries are also synced to the cloud backup described below.
• NEVER writes data: Eşik NEVER writes data to Apple Health.
• Permission management: You can revoke Apple Health permissions at any time via iOS Settings → Health → Data Access & Devices → Eşik. Health data is never transmitted to advertisers or third parties.

Account mode & encrypted cloud backup

For users who wish to prevent data loss or sync records across devices, an optional account can be created (Sign in with Apple or phone number).

• Encrypted cloud sync: When a user creates an account (Apple or phone number), health data is synced solely to their own encrypted cloud database (Supabase). Database access is restricted to the authenticated account owner (auth.uid()) through strict Row Level Security (RLS) policies.
• Zero data selling or sharing: Cloud-backed data is strictly never sold or shared with third parties or advertising networks.
• Provider and location: The cloud backup is hosted by Supabase in the European Union (Frankfurt, eu-central-1); data is encrypted in transit (TLS) and at rest.
• Identity data processed for the account: An account identifier; with Sign in with Apple, the email address Apple shares (this may be a private relay address); with SMS sign-in, your phone number.
• SMS verification code (Twilio): When you sign in with a phone number, the number is sent to our SMS provider Twilio (USA) to deliver and check a one-time verification code. Twilio processes it only for that purpose and for abuse prevention; your health records are never sent to Twilio.

Ad measurement (AppsFlyer) and tracking permission (ATT)

Eşik shows no ads. AppsFlyer is used to measure whether an ad campaign led you to install the app.

• Your choice: The app asks once for iOS "Allow Apps to Request to Track" (App Tracking Transparency) permission.
• If you allow: AppsFlyer receives your device's advertising identifier (IDFA) and app install/session information. Subscription purchases are forwarded to AppsFlyer through RevenueCat for campaign measurement.
• If you don't allow: The advertising identifier is not collected. Apple's privacy-preserving, aggregate measurement tools (SKAdNetwork / AdServices) are used instead.
• Never sent: Health records, symptoms, scale results, medications, notes, email, phone number and location are never sent to AppsFlyer.
• Change anytime: iOS Settings → Privacy & Security → Tracking.

Subscriptions & analytics (RevenueCat)

Eşik Plus subscriptions support the independent development of the app.

• In-App purchases via Apple: All subscription sales and payments are processed directly through the Apple App Store and billed to your Apple ID account. We do not access or store your credit card or financial details.
• Status verification: RevenueCat is used solely for validating subscription status and lifecycle analytics.
• Data scope: RevenueCat does not receive or process credit card, payment, or health data. Without an account it uses an anonymous app user identifier; with an account it uses a subscription identifier linked to your account (esik_<account id>), plus the purchase receipt. If you allowed tracking, the AppsFlyer ID and device identifiers are also sent to RevenueCat so subscription events can be matched to a campaign.

Your rights: Data export and account deletion

In full compliance with KVKK, GDPR, and Apple App Store guidelines, you maintain absolute control over your personal data:

• Export as CSV: The user can export their logged data as a CSV file to their device at any time with a single tap from app settings, ready to share with a physician or archive.
• Account and cloud deletion: The user can permanently delete their account and all associated cloud data at any time from inside the app (delete_own_account). The account's records on this phone are deleted too; guest records you had before creating the account stay on the device. Exporting your data first is recommended. If you signed in with Apple, we first revoke Eşik's access to your Apple ID through our server; if that step cannot be completed, your account is not deleted and you are asked to try again.
• Contact: For all privacy and data inquiries, our sole point of contact is: hello@faapps.io.