Cookie Policy

1. Scope and Definitions

This Cookie and Tracking Technologies Policy (the "Policy") sets out the scope and purposes of use of the cookies, Software Development Kits (SDKs), local storage tools and similar mobile tracking technologies used within the "Growbaby" mobile application (the "Application") operated by Snaiper Teknoloji Anonim Şirketi (the "Company"), and your rights in relation to these technologies.

Rather than the standard browser cookies used on traditional websites, mobile applications use device-based SDKs and in-app local storage areas in order to optimise in-app functionality, stability and the user experience. Within this Policy, the term "Cookie" is used to cover all of these tracking technologies and SDK infrastructures running on your mobile device.

2. Technical Classification of the Technologies Used

All of the third-party integrations in our Application architecture, detailed below, are limited solely to operational requirements and the purpose of improving the user experience:

A. Mandatory and Strictly Necessary Technologies (Strictly Necessary SDKs)

These technologies must run for the Application to perform its basic functions, to ensure security and to perform our contractual obligations. By the nature of the system, these tools cannot be turned off:

Supabase SDK: The Application's core data store and infrastructure. It is required for managing user sessions (Authentication), for the secure storage of authentication tokens, and for synchronising the user profile and family/child notes.

Apple and Google Sign-In SDKs: Where the user chooses them of their own will, they provide fast, passwordless and secure authentication (OAuth).

RevenueCat SDK: Required for the instant verification and management of in-app "Growbaby Unlimited" subscriptions, purchases and StoreKit/Google Play Billing payment status.

Resend API/SDK: Required for delivering password resets, family invitation codes and system/transactional emails to the user.

B. Debugging, Performance and Operational Infrastructure Technologies (Performance & Infrastructure SDKs)

Used on the legal basis of "Legitimate Interest" to protect the stability of the Application, to ensure cyber security and to monitor technical crashes second by second:

Sentry SDK: Used to detect technical crashes, freezes and code-level errors in the Application in real time. Raw chat messages, baby notes or audio files are not sent to Sentry; in the mobile application, fields named email, password, token and child name/ID are masked at the top level ([redacted]) before they are sent, and mobile reports are collected in the EU (Germany). A crash report may carry the most recent in-app event trail (including coarse child context such as age group and gender) and the country derived from the IP address; an error report about a failed database operation may in some cases contain the fields that operation returned. Our server side's error reports contain account, family and child identifiers as technical tags (details in Section 7 of the Privacy Policy).

Expo / EAS (Expo Application Services): Processes device and update metadata in order to keep the Application on its latest version and to deliver critical security patches and remote updates (OTA, over-the-air) to the device.

Expo Push (APNs and FCM intermediary): Where the user grants permission at device level, it manages the push-token mechanism that delivers development reminders and push notifications to the device through Apple's and Google's servers.

Mux (video streaming): The videos we offer within the Application are hosted and streamed on Mux; playback events, device information and the approximate location derived from the IP address are processed as part of delivering the video and are not associated with the user account (see Section 7.2 of the Privacy Policy).

C. Product Analytics, Advertising Attribution and Lifecycle Messaging Technologies:

Mixpanel: Processes only the event types we have defined (about fifty) for user behaviour analysis and product development; automatic collection is off. The identity is a hashed (pseudonymous) value derived from the account identifier, and no email or name is sent; events and the analytics profile carry limited child context (gender, age group, age in months on the onboarding event, caregiver role, language), onboarding answers and install campaign fields; Mixpanel derives an approximate location from the IP address. Data is sent to Mixpanel's EU data centre (details in Section 7.2 of the Privacy Policy).

Airbridge SDK and Android Play Install Referrer: Used to attribute which marketing channel (advertisement/link) the Application was downloaded through, to verify installs and to analyse advertising conversions; the install source and campaign information, the account identifier, the approximate (city-level) location derived from the IP address and the provider's own device-matching identifiers are processed. The iOS advertising identifier (IDFA) is accessed only if ATT permission is granted; Apple's SKAdNetwork framework separately delivers privacy-preserving install notifications. Subscription events are forwarded to Airbridge from our own server (they contain no advertising identifier, IP address, ATT status or email; see Section 7.3 of the Privacy Policy). No baby notes, sound analysis or Growy AI chat history are EVER transmitted to these tools.

RevenueCat SDK (analytics level): In addition to the mandatory purchase check (Article 2/A), purchase, trial and subscription events are forwarded to Mixpanel through the RevenueCat integration, and RevenueCat receives, among the subscriber attributes, the paywall placement from which the purchase was started (which can show which feature screen you came from) and integration identifiers (see Section 7.3 of the Privacy Policy).

Customer.io (lifecycle messaging): Used to schedule and personalise lifecycle notifications and engagement messages; the account identifier, the child's name and date of birth, time zone, language and subscription status are processed, together with lifecycle events (for example week/month birthdays, a Growy question asked, a recipe viewed). Health-related events are not sent to Customer.io. Data is processed in the United States; when the account is deleted, the person record at Customer.io is deleted (details in Section 7.2 of the Privacy Policy).

3. Global Regulations and Store Compliance Notes

For residents of the European Union (GDPR / ePrivacy) and the United Kingdom (UK): In-app analytics and infrastructure technologies run as part of operating the service, as described in Section 7 of the Privacy Policy. On iOS, access to the advertising identifier (IDFA) is in every case subject to ATT permission. On our website growbaby.ai, PostHog runs only according to the choices you make in the site's cookie banner; Google tags load on every visit and, unless accepted, start in a denied consent state, in which case they set no cookies but may send cookieless, aggregate measurement signals to Google; cookies are used only after your acceptance (details in Section 9 of the Privacy Policy).

For Apple iOS users (ATT, App Tracking Transparency compliance note): Under Apple's privacy policies, for analytics tools to be able to track device-based identifiers, consent must also be given on the "App Tracking Transparency" pop-up shown by the iOS operating system. You can withdraw this permission at any time from your device settings.

Marketing integrations and Apple ATT (App Tracking Transparency) compliance note: Access by the advertising attribution (Airbridge) and analytics (Mixpanel) tools within our Application to device-based advertising identifiers (IDFA/GAID) is subject, for iOS users, to active consent given on the Apple ATT (App Tracking Transparency) screen and, on Android, to the device-level advertising identifier controls. If permission is not given, the advertising identifier is not accessed and no tracking based on the advertising identifier takes place; providers may carry out limited and probabilistic measurement within their own infrastructure using parameters that do not include the advertising identifier (IP address, device configuration, timestamps) (see Section 7.4 of the Privacy Policy). This does not prevent use of the Application's main functions.

4. Time Limit and Forfeiture for Privacy and Tracking Claims (Time Limit for Claims)

To the maximum extent permitted by applicable mandatory law, the User must bring any legal claim or cause of action arising from the tracking technologies, SDK use or data logs within the scope of this Policy, or from privacy breach allegations connected with them, before the official authorities within the time limits set out below:

A. For residents of the United States (US): The relevant arbitration or legal proceeding must be started at the latest within 1 (ONE) YEAR of the date on which the event giving rise to the claim occurred.

B. For residents of the European Economic Area (EEA), the United Kingdom (UK) and Türkiye: To the maximum extent permitted by the relevant consumer and data protection legislation, the official proceeding must be started at the latest within 2 (TWO) YEARS of the date on which the claim arose or should reasonably have been noticed. Where these geographic time limits are exceeded, the relevant claim or right of action will be deemed permanently and conclusively time-barred, and the User will be deemed to have waived those rights.

5. Severability and Automatic Minimum Substitution of Periods (Savings Clause)

Where the 1- or 2-year time limits set out in Article 4, or any disclaimer, are declared invalid or unenforceable by a competent court or data protection authority of the user's country of residence as an "unfair term" or for conflict with mandatory legislation:

(a) Survival of the clause: That finding of invalidity will in no way affect the validity and enforceability of the other provisions of this Policy; all the remaining articles of the Policy will continue to bind the parties.

(b) Automatic minimum period substitution: The relevant time limit found invalid will not disappear altogether; instead it will be deemed automatically raised, revised and replaced by the "SHORTEST STATUTORY PERIOD" (minimum statutory period permitted by law) that the mandatory laws of the relevant country allow to be set by contract.

6. Primacy of Mandatory Statutory Log Retention Obligations (Primacy of Statutory Logs)

Even where the User withdraws permissions and preferences relating to tracking (for example the ATT permission, the research contribution preference, AI consents) or submits an account deletion request, if the national or international mandatory legislation to which the Company is subject, cyber security logging obligations (for example the logs under Law No. 5651 in Türkiye, or international cyber security standards) or duties to prevent fraud require system error and access logs (Audit Logs) to be kept for longer than stated in this Policy, or where a statutory maximum retention period exists, those mandatory maximum periods will apply first and directly in the Company's favour. Where the law requires longer or maximum periods to apply, those statutory retention periods will be deemed absolutely to prevail over the user's deletion or cookie refusal requests.

7. Refusal of Necessary Technologies, Wrongful Blocking and Service Interruption (Consequences of Blocking Necessary Trackers and No-Refund Policy)

7.1. Users may at any time turn off or withdraw the "Contribute soothing research" preference from the Profile > Manage My Data screen, and their AI consents relating to artificial intelligence providers by writing to support@growbaby.ai from their account's email address; on iOS the ATT permission and the device-level advertising identifier controls are always in the user's hands. Using these preferences does not prevent use of the Services (features that depend on a withdrawn AI consent cannot be used until the consent is given again).

7.2. However, where the User does not permit, disables or blocks the "Mandatory and Strictly Necessary" technical technologies under Articles 2/A and 2/B, which ensure the Application's cyber security, prevent fraud and abuse, run session management and log system errors second by second, by means of device-based third-party software, VPN/AdBlocker filters, network manipulation or operating system interference (jailbreak, root and so on), the Company reserves the right, in order to protect the structural integrity and cyber security boundaries of the platform, to provide no service at all to that user and to suspend, restrict or close the account immediately.

7.3. Non-refundability in the case of wrongful technical blocking: Because the blocking or disabling of the mandatory technologies results from the User's own wrongful technical interference in breach of the agreement, where the Company suspends or closes the account for platform security, no partial (pro-rata) or full refund of the subscription fees paid for the unused period will in any case be made, even if the User has an active paid subscription (except where applicable local mandatory consumer laws expressly require otherwise). The User accepts in advance that the absence of a refund following the blocking of mandatory cyber security logs is not an unfair penalty, but a set-off against and compensation for the cyber risks, infrastructure disruption and administrative and operational losses suffered by the Company. The parties accept that the final authority in subscription billing and any refund dispute processes is the policy of the relevant In-App Store (Apple App Store or Google Play Store).

8. Informal Resolution as a Precondition (Informal Resolution First)

Before applying to an official judicial authority or a Data Protection Authority (KVKK, ICO, EDPB and so on) in relation to the use of tracking technologies or an alleged breach of this Policy, the parties accept as a contractual good-faith obligation that the 30-day Mandatory Informal Pre-Application process set out in Article 10 of the Terms of Service is followed and that the claim is first notified in writing to support@growbaby.ai.

9. Policy Changes and Update Procedure (Modifications)

The Company reserves the right to change, update or renew this Policy unilaterally at any time in line with technical requirements, the integration of new tracking technologies or SDKs into the system, or updates to international legislation.

Where a material change is made to the Policy that directly affects the user's rights, extends retention periods or adds a new third-party SDK, Users will be given the necessary information through an in-app notification, an updated-version notice or a Cookie Banner (pop-up), and, where mandatory laws so require, renewed consent (opt-in) will be requested for analytics tracking preferences. Continuing to use the Application after the changes are published means that you have read and accept the current terms of the Policy. If you do not accept the updated terms, you can turn off the optional tracking technologies with the controls described in Article 7.1, or delete your account.

10. Contact

For any question or technical support request about tracking technologies and your cookie preferences, you can contact us directly:

Data Controller: Snaiper Teknoloji Anonim Şirketi

Email: support@growbaby.ai