Privacy Policy

Last updated: 21 May 2026

This Privacy Policy explains what data Readout processes, why, and the rights you have over it. It is written to satisfy the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law (KVKK, Law No. 6698).

1. Data Controller

The data controller responsible for processing your personal data is the operator of the Readout service. For all data-protection questions and requests, contact us at [email protected].

2. What we collect

Readout does not ask for an email, password, or phone number. We process the following categories of data:

• Device identifier: a token generated on first launch so we can recognise your installation and keep you signed in.
• Language and timezone: detected automatically from your device so digests arrive in the right language at the right local time. You can change the language later in Settings.
• Topics and digests: the topic text you write, your chosen delivery time, and the digests we generate for you.
• Notification settings: whether push is enabled, the FCM push token, quiet hours.
• Technical and diagnostic data: app version, operating system, device type, language, and crash/error reports.
• Subscription state: whether you have an active subscription (handled via Apple App Store / Google Play and RevenueCat). We do not see or store your payment card details.

We do not collect contacts, photos, precise location, health data, biometric data, or payment card numbers.

3. Why we process it (legal basis)

We process the data above on the following legal bases:

• Performance of the service (GDPR Art. 6(1)(b), KVKK Art. 5(2)(c)): to understand your topic, generate the daily digest, deliver it as a push, and keep your past digests available.
• Legitimate interests (GDPR Art. 6(1)(f), KVKK Art. 5(2)(f)): to keep the service running reliably, prevent abuse, and improve quality (e.g. via aggregated crash reports).
• Explicit consent (GDPR Art. 6(1)(a), KVKK Art. 5(1) and Art. 9): for sending the topic text to AI providers located outside Türkiye/EEA, and for push notifications. You give this consent when you continue past the welcome screen and when you enable notifications; you can withdraw it at any time by disabling notifications or by deleting your account.

4. AI processing of your topic

To generate a digest, your topic text and short snippets of public web content are sent to AI language models, which return a summary. Please do not put sensitive information — such as health details, financial details, identity documents, or information about other identifiable individuals — into your topic. Topic text and resulting digests are stored on our servers so you can view them in the app.

5. Third-party processors and international transfers

To run Readout we rely on the following service providers. Several of them are located outside Türkiye and the EEA, which means your data is transferred internationally. By using Readout you give your explicit consent (KVKK Art. 9, GDPR Chapter V) to these transfers:

• Google (Firebase Cloud Messaging, Gemini) — push notification delivery and AI summarisation. United States / global.
• OpenAI — AI summarisation fallback and content moderation. United States.
• Brave Search, Tavily — web search to find recent public content for your topic. United States.
• Sentry — crash and error reporting. European Union (Frankfurt) region.
• Apple, Google (App Store / Play / RevenueCat) — subscription delivery and receipt validation. United States.
• Our hosting provider — application and database servers, located in the European Union.

Each provider receives only the data needed for its task, is bound by contract not to use it for unrelated purposes, and applies industry-standard safeguards (e.g. Standard Contractual Clauses for transfers out of the EEA).

6. Storage and retention

Your data is stored on secure servers in the European Union and transmitted over encrypted (TLS) connections. We keep your account and digests for as long as the account is active. Inactive accounts and the digests attached to them are subject to periodic cleanup so we don't keep data we no longer need. When you delete your account, your profile, slots, notification settings, and saved digests are removed; a small anonymous record of the deletion itself is kept to prevent abuse and to satisfy our legal obligations.

7. Your rights

Under GDPR Articles 15–22 and KVKK Article 11 you have the right to:

• learn whether we process your personal data and request a copy;
• request correction or deletion of incomplete or inaccurate data;
• object to or restrict certain processing, including processing based on legitimate interests;
• withdraw consent you have given (without affecting earlier processing);
• request portability of data you provided to us;
• lodge a complaint with a supervisory authority — in Türkiye, the Kişisel Verileri Koruma Kurumu (KVKK); in the EU, your local data protection authority.

To exercise any of these rights, email [email protected]. The fastest way to delete everything we have on you is the "Delete account" option in the app's Settings screen.

8. Security

We use industry-standard measures — encrypted transport, access control, secrets management, isolated production environments — to protect your data. No service can guarantee perfect security, but we treat security as an ongoing responsibility and respond to disclosed issues quickly.

9. Children

Readout is not intended for children under 13. We do not knowingly collect data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Changes

If we materially change this policy we will update the date above and, where the change is significant, notify you inside the app before it takes effect.

11. Contact

Questions or data-protection requests: [email protected].