Privacy Policy

In short

This policy explains what data I process when you use the ÇAMUR mobile app and camurapp.com. I built the app on my own, so this text says "I": there is no company behind it, and the data controller is me as a natural person.

I do not sell your data. I do not share it with anyone for advertising purposes.

The app shows ads, but they are non-personalised: no advertising profile is built for you, no system tracks you across apps, and nothing about your account or the work you make reaches the ad network. Exactly what does reach it is listed point by point under Advertising below.

Who makes this app

There is no company behind ÇAMUR. The app, this site and the character were all made by me — Baran Şahin, an independent developer working alone. No investors, no team, nobody selling data. I am also the person responsible for your data.

Contact: camur@baransahin.com
Web: baransahin.com

What I collect

Account information

You can create an account in two ways:

• Email and password: I process your email address and chosen display name. Your password is never stored in plain text — only as an irreversible hash.
• Sign in with Apple or Google: The provider sends me only a user identifier and an email address. If you choose to hide your email with Apple, I receive a relay address and never see your real one. I never see your password.

Error logs

When something inside the app fails unexpectedly I record four things: where it happened (for example "saving a seal"), the technical error message, the app version and the platform (iOS / Android). I do not record your device model, your OS version or what you were doing on screen.

These logs go into my own Supabase database, not into a third-party crash reporting service — I do not use Firebase Crashlytics, Sentry or anything similar.

They are linked to your account. Each log is stored with your account identifier so I can see how often one person hits the same failure and follow up if needed. Deleting your account breaks that link and the log becomes anonymous. Logs are deleted after at most 60 days.

Push notifications

The app sends two kinds of notification, and you control the two separately:

• Social notifications — when someone likes your work or follows you. They come out of your own use of the app and are part of the service; on by default.
• Announcements — occasional broadcasts about new features. Off by default; I ask you once after you grant notification permission and send nothing unless you say yes.

You can change either at any time under Profil → Ayarlar → Telefon bildirimleri (Profile → Settings → Phone notifications). Turning notifications off in your phone’s own settings switches all of them off at once.

To deliver notifications I store your device’s push token; it is deleted when you sign out.

Usage analytics

I do not collect usage analytics. Which screens you open, how long you stay and what you tap are not recorded anywhere. The app contains no Google Analytics, Firebase Analytics, Facebook SDK or any comparable measurement tool.

I do not track you across apps. Your data is not linked with data collected from other companies' apps or websites, and it is never sold to data brokers. The app never asks for tracking permission, so iOS shows no App Tracking Transparency prompt and your IDFA never reaches anyone. What happens with the Android advertising ID is set out, without varnish, under Advertising.

Website

camurapp.com uses no cookies and contains no forms. My hosting provider may temporarily log IP addresses and request times as a technical necessity. The site loads fonts from Google Fonts, which means your IP address reaches Google’s servers.

Advertising

The app shows ads. I’m not going to hide why: Çamur is free and it is staying free — putting a payment screen in front of someone who wants to learn ceramics does not sit right with me. But the app has to cover its costs somehow. Instead of subscriptions or in-app purchases, I chose ads.

The ads are served by Google AdMob; how Google handles that data is set out in its own advertising privacy policy.

The ads are non-personalised. They are chosen by the context of the app, not by who you are. Which means:

• No advertising profile is built for you and no interest category is assigned to you.
• There is no system that tracks you across apps: your data is not linked with data from other companies' apps and websites, and it is not sold to data brokers. The app never asks for tracking permission, so that prompt never appears on iOS — and your IDFA never reaches the ad network.
• Nothing about your account, your email address, your username or the things you make in the app — your pieces, your notes, your progress — is sent to the ad network.

Let me be straight about the advertising ID. On Android, your advertising ID (Android Advertising ID) does reach the ad network. Not to target you or build a profile of you, but for frequency capping (so you don't see the same ad over and over), aggregated reporting and fraud prevention. "Non-personalised" does not switch that off — Google's own documentation says as much. It would have suited me to write otherwise. I didn't.

Everything that reaches the ad network:

• Your IP address — used to estimate approximate, city-level location
• Your device type and operating system version
• On Android, your advertising ID; on both platforms, an identifier scoped to the app or the developer
• Which ad slot was shown, and which ads you saw or tapped
• Basic technical and performance data such as app launch time and crash reports

This data is shared with the ad network, which acts as a separate data controller for it under its own privacy policy. None of it is stored by me.

In Europe you'll see a consent screen. Users in the European Economic Area, the UK and Switzerland are asked whether they allow data to be stored on their device. That question is about storage, not personalisation — the law in those regions requires it. If you are in Türkiye, you won't see it.

Beyond ad revenue I make no money from Çamur: I do not sell data, there is no sponsored content and nothing inside the app is paid.

Legal basis

Under Article 5 of KVKK: account data is processed to perform my contract with you; error logs and non-personalised ad serving rest on my legitimate interest in keeping the app working and paid for — because the ads are not personalised and no profile is built, no separate consent is collected for them. (Users in the European Economic Area, the UK and Switzerland are shown a separate consent screen for on-device storage, as the law there requires.) You may object to processing based on legitimate interest.

Who I share with

I share data only with the providers I need in order to run it: hosting, authentication, email delivery, notification delivery and ad serving. I share it with no one else. I may disclose data to authorities where legally required.

Every provider except the ad network acts as a data processor: they process the data only on my instructions, to run the service, and none of them receives data for advertising.

Google AdMob acts as a separate data controller under its own privacy policy. What reaches it is listed point by point under Advertising above; nothing outside that list goes from you to it.

Retention

Account data is kept until you delete your account. Error logs are deleted after at most 60 days. No analytics data is collected, so there is no measurement record to keep.

Clearing backups takes a little longer; they roll over on the infrastructure provider’s own cycle.

Your rights

Under Article 11 of KVKK you have the right to access your data, to have it corrected or deleted, and to object to its processing. Write to camur@baransahin.com and I will respond within 30 days.

Deleting your account

You can delete your account and data at any time: Delete account

Children

The app is not directed at children under 13 and I do not knowingly collect data from them. If I discover such data, I delete it.

Changes

When this policy changes I update the date above. For significant changes I also notify you inside the app.