Privacy Policy

Last updated: [TO FILL: publication date] · Draft of November 3, 2026 · Türkçe

1. Who we are

Sare is a pregnancy app for iPhone. This policy explains what personal data the Sare app and this website handle, why, and what your choices are. It applies to the app and to hellosare.com.

The controller of your personal data (the “data controller” under the GDPR and UK GDPR, and the “veri sorumlusu” under Türkiye’s KVKK) is:

“Sare”, “we”, “us” and “our” mean the controller above.

2. What stays on your phone

Some of the most personal things in Sare never leave your iPhone. We don’t receive them and can’t see them:

• Your photos: bump photos, ultrasound images (the cleaned-up version and the original), moment photos and the birth photo, with their week, date, title and note.
• Image processing: straightening and cleaning up ultrasound printouts, reading the date on a printout, and finding names and patient numbers so they can be blurred on keepsakes all happen on your phone.
• Keepsakes (share cards) are made on your phone. They only go where you send them with the iOS share sheet.
• Reminders are scheduled on your phone as local notifications. Sare doesn’t use a push notification server.
• Your health-related answers during setup stay on your phone until you give consent at the end of setup (see section 4).

Your phone also keeps a copy of your records so Sare opens quickly and works offline, and a queue of changes made while offline.

Backups are up to you. Your photos are part of your iPhone’s backup (iCloud Backup or a backup on your computer), which Apple or your computer handles under its own terms. If you turn on Also save to Photos, each photo is also copied to a “Sare” album in your Photos library, where iCloud Photos may sync it if you use it. If you delete Sare without a backup, the photos are deleted too.

3. What we store, and why

To sync your records and bring them back on a new phone, Sare stores the following on our servers, hosted by Supabase (see section 9). Each table row is locked to your account.

If you write to us, we keep your email address and messages in our support inbox to answer you.

We don’t ask for your age, your weight at sign-up, previous pregnancies, or your contacts. We don’t collect your precise location; your country or region comes from your phone’s settings.

4. Health data and your consent

Health data is a special category of personal data under the GDPR and UK GDPR, “özel nitelikli kişisel veri” under the KVKK, and “consumer health data” under some US state laws. Sare treats everything about your pregnancy, cycle and health this way.

• Separate and explicit. At the end of setup Sare asks for your consent in its own step: “I agree that Sare stores and processes my health data to run the app.” You can choose Not now.
• Without consent Sare works in read-only mode: you see your week and the week’s reading, and nothing health-related is stored on our servers. You can turn it on later in Profile.
• Every write is checked. Our servers refuse to save health records for an account without consent.
• Withdrawing consent (Profile › Privacy & data › Health data › Withdraw consent) stops Sare saving anything new at once. What was saved before stays on the server, so you can still see and export it, until you delete it on the same screen with Delete my health data from the server. [TO CONFIRM with counsel: whether previously stored health data must be deleted automatically on withdrawal]

5. Signing in and backing up

Sare starts with an anonymous account: a random ID, no email, no password. If you choose Back up your account, you can link one of these to the same account:

• Sign in with Apple: we receive an Apple identifier, the email address Apple shares (which may be a private relay address if you choose Hide My Email) and your name if you share it.
• Google: we receive a Google identifier and the profile details Google shares at sign-in, such as your email address, name and profile picture link.
• Email: you type your email and we send a 6-digit code (valid for 10 minutes). There is no password. Code emails are sent by our email provider, Resend, with open and click tracking turned off.

We use these only to sign you in. We don’t send marketing emails. [TO CONFIRM: if marketing emails are ever added, they will be opt-in only]

6. Subscriptions

Sare Pro is sold through the App Store. Apple handles payment; we never see your card or payment details. We use RevenueCat to manage subscriptions. When you open Sare, the RevenueCat software in the app identifies you to RevenueCat with your random Sare user ID (never your name or email) to check what you’ve bought. RevenueCat receives the App Store transaction details and the technical information its software needs, such as app version, iOS version, language, store country and IP address. We also tell RevenueCat how you heard about Sare (the creator’s handle and whether you came via a list, code or link) so creator revenue shares can be reported. RevenueCat then tells our servers your subscription status.

7. Usage statistics and crash reports

Today the app sends no usage statistics and no crash reports. [TO CONFIRM before launch: the analytics and crash-reporting tools, their providers and regions. If the app launches without them, keep only the sentence before this note.]

If we add usage statistics, they will follow these rules, which are already built into the app:

• Only a short fixed list of neutral events, such as “app opened”, “record saved”, “paywall viewed” or “export completed”. No event says which category, week, value, med, symptom or note was involved, and nothing from a check-in is ever sent beyond “check-in done”.
• A random install ID, never your Sare account ID, and never shared with an advertising network.
• No session recording, no automatic capture of screens or taps, no advertising identifier (IDFA).

Crash reports, if added, would contain technical details of the error and your device, not your health records.

8. AI

Sare currently has no AI features and sends none of your data to AI providers. If we add one, we will update this policy before it’s available and explain exactly what is sent, and it will be optional.

9. Who processes data for us

We use a small number of service providers. They process data on our instructions and under data processing agreements, or, where marked, act as independent controllers under their own privacy policies.

We may also disclose data if the law requires it, to protect people’s safety, or as part of a merger or sale of the business, in which case this policy would continue to apply to your data.

10. What we never do

• We don’t sell or rent your personal data, and we don’t share it for advertising.
• We don’t show ads and have no advertising software in the app.
• We don’t track you across other companies’ apps or websites, and we don’t ask for the advertising identifier (IDFA).
• We don’t use your health data for marketing, and we don’t make automated decisions about you that have legal or similarly significant effects.

11. Legal bases (GDPR and UK GDPR)

• Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)): pregnancy, cycle and health records and check-ins.
• Contract (Art. 6(1)(b)): your account, sign-in, settings, syncing, Sare Pro and answering support requests.
• Legitimate interests (Art. 6(1)(f)): keeping the service secure and working, preventing abuse, recording how you heard about Sare to pay creators, and usage statistics without health data if we add them. You can object to these at any time.
• Legal obligation (Art. 6(1)(c)): keeping purchase records for tax and accounting.

Your care team contacts (names and phone numbers of your midwife, doctor or doula) are details about other people. Add only what you need, and only for your own use.

12. How long we keep data

• Your account and records: until you delete them or your account.
• Accounts never backed up: an anonymous account that has no subscription and isn’t used for 180 days may be deleted with all its data. [TO CONFIRM: this clean-up runs by hand today; confirm the rule and how “used” is measured]
• After you delete your account: every row of yours is deleted from our database at once, and your customer record at RevenueCat is deleted first. Database backups at our hosting provider are overwritten within [TO CONFIRM: backup retention, e.g. 7 days].
• Records we must keep: purchase and payout records needed for accounting and creator revenue shares are kept without your name, email or account for [TO CONFIRM: period required by tax law].
• Support emails: [TO CONFIRM: e.g. 2 years after the conversation ends].
• On your phone: until you delete them, delete your account, or delete the app.

13. Your rights, and how to use them

Depending on where you live, you have the right to access your data, receive a copy (portability), correct it, delete it, restrict or object to processing, and withdraw consent at any time without affecting what was done before. Most of this is built into the app. Open Profile with the round button at the top right of Today:

For anything else, or if you no longer have the app, email contact.sareapp@gmail.com. We may ask you to confirm the request from the email address linked to your account. We answer within one month (30 days under the KVKK). You can also complain to your data protection authority, for example your EU authority, the UK Information Commissioner’s Office (ICO), or Türkiye’s Personal Data Protection Authority (KVKK).

14. International transfers

Our providers may process data outside your country, including in the United States. Where data leaves the EEA, the UK or Türkiye, we rely on adequacy decisions where they exist, the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, the EU-US Data Privacy Framework where the provider is certified, and, for Türkiye, the standard contracts under Article 9 of the KVKK. [TO CONFIRM: the mechanism for each provider, and notification of the KVKK standard contracts to the Authority]

15. Security

• Data travels over encrypted connections (TLS) and is encrypted at rest by our hosting provider. It is not end-to-end encrypted: our systems can process it to run the app.
• Every table is locked to its owner with row-level security, so one account can never read another’s rows.
• Secret keys stay on the server, never in the app.
• Access to production systems is limited to the people who need it to run Sare.
• Your photos never reach our servers, so they can’t leak from them.

No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as the law requires.

16. Children

Sare is meant for adults. You must be at least 18, or the age of majority where you live, to use it. [TO CONFIRM: minimum age] We don’t knowingly collect data from children. Details you add about your baby (such as a name, sex, birth date, weight and length) are entered by you as the parent and handled like the rest of your data.

17. Türkiye, the US and other regions

Türkiye (KVKK)

If you live in Türkiye, the Turkish version of this policy is our information notice (aydınlatma metni) under Law No. 6698. It explains your rights under Article 11 and how to apply to us.

United States

We treat your pregnancy and health data as consumer health data under laws such as Washington’s My Health My Data Act. We collect it to provide the app you asked for, only with your consent; we share it only with the processors in section 9; we never sell it. You can access, export and delete it as described in section 13, and withdraw consent at any time. We don’t sell or “share” personal information as those terms are defined under California law. [TO CONFIRM with counsel: whether a separate Consumer Health Data Privacy Policy page is needed]

18. This website

hellosare.com uses no cookies, no analytics and no third-party scripts, and loads no fonts or files from other sites. It is hosted by Cloudflare, which processes technical request data such as your IP address to deliver pages and protect the site.

19. Changes to this policy

We will update this page when the app or the law changes, and change the date at the top. If a change matters to how your data is used, we will tell you in the app before it takes effect, and ask for consent again where needed.

20. Contact

Questions or requests about privacy: contact.sareapp@gmail.com.
Post: [TO FILL: legal entity name and address]