Privacy Policy

In short

Pamuk has no accounts. Your data stays on your phone. If you never invite anyone into your home, nothing reaches our server. If you do, changes travel through the server so both phones can see the same home.

Data that stays on your phone

The following is stored only on your device and we have no access to it:

• Your rooms, chores, and when you did them
• The name you gave the creature and your own display name
• Your app settings
• Your device identifier and secret key (in your phone's secure keychain)

Data that reaches the server

Only when you join a home or invite someone, the following is sent:

• A randomly generated device identifier (UUID). Not your name, email, or phone number.
• A cryptographic hash of your secret key. The key itself is never stored on the server.
• A home identifier and invite code.
• Change records. These are opaque byte strings to the server software, which never opens them and only relays them. However, there is no end-to-end encryption today — someone with physical access to the server could technically read the contents. We keep the server from touching them so that encryption can be added later.

Notifications

If you allow notifications, your phone's push token and time-zone offset are stored on the server — to reach the right phone at a reasonable hour rather than in the middle of the night. If you decline, this data never exists.

Anonymous counters

To understand which parts of the app are used, we keep anonymous counters: only a day, an event name, and a number. No device identifier is recorded, and these counters cannot be traced back to any person.

What we don't do

• We show no advertising.
• We use no third-party tracking tools.
• We do not sell, rent, or share your data.
• We do not ask for your location, contacts, or photos.
• We do not collect an advertising identifier (IDFA).

Retention and deletion

Deleting the app removes all data from your phone. Change records on the server are deleted automatically once every device in the home has received them and thirty days have passed. To have everything removed completely, write to the support address.

Children

Pamuk is not directed at children under thirteen, and we do not knowingly collect data from them.

Your rights

Under GDPR and Turkey's KVKK you have the right to access, correct, and delete your data. Because we keep no accounts, most of your data is already only yours; for the part on the server, writing to the support address is enough.

Contact

destek@pamukapp.com