Huppi — Privacy Notice on the Processing of Personal Data

Translation. This is an English translation of the Turkish "Aydınlatma Metni" provided for information only; the Turkish text is the legally binding version. If the two differ, the Turkish text prevails. Draft (22.10.2026). It will be reviewed by legal counsel before release. Fields in square brackets will be filled in. Version: 2026-10-v1 (sent as consent_version in the app's consent record).

1. Data controller

[Futurecode ticaret unvanı], [adres], MERSİS: [numara] ("Futurecode"). The Huppi app is developed and operated by Futurecode.

2. Personal data processed

• Identity and contact: name, email address; when you sign in with Apple or Google, the identity information these services share.
• Profile: gender, year of birth, height, weight, activity level, time zone, unit preference, goals (all optional).
• Habit and health data (special category): water entries, steps, distance, calories, sleep durations and stages, and the fasting timers you set yourself.
• Game data: XP, level, streak, badges, quests, coins, league ranking, friend connections.
• Device data: notification token, operating system type.
• Menstrual cycle data is kept only on your phone and is not sent to our servers.

3. Purposes of processing and legal grounds

• Creating the account, enabling sign-in and running the app: establishing and performing the contract (KVKK Art. 5/2-c).
• Storing habit and health data, syncing it across devices and calculating game points: your explicit consent (KVKK Art. 6). You can withdraw your explicit consent at any time in the app settings; in that case this data is not processed on the server.
• Sending notifications: performance of the contract; notification content never includes health values.
• Security and legal obligations: legal obligation and legitimate interest (KVKK Art. 5/2-ç, f).

Huppi does not provide health services, does not diagnose and does not give medical advice.

4. Transfer of data and transfer abroad

• Server hosting: Your data is stored on servers in Hostinger International Ltd.'s data center in Germany (Frankfurt). This transfer is made under the standard contract set by the Turkish Personal Data Protection Board in accordance with KVKK Art. 9.
• Notification service: Google Firebase Cloud Messaging (abroad); only the device token and notification text without health values are sent.
• Sign-in services: If you choose to sign in with Apple or Google, authentication is carried out through these companies.
• Friends and league: other users only see your first name, the initial of your last name, your avatar, level, title, streak and weekly XP; your health data is never shown to any user.
• To authorized public authorities where required by law.

5. Method of collection

Electronically, through the information you enter in the app and, if you allow it, through your phone's step counter and Health Connect.

6. Retention period

When you delete your account, your data is kept for 30 days in a way that can still be restored, and is then permanently deleted. Records subject to a legal retention obligation are kept for the required periods.

7. Your rights (KVKK Art. 11)

You have the right to learn whether your data is processed, to request information, to learn the purpose of processing, to know the parties it is transferred to, to request correction or deletion, to ask that the parties it was transferred to be notified, to object to the result of automated analysis and to claim compensation for damages. You can get a copy of your data with the "Download my data" option in the app.

Application: by email to [kvkk@futurecode.com.tr] or in writing to [adres].