Privacy Policy

Last updated: October 29, 2026

Wordseal (called Şahit in Türkiye) is operated by GMY Bilişim Sanayi ve Ticaret Ltd. Şti..

Data controller

GMY Bilişim Sanayi ve Ticaret Ltd. Şti.
Cumhuriyet Mah. Yağmur Sok. Çamlık Sitesi C Blok Daire 5, 16140 Nilüfer / Bursa, Türkiye
Contact: privacy@wordseal.app

This notice applies to all users. It also serves as the information notice required by Turkish Law No. 6698 (KVKK) and sets out the information required by Articles 13–14 of the GDPR.

What is Wordseal?

Wordseal lets two people keep an IOU record between them together. It does not move money, take payments or lend; records are information notes belonging to the parties and are not an official document or e-signature.

Personal data we process

• Account data: user ID, email address, display name, optional profile photo link and language from your sign-in provider (Apple, Google or email).
• Record data: amounts (money, gold etc.), due date, installment plan, payment notices, note, status and event history. The other person's name is the name you type yourself; we never access your contacts.
• Witness data: records you invite witnesses to or join as a witness, and your display name.
• Notification data: your device push token. Notifications never contain amounts.
• Subscription data: your Premium status and your reward counter. We never see your card details; payment goes through your store account.
• Advertising data: device identifiers and ad interactions collected by our ad partner Google AdMob, only according to your choice and consent.
• Anonymous usage counters: aggregate counts such as screen or event names; they contain no amounts, names or record content and are not linked to you.
• Technical data: IP address, request time and error logs for security and abuse prevention.

Purposes and legal bases

• Providing the service: account, shared records, invitations, witnesses, reminders and notifications. Legal basis: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c).
• Security, abuse prevention and improving the service (anonymous counters). Legal basis: our legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5/2-f).
• Verifying subscriptions and purchases. Legal basis: contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).
• Personalized ads and notification preferences. Legal basis: your consent (GDPR Art. 6(1)(a)); you can withdraw it at any time.

Recipients and international transfers

• Google Firebase (authentication, database): data may be processed on servers outside your country, including the USA.
• Google AdMob (ads): only on the free plan and according to your consent choice.
• RevenueCat: subscription management and purchase validation.
• Cloudflare: hosting of our server functions and these web pages.
• Expo Push and the Apple/Google notification services: delivering notifications.
• Transfers outside the EEA/UK rely on the providers' adequacy decisions or standard contractual clauses (GDPR Chapter V) and, for Türkiye, KVKK Art. 9. We do not sell your data.

Ads and your choices

The free plan shows ads. Depending on your country, Google's consent form (UMP) and, on iOS, the tracking permission prompt ask whether ads may be personalized. If you decline you see non-personalized ads. You can change your choice from the ad privacy option on the Profile screen. Premium removes ads. The content of your records (amounts, names, notes) is never shared with ad partners.

The other person and witnesses

The other person and witnesses of a record can see its contents (amounts, due date, installment plan, note, names) and event history. You type the other person's name yourself; if you create a record naming someone else, we recommend telling them first.

Retention and account deletion

We keep your data while your account is open. If you delete your account, your profile, push tokens, subscription record and block list are deleted and your sign-in account is removed. Records shared with someone else are not deleted, so the other person keeps their copy; your name on those records is anonymized as “Deleted user” and the email linked to your account is removed. Technical logs are kept only as long as our providers' own retention periods. Details: Account deletion.

Your rights

Under GDPR Articles 15–22 (and KVKK Art. 11) you may request access to your data, rectification, erasure, restriction of processing, data portability, and object to processing; you may withdraw consent at any time without affecting earlier processing. We do not make decisions based solely on automated processing that significantly affect you. To use your rights write to privacy@wordseal.app from the address on your account; we reply within one month (30 days under KVKK). You may also complain to your local data protection authority (in Türkiye, the Personal Data Protection Board). Providing account and record data is necessary to use the service; ad personalization is optional.

Children

The app is for people aged 18 and over.

Changes

We may update this notice; the current version is published at this address.