Privacy Policy

Effective date: to be updated on the publication date.

This Privacy Policy explains how GetAscend ("ASCEND", "GetAscend", "we", "us", "our") collects, uses, shares, transfers, retains and protects personal data when you use the GetAscend mobile application, the ascendco.app website, and related services (together, the "Service").

This document is published in English and Turkish. If there is a conflict between the two versions, the English version governs, except where mandatory local law requires otherwise.

1. WHO WE ARE

Data controller:

Furkan Halis Akın (sole proprietorship)
Akse Mahallesi, 526. Sokak, No: 22
41420 Çayırova, Kocaeli
Türkiye

Contact: getascend.dev@gmail.com

We are a small independent developer. We do not have a dedicated Data Protection Officer, and we are not required to appoint one under applicable law. All privacy enquiries go to the address above.

2. AGE REQUIREMENT

You must be 16 or older to use GetAscend.

We do not knowingly collect personal data from anyone under 16. We do not offer child-directed features, and the Service is not designed or marketed for children.

Users aged 16 or 17 are treated as below the age of consent for advertising purposes. We do not request personalised advertising for them (see Section 8).

If you believe a person under 16 has created an account or submitted photographs, contact us at getascend.dev@gmail.com. We will delete the account and associated data.

3. WHAT WE COLLECT

3.1 Photographs you submit

You may submit photographs of yourself for analysis. Depending on the analysis you request, these may show your face, skin, eyes, hair or scalp, or your posture and body alignment.

Posture and body analysis assesses physical alignment — shoulder level, spinal curvature, head position and similar postural characteristics. It does not score physical attractiveness.

You may only submit photographs of yourself. You must not submit photographs of any other person, even if that person has given you permission.

We do not scan your photo library. We only receive images you actively choose to capture or select.

3.2 Analysis results

When an analysis completes, we generate and store results derived from your photograph. These include scores, metric values, measurements, ratio estimates, breakdowns, potential values, comparative or percentile information, AI-generated commentary, recommendations, timestamps, analysis history and progress records.

3.3 Account and authentication data

Internal user identifier, Firebase user identifier, email address (where you provide one), display name, language and locale, account status, account creation and update timestamps, authentication data, and height and weight where you choose to enter them.

3.4 Subscription, purchase and credit data

Premium status, subscription product and period, renewal or expiry status, purchase platform, product identifier, transaction status, amount, currency, credit balance, credit grants and deductions, rewarded-advertisement progress, and refund or chargeback status.

We never receive or store your full card details. Payments are processed entirely by Apple or Google.

3.5 Device, technical and diagnostic data

Application version, language and locale, a stable application or device identifier, push notification token, in-app events, crash reports, error information, API request metadata, response status information and security-related information.

Our own application logging is configured not to record complete analysis request bodies or analysis photographs.

Our infrastructure and third-party providers independently process connection data such as IP address for security, delivery, fraud prevention and service operation.

We do not collect precise GPS location. Advertising and infrastructure providers may infer approximate location from IP address.

3.6 Communications

If you email us, we process your email address, the content of your message and anything else you choose to include.

4. HOW YOUR PHOTOGRAPHS ARE PROCESSED

Your photographs are processed on our servers and by third-party AI providers. They are not processed only on your device.

The processing works as follows:

1. The application sends your photograph to the GetAscend backend as part of an analysis request.
2. The backend forwards the photograph, together with analysis instructions, to a third-party AI provider (see Section 5).
3. The provider returns analysis output.
4. We convert that output into the scores, metrics and commentary you see in the app.
5. The photograph is removed from our active analysis record.

Photograph data is held only for as long as the analysis is being processed. We do not operate a photo library and we do not intentionally retain your original analysis photograph as a stored image file.

The photograph is removed when the analysis completes successfully, and also when an analysis reaches a permanent failure state. If a technical interruption prevents an analysis from reaching either state, temporary data may persist until that operation is resolved or cleaned up by our routine cleanup processes.

After the photograph is removed, the analysis results described in Section 3.2 remain associated with your account.

4.1 What we do not do with your photographs

We do not use your photographs to:

  • identify you or anyone else;
  • verify your identity;
  • authenticate you into the Service or any other system;
  • create, store or match a biometric template capable of uniquely identifying a person;
  • build a searchable database of faces;
  • assist law enforcement identification; or
  • conduct surveillance.

What we actually do: our analysis measures geometric relationships and proportions visible in the image — for example distances and ratios between facial features — in order to produce appearance scores. These measurements are used solely to generate your results. They are not retained as a biometric identifier and are not used to recognise you in any other image.

We are describing this openly because we would rather be accurate than reassuring. Our position is that this processing does not produce biometric data as defined under applicable data protection law, because we do not create, store or match any template capable of uniquely identifying a person, and identification is neither our purpose nor a technical capability of the Service. On that basis, we process your photographs to perform the contract you enter into with us when you request an analysis.

If a competent authority determines that this processing constitutes special-category or biometric processing in your jurisdiction, we will change our legal basis accordingly, obtain explicit consent where required, and update this Policy before continuing.

5. THIRD-PARTY AI PROVIDERS

We do not train or operate our own AI models. Analyses are performed with the assistance of third-party AI providers.

As of the effective date of this Policy, we use:

  • OpenAI (OpenAI API)
  • Google (Gemini API)

Your photograph and the associated analysis instructions are transmitted to the applicable provider solely to generate the analysis you requested.

We use paid API tiers that, under the applicable provider terms, do not use our API inputs or outputs to train the providers' models. Providers may retain limited data for a short period for abuse monitoring and security purposes in accordance with their own terms and their legal obligations. Provider-side logging, retention and deletion are governed by each provider's contractual terms and technical configuration, not by us.

We may add, replace or remove AI providers where reasonably necessary for quality, availability, cost, safety, legal compliance or technical reasons. We will update this Section when we do.

We do not use your photographs or analysis content to train any AI model, ours or anyone else's.

6. HOW YOU SIGN IN

You can use the Service with:

  • anonymous / guest access; or
  • email-based one-time passcode (OTP) authentication.

OTP emails are delivered through Resend and sent from noreply@ascendco.app. Passcodes expire after a short period, shown to you at the time of request.

We do not currently offer Google, Apple or telephone-number sign-in.

7. WHY WE PROCESS YOUR DATA, AND ON WHAT LEGAL BASIS

| Purpose | Legal basis (GDPR / equivalent) |
|---|---|
| Creating and operating your account; authenticating you | Performance of a contract |
| Running the analyses you request and displaying results | Performance of a contract |
| Processing photographs to generate your analysis | Performance of a contract |
| Storing analysis history and progress | Performance of a contract |
| Managing Premium, credits and purchases | Performance of a contract |
| Verifying purchases and preventing purchase fraud | Legitimate interests; legal obligation |
| Sending service and account notifications | Performance of a contract |
| Providing support | Performance of a contract; legitimate interests |
| Crash reporting, error investigation, analytics | Legitimate interests |
| Security, abuse prevention, fraud detection | Legitimate interests; legal obligation |
| Personalised advertising | Consent |
| Non-personalised advertising | Legitimate interests |
| Tax, accounting and consumer-law record keeping | Legal obligation |
| Establishing, exercising or defending legal claims | Legitimate interests; legal claims |

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms. You may object to processing based on legitimate interests — see Section 12.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before withdrawal.

8. ADVERTISING

We may show advertisements through Google AdMob, including rewarded advertisements that unlock in-app benefits.

Users aged 16 and 17: we do not request personalised advertising. Advertising requests for these users are tagged as being for users below the age of consent, which restricts the advertising served to them.

Users aged 18 and over: personalised advertising is requested only where the applicable consent requirements are met. On iOS this can include both Google User Messaging Platform consent and App Tracking Transparency permission. On Android it can include Google User Messaging Platform consent.

If the required consent is refused, unavailable, uncertain or cannot be verified, we request non-personalised advertising instead.

You can change your advertising consent at any time in your device settings, and where offered, in the app.

9. WHO WE SHARE DATA WITH

We share personal data with service providers who process it on our behalf and under contract. As of the effective date of this Policy:

| Provider | Purpose |
|---|---|
| OpenAI | AI analysis |
| Google (Gemini API, Firebase, AdMob, Google Play) | AI analysis, authentication, analytics, crash reporting, push notifications, advertising, payments |
| Apple (App Store) | Payments, distribution |
| Supabase | Database |
| Railway | Application hosting |
| RevenueCat | Subscription and purchase management |
| Resend | Transactional email |
| Cloudflare | Website hosting, security |

We may also disclose personal data where legally required to courts, regulators, law enforcement, tax authorities, or our professional advisers, and where necessary to establish, exercise or defend legal claims.

We do not sell personal data. We do not share personal data for cross-context behavioural advertising beyond the advertising arrangements described in Section 8.

10. INTERNATIONAL TRANSFERS

We operate from Türkiye and our providers operate internationally. Your personal data will be transferred outside your country of residence, including to the United States and other jurisdictions.

For transfers subject to the GDPR or UK data protection law, we rely on the transfer mechanisms available for the relevant transfer, which may include an adequacy decision, Standard Contractual Clauses (with the UK Addendum where applicable), or a derogation permitted by law.

For transfers subject to Turkish Law No. 6698 (KVKK), we rely on the mechanisms set out in Article 9 of that Law.

Where a transfer cannot lawfully be carried out, we will restrict or discontinue the affected processing.

You may request further information about the safeguards applicable to a specific transfer by contacting us.

11. HOW LONG WE KEEP DATA

| Data | Retention |
|---|---|
| Analysis photographs | Duration of the analysis only; removed on completion or permanent failure, subject to cleanup of interrupted operations |
| Analysis results and progress | While your account exists |
| Account data | While your account exists |
| Inactive accounts | Not currently deleted automatically for inactivity alone |
| Support emails | Normally up to 12 months after the last message; longer where the matter is an unresolved dispute, payment dispute or security incident |
| Technical and security logs under our control | Normally no more than 30 days; longer where needed for a documented security incident |
| Payment and transaction records | For the period required by tax, accounting, audit, refund, chargeback, fraud-prevention and consumer-protection obligations |
| Backups | Deleted data may persist in restricted backups until the relevant backup cycle expires |
| Third-party provider records | Subject to each provider's own contractual, security and legal retention periods |

12. YOUR RIGHTS

Depending on where you live, you may have the right to:

  • be informed about how we process your data;
  • access your personal data;
  • have inaccurate data corrected;
  • have your data deleted;
  • restrict processing;
  • object to processing, including processing based on legitimate interests;
  • object to decisions based solely on automated processing that produce legal or similarly significant effects;
  • data portability;
  • withdraw consent where processing is based on consent; and
  • lodge a complaint with a supervisory authority.

If you are in Türkiye, you have the rights set out in Article 11 of Law No. 6698, and you may complain to the Turkish Personal Data Protection Authority (KVKK). See our separate KVKK Disclosure Notice at ascendco.app/kvkk.

If you are in the EEA or UK, you may complain to your national data protection authority.

How to exercise your rights: email getascend.dev@gmail.com from the address associated with your account, or write to the postal address in Section 1. We will respond within the period required by applicable law — within 30 days for requests under KVKK, and within one month for requests under the GDPR, extendable where permitted.

We may need to verify your identity before acting on a request. Where we cannot verify that a request comes from you, we may decline it.

Automated processing

Your analysis scores are generated by automated processing. These scores are informational and do not produce legal effects or similarly significant effects for you: they do not determine access to credit, employment, insurance, education or any other service. If you disagree with a result, you can run a new analysis, contact us, or delete your account.

13. DELETING YOUR ACCOUNT

You can delete your account:

  • in the app, at Profile → Settings → Delete Account; or
  • by following the instructions at ascendco.app/delete-account; or
  • by emailing getascend.dev@gmail.com from your account email address.

When you request deletion, your account is disabled immediately and you are signed out. A background process then deletes your data across our systems and our providers, including your RevenueCat customer profile, your Firebase Authentication identity, your database record, your analyses and scores, your subscription and credit records, and your push notification records.

Because deletion runs across several external systems, it uses retry and checkpoint mechanisms and does not complete in the same instant across every system. It normally completes within minutes.

Limited financial records may be retained where required by law. Where they are retained, we remove your user identifier and transaction identifier from them so they can no longer be linked back to you.

Deleting your account does not cancel a subscription bought through the App Store or Google Play. You must cancel that separately through the relevant store. Deleting your account also permanently removes any unused credits, and does not by itself entitle you to a refund.

14. THE WEBSITE

The ascendco.app website exists to describe the Service, host legal documents, and provide support and account-deletion information.

The website does not run visitor analytics, advertising pixels, newsletter signup, user login, contact forms, or non-essential cookies.

The website is hosted on Cloudflare Pages. Cloudflare processes standard connection data, including IP address, to deliver and secure the site.

15. SECURITY

We use technical and organisational measures appropriate to the size of the Service and the risk involved, including authentication controls, server-side authorisation, restricted database access, encrypted transport, data minimisation, limited application logging, transient photograph processing, purchase verification, fraud controls and structured deletion workflows.

No online service can guarantee absolute security.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, you.

16. CHANGES

We may update this Policy when the Service, our providers, our processing activities, or the law change. The effective date at the top shows when the current version took effect.

Where a change is material, we will notify you in the app, by email, or by another means required by applicable law before it takes effect.

17. CONTACT

Furkan Halis Akın (sole proprietorship)
Akse Mahallesi, 526. Sokak, No: 22
41420 Çayırova, Kocaeli
Türkiye

getascend.dev@gmail.com

← Back to GetAscend