1. Introduction and Scope
1.1. This Privacy Policy (the “Policy”) describes how personal data is processed through the Dandini iOS application (the “App”) and the dandini.app website (the “Site”; together with the App, the “Service”). It constitutes the privacy notice required by Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, where applicable, the information required by Articles 13 and 14 of the EU General Data Protection Regulation (EU) 2016/679 (“GDPR”).
1.2. The Service uses artificial intelligence to create personalized, illustrated and narrated bedtime stories for children, and provides ambient sleep sounds. The App is available on iPhone and iPad.
1.3. The Service is designed to be used by parents or guardians aged 18 or over. Children may not operate the Service or hold an account; information about children is entered only by a parent or guardian (see Section 6).
2. Definitions
- User / you: the parent or guardian, aged 18 or over, who uses the App.
- Child: the person whose profile the User creates in the App and for whom stories are generated.
- Personal data: any information relating to an identified or identifiable natural person.
- Special category data: data concerning religion, belief, philosophical conviction and similar matters within the meaning of KVKK Article 6 and GDPR Article 9.
- Processor: a service provider that processes personal data on behalf of the controller.
- Account ID: the anonymous identifier randomly generated on first use of the App that identifies your account.
- Dandi's memory: the optional family memory feature described in Section 7.
3. Data Controller
3.1. The controller of your personal data is Arda Erem Karagöz (AEK Studio), a sole proprietorship located at Maslak Mah. Aos 55 Sok. B Blok No: 4/542, Sarıyer / İstanbul 34485, Türkiye (the “Controller”, “we”, “us”).
3.2. Questions and requests regarding this Policy may be sent to [email protected].
4. Categories of Personal Data
4.1. Account and technical data: Account ID, App version, device type and operating system, last-use time, and server and security logs necessary for the secure and uninterrupted operation of the Service.
4.2. Child profile data: the child's name, age or date of birth (to determine the age band), gender, avatar preferences, interests and notes optionally entered by the parent.
4.3. Family characters: the names and roles of family members or other characters to appear in stories (e.g. “grandma”, “big brother”).
4.4. Story requests and chat content: messages you write in the in-app story chat and your story requests.
4.5. Generated content: story texts, illustrations and narrations generated for you, saved sound mixes and App preferences.
4.6. Dandi's memory data: only where you have given explicit consent, short notes you shared in the chat and agreed to have remembered. These notes may contain special category data (see Section 7).
4.7. Purchase data: subscription status, purchase history and diamond balance. Payments are processed by Apple; we do not access or store your card or other payment details.
4.8. Notification data: the push token required to deliver notifications to your device and your notification preferences.
4.9. Usage analytics data: usage events such as screen views and in-app interactions. The child's name and story content are not included in analytics data (see Section 11).
4.10. Content-safety records: results of the content-safety review of your inputs and, where applicable, records of policy violations (see Section 9).
4.11. Correspondence data: your email address and the content of your correspondence if you contact us by email.
4.12. Advertising measurement data: only if you grant iOS App Tracking Transparency (ATT) permission and the in-app setting "Allow data collection for analytics" is on: the Account ID, the anonymous ID that the advertising measurement provider assigns to your device, the device/advertising identifier (IDFA), the identifier for vendor (IDFV), IP address and app events (app install or open, onboarding completed, trial or subscription started or renewed, diamond pack purchase, and the related value and currency). This data does not include the child's name, age, story content or family memory, nor your email address or telephone number (see Section 11).
4.13. We do not collect postal address, precise location, school, telephone number or passwords. The App shows no ads and contains no ad-serving network; the advertising measurement using device identifiers described in Sections 11.3–11.8 depends solely on your permission; for Apple's attribution systems that do not require permission, see Sections 11.5 and 11.9.
4.14. Apple Search Ads attribution data: attribution information provided by Apple on whether the App was installed through an Apple Search Ads ad and, if so, about the related campaign; this information is linked to your Account ID (see Section 11.9).
4.15. Story sharing data: if you create a share link for a story, the link code and sharing status, and records of visits to the shared page (random visitor ID, event type, country and time; see Sections 18.3–18.8).
5. Purposes and Legal Bases
5.1. Your personal data is processed for the following purposes and on the following legal bases:
| Purpose | Data categories | Legal basis |
|---|---|---|
| Creating the account and providing the Service; generating personalized stories, illustrations and narration; storing your library | 4.1–4.5 | Conclusion and performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)); for the child's data, the explicit consent of the parent or guardian (KVKK Art. 5(1); GDPR Art. 6(1)(a)) |
| Keeping the family memory for personalized story suggestions | 4.6 | Explicit consent (KVKK Arts. 5(1) and 6(2); GDPR Art. 9(2)(a)) |
| Managing subscriptions and diamond transactions | 4.1, 4.7 | Performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)); legal obligation (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)) |
| Sending story-ready, account and reminder notifications | 4.1, 4.2, 4.8 | Performance of a contract and legitimate interest (KVKK Art. 5(2)(c) and (f); GDPR Art. 6(1)(b) and (f)) |
| Sending marketing notifications | 4.1, 4.8 | Consent (KVKK Art. 5(1); GDPR Art. 6(1)(a)) |
| Usage analytics to improve the Service and detect errors | 4.1, 4.9 | Legitimate interest (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)); can be turned off in the App at any time |
| Measuring advertising performance (determining which ads lead to installs and subscriptions) | 4.1, 4.12 | Explicit consent (KVKK Art. 5(1); GDPR Art. 6(1)(a)): iOS ATT permission and the in-app "Allow data collection for analytics" setting. You can withdraw either at any time (iOS Settings or the App's Preferences) |
| Measuring how Apple Search Ads ads contribute to installs and subscriptions | 4.1, 4.14 | Legitimate interest (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)); you may object under Section 17 |
| Creating story share links when you share a story in the App, serving the shared story page and counting visits to it | 4.2, 4.3, 4.5, 4.15 | Performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)); for the child's data shown on the shared page, the explicit consent of the parent or guardian who starts the sharing (KVKK Art. 5(1); GDPR Art. 6(1)(a)); for counting visits, legitimate interest (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)) |
| Ensuring content safety and preventing abuse and fraud | 4.1, 4.4, 4.10 | Legitimate interest (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)) |
| Responding to your requests and providing support | 4.1, 4.11 | Performance of a contract and legitimate interest (KVKK Art. 5(2)(c) and (f); GDPR Art. 6(1)(b) and (f)) |
| Complying with legal obligations and establishing, exercising or defending legal claims | All relevant categories | Legal obligation and establishment, exercise or defence of a right (KVKK Art. 5(2)(ç) and (e); GDPR Art. 6(1)(c) and (f)) |
5.2. Your personal data is not sold, is not used for advertising or targeting (other than the permission-based advertising measurement described in Sections 11.3–11.8 and the Apple attribution systems described in Sections 11.5 and 11.9), and is not used to train any artificial intelligence model.
6. Children's Personal Data
6.1. The App is not designed to be used or operated by children. The account holder must be an adult aged 18 or over. We do not knowingly permit a child to operate the App.
6.2. A child's personal data is entered by the parent or guardian, not collected from the child, and is processed on the basis of the parent's or guardian's explicit consent. This data is processed solely to generate age-appropriate, personalized stories. Beyond that, the child's name appears only on the page and preview of a story share link that the parent or guardian creates themselves (see Sections 18.4 and 18.8).
6.3. The parent or guardian may view, correct and delete all of the child's data in the App at any time. If you withdraw your consent, you may delete the relevant child profile or have all of your data deleted as described in Section 15.
6.4. If you believe that a child's personal data has been processed without the consent of a parent or guardian, please notify us at [email protected]; the data will be deleted without delay.
6.5. In processing children's data we observe KVKK, the GDPR (including Article 8) and, to the extent applicable, the principles of the U.S. Children's Online Privacy Protection Act (COPPA).
7. Dandi's Memory
7.1. Nature. “Dandi's memory” is an optional feature that remembers short details you share in the story chat (for example, “We visit Grandma on Saturday mornings” or “We set a table for iftar during Ramadan”) for use in later story suggestions. The feature is off by default.
7.2. What is stored. Concrete details you state in the chat are stored as short notes of no more than 120 characters, in your own words. These notes may include information about traditions, holidays, values or beliefs your family chooses to share. No labels or profiles about you (such as “religious” or “conservative”) are derived from this information or stored. Your children's interests and notes are held in their child profiles; the memory does not duplicate them.
7.3. Explicit consent. The memory is enabled only with your explicit consent. When the story chat contains something worth remembering, you are asked once; selecting “Yes, remember” enables the feature, and selecting “Not now” means you will not be asked again. You may also enable the feature in Settings, which shows the same consent text. If you do not consent, nothing is stored and details you share in the chat are used only for that story.
7.4. Purpose and access. Stored details are used solely to offer more relevant story suggestions and to personalize stories. They are not used for advertising, profiling, scoring or any other purpose, and are not shared with or sold to third parties. The Dandini team, including the founders, cannot access the contents of the memory in our administrative tools; only whether the feature is on or off and how many items it holds can be seen.
7.5. Viewing and deletion. In Settings > Dandi's memory you can view all items, delete items individually, turn the feature off, or erase all items and the summary with “Delete memory and turn off”. Deletion is permanent and cannot be undone. While the feature is off, nothing new is stored.
7.6. Legal basis. Because these details may reveal religious or philosophical beliefs or family life, they are processed on the basis of your explicit consent (KVKK Arts. 5(1) and 6(2); GDPR Art. 9(2)(a)). You may withdraw your consent at any time by turning the memory off; withdrawal does not affect the lawfulness of processing carried out before withdrawal.
7.7. Processing and transfer. Memory items are stored on the servers described in Section 12. When a story suggestion or story is generated, relevant items may be sent, as part of the request, to the artificial intelligence providers described in Sections 8 and 12. Section 13 applies to international transfers.
7.8. Retention. Memory items are kept until you delete them or delete your account; deleting your account deletes the memory.
8. AI-Generated Content
8.1. Story texts, chat replies, illustrations and narrations are generated through artificial intelligence service providers. For this purpose the child's name, age, gender and interests, your notes, the names and roles of family characters, your chat messages and, if enabled, relevant memory items are sent to these providers.
8.2. Story text and chat are provided through AI service providers, configured so that providers do not retain request content (zero data retention) and do not use it for model training. Image generation and text-to-speech are also provided through AI service providers; storage of inputs and outputs is disabled through the settings available for these services.
8.3. Only the minimum data necessary to generate the relevant content is sent to AI providers. This data is not used to train any artificial intelligence model.
9. Content Safety and Automated Review
9.1. To keep the Service suitable for children, your inputs such as story requests, chat messages and profile information are subject to automated content-safety review, which combines defined word lists with AI-assisted assessment. Inputs found to be inappropriate are rejected.
9.2. Review results and records of policy violations are retained. Repeated violations of the content rules may result in free-text input being temporarily restricted. This restriction serves the security of the Service and does not constitute a decision producing legal effects concerning you or similarly significantly affecting you. If you believe a restriction is mistaken, you may request human review and submit an objection at [email protected].
10. Notifications
10.1. The App may send story-ready, account, reminder and marketing notifications. Marketing notifications are sent only with your consent.
10.2. Notifications may include your child's first name. This setting is on by default and can be turned off in the notification settings. Notifications are delivered through the Apple Push Notification service (APNs), and their content therefore passes through that service to reach your device.
10.3. You may disable each notification category separately in the App's notification settings or in your device's system settings.
11. Usage Analytics
11.1. To improve the Service and detect errors, usage analytics data is processed on servers located in the European Union through an analytics service provider. Analytics data is associated with the Account ID; the child's name and story content are not included.
11.2. You may turn off usage analytics at any time in the App's Settings. Turning analytics off does not affect the operation of the Service.
11.3. Advertising measurement and permission. The App includes a software development kit (SDK) from an advertising measurement provider, used to measure which ads lead to installs and subscriptions. This SDK is started only if you grant iOS App Tracking Transparency (ATT) permission and the "Allow data collection for analytics" setting (Preferences) is on. If either is missing, the SDK is never run and no event or identifier is sent from your device to the advertising measurement provider.
11.4. What is shared with permission. With your permission, (i) app install or open and onboarding-completed events are sent from your device together with the anonymous ID the provider assigns to your device and the advertising identifier (IDFA); and (ii) trial started, subscription started or renewed, and diamond pack purchase events (with value and currency) are sent server-side through our subscription management provider, matched with your Account ID, that anonymous ID, the IDFA, the identifier for vendor (IDFV) and IP address. No child data (name, age, story content, family memory), email address or telephone number is sent to this provider.
11.5. Without permission. Advertising measurement is performed only through Apple SKAdNetwork and the Apple Search Ads attribution described in Section 11.9. As for SKAdNetwork: on first launch the App registers with this Apple system, and Apple reports to the ad network, in an aggregated, delayed and non-identifying way, which ad led to an install. We share no identifier, account information or app event in this process, and you are not individually tracked across apps or websites.
11.6. Withdrawing permission. You can withdraw the iOS permission or turn the in-app setting off at any time. From then on the status is re-checked every time you return to the App; no new events or identifiers are sent, and the advertising measurement match held by our subscription management provider is removed. Data already shared while permission was in place is subject to the relevant providers' own retention policies; you can request its deletion at [email protected]. "Delete all my data" also resets the anonymous advertising measurement ID on your device.
11.7. The advertising measurement provider is located in the United States; transfers rely on the safeguards described in Section 13.
11.8. The legal basis for advertising measurement is set out in the table in Section 5.
11.9. Apple Search Ads attribution. Through Apple's AdServices framework, the App obtains an attribution token from Apple and passes it to our subscription management provider. Using this token, the provider obtains from Apple whether the App was installed through an Apple Search Ads ad and, if so, attribution information about the related campaign, and links this information to your Account ID. This Apple system does not depend on iOS ATT permission, and Apple provides the attribution information without any device or advertising identifier (IDFA); it therefore works even if you have not granted permission. No child data (name, age, story content, family memory) is shared in this process. The legal basis for this processing is set out in the table in Section 5; you may exercise your right to object under Section 17.
12. Recipients and Service Providers
12.1. Your personal data may be disclosed, only to the extent necessary for the purposes in Section 5, to the following service providers acting as processors:
| Recipient category | Purpose | Location |
|---|---|---|
| Hosting and infrastructure service providers | Database, file storage and server functions | Germany (EU) |
| AI service providers | Generating story text and chat replies; content-safety assessment; image generation; text-to-speech | United States and other countries |
| Payment and subscription management service providers | Subscription and purchase management | United States |
| Analytics service provider | Usage analytics | European Union |
| Advertising measurement provider | Measuring advertising performance (install and subscription events) | United States |
| Apple Inc. and its affiliates | App Store distribution and payments, push notifications (APNs), abuse prevention via DeviceCheck, advertising attribution (SKAdNetwork, Apple Search Ads) | United States and other countries |
| Website hosting and content delivery network provider | Website hosting and content delivery; serving shared story pages | Global |
You can request the current list of service providers by writing to our contact address ([email protected]).
12.2. Otherwise, your personal data may be disclosed only to competent public authorities or courts where and to the extent required by applicable law.
12.3. Purchases are processed by Apple under its own terms and privacy policy. Apple's privacy policy applies to data you share directly with Apple.
13. International Transfers
13.1. Some of the service providers listed in Section 12 are established, or process data, outside Türkiye and the European Economic Area, in particular in the United States. Your personal data may therefore be transferred abroad.
13.2. Under KVKK Article 9, transfers abroad are based on an adequacy decision where one exists; otherwise on appropriate safeguards under KVKK Article 9(4), in particular the standard contracts published by the Personal Data Protection Board; and, in incidental cases where these cannot be applied, on the exceptions listed in KVKK Article 9(6).
13.3. Where the GDPR applies, transfers outside the European Economic Area are based, in accordance with Chapter V of the GDPR, on adequacy decisions of the European Commission (including, where applicable, the EU-U.S. Data Privacy Framework) or on standard contractual clauses adopted by the European Commission.
13.4. You may request information about the safeguards applied by contacting [email protected].
14. Retention Periods
14.1. Personal data is retained for as long as necessary for the purposes for which it is processed, subject to statutory retention periods, as follows:
| Data category | Retention period |
|---|---|
| Account and technical data, child profiles, family characters, chat content and generated content | For as long as your account is active; deleted immediately when you delete the relevant content or your account |
| Dandi's memory | Until you delete it, erase and turn off the feature, or delete your account |
| Push token and notification preferences | For as long as your account is active or the token remains valid |
| Usage analytics data | For as long as required to improve the Service; dissociated from the Account ID when the account is deleted |
| Content-safety records | For as long as required to prevent abuse, and no longer than until your account is deleted |
| Story share links and page visit records | A link works until you stop sharing, until it closes automatically after 90 days without being opened, or until you delete the story or your account; the record of a stopped link and its visit records are kept until the story or your account is deleted |
| Apple Search Ads attribution data | Held by the subscription management provider, subject to its own retention policy |
| Purchase and accounting records | For the periods required by applicable law, in particular the Turkish Tax Procedure Law No. 213 and the Turkish Commercial Code No. 6102; records held by Apple and payment and subscription management service providers are subject to their own retention policies |
| Support correspondence | For as long as necessary to resolve the request, subject to statutory limitation periods for potential disputes |
14.2. At the end of the retention period, personal data is deleted, destroyed or anonymized in accordance with applicable law.
15. Deletion
15.1. You can delete individual stories, child profiles, family characters and memory items in the App.
15.2. “Delete all my data” in Settings immediately and permanently deletes your account together with child profiles, family characters, stories, image and audio files, Dandi's memory, your diamond balance, story share links and the related records on our servers. This action cannot be undone.
15.3. What deletion does not cover. “Delete all my data” deletes the data on our servers; however, in the following cases data does not disappear immediately through this action:
- Apple and the subscription management provider: App Store purchase records are kept by Apple, and subscription and purchase records (including the matching and attribution information described in Sections 11.4 and 11.9) are kept by our subscription management provider, under these companies' own retention policies.
- Statutory retention obligations: purchase records that we must keep for legal reasons, such as accounting and tax law, are kept for the statutory periods in Section 14 and only to fulfil the relevant obligation. These records, as well as abuse-prevention limit records and audit records of administrative actions, are dissociated from your account at deletion.
- Backups: data that may be contained in backup copies of our servers disappears as those backups are deleted or overwritten in their normal cycle.
- Data previously sent to service providers: data sent to artificial intelligence service providers during story generation is subject to the terms described in Section 8.2, and data shared with the advertising measurement provider with your permission is subject to the terms described in Section 11.6.
- Shared stories: share links stop working upon deletion; however, previews and copies remaining on the devices or in the messaging apps of people who opened the link earlier are outside our control (see Section 18.6).
15.4. Deleting your data or removing the App from your device does not end your App Store subscription. You must cancel the subscription separately in your Apple ID account settings.
16. Security
16.1. In accordance with KVKK Article 12 and GDPR Article 32, we implement appropriate technical and organizational measures to prevent unlawful processing of and unauthorized access to personal data and to safeguard it. These include encryption in transit, restricted access rights, row-level isolation of user data and server-side authorization checks.
16.2. If personal data is obtained by others through unlawful means, this will be notified to the data subjects concerned and to the competent supervisory authorities within the periods and in the manner required by law.
17. Your Rights
17.1. Under KVKK Article 11 you have the right to learn whether your personal data is processed; to request information about such processing; to learn the purpose of processing and whether data is used in accordance with that purpose; to know the third parties to whom data is transferred in Türkiye or abroad; to request correction of incomplete or inaccurate data; to request deletion or destruction under the conditions of KVKK Article 7; to request that such operations be notified to third parties to whom the data was transferred; to object to an outcome to your detriment arising from analysis exclusively by automated systems; and to claim compensation for damage arising from unlawful processing.
17.2. Where the GDPR applies, you also have the rights of access, rectification, erasure, restriction of processing, data portability, objection, and not to be subject to decisions based solely on automated processing, under GDPR Articles 15–22. Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing before withdrawal.
17.3. How to submit a request. Requests may be sent by email to [email protected] or in writing to the address in Section 3. Because accounts are anonymous, you may be asked to include the Account ID shown in the App's Settings so that your request can be matched to your account. Requests are resolved free of charge as soon as possible and at the latest within thirty (30) days in accordance with KVKK Article 13; for requests under the GDPR, the time limits in GDPR Article 12 apply.
17.4. Right to lodge a complaint. If your request is rejected, the response is insufficient or no response is given in time, you may lodge a complaint with the Turkish Personal Data Protection Board under KVKK Article 14. Where the GDPR applies, you also have the right to lodge a complaint with the supervisory authority of the EU Member State of your habitual residence, place of work or place of the alleged infringement.
18. Website
18.1. The Site is hosted on the infrastructure of a website hosting and content delivery network provider. When you visit the Site, this provider may process technical data such as IP address, browser information and access time for security and service delivery.
18.2. The Site does not use cookies for advertising or analytics. This provider may use strictly necessary technical cookies to protect the Site. For visit counting on shared story pages, see Section 18.7.
18.3. Story share links. Stories are not shared by default. When you use the share option for a story in the App, a link to that story (dandini.app/stories/…) is created. The link consists of an unguessable random code; however, anyone who has the link can view and listen to the story, without an account or sign-in. We therefore recommend sharing the link only with people you trust.
18.4. What the shared page shows. The shared page shows the story's title, short teaser, intended age group, length and category, cover image, full story text, scene illustrations and narration. The name of the child or children the story was written for, as entered in the App, appears on the page and in the link preview (e.g. “A bedtime story written for Ada”); the story text may also mention the child's and family characters' names. When the link is shared in a messaging app or on social media, these apps may show the story's title, that description line and the cover image as a preview. The child's date of birth, gender, interests, notes you entered, Dandi's memory, your chat messages and your account information do not appear on the shared page.
18.5. Search engines. Shared pages are marked “noindex” so that search engines do not index them, and they are not included in the Site's sitemap. However, how the link is used wherever you or its recipients pass it on is outside our control.
18.6. Stopping sharing. You can stop sharing in the App at any time; the link stops working immediately. The link also ends if you delete the story or your account, and links that are not opened for 90 days are closed automatically. People who have the page open at the moment sharing stops may keep access to its image and audio files for up to 6 hours, and the preview image may remain in the content delivery network's cache for up to 1 hour. Previews remaining on the devices or in the messaging apps of people who opened the link or saw its preview earlier, and copies they saved, are outside our control.
18.7. Counting visits. To count how many people opened the link, listened, listened to the end and tapped the App Store link, the shared page stores a randomly generated visitor ID in the visitor's browser local storage (no cookies are used) and sends these events to our servers together with the country determined by the content delivery network provider. The visitor's IP address is not stored in these records, and no third-party advertising or analytics tools are used.
18.8. The Dandini team and share links. The Dandini team does not create share links for users' stories; share links are created only by the parent or guardian, in the App. Stories the team shares using its internal tools belong only to the team's own test and demo accounts and contain no user data. Users' stories are never used publicly for promotion, marketing, social media, the App Store or the press without the separate, explicit written consent of the parent or guardian.
19. Changes to this Policy
19.1. This Policy may be updated to reflect changes in law or in the Service. The current version is always published on this page, with its effective date shown at the top.
19.2. Changes that materially affect the processing of your personal data will be announced through the App or the Site before they take effect. Where a change involves a new purpose or requires consent, your consent will be obtained separately.
19.3. In the event of any conflict between the Turkish and English versions of this Policy, the Turkish version prevails.
20. Contact
Data controller: Arda Erem Karagöz (AEK Studio)
Address: Maslak Mah. Aos 55 Sok. B Blok No: 4/542, Sarıyer / İstanbul 34485, Türkiye
Email: [email protected]