Privacy Policy / KVKK
Burak Altınoluk (Lilbo) is the data controller for Lilbo. This policy explains the personal data processed for accounts, baby care and family sharing. Contact: burak@lilbo.app. Last updated: 12 November 2026.
1. Information collected and its purposes
We process your email address, account identifier and profile for registration and sign-in, and your membership, role and baby permissions for family sharing. Baby names, dates of birth, care records, growth measurements, health information, documents, photos, comments and notes entered by you or authorized family members are stored to provide the features you choose. Notification preferences and device notification tokens support notifications you allow. Subscription features process account identifiers, store transactions and subscription status; Lilbo does not receive payment card details. Technical connection and security data may be processed to operate the service and prevent abuse.
Content reports contain the reporting account, baby and content reference/version, reason, details and review status. We store your own block preferences and record references for content whose author was erased; no content copy or erased-author identity is retained.
2. Collection methods and legal grounds
Information is collected electronically through your app entries, authorized family members’ contributions, support messages and technical operations of the features you use. Account and service processing is considered on the basis of entering into or performing a contract; required records and requests on legal obligations and establishing, exercising or protecting a right; and necessary security processing on legitimate interests that do not override your fundamental rights. Health information is sensitive personal data under Türkiye’s Personal Data Protection Law (KVKK) and is subject to Article 6. Where explicit consent is required, this policy alone does not constitute that consent. Lilbo is for adult parents and authorized caregivers; enter only child and family information you are authorized to share.
This data lets Lilbo support review family-content reports and apply personal social blocks. A narrow text filter applies to new photo captions, comments and family notes. Images are not automatically scanned; care, health and profile photos are outside this filter.
3. Family sharing
Shared records are available to members with current membership and baby permissions in the relevant family. Family access levels affect available features. Check access before inviting someone or sharing content. Removing access also prevents further archive downloads for that scope. Personal data is not sold for advertising; advertising tracking, Firebase Analytics and Crashlytics are not enabled in the app.
4. Service providers and international processing
Supabase provides authentication, database and file storage; the current database region is Frankfurt, Germany. The Netcup server handles private file transfers, exports and deletion processing. If you enable notifications, Firebase Cloud Messaging and Apple Push Notification service process device tokens and notification delivery data. Premium features use RevenueCat and the relevant store (Apple App Store or Google Play) to process account/transaction identifiers and subscription status. Cloudflare Turnstile processes connection and device signals for sign-in security; email providers process your email address to deliver sign-in codes. These providers also operate outside Türkiye, so data may be processed abroad. International transfers are subject to Article 9 of KVKK; this policy is not transfer consent. Contact burak@lilbo.app for information about providers and transfers.
5. Export and account deletion
You can request a data export or account deletion in Settings. A sensitive action requires confirmation of an email-code sign-in completed within the last five minutes; each sign-in can confirm one action. If needed, sign out, sign in again and restart the action. Account deletion requires a separate final confirmation and cannot be undone. A family owner must transfer ownership to an eligible administrator who accepts, or explicitly choose to close the family. Deleting an account does not automatically cancel a store subscription. Step-by-step instructions: https://lilbo.app/account-deletion.
6. Retention and deletion scope
Account and family records are retained while the related service and shared family continue. A prepared private ZIP archive is downloadable for at most seven days; loss of access or an account deletion request may invalidate it sooner. Accepted account deletion closes access and sessions and starts cleanup of personal account data, preferences, reminders and unpublished files. The target is 30 days. A continuing family’s shared care and health records, photos, comments and notes may remain with personal author attribution removed; their text or images may still identify someone. Closing a family also starts deletion of its data. Backups, deletion/restore records, provider logs and required transaction records may be retained separately from active app data; this does not mean they are all physically erased immediately or within the same period. Accepted deletion requests are reapplied during recovery. Contact us about shared content and retention requests.
Reports and operation receipts are retained for 90 days from creation. Active blocks remain until removed, the blocking account is erased, or the family ends. Record references for erased-author content are removed when the associated block is removed.
7. Your rights and requests
Under KVKK, you may ask whether your data is processed, why it is processed and who receives it; request correction of inaccurate or incomplete data, erasure or destruction when the applicable conditions are met, and notification of the action to recipients. You may object to adverse results based solely on automated analysis and seek compensation for harm caused by unlawful processing. You may withdraw consent for processing based on explicit consent. Email burak@lilbo.app from your account’s registered email address with the subject and details of your request. We may request information needed to verify your connection to the account; do not send sign-in codes or passwords. We resolve requests as soon as possible and within 30 days. You can manage notification permission in your device settings.
8. Contact
Data controller: Burak Altınoluk (Lilbo)
Privacy, support and account deletion: burak@lilbo.app
Current policy: https://lilbo.app/privacy