Privacy Policy and KVKK Information Notice
Version 2.4 · Effective 11.09.2026
Version 2.3 · Effective 25.08.2026 · Last updated 25.08.2026
Damy — Water Tracking App
1. Data Controller
Pursuant to the Personal Data Protection Law No. 6698 ("KVKK"), the data controller is:
Drupart Dijital Çözümler ve Tic. Ltd. Şti.
GOSB Teknopark Hi-Tech Bina, 3rd Floor, B3, Gebze / Kocaeli
Tax Office: İlyasbey · Tax No: 3130606736
Email: [email protected]
This notice covers the Damy application and the services provided under the damywt.com domain name.
2. What Has Changed in This Notice
In the previous version, your water logs were stored only on your device. In the new version, your water consumption records are also stored on our servers for the purposes of multi-device support, backup and the protection of your account.
Water consumption, goal, weight and sleep time information constitutes health data and is deemed special category personal data within the scope of Article 6 of the KVKK. Therefore, the processing of such data is subject to your explicit consent. Continuing to use the application does not constitute consent; you must give your consent explicitly on a separate approval screen.
If you do not wish to give consent, you may delete your account.
3. Personal Data We Process
3.1 Account and identity data
- Name or nickname
- Email address
- Date of birth (solely for the purpose of verifying the age limit)
- Your password (stored in the form of an encrypted hash; not even we can see it in plain text)
- If you choose to sign in with Google, the email address and unique user ID of your Google account
Creating an account is mandatory in order to use the application.
3.2 Health data (special category)
- Daily water and other beverage consumption records (amount, type, time)
- Daily goal amount
- Your weight (for goal calculation, optional)
- Wake-up and sleep times (for reminders and goal planning, optional)
- Records of beverages containing caffeine and sugar
This data is processed on the basis of your explicit consent.
3.3 Application usage data
- In-app progress: streaks, challenges, achievements, collection
- Virtual currency (drops) balance and spending history
- Your conversations with the Damy AI assistant
- Your application settings: language, theme, notification preferences, sound and vibration settings
- Your support requests and the messages you send us
3.4 Technical data
- Device model and operating system version
- Application version
- IP address
- Session and security logs (login time, failed login attempts)
- Error and crash logs
- Approximate location information — only if you choose to use the weather-based goal adjustment feature. It is at city level, is not stored on our servers, and you can turn this feature off in the settings.
3.5 Purchase data
When you make an in-app purchase, the payment is processed through Google Play. We have no access whatsoever to your card details, and we do not store this information. We only keep a verification record confirming that the purchase took place, and your membership status.
4. Purposes for Which We Process Data
| Purpose | Data category |
|---|---|
| Creating your account and ensuring its security | Account and identity data |
| Providing the water tracking service and showing your progress | Health data |
| Synchronizing and backing up your data across devices | Health and usage data |
| Sending reminder notifications | Sleep/wake-up times, usage data |
| Operating the in-app reward and collection system | Usage data |
| Providing the Damy AI assistant and storing your chat history | Usage data |
| Adjusting goals based on the weather (optional) | Approximate location |
| Managing membership and purchase transactions | Purchase data |
| Responding to your support requests | Account data, support messages |
| Detecting errors and improving the application | Technical data |
| Preventing misuse and fraud | Technical data, security logs |
| Fulfilling our legal obligations | All relevant categories |
5. Legal Grounds
Your personal data is processed on the basis of the following legal grounds:
- Explicit consent (KVKK Art. 6/3-a) — Your water consumption records and related measurements constitute special category health data; their processing and storage on our servers rely solely on your explicit consent.
- Establishment and performance of a contract (KVKK Art. 5/2-c) — Account creation, membership management, purchase transactions.
- Legal obligation (KVKK Art. 5/2-ç) — Record-keeping obligations arising from tax, commercial and consumer legislation.
- Legitimate interest (KVKK Art. 5/2-f) — Security, prevention of misuse, error detection and maintaining the quality of the service.
You may withdraw your explicit consent at any time. Withdrawal does not invalidate the processing carried out up to that point.
6. Where Data Is Stored
Your data is stored on servers located within the borders of the Republic of Türkiye. Your health data is not transferred abroad.
If you choose to use the Sign in with Google feature, authentication is carried out through Google's infrastructure, and within this scope your email address is processed by Google. Using this feature is not mandatory; you can also register with an email address and password.
7. Transfer of Data
We do not sell your personal data, and we do not share it with third parties for marketing purposes.
Your data is transferred only in the following cases and only to the extent necessary:
- To our hosting service provider — within the scope of the server infrastructure, in its capacity as data processor and subject to a contract
- To Google Play — solely for the purpose of purchase verification; your health data is not transferred
- To the weather service (Open-Meteo) — only if you have enabled the weather-based goal adjustment feature, your approximate city-level location is transmitted for the purpose of retrieving weather data. Your identity information is not transmitted, and your location information is not stored. You can turn this feature off in the settings.
- To authorized public institutions and organizations — only in cases required by law and upon a duly submitted request
Your health data is not transferred to any third party for analytics, advertising or marketing purposes.
8. Damy AI Assistant
The Damy assistant within the application provides you with information and suggestions about water consumption.
The assistant does not give medical advice, make diagnoses or recommend treatment. Please consult your physician for decisions concerning your health.
Your conversations and chat history with the assistant are stored on our servers so that the service can be provided and made accessible across your devices. This data is transmitted over an encrypted connection, is not used for advertising or marketing purposes and is not shared with third parties. Your chat history is deleted together with your account.
9. Retention Periods
| Data | Period |
|---|---|
| Account and health data | For as long as your account is active |
| After account deletion | Deleted within 30 days |
| Copies in backups | Completely removed within 90 days |
| Purchase records | 10 years, as required by tax legislation |
| Support correspondence | 3 years |
| Security and access logs | 1 year |
| Error and crash logs | 6 months |
You may revoke your request within 30 days following your account deletion request. This period is a safeguard against accidental deletions.
10. Your Rights
Pursuant to Article 11 of the KVKK, you have the right to:
- Learn whether your personal data is being processed
- Request information regarding the processing, if your data has been processed
- Learn the purpose of the processing and whether the data is used in accordance with that purpose
- Know the third parties to whom the data is transferred, domestically or abroad
- Request rectification if the data has been processed incompletely or inaccurately
- Request its erasure or destruction
- Request that the rectification, erasure and destruction operations be notified to the third parties to whom the data has been transferred
- Object to a result arising against you through analysis of the data exclusively by automated systems
- Claim compensation for damages if you suffer loss due to unlawful processing
Rights you can exercise directly within the application: deleting your account, withdrawing your explicit consent, changing your notification and privacy preferences.
To obtain a copy of your data, you may write to our support address; your data will be sent to your registered email address in PDF format. This copy is a readable document and cannot be transferred to another account.
For your other requests, you may write to [email protected]. Your applications will be concluded within 30 days at the latest.
11. Age and Purchases
Damy is intended for users aged 13 and over. The application's water tracking, reminder and gamification features may be used by any user who has reached the age of 13.
Age limit. The application is not directed at users under the age of 13, and we do not knowingly collect data from this age group. Date of birth is requested during registration; no account is created for users found to be under the age of 13, and the information entered is not stored.
Purchase limit. Purchases made with real money within the application are subject to an age limit of 18. Users under the age of 18 may use the application with all its features but cannot make purchases with real money. The in-app virtual currency (drops) and boxes containing random rewards may be used by any user with drops earned within the game; the content probabilities of the boxes are clearly displayed within the application.
Use of age information. Your date of birth is requested solely for the purpose of applying the age limit and the purchase restriction; it is not used for any other purpose, and no profiling is carried out.
Practices concerning children. We do not engage in marketing directed at children. We do not use user data for advertising, profiling or behavioral analysis purposes, and we do not share it with third parties for these purposes.
If we learn that we have collected data belonging to a person under the age of 13, we will delete such data without delay. If you become aware of such a case, you may report it to [email protected].
12. Data Security
The main measures we take to protect your data:
- All data communication takes place over an encrypted connection (TLS)
- The local database on your device is stored in encrypted form
- Passwords are stored in irreversibly hashed form
- Server access is limited to authorized personnel and is logged
- Backups are stored in encrypted form
- Access and transaction logs are regularly kept and reviewed
No system can provide absolute security. Should we detect that your personal data has been unlawfully obtained, we will notify you and the Personal Data Protection Board within the period prescribed by the legislation.
13. Cookies and Similar Technologies
No advertising or tracking cookies are used in the mobile application.
On the damywt.com website, strictly necessary cookies required for the site to function (language preference, session management) are used, together with Google Analytics for measuring visit statistics. Google Analytics generates aggregate statistics such as visitor numbers and page views; it does not access your health data within the application.
For details, please see our Cookie Policy.
14. Changes to This Notice
We may update this notice from time to time.
In the event of material changes — such as starting to collect a new type of data, using data for a new purpose or sharing it with a new party — you will be informed when you open the application, and your consent will be requested before you continue. If you do not wish to give consent, you may delete your account.
In the event of minor corrections — typos, wording improvements, contact information updates — renewed consent is not requested; only the version number and date are updated.
All previous versions of this notice are kept in an archive and shared upon request.
15. Deletion and Closure of Your Account
You may close your account at any time. In the application, follow Profile → Settings → Data and Privacy → "Delete my account". The process requires two-step confirmation and asks for your password; this prevents accidental deletion.
- 30-day recovery: When you delete your account, it is first marked as "closed". Within 30 days, you can restore your account by writing to [email protected]; your collection, drops, streak and all of your progress are preserved. Restoration is possible only if no new account has been opened with the email address belonging to your account.
- Permanent deletion: At the end of the 30 days, your account and all personal data linked to it (your water/health records, preferences, collection and chat history) are permanently deleted from our servers; your account's identity information is anonymized.
- Under 13: Accounts found, based on the date of birth, to belong to a person under the age of 13 are deleted immediately and permanently, without waiting 30 days and without any data being retained.
- Get your data before deleting: Before deletion, you may, if you wish, request a copy of all your data in PDF format by writing to our support address (KVKK right of access). This copy is a readable document; it cannot be transferred to another account.
Deleting your account also clears the application data on your device. If there are records that must be retained due to legal obligations (e.g. invoice/payment records), they are kept only for the period prescribed by the relevant legislation and solely for this purpose.
16. Contact
Drupart Dijital Çözümler ve Tic. Ltd. Şti.
GOSB Teknopark Hi-Tech Bina, 3rd Floor, B3, Gebze / Kocaeli
Email: [email protected]
You may submit your applications in writing to the address above or by email. You may also exercise your right to lodge a complaint by applying to the Personal Data Protection Authority.
Damy · Drupart Dijital Çözümler ve Tic. Ltd. Şti. · [email protected]