Last updated: August 2, 2026

Privacy Policy

Not ready to publish — draft

This document must not be published before the company's official registration details (legal name, address, MERSİS number, tax number) are filled in. The fields below are shown as blank / “—” until a lawyer reviews this draft and the real registration data is entered.

1. Introduction and Scope

This Privacy Policy explains how personal data is collected, used, stored, shared and protected through the Cookrange mobile app and the cookrangeapp.com website ("Cookrange", the "Service"). Cookrange is headquartered in Turkey and targets the Turkish market first, with the European Union and the United States as secondary markets. Accordingly, this policy is written to reflect both Turkey's Law No. 6698 on the Protection of Personal Data ("KVKK") and the EU's General Data Protection Regulation ("GDPR", Regulation (EU) 2016/679). Users in Turkey are additionally covered by the mandatory Turkish-languageKVKK Disclosure Notice; this policy complements rather than replaces it.

2. Who We Are (Data Controller)

Trade name	Cookrange
Registered legal name	[to be added]
Address	[to be added] — Antalya, Türkiye
MERSİS number	[to be added]
Email	contact@cookrangeapp.com

For the purposes of this policy, Cookrange acts as "data controller" under GDPR and "veri sorumlusu" under KVKK.

3. Personal Data We Collect

Account data: name, email address, date of birth, gender, hashed password.
Health and nutrition data: height, weight, body composition, allergy/diet preferences, meal logs, training and performance data, sleep data.
Gym check-in data: check-in/check-out timestamps at partner gyms.
Community/squad data: profile visibility, shared progress, in-app messaging (where applicable).
Technical/usage data: IP address, device/OS/browser information, in-app event logs, cookie identifiers.
Support communications: messages you send us via support requests or forms.
Marketing preferences: your email/SMS/push consent status.
Payment/subscription data (Premium): subscription status and billing records; card details are handled by the payment provider or app store, not stored on Cookrange servers.

4. How We Collect It

Directly from you: during sign-up, onboarding, the waitlist form, in-app use, and support requests.
Automatically: through cookies and similar technologies while you use the app/site (see the Cookie Policy).
From third parties: partner gyms (for check-in verification), and — only with your explicit permission — wearables or health platforms we may integrate with in the future.

5. Purposes and Legal Basis

The table below summarizes, for each processing purpose, the corresponding legal basis under GDPR and KVKK. Category-specific exact retention periods will be added once our data retention and disposal policy is finalized (see section 10).

Processing Purpose	GDPR Legal Basis (Art. 6/9)	KVKK Legal Basis (Art. 5/6)
Account creation and providing the Service	Performance of a contract (Art. 6(1)(b))	Performance of a contract
Personalized nutrition/training recommendations (health data)	Explicit consent (Art. 9(2)(a))	Explicit consent (special category data)
Service security and fraud prevention	Legitimate interest (Art. 6(1)(f))	Legitimate interest
Legal/tax/consumer-law obligations	Legal obligation (Art. 6(1)(c))	Legal obligation
Marketing communications	Consent (Art. 6(1)(a))	Explicit consent
Product analytics and improvement (post-consent)	Consent or legitimate interest	Explicit consent / legitimate interest

6. Cookies and Similar Technologies

Alongside strictly-necessary cookies, the site/app may use analytics and marketing cookies or SDKs that only activate once you've given consent. See the full inventory and consent mechanism (Google Consent Mode v2) in our Cookie Policy.

We share personal data with hosting, database and (in the future) email/analytics sub-processors only to the extent needed to run the Service. These providers may not use your data for their own marketing purposes. See our current Sub-Processorslist. We may also disclose data to competent public authorities where legally required.

8. Sponsored Products Layer

As one way of funding the free tier, Cookrange may show sponsored suggestions from brand partners (e.g. protein powder, protein bars) in certain meal/snack slots — these are always labeled "Sponsored" and are never a pre-selected default. Matching which product fits which slot runs entirely on your device; no personal data identifiable to you is transferred to brand partners. Brand partners only receive aggregate, de-identified counts (impressions and discount-code redemptions) reported in cohorts of at least 1,000 accounts. Accepting a sponsored suggestion, or muting/declining a brand, is stored as a preference record tied to your account, subject to the general retention rules described in section 10. Redeeming a discount code you accept happens directly in the brand's own store — any payment or delivery data you provide in that transaction is governed by that brand's own privacy policy, not Cookrange's; Cookrange is not a party to that sale. See theSponsored Products page for the system's full rule set.

9. International Transfers

Although Cookrange is headquartered in Turkey, our hosting and database infrastructure (Vercel, Firebase/Google Cloud) may run on servers outside Turkey and outside the EU. Transfers from Turkey rely on KVKK Art. 9 and the relevant transfer mechanisms recognized by the Turkish Personal Data Protection Board (e.g. Standard Contract); transfers from the EU rely on GDPR Chapter V (Standard Contractual Clauses, adequacy decisions where applicable). The final contractual basis for these transfers will be confirmed once data processing agreements with each provider are finalized (seedocs/LEGAL-REVIEW.md).

10. Retention Periods

We keep personal data for as long as needed for the purpose it was collected, and for any statutory limitation periods that apply. When you delete your account, your data is deleted or anonymized within a reasonable period, except where we are legally required to keep it. Exact, category-by-category retention periods will be added to this policy once our data retention and disposal policy is finalized.

11. Data Security

We apply reasonable technical and organizational measures to protect your personal data against unauthorized access, loss, alteration or disclosure (encryption in transit, access controls, least-privilege principle). No system is completely secure, and we cannot guarantee absolute security.

12. Children's Privacy

Because Cookrange processes health and nutrition data, the Service is not directed at, and we do not knowingly collect data from, individuals under 16. If we learn that someone under 16 has provided us with personal data, we will delete it within a reasonable time. (This 16-year threshold is an assumption reflecting GDPR Art. 8's 13–16 range left to member states' discretion and KVKK's guardian-consent principle for those lacking legal capacity — the exact threshold will be confirmed during legal review.)

13. Your Rights

Depending on where you live, you may exercise the following rights:

Access: request a copy of the data we hold about you,
Rectification: request correction of inaccurate or incomplete data,
Erasure: request deletion of your data ("right to be forgotten", GDPR Art. 17 / KVKK Art. 7),
Portability: receive your data in a structured, commonly used format (GDPR Art. 20),
Objection: object to processing based on legitimate interest (GDPR Art. 21),
Restriction: request that processing be restricted in certain circumstances (GDPR Art. 18),
Withdraw consent: withdraw consent for consent-based processing at any time.

To exercise these rights, see our Data Subject Request page. Users in Turkey have the equivalent rights under KVKK Art. 11, detailed in theKVKK Disclosure Notice.

14. Complaints and Supervisory Authorities

Turkey: if you believe your KVKK rights have been violated, you must first apply to us as the data controller; if your request is rejected, insufficiently addressed, or not answered within the statutory period, you may lodge a complaint with the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

European Union: under GDPR Art. 77, you may lodge a complaint with the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement (for example Ireland's Data Protection Commission, Germany's relevant state authority, or France's CNIL).

Assumption: Cookrange currently has no establishment or representative in the EU, so GDPR's "one-stop-shop" mechanism (Art. 56) — which applies only to controllers with a main establishment in the EU — does not yet apply. Rather than naming a single "lead supervisory authority," this section points EU users to their own national authority. This section will be updated once an EU representative or entity is established.

15. US Residents (CCPA)

California residents have rights under the California Consumer Privacy Act ("CCPA", as amended by the CPRA), including the right to know what personal information is collected, to request deletion, to opt out of the "sale" or "sharing" of personal information, and to not be discriminated against for exercising these rights. Cookrange does not sell personal information for monetary consideration within the meaning of the CCPA. You can submit requests via ourData Subject Request page.

16. Changes to This Policy

We may update this policy from time to time. For material changes, we may additionally notify you in-app or by email. The current version is always published on this page with the "Last updated" date shown at the top.

17. Contact

Questions about this policy can be sent to contact@cookrangeapp.com.