Privacy Policy

Last updated 17 September 2026 version 2026-09-17

Squad Streaks helps a small crew keep one shared fitness streak alive. This policy is the plain-language version of what we collect, why, and the control you have over it. We don't sell your data, we don't currently run third-party ads, and we don't track you across other apps.

What we collect

• Your account — the email address and password you sign up with (the password is stored only in a hashed form by our authentication provider, never in plain text), and the display name you choose. Your email is used to sign you in and to reach you about your account; it is never shown to other members.
• What you log — your check-in photos and captions, your workout entries (exercises, sets, reps, and weights), and the messages you send inside a squad.
• What you post to your squad — the events you create (title, description, meeting point and any map link you paste), your answer to an event invitation, the polls you create and the options you vote for, the emoji reactions you leave, and the buddy pairing you accept inside a squad.
• What your squad chooses to publish — if a squad turns on the public listing, its name, city, goal tags, description, member count and streak length become readable by anyone, including on its own page at kep90.com. Member names, photos, check-ins and messages are never part of that listing.
• Your squads — which squads you belong to or own, and squad invite codes.
• Notifications — a device push token, so we can remind you when your crew is waiting on you, and your per-type notification switches (announcements, nudges, deadline and event reminders, buddy nudges, assigned programs, the weekly report). You can turn each type off in the app and all of them off in your device settings.
• What you report — when you report a message, a check-in, a poll or an event, we store a copy of that content, who wrote it, and your reason, so it can be reviewed after the author edits or deletes it.
• Age eligibility — for eligible accounts, the 13–17 or 18-or-older range selected at registration. An under-13 selection is rejected on the device and is not sent to create an account. We do not ask for or store your full birth date.

How we use it

We use what we collect only for the purposes below, and nothing else:

• to run your squad — showing the check-ins, messages, and workouts you post to the members of that squad;
• to screen check-in captions, squad messages, poll and event text, and public squad listings against an automated blocklist before anyone but you sees them, and to act on reports and blocks you or another member file;
• to show a squad's coaches how the squad is doing — each member's check-in history in that squad, who has gone quiet, and a weekly summary — and to let them export that squad's check-ins and event attendance as a spreadsheet, which then leaves the app wherever they choose to share it;
• to send the reminders you opt into, and to notify you of squad activity you're part of;
• to enforce the age eligibility you selected at registration;
• to keep your account secure, restore it if you lose access, and respond if you contact us; and
• to comply with a legal obligation, such as a lawful request from an authority.

We do not use your account details or squad activity for any other purpose, and we do not sell it. The one exception is the optional advertising and analytics consent, described below, which you can decline or withdraw at any time.

Who can see your content

The members of a squad can see the check-ins and messages you post to that squad, labelled with your display name — that is the point of a shared streak. No one outside your squad can see them, and no other member ever sees your email address. We never share or sell your data to advertisers or data brokers.

A squad message or check-in caption that our automated filter flags is held back and shown only to you until it is reviewed; a poll, an event or a public listing carrying a blocked word is refused as you write it. Every member can also report or block another member directly from the app, which stops that member's content from reaching them immediately.

Inside a squad, the people who hold the Kurucu or Koç role can additionally see each member's check-in record for that squad — dates, notes and whether a photo was attached — and can export it. If that is more than you want a squad to know about you, leaving the squad stops it: an export can only ever cover the squad it is run in.

A squad that turns on its public listing publishes only the squad's own details, listed under What we collect. Turning the listing off removes it from search and from the public page; the address stays reserved for that squad so a link already shared does not later point at somebody else.

Where it lives, and how it's protected

Your data is stored with Supabase, our database and backend provider, under row-level security rules that keep every account reachable only to its own owner and their squads. On your device, the credentials that keep you signed in are held in the operating system's secure keystore (iOS Keychain / Android Keystore), not in plain app storage. Push reminders are delivered through Expo's notification service.

Security and account safety

We use reasonable technical and organizational safeguards, but no internet service can promise absolute security. Keep your password private, use a password you do not reuse elsewhere, and contact us if you believe your account or device has been compromised. A security incident does not remove our obligation to investigate, limit harm, and provide any notice required by applicable law.

Your rights over your data

Wherever you live, you can ask us what we hold about you, ask for a copy, ask us to correct it, and ask us to delete it. Under Turkey's Personal Data Protection Law (KVKK, Law No. 6698) you also have the right to learn whether your data is processed and for what purpose, to know who it has been transferred to, to ask that incomplete or inaccurate data be corrected and that the correction be passed on, to object to a result produced solely by automated analysis, and to claim compensation for damage caused by unlawful processing. Under the GDPR you additionally have the right to restrict processing, to receive your data in a portable form, and to complain to your local supervisory authority.

Two of these you can exercise yourself, immediately, without asking us: deleting your account (below) removes your data, and withdrawing the advertising and analytics consent is done by declining it the next time we ask. For anything else, email support@kep90.com. We answer within 30 days.

Consent, and when we ask again

When you create an account we record which version of this policy and which version of the advertising and analytics consent you agreed to, along with the time — the time is set by our server, not by your device. That record is append-only: it can be added to but never edited or erased from inside the app, including by you, because a consent record its subject can rewrite is not a record of anything.

When we reword either document in a way that changes what you are agreeing to, we raise its version and ask you again the next time you open the app. Until you agree to the new wording the app does not continue. You can decline; declining signs you out and leaves your account and data untouched, and you can delete the account at any time.

Deleting your account

You can delete your account at any time from Profile → Delete account, right inside the app. Deleting is permanent and immediate: it removes your profile, the squads you own, your check-ins, your workouts, your messages, and every photo you uploaded. There is no separate request to file and nothing to email us for.

How long we keep it

We keep your data for as long as your account is active. When you delete your account, the data is removed as described above. Operational backups roll off on our provider's normal cycle.

Children

Squad Streaks is not directed to children under 13. Registration asks for an age range and refuses account creation when “under 13” is selected. If you believe a child bypassed this control and created an account, contact us and we'll remove it.

Future advertising changes

The preview banners in development builds are visual placeholders and do not contact an ad network. Before enabling third-party advertising, we will update this policy, disclose the provider and data it processes, update the app-store privacy information, and request any consent required for personalized advertising or cross-app tracking.

Changes to this policy

If we change what we collect or how we use it, we'll update this page along with the date and version at the top. A change that alters what you are agreeing to is not left on this page to be discovered: the app asks you to accept the new wording before it continues, as described above.

Data controller & contact

The data controller responsible for your personal data is Kutay Turker. Questions about your privacy, or to exercise your rights over your data? Email support@kep90.com and we'll get back to you.