Privacy Policy

1. Data controller

The data controller for your personal data is Folii. You can reach us at privacy@folii.app.

2. The data we process

When you use the Folii app:

• Sign-in details — your email address, your password, or your sign-in with a Google or Apple account. These are held by Google's Firebase Authentication service; our database holds no email address and no password. We keep only the identifier Firebase gives your account.
• Profile — your username, display name, a link to the profile photo that came from Google or Apple, your language, and optionally your country and time zone.
• Reading preferences — the reading goals, genres, formats and reading frequency you chose when you first opened the app.
• Your library — the books you added and their shelves, your favorites, reading start and finish dates, the progress and reading time you recorded, and your own tags.
• Ratings and reviews — the ratings you gave books and the reviews you wrote.
• Consent records — the versions of the Terms of Use and the Privacy Policy you accepted and when; if you gave notification permission, when you gave and withdrew it.
• On your device — your profile details are stored on your phone so your session is remembered. Sign-in tokens are never written to disk.

3. The website and the waitlist

If you leave your email address on the waitlist at folii.app, your address, the site's language, when you submitted the form, the page you came from and the country your browser reports are sent to us by email. We use this only to tell you when Folii opens; we do not keep it in a database.

The website sets no cookies. Your light or dark theme preference is kept only in your browser's local storage and is never sent to us.

4. Why we process it, and on what legal basis

• To open your account and provide your library, reading records and reviews — establishing and performing a contract (KVKK Art. 5/2-c).
• To keep a record of the texts you accepted and to respond to legal requests — compliance with our legal obligations (Art. 5/2-ç) and establishing, exercising or protecting a right (Art. 5/2-e).
• To keep the service secure and prevent abuse — our legitimate interest (Art. 5/2-f).
• To send reading reminders and Folii news — only if you ticked the notifications box, on the basis of your explicit consent (Art. 5/1). This permission is optional; not giving it does not stop you from using Folii.

5. What other people see

Your published reviews are public: a review shows your display name, your profile photo and the rating you gave that book. A book's rating distribution is shown only as counts, without saying who gave them.

Your library, reading history, tags, reading preferences and time zone are shown to no other user.

6. Transfers and service providers

We do not sell your data and we do not share it with anyone for advertising. We work with the service providers below to run Folii; they process your data only on our behalf and on our instructions:

• Google (Firebase Authentication) — sign-in, email verification and password reset. The data is held on servers outside Türkiye.
• Google and Apple — if you choose to sign in with them.
• Vercel — hosting of the website and the app server. Outside Türkiye.
• Neon — hosting of the database, European Union (Frankfurt).
• Resend — delivering waitlist notifications by email. Outside Türkiye.
• ISBNdb — book covers load directly from their servers, which means your device's IP address reaches them.

Because some of these providers are located abroad, your personal data is transferred outside Türkiye. These transfers are made within the framework of Article 9 of the KVKK. Where the law requires it, your data may also be shared with authorized public bodies.

7. How long we keep it

We keep your data for as long as your account is open. When you delete your account, a 30-day waiting period begins: during it you can cancel the deletion by signing in. When it ends, your profile, library, ratings, reviews and consent records are permanently deleted from our database, and your sign-in details from Firebase; no anonymized copy is kept.

An email address left on the waitlist is kept until the announcement is made or until you ask us to delete it.

8. Your rights

Under Article 11 of the KVKK you have the right to:

• learn whether your personal data is processed and, if so, request information about it,
• learn the purpose of the processing and whether the data is used for that purpose,
• know the third parties, in Türkiye or abroad, to whom it is transferred,
• ask for it to be corrected if it is incomplete or inaccurate,
• ask for it to be deleted or destroyed,
• ask for corrections and deletions to be notified to the third parties it was transferred to,
• object to an outcome against you that results from analysis by automated systems alone,
• claim compensation if you suffered damage because of unlawful processing.

To exercise these rights, write to privacy@folii.app. If you ask for a copy of your data, we send you everything we hold about you. We answer your request free of charge within 30 days at the latest. You can withdraw your notification permission at any time by writing to the same address or from your device's settings. If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Board.

9. Changes to this policy

We may change this policy. Every significant change raises the version number, and we ask you to accept the new version the next time you use Folii.