Privacy Policy
Morrow is a personal wishlist app that keeps the things you want in one calm list. This page explains what data the app touches, what it never touches, and your rights over your data. It is our privacy notice under the EU General Data Protection Regulation (GDPR) and Türkiye's Personal Data Protection Law (KVKK).
Morrow is the app's name in English; the same app appears as Belki in Turkish.
In short
- No account, no sign-in. We don't ask for your name, email or phone number.
- Your saved items live on your device and in your own iCloud. We can't reach them.
- No ads, no advertising identifier (IDFA), no third-party tracking, no affiliate links.
- We don't send the links, titles, notes or prices you save to any server — we don't run one.
- The personal data we are responsible for sits in two places: an anonymous record at RevenueCat (United States) that manages your purchases, and your emails if you write to us.
Data controller and contact
The controller of the personal data described on this page is the developer and publisher of Morrow:
- Onur Burak Çokyıldırım
- Email: bcokyildirim@gmail.com
Where your items live
Everything you save (link, title, image, price, note, tags, lists) is stored in a local database on your device. If iCloud is on, it syncs between your own devices through Apple's private CloudKit database. That data sits inside your Apple account; as the developer we cannot read, download or delete it. If iCloud is off, the app quietly works in local-only mode and never pushes you to sign in.
What happens when you save a link
When you share or paste a link, the app reads that page: a request goes directly to that site's server to extract the title, image and price (including the site icon, again from the site's own address). The request does not pass through us; there is no server of ours in the middle. We cannot see which sites you browse — only the page you chose to save is read. Tracking parameters (such as utm_*) are stripped from the address we store.
Some pages can only be read once they are opened in a browser. In that case, and only while you are using the app, the app opens the page in an invisible browser view: the page's own scripts run, and the page may connect to the services it uses, just as it would in Safari; those connections are covered by that site's privacy policy. The view's cookies and data are never written to disk and are gone when the app closes.
Clipboard
We read a link from your clipboard only at the moment you tap to use it. The value is not stored or sent anywhere; if you don't save it, nothing remains.
Smart tagging
The feature that suggests category tags runs entirely on your device where the hardware supports it (Apple's on-device model). Your titles and links are not sent anywhere for this. You can turn it off in Settings.
Purchases
Pro subscriptions and the one-time purchase are handled with RevenueCat (RevenueCat, Inc., United States), a service provider that works on our behalf and on our instructions (a processor).
When the app first runs, RevenueCat's software creates a random, anonymous identifier on your device (it starts with $RCAnonymousID:) and keeps it there. As the app opens and comes to the foreground, it connects to RevenueCat with this identifier to learn whether Pro is active and what the free save limit is — even if you have never bought anything.
Under this identifier RevenueCat keeps: your purchase history (which product, when, whether it is active), Apple's receipt for your purchases, when you last used the app, your device type and operating system, and your locale (language and region) and currency. Your device's IP address also reaches RevenueCat's servers, because that is how the connection is made.
We do not link this identifier to your name, email or anything else — we don't hold such data. Because it is unique and tied to a purchase history, we still treat it as personal data and apply every safeguard on this page to it. If you delete and reinstall the app, a new anonymous identifier is created.
Payment is processed by Apple; your card details never reach us or RevenueCat. Apple handles your purchase under its own privacy policy.
When you write to us
Settings ▸ Support opens a draft to us in your own mail app; the draft ends with the app and iOS versions, and you see every line before you send it. If you send it, your email address, your message, any attachments and those versions reach us. Our support inbox is on Google's Gmail; your email is stored on Google's servers, and Google may process it on servers outside the country where you live.
What we process, why, and on what legal basis
1. Purchases and Pro status
- Data: the anonymous identifier at RevenueCat and the record tied to it (see "Purchases").
- Purpose: to unlock Pro, verify and restore your purchase, and apply the free save limit.
- Legal basis: performance of our contract with you (the app's terms of use) — GDPR Art. 6(1)(b); KVKK Art. 5(2)(c).
- How it is collected: automatically, by RevenueCat's software in the app.
2. Subscription charts
- Data: the same record, in aggregate.
- Purpose: to see in RevenueCat's dashboard how many people subscribe and how often subscriptions renew or are cancelled.
- Legal basis: legitimate interests — GDPR Art. 6(1)(f); KVKK Art. 5(2)(f). Our interest is understanding how the app's pricing and sustainability are doing. Our balancing: the charts show only aggregate numbers, the record is not linked to your name, and it is never used for advertising or tracking, so we believe our interest does not override your rights. You can object to this (see "Your right to object").
- How it is collected: automatically.
3. Support emails
- Data: your email address, your message, any attachments, the app and iOS versions.
- Purpose: to answer your question or request.
- Legal basis: legitimate interests (being able to reply to you) — GDPR Art. 6(1)(f); KVKK Art. 5(2)(f). If you are exercising a right, our legal obligation — GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç).
- How it is collected: partly automatically, through the email you send.
Do you have to provide any of this? You don't have to give us any personal information to use the app. The RevenueCat connection is needed to buy and restore: if RevenueCat cannot be reached, the app keeps working with the last known Pro status, but a purchase or restore may not complete at that moment. Writing to us is entirely optional.
No automated decisions. No automated decision or profiling that has legal or similarly significant effects on you takes place.
Who receives your data, and in which country
- RevenueCat, Inc. (United States) — our processor; only for purposes 1 and 2 above. RevenueCat's own service providers (for example Amazon Web Services) are also in the United States.
- Google (Gmail) — where our support emails are kept; only if you write to us.
- Apple — runs payment and iCloud sync under its own responsibility; Apple's privacy policy applies.
We do not sell your data, and we share it with no one else unless the law requires it.
Transfer to the United States through RevenueCat
- If you are in the EU/EEA, the UK or Switzerland: the European Commission's adequacy decision for the United States covers only companies that joined the EU–US Data Privacy Framework; RevenueCat is not on that list. The transfer therefore relies on the Commission's standard contractual clauses (Implementing Decision (EU) 2021/914, Module 2: controller to processor), which are part of RevenueCat's Data Processing Addendum. For the UK, the ICO's International Data Transfer Addendum applies; for Switzerland, the same clauses adapted for Switzerland. Copy of the addendum: https://www.revenuecat.com/dpa · official text of the clauses: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj
- If you are in Türkiye: Türkiye's Personal Data Protection Board has not issued an adequacy decision for the United States, and we have not put in place any of the safeguards KVKK Art. 9 provides for this transfer (such as the Board's standard contract): your anonymous identifier and the record tied to it are transferred to the United States without a KVKK safeguard.
How long we keep it
- Items on your device and in your iCloud: until you delete them. We have no access to them.
- The RevenueCat record: for as long as our RevenueCat account stays open so that we can verify and restore your purchase, or until you ask us to delete it. If you ask, we delete the record from RevenueCat permanently. If we stop using RevenueCat, the data is returned or deleted under our contract with RevenueCat.
- Support emails: kept for 12 months after the conversation is closed, then deleted.
Analytics
This version ships with no analytics or measurement tool: we collect no usage data. If we add anonymous measurement later, this page will be updated and these limits will hold: full addresses, titles, notes and prices never enter any measurement, and no advertising identifier is used.
Notifications
The app does not ask for notification permission and does not send you reminders.
Children
The app is not directed at children and collects no age information. Where the law requires it, Apple's own age range sheet is shown; the app does not use the age group you share for anything, and never stores or sends it — the only trace left on your device is the date you were last asked.
Deleting your data
Because the data is yours, deletion is yours too: remove an item inside the app, or remove everything by deleting the app and clearing its iCloud data in Settings. Settings ▸ "Export your data" gives you a JSON copy of everything. To have your purchase record at RevenueCat deleted, write to us (see "Your rights"); deleting the record does not cancel your subscription.
Your rights
Under the GDPR and the UK GDPR: to access your data and get a copy, to have it corrected if it is wrong, to have it erased, to restrict its processing, to object to processing (see below), and to receive it in a common format (portability).
Under KVKK Art. 11: to learn whether your personal data is processed; if it is, to request information about it; to learn the purpose of the processing and whether the data is used accordingly; to know the third parties it is transferred to in Türkiye or abroad; to have it corrected if incomplete or wrong; to have it erased or destroyed under the conditions of KVKK Art. 7; to have those corrections and erasures notified to the third parties it was transferred to; to object to an outcome against you that results solely from automated analysis; and to claim compensation if you suffer damage from unlawful processing.
How to use them: write to bcokyildirim@gmail.com. Because we don't know your name or email, we can only find your RevenueCat record with information you give us: the record can be looked up by the anonymous identifier, a transaction number, or an Apple order ID. Without it we cannot tell which record is yours. We handle requests free of charge, within one month under the GDPR and within 30 days under KVKK.
A formal application under KVKK is made in Turkish, as required by the Communiqué on the Procedures and Principles of Application to the Data Controller, and sent to our email address signed with a secure electronic signature or mobile signature. It must include your name, Turkish ID number (for foreign nationals, nationality and passport or ID number), address for notifications, and your request. A complaint to the Board is possible only after such an application.
Your right to object
You can object at any time to the processing we do on the basis of legitimate interests for subscription charts (purpose 2 above). Because the charts are fed by the purchase record itself, we meet your objection by deleting your record from RevenueCat. We do no direct marketing.
Your right to complain
- Türkiye: you must first apply to us (KVKK Art. 14). If your application is rejected, you find our answer insufficient, or we do not answer within 30 days, you can complain to the Personal Data Protection Board within 30 days of learning our answer and in any case within 60 days of your application: https://sikayet.kvkk.gov.tr · Kişisel Verileri Koruma Kurumu, Nasuh Akar Mah. 1407. Sok. No: 4, 06520 Çankaya/Ankara.
- EU / EEA: to a data protection authority, in particular in the country where you live, work, or where you believe the infringement happened (GDPR Art. 77). List of authorities: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en
- United Kingdom: you can complain to us, and we acknowledge your complaint within 30 days. You can also complain to the Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/
- Anywhere else: to your country's data protection authority.
Changes to this page
Changes are published here and the date above is updated. An update that changes the app's data behaviour is also noted in the release notes.
Contact
Questions and requests: bcokyildirim@gmail.com