Privacy Policy

Who we are

Kitio ("the app", "we", "us") is provided by Kerem Berkant Çatkaya, operating as Catkaya Software ("the provider"), Türkiye. Contact: support@kitioapp.com.

Summary

Kitio is designed to work with minimal data. We do not require an account, do not ask for your name or email to use the app, show no advertising, and do not track you across other apps or sell your data.

Information we process

• Anonymous app identifier. On first launch, Kitio creates an anonymous identifier (via Firebase Anonymous Authentication) so your unlocked modules work without an account. It is not linked to your name or email.
• On-device data. Modules you unlock, content you import from .kitio files, and your redeemed-code history are stored on your device.
• Activation and entitlement records. When you redeem a code or import a .kitio file, our server records the resulting entitlement against your anonymous identifier so your modules can be restored.
• Abuse-prevention metadata. To prevent code-guessing, we keep rate-limit and audit records that store only a one-way hash (fingerprint) of attempted codes — never the code itself — plus timestamps.
• What we do not collect. No advertising identifiers, no cross-app tracking, no analytics, and no crash-reporting in this version. We do not collect your name, email, contacts, location, photos, or precise device identifiers.

About .kitio files

A .kitio file is a data and content package only — it carries content and settings, never executable code. Kitio reads only its content; your imported files stay on your device.

How we use information

Solely to: create and restore your module unlocks; verify activations; prevent abuse (rate-limiting); and operate, maintain, and secure the app. We do not use your information for advertising or profiling.

Service providers

We use Google Firebase (Firebase Authentication, Cloud Firestore, Cloud Functions, and Firebase Remote Config) as our processor to operate activations and entitlements. Google processes this data on our behalf under its terms. We do not share your information with advertising networks and do not sell it.

International transfers

Our service-provider infrastructure (Google Firebase) may process data on servers outside Türkiye (including the European Union and the United States). Where applicable, transfers rely on the provider's safeguards.

Data retention

• On-device data remains until you reset local data (Settings → Data and Storage) or uninstall the app.
• Server-side entitlement records are retained while needed to provide and restore access, comply with legal obligations, resolve disputes, and maintain security.
• Abuse-prevention audit and rate-limit records are retained for up to 180 days, unless longer retention is required for security, abuse investigation, or legal compliance.

Your rights

Depending on where you live, you may have rights under KVKK (Türkiye, Law No. 6698), the GDPR, or the CCPA — including access, correction, deletion, and objection. Because this version uses an anonymous, device-bound identifier and no account, you can clear local data anytime in Settings → Data and Storage. To request action on server-side records tied to your anonymous identifier, contact support@kitioapp.com. (Account creation and in-app account deletion are planned for a future version; this policy will be updated then.)

Security

Entitlements are server-authoritative; the offline cache is integrity-protected and device-bound; the app holds no private signing keys.

Children

Kitio is not directed to children under 13, and we do not knowingly collect their data.

Changes

We may update this policy; the "Last updated" date reflects the latest version. Material changes will be reflected here and at https://kitioapp.com/privacy.

Contact

Questions: support@kitioapp.com · https://kitioapp.com/support.