Milk & Spoon — Privacy Policy

Last updated: 25 June 2026

Short summary

• Your data stays in Türkiye. The records on your device are optionally backed up to our servers located within Türkiye.
• No advertising, analytics or third-party tracking is used.
• You can use the app without creating an account. In the anonymous stage, no email, name or personal information is collected.
• Your feeding, bottle, pumping, milk-stock and meal/plate records are lifestyle data — they are not health data.
• Your allergy notes are treated as health data out of caution and your explicit consent is obtained.
• Only pseudonymous technical error logs are sent abroad (Sentry — Frankfurt, EU). These logs contain only your random user identifier (UUID) and the error message; baby name, email, record content or IP address are not sent.

1. Data Controller

"Milk & Spoon" is a brand operated by the natural person Turkuaz ŞENGÜL. The data controller of your personal data is this natural person.

• Data controller: Turkuaz ŞENGÜL (natural person)
• Brand / app: Milk & Spoon · Baby Feeding Tracker
• Requests / contact: destek@milkandspoonapp.com
• Web: https://milkandspoonapp.com

2. Data we collect

2.1. Anonymous stage (use without an account)

When you start using the app without creating an account, only a random user identifier (UUID) is generated. At this stage:

• Email, name, phone or any other information identifying you is not collected.
• The records you keep on your device remain only on your device.
• In KVKK terminology, this is a pseudonymous data regime; the personal-data quality is minimal.

2.2. After upgrade (with Apple Sign In or email)

If you wish, you can link the app to an account via Sign in with Apple or email + password. The same UUID is preserved; cloud backup and family sharing features become active. The personal data processed at this stage:

• Email address (Apple's relay email if you choose "Hide My Email")
• Apple user identifier (when signing in with Apple)
• Account creation date

2.3. App content

About the legal consent record: When you approve the legal texts, your random user identifier (UUID), the version of the text you approved, and the date are also kept on our server for proof purposes. This record is independent of your feeding/allergy content; it only proves that consent was given (KVKK art. 12, accountability). This record is also kept by UUID for anonymous (no-account) use.

About free-text fields: You can enter any information you wish into free-text fields such as the plate name, note and allergy description. We recommend that you do not enter sensitive information such as health conditions or identity details into these fields; the content you enter is stored as you entered it and is shared with the family members you invite (if you have created an account).

3. How we store it

• On your device (local database): primary storage. If you delete the app, all records on the device are deleted.
• On our servers in Türkiye: optional cloud backup. Data is stored encrypted and is accessible only to you and the family members you invite; transmission is done over an encrypted connection (HTTPS).
• Data stays within the borders of Türkiye (except Sentry — see article 4).

4. Third parties

The app uses only the following third parties with the minimum data required:

Details about Sentry: Before sending data to Sentry, the app automatically scrubs user record content (baby name, feeding, allergy, email), IP address and geographic location; geographic location is not stored. What is sent to Sentry is not a health-data transfer but pseudonymous technical error tracking.

No advertising, analytics, profiling or tracking. No tools such as Google Ads, Facebook SDK, Firebase Analytics, AdMob or similar are used.

5. Data retention period

• Data on the device: until you delete it.
• Cloud backup: as long as your account is active. When you request it via "Delete Account" or by support email, it is permanently deleted within 30 days.
• Sentry error logs: automatically deleted after 30 days.
• Records subject to a legal retention obligation (invoices/finance, if any): for the period required by legislation.

6. Your rights (KVKK art. 11)

You may exercise the following rights at any time:

• Learn whether your personal data is being processed
• If processed, learn for what purpose
• Learn whether it has been transferred domestically/abroad
• Request correction if processed incompletely/incorrectly
• Request its deletion or destruction
• Request that correction/deletion actions be notified to third parties to whom the data was transferred
• Object to a result against you arising from analysis by automated systems
• Claim compensation if you have suffered damage due to unlawful processing of your data

For your requests: destek@milkandspoonapp.com — answered within 30 days at the latest.

7. Children

The app is intended for parents of babies aged 6–18 months. The user of the app (the guardian) must be an adult. Persons under the age of 18 are not expected to use the app. Children do not use the app directly; the guardian enters information on their own behalf and on behalf of their baby.

8. Data breach

If we become aware that unauthorized access to your data has occurred, we will inform you as soon as possible (within 72 hours at the latest) and notify the Board pursuant to KVKK art. 12/5.

9. Changes

We may update this policy from time to time. We will announce significant changes within the app and by email. The current version is always displayed on this page.

For questions: destek@milkandspoonapp.com

This text is governed by Turkish law. In case of dispute, the Istanbul Courts and Enforcement Offices have jurisdiction.