Privacy policy

Last updated: October 2026

Xamally ("the app", "we") helps you plan and track study time for your exams. This page explains what data the app collects, why, and how you can control or remove it. Xamally stores almost everything on your own device and never sells your data.

Who is responsible

Xamally is responsible for your data (the data controller under KVKK and GDPR). Contact: support@xamally.com

What we collect

Your courses, exam dates, priorities, study sessions and reported grades are stored only on your device, in a local database, unless you choose to sign in for cloud backup.

If you sign in, we store your email address and, when you sign in with Apple or Google, the name they share with us. We use them only to identify your account and, for email sign-in, to send you a one-time code. We never see or store a password. With Apple you can choose to hide your email.

When signed in, a backup copy of your plan (courses, sessions, promises and rewards) is uploaded to our backend about once a day, so you can restore it on a new device.

Photos and videos you add as promises or rewards stay on your device. If you are signed in when you add them, they are also uploaded, so they can be restored with your cloud backup.

Anonymous usage analytics are off by default. If you turn them on in Settings, we receive anonymous events (e.g. "a session was completed") that never include your course names, dates, notes or any other personal content, and are never linked to your identity.

If you buy a subscription or a one-time pack, the purchase itself is handled entirely by the Apple App Store or Google Play and RevenueCat; we only receive whether you have an active entitlement, never your payment details. RevenueCat also receives an anonymous app user ID (your account ID if you are signed in) and two technical labels: the date you first opened the app and whether you are an early user.

At the end of a study period you can answer a short, optional survey. Your answers are sent only if you tap Send, together with your final adherence rate, platform, app version and language, but never with your name, email or account.

If the app crashes or hits an unexpected error, a technical crash report is sent to Sentry so we can find and fix the problem: the error and where in the code it happened, the device model, operating system and app version, and the screens visited just before. It never includes your name, email, account, course names or notes, and your IP address is not stored.

How we use it

Your study data is used only to run the app: build your plan, show your progress and send you the reminders you asked for. Your email, if any, is used only for sign-in and backup. Anonymous analytics, if enabled, help us understand which parts of the app are useful and fix problems.

Legal basis

We process your data to provide the app you asked for (performance of a contract); crash reports, to keep the app working, on the basis of our legitimate interest; and, for anonymous analytics, only with your consent, which you can withdraw in Settings at any time.

Who we share it with

We use four services to run the app, and share only what each one needs to do its job: Supabase (account sign-in and cloud backup storage), RevenueCat (subscription and purchase status), PostHog (anonymous analytics, only if you opt in) and Sentry (crash and error reports). None of them receive your course names, exam dates or session content unless you are signed in, in which case Supabase stores your backup so you can restore it.

Transfers abroad

Supabase, RevenueCat, PostHog and Sentry may process data on servers outside Türkiye and the EU, for example in the United States. We share only what each service needs, under their data processing terms.

How long we keep it

Local data stays on your device until you delete it. If you use a 2-month pack, your data is kept for 30 days after the pack ends; if you don't buy again in that time, your plans are deleted from the device and from the cloud backup. A cloud backup is otherwise kept for as long as your account exists. You can delete everything at any time from Settings > "Delete all my data", which removes your local data, your cloud backup, your uploaded reward media and, best-effort, your account itself.

Your choices

You can turn analytics on or off at any time in Settings, sign out or delete your account, and delete all your data from the app at any time. You can also ask us directly for any of these by using the contact details below. Under KVKK Article 11 and the GDPR you can ask whether we process your data, get a copy, have it corrected or deleted, object to processing, and complain to the Turkish Personal Data Protection Authority (KVKK) or your EU data protection authority.

Children

Xamally is not directed at children under 13, and we do not knowingly collect data from them.

Changes to this policy

If this policy changes in a way that matters, we will update this page and the date below.

Contact

Questions about your data or this policy? Email support@xamally.com