DRAFT — This text has not been legally reviewed and is not final.

Privacy Policy

Last updated: 01.11.2026

This policy explains how we handle your personal data when you use the feednik.com website and the Feednik app (the "Service"). It applies wherever you live. Information specific to Türkiye is also in the KVKK Privacy Notice, and your rights by region are in section 11 below.

In short

• We do not sell your personal data, use it for advertising or share it for advertising. We use no advertising, analytics or tracking tools.
• We only collect what we need to provide the Service.
• Your email address is never sent to AI providers. We do not use your data to train our own AI models.
• Other users cannot see your notes or the documents in your library.
• You can download your data or delete your account at any time.

Effective date: 01.11.2026

1. Data controller

[DATA CONTROLLER / COMPANY NAME], Yumurtacı Abdi Bey Cad. No:4, Kadıköy, Istanbul, Türkiye. Email: readarlyapp@gmail.com · KEP: [REGISTERED E-MAIL ADDRESS (KEP)] · MERSIS: [MERSIS NUMBER]
EU / UK representative: [EU/UK REPRESENTATIVE, IF APPOINTED]

2. Data we collect

• Account: your email address, a one-way hash of your password, whether your email is verified, your language, sign-up date.
• Profile and preferences: your profile type (individual or company), role, the description and goals you write, the topics, subtopics, countries, keywords, people and stocks you follow, the "finance tracking" setting; for company profiles, company name, sector, markets and revenue/cost factors.
• Usage: publications you save, like or mark as not interesting, your notes on publications, notifications shown to you, AI usage records (which feature, when, how many units), briefs and analyses generated for you.
• Social features: your handle, display name and short bio, posts, polls, votes and files you share in rooms and discussions, your direct messages, room memberships, join requests, invitations, friends, people you block, reports you make or that are made about you, moderation outcomes.
• Library: documents you upload and links you add, and the text and summaries extracted from them.
• Subscription: your plan, trial period, store (Google Play / App Store), product, subscription status and end date. We never receive your card details.
• Device: if you allow notifications, your device's push token and platform (Android / iOS).
• Consents: which document version you accepted, your marketing email preference, and the time and IP address of these actions.
• Technical and security: session key, IP address, server access logs (time, requested address, browser information), error logs.
• Correspondence: your messages when you email us.

We get most data directly from you; some is created automatically as you use the Service. We receive subscription status from the stores via RevenueCat. We do not ask for sensitive data (health, religion, ethnic origin, etc.); please do not share it.

People whose publications we list (authors and well-known people): When indexing publications the Service processes author names. The "People" feature also shows the name, title or role, a short introduction, and the writings and talks that well-known people such as economists, executives and researchers publish openly on their own blogs, newsletters or RSS feeds and in the news. We take this information from their own public sources and from publishers. Our purpose is to let our users follow these people's public views; our legal basis is that the person made the data public (KVKK Art. 5/2-d) and our legitimate interests (GDPR Art. 6(1)(f)). We keep it while the publications remain public at the source and the person is listed in the Service. These people have all the rights in this policy; they can object or ask to be removed from the Service by writing to readarlyapp@gmail.com.

3. Why we use data and our legal bases

Our legitimate interests are: the security of the Service and its users, preventing abuse and fraud, and improving the Service. You can object to processing based on legitimate interests (section 11). Withdrawing consent does not affect processing before withdrawal.

Providing an email address and a password is necessary to create an account; without them we cannot provide the Service. Everything else (profile details, goals, follows, social profile, notifications, marketing emails) is optional; if you don't provide it, the related feature is unavailable or less personalised.

4. AI and personalisation

• What goes to AI: the title and public description of publications; for sources whose publisher allows reuse, including for commercial purposes (e.g. public-domain official publications, CC BY content; we check this source by source), up to about 30,000 characters of full text per publication; when you use a feature, a short summary of your profile (profile type, role, goals, what you follow, interests, stocks) and your question (e.g. "Ask Radar", "ask the publication"); the text of your document when you ask for a library analysis; every post you share in rooms and discussions, for automated moderation before it is published; room names and descriptions; a small copy of images attached in rooms (for a safety check); for room summaries and "ask the room", the text of recent posts in the room (with handles, emails, phone numbers, bank account and ID numbers and links removed).
• What never goes to AI: your email address, password, payment details and direct messages.
• Provider: Our AI provider is Anthropic PBC (USA); requests may be processed through Anthropic's own infrastructure. Anthropic does not use the content we send to train its models. It generally deletes it within 30 days; content its automated systems flag as violating its usage policy may be kept for up to 2 years, and longer where the law requires.
• Labelling: AI-generated summaries, answers and analyses are labelled "AI-generated" on publication pages and in AI features; the short summary lines on feed cards are also AI-generated. When you chat with the Radar AI assistant or use the "ask" features, you know you are interacting with AI, not a person.
• Personalisation: The order of your feed is based on a score calculated automatically from what you follow, your keywords, countries and goals, and how you react to publications (save, like, not interested). Each publication also gets an AI relevance score that is the same for everyone. You can change the ranking at any time by changing what you follow.
• Automated decisions: The AI relevance score, the personalised feed and automated moderation are not decisions with legal or similarly significant effects on you (GDPR Art. 22). Automated moderation may block a post, ask you to soften it or hold it for review; you can then ask for human review and appeal by writing to readarlyapp@gmail.com. Users in Türkiye also have the right to object to a result against them that arises solely from automated analysis (KVKK Art. 11(1)(g)).

5. Who we share data with

We do not sell your data or share it with anyone for advertising. We only share what is necessary with service providers that help us run the Service and act on our instructions, and with the recipients listed below:

• Hosting: [HOSTING PROVIDER], servers in Germany (EU). The database, uploaded files and on-server backups are stored there. An off-site backup copy is also kept: [OFF-SITE BACKUP PROVIDER AND COUNTRY].
• AI: Anthropic PBC (USA). See section 4.
• Email delivery: verification, password reset and notification emails are sent through Resend, Inc. (USA) or an SMTP email service provider [NAME AND COUNTRY OF THE PROVIDER IN USE]. The provider receives your email address and the email content.
• Subscriptions: Google (Google Play) and Apple (App Store) take payment; RevenueCat, Inc. (USA) manages subscription status. RevenueCat receives a pseudonymous user number (e.g. rr_123), not your email, together with device and transaction data (app version, IP address, store transaction IDs).
• Push notifications: if you allow them, Google Firebase Cloud Messaging (USA) and, on iOS, Apple Push Notification service; they receive your push token and the notification text (e.g. a publication title).
• Other users: your handle, display name and what you post in rooms are visible to the other members of the room or, in open rooms and publication discussions, to other users of the Service. Making your profile searchable and showing what you follow are off by default.
• Professional advisers: lawyers, accountants and auditors, where needed and under a duty of confidentiality.
• Authorities: only where the law requires it and at the request of a competent authority.
• Business transfer: if the Service is transferred to another company, together with the safeguards in this policy.
• Third parties your browser contacts directly (they receive your IP address): Google Fonts and publishers' image servers. They are not service providers acting for us; see section 6.

When you follow a new keyword, we search public research and news databases (e.g. OpenAlex, Crossref, arXiv, Europe PMC, GDELT) for that keyword; your identity is not sent with these searches. When you add a link to your library, our server downloads that page.

6. Third-party content on our pages

• Publication cover images load from the publisher's own server. When they load, your IP address and browser information reach that publisher.
• The site and app load fonts from Google Fonts (Google); your IP address reaches Google when they load. Google Fonts does not use cookies.
• When you follow a link to the original source, that site's own privacy policy applies.

7. International transfers

We are based in Türkiye, our server is in Germany and some of our providers are in the USA, so your data moves between Türkiye, the EU and the USA.

• Transfers from Türkiye (KVKK Art. 9): Under KVKK our server in Germany also counts as abroad. The Turkish Data Protection Board has no adequacy decision for Germany or the USA, so we transfer data to these providers only under the standard contracts published by the Board, and we notify each signed contract to the Board within 5 business days of signing. We do not rely on the occasional-transfer exceptions in KVKK Art. 9(6) for the regular transfers needed to run the Service.
• Transfers from the EU / UK (GDPR): For transfers to providers in the USA we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data) or, where the provider is certified, the EU-US Data Privacy Framework. Türkiye has no EU adequacy decision, so we apply GDPR-level protection to all our users.
• You can ask for a copy of these safeguards at readarlyapp@gmail.com.

8. How long we keep data

9. Security

• Connections are encrypted with HTTPS. Passwords are stored as one-way hashes (PBKDF2, 200,000 rounds); only hashes of verification and reset codes are kept.
• Sign-in, sign-up and password reset attempts are rate-limited; sessions expire after 30 days; state-changing requests from other sites are rejected; security headers (HSTS, CSP) are used.
• Location and EXIF data are removed from shared images. Posts in rooms and discussions that contain an email address, phone number, bank account (IBAN) or Turkish ID number are rejected before they reach AI; in direct messages, bank account and ID numbers are blocked. For room summaries, handles, emails, phone numbers, bank account and ID numbers and links are removed before posts are sent to AI.
• Server access is limited to a small number of authorised people; backup files can only be read by their owner.
• No system is 100% secure. If a breach affects your personal data, we notify the Turkish Data Protection Board within 72 hours and, where GDPR applies, the competent supervisory authority within 72 hours, and we tell you as soon as possible if it is likely to affect you.

10. Children

The Service is for people aged 16 or over and is not directed at children. When you sign up, you confirm that you are at least 16. We do not knowingly collect data from anyone under 16 (and certainly not under 13); if we find such an account, we close it and delete its data. If you become aware of one, write to readarlyapp@gmail.com. Users aged 16-17 should use the Service with a parent's or guardian's knowledge and need their permission for paid plans.

11. Your rights

Everyone: You can access your data, get a copy, correct it, ask for deletion, ask us to restrict processing, object to processing based on legitimate interests, withdraw consent at any time, and receive your data in a portable format (JSON). You can do much of this yourself: in Profile → Account settings you can download your data, change email preferences and delete your account. The in-app download currently contains your account, profile, follows, saved items, notes, library and consent data; your social profile, room posts, messages and subscription details are not in it yet. For a full copy including these, write to readarlyapp@gmail.com and we will send it within 30 days. For other requests also write to readarlyapp@gmail.com. To verify your identity we may ask you to write from your account's email address. We reply free of charge within 30 days.

Türkiye (KVKK): Your rights under KVKK Article 11 and how to apply are in the KVKK Privacy Notice. You must apply to us first; if you are not satisfied with our answer you can complain to the Turkish Personal Data Protection Board (kvkk.gov.tr).

EU, EEA and UK (GDPR / UK GDPR): In addition to the rights above, you can complain to the data protection supervisory authority where you live or work (EU list: edpb.europa.eu; UK: ico.org.uk). You can always object to direct marketing.

USA (California CCPA/CPRA and other state laws): Even where these laws do not apply to us, we honour the following:

• Categories of personal information collected in the last 12 months: identifiers (email, handle, IP address, push token), commercial information (plan and subscription), internet activity (use of the Service), inferences (interest profile), user content (posts, messages, documents), account login credentials. Their sources, purposes and recipients are described above.
• You have the right to know/access, delete, correct and port your data. We will not treat you differently for using these rights.
• We do not sell your personal information or share it for cross-context behavioural advertising, and have not done so in the last 12 months. That is why no "Do Not Sell or Share" link is needed. We treat a Global Privacy Control signal as a valid opt-out request, although we do not sell or share personal information. We use sensitive personal information (e.g. account login credentials) only to provide the Service.
• You or an authorised agent can send a request to readarlyapp@gmail.com; we reply within 45 days. If we deny your request you can appeal by replying to our answer; if the appeal is denied you can contact your state Attorney General.

12. Cookies and "Do Not Track"

We only use necessary cookies and browser storage; the app contains no analytics or advertising SDKs. Details: Cookie Policy. Because we do not track you across sites, we do not change anything in response to your browser's "Do Not Track" signal; no tracking takes place whether the signal is on or off.

13. Changes

We may update this policy. The current version is always on this page; we announce important changes by email or in-app notice before they take effect.

14. Contact

[DATA CONTROLLER / COMPANY NAME] · Yumurtacı Abdi Bey Cad. No:4, Kadıköy, Istanbul, Türkiye · readarlyapp@gmail.com

Other documents: Terms of Use · Privacy Notice (KVKK) · Cookie Policy · Account and data deletion · Support