Lapis

Effective date: 26 October 2026

1. Who we are

Lapis is provided by Ekin Barış Çakır ("we"). Address: Sevgi Mahallesi 665 Sokak 7/6 Gaziemir İzmir Türkiye. Email: lapis@ekinbariscakir.com. We are the controller of your personal data.

2. In short

• No accounts. We don't ask for your name, email address or phone number.
• Your drawings, the photos of your drawings and your Photo Guides are stored only on your phone.
• For a Photo Guide, your phone cuts the subject out of your photo; your full photo never leaves your phone. Only the cut-out is sent, and our server and Google process it only to create the steps. Our server doesn't keep it; Google may keep it for up to 90 days to detect abuse. It isn't used to train AI.
• With your permission, we collect usage statistics and crash reports to improve the app. You give or refuse each separately. They are tied to a random ID, not to your name, and hold no location. There are no ads, no tracking across apps and no selling of data.

3. What we process and why

We collect data electronically and automatically, through the app and our server. If you don't provide a photo, only Photo Guide won't work; refusing usage statistics or crash reports doesn't limit any feature.

a) Photo Guide photo

• What: a cut-out of the photo you pick or take for a Photo Guide. On your phone, Apple's Vision framework separates the subject from its background; only this cut-out is sent, never the full photo. To make each next Step, the app also sends the image of the previous Step.
• Why: to create drawing steps from it. Our server crops the cut-out and sends it, with the previous Step, to Google's Gemini model (Google Cloud Vertex AI). The generated step images come back to your phone.
• How long: our server holds the cut-out and the step images in memory only while each request is processed, and writes none of them to disk. Google may keep the request for up to 90 days to detect abuse; otherwise it doesn't store it or use it to train AI.
• Legal basis: providing the service you asked for (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)). We also ask for your explicit permission before the first upload; you can withdraw it in Settings.
• If the photo shows identifiable people, you need their permission (see the Terms of Use). We don't do face recognition.

b) Install ID, Pro check, Photo Guide counter and abuse checks

• What:
  • On first launch the app creates a random install ID. Once, the app registers an Apple App Attest key with our server, and every Photo Guide request is signed with it, so our server can check that requests come from the real Lapis app. We keep the key's public part, a usage counter, Apple's receipt for the key and a one-way hash of the install ID. Each Photo Guide also gets a small record of how many steps and images were made; this record holds no photo.
  • When you start a new Photo Guide, or the app shows how many you have left, it sends its anonymous RevenueCat user ID. Our server asks RevenueCat whether Pro is active, whether it is in its trial, and when the paid subscription began. We don't store the RevenueCat user ID; the answer is kept in the server's memory for at most 30 seconds.
  • Our server counts the Photo Guides made in each allowance month under a code derived from your subscription, not from your install or your Apple ID, and keeps the moment your paid subscription began, so that the month renews on the same day (Google Firestore). Because the count belongs to the subscription, reinstalling the app or restoring on another iPhone keeps it.
  • We also count how many Photo Guides are started from each network per day: we don't store the IP address, only a code made from it with a key that changes every day, so the same address gives an unrelated code the next day.
• Why: to give new Photo Guides only to Pro, to apply the monthly allowance and the trial's one Photo Guide, and to prevent abuse. The App Attest key lets us check that requests come from the real Lapis app.
• How long: each month's counter is deleted automatically about one month after that allowance month ends. The moment your paid subscription began is deleted 400 days after it was last used, so that a subscriber who comes back keeps the same renewal day. Each Photo Guide's record is kept 2 days; the App Attest key record 12 months after the app last used it; the daily network count until that day ends (UTC). Each is then deleted automatically.
• Legal basis: providing the service (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) and our legitimate interest in preventing abuse (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).

c) Server logs

• What: a technical record of each request to our server: IP address, time, the address requested, app and device information (user agent), error codes and a short code derived from the install ID; for a new Photo Guide also a short code derived from the subscription. No photos or images.
• Why: to keep the service running and secure, and to find errors and abuse.
• How long: 30 days (Google Cloud Logging).
• Legal basis: our legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).

d) Purchases

• What: subscription status and purchase history. They come from Apple through RevenueCat, under an anonymous RevenueCat user ID. We never see your payment details; Apple takes the payment.
• Why: to unlock Pro and restore purchases.
• How long: for the length of the subscription and as long as tax law requires.
• Legal basis: performance of the contract and legal obligation (GDPR Art. 6(1)(b), (c); KVKK Art. 5(2)(c), (ç)).

e) Usage statistics and crash reports (only with your permission)

We ask for these two separately. You can allow one, both or neither, and change each any time in Settings. Both are linked to a separate random analytics ID (not the install ID) and contain no photos, drawings or names. Every event also says whether you're on Pro, but your purchase ID is never sent to PostHog. No location is stored: your IP address isn't kept at PostHog, and no city or country is derived from it. If you allow neither, nothing at all is sent to PostHog.

*Usage statistics*

• What: events such as which screens you open, whether you finish a Lesson or see the purchase screen, and when the app is installed, opened or closed; device model, iOS version, language.
• Why: to see where the app is hard to use, and to test which version of a screen works better.

*Crash reports*

• What: reports of app errors and crashes, with the device model, iOS version and app version.
• Why: to find and fix bugs.

*For both*

• Who: PostHog (EU region, Frankfurt).
• How long: at most 2 years, then deleted. You can delete them earlier with Delete my data (see 7).
• Legal basis: your explicit consent, given separately for each (GDPR Art. 6(1)(a); ePrivacy Art. 5(3); KVKK Art. 5(1)). Withdrawing one doesn't affect the other.

f) Support emails

• If you email us, we use your email address and message only to reply, and delete them 1 year after your request is closed.

4. Who we share data with

We don't sell your data or use it for advertising. We share it only with these companies, which run the service on our behalf (processors):

We have data processing agreements with these companies. Apple handles payment and app verification (App Attest) on its own behalf; Apple's privacy policy applies to these. Google does not use your data to train its models.

We may share data with authorities where the law requires.

5. International transfers

Lapis is run from Türkiye, and the companies in section 4 process data outside Türkiye, in the EU and the USA. For these transfers we use the standard contracts published by Türkiye's Personal Data Protection Board (KVKK Art. 9) and notify the Board of them as the law requires. For RevenueCat in the USA, data from the EU is also covered by the European Commission's Standard Contractual Clauses. You can ask us for a copy of these safeguards at lapis@ekinbariscakir.com.

6. What stays on your phone

Your drawing history, the photos of your drawings and your Share Cards stay only on your phone and are never sent to us. The Photo Guides generated for you are stored only on your phone too; while one is being made, the app sends its cut-out and previous Step to our server for each next Step (see 3(a)), and we don't keep them. If iCloud Backup is on, they're included in Apple's backup. Deleting the app deletes them. Reminders are scheduled on your phone too; nothing is sent to us for them.

7. Your rights

Under the GDPR and KVKK Art. 11, you have the right to access, correct and delete your data, to restrict or object to its processing, to data portability, and to withdraw your consent. Since there are no accounts:

• Settings → Delete my data deletes your usage statistics and crash reports at PostHog first. Only once that is confirmed does the app continue under a new analytics ID. If deletion fails, the app keeps the old analytics ID, even if you close it, so you can try again later; it keeps working normally meanwhile. Your consent choices stay as they were.
• If nothing has been sent under your current analytics ID (for example, you never allowed either, or you already deleted and nothing was sent since), the app tells you there is nothing to delete and sends no request.
• If deletion keeps failing, you can email us your analytics ID from the app instead, and we delete the data manually within 30 days. Once Mail has sent your email, the app continues under a new analytics ID. If your phone has no Mail account, the app shows the ID and our address for you to send from any email app.
• So that the monthly allowance can't be reset by deleting, the install ID, the Photo Guide counter, the moment your paid subscription began and the App Attest key record stay until they expire (see 3(b)). They hold no photos or personal content.
• For other requests, email lapis@ekinbariscakir.com with your install ID (shown in Settings). Requests are free; we reply within 30 days at the latest.
• We don't keep photos, so there are no photos to access or delete.

You have the right to complain: in the EU, to the data protection authority of your country; in Turkey, to the Personal Data Protection Board (KVKK).

8. Age

Lapis is not directed at children. Photo Guide is for users 18 and older only. We don't knowingly collect data from children under 13; if we learn we have, we delete it.

9. AI

Lesson and Photo Guide step images are generated by AI and marked in a machine-readable way. We don't make automated decisions about you; the AI only produces drawing steps.

10. Security

Connections are encrypted (HTTPS). Server credentials stay only on the server. No system is perfect; if a breach happens, we'll notify as the law requires.

11. Changes

If we change this policy, we'll update its date, and we'll tell you in the app about significant changes.

12. Contact

lapis@ekinbariscakir.com · Sevgi Mahallesi 665 Sokak 7/6 Gaziemir İzmir Türkiye