Privacy Policy

Version 0.8 — Last updated 2026-11-13

1. Who we are and what this policy covers

Unmelt (the "app") is operated by Mamonta Dış Ticaret A.Ş. ("we", "us"), a company registered in Türkiye. Address: Akyapı No:23 D:49, İkitelli OSB Mah., Bedrettin Dalan Bulvarı, Başakşehir, Istanbul 34490, Türkiye. Email: info@hicatcher.co. We are responsible for the personal information described in this policy.

Unmelt is an app for parents and legal guardians. It offers a library of narrated, animated picture-book stories about everyday feelings, and lets you create a story for your child with the help of AI. This policy explains what information the app collects, why, who receives it, how long we keep it and what your rights are.

2. Information we collect

• Account: your email address, your display name (the name your Apple or Google account shares, otherwise the part of your email before "@"), your password if you sign up with email (stored only as a hash by our authentication provider) and an internal user ID.
• Guest session: you can try the app before creating an account. This creates an internal user ID with no email. Guest sessions cannot buy subscriptions.
• Your acceptance of the Terms of Use and this Policy (which document, which version, when).
• Child profile: your child's first name or nickname, birth year and, optionally, birth month (we never ask for the day), gender (girl, boy or "prefer not to say") and an avatar picked from a built-in set.
• Stories you create: the text you write about your child's situation (see section 2.1), your choices in the story steps, and the story text, pictures and PDF files made from them. If you edit a story's text, earlier versions are kept (see section 7).
• Library use: which library stories you opened in each free or subscription period, the page you last reached, stories you marked as favourites, your narrator and background-sound choice, and content reports you send (story, page, reason and an optional note).
• Feelings answers and reading days: at the end of a library story, your child (or you) can tap a face for "good", "so-so" or "not good"; this can be skipped. We store the story ID, the answer and the date, linked to the child profile. We also store the dates on which a child profile reached the end of a story, to show a reading streak.
• Subscription and credits: whether your subscription is active, when the current period ends, the product, whether you are in a free trial, store purchase events, and the history of story credits added, used and returned. We never receive your card or bank details.
• Notifications: if you allow notifications, a device push token and the platform (iOS or Android), used to tell you when a story is ready.
• Error reports: see section 2.2.

We do not collect your location, advertising ID or photos, and we do not use advertising or analytics SDKs. We do not collect health data from your device (such as Apple Health or step counts); the "sensitive information" described below is only the text you write yourself.

2.1 Sensitive information: the text you write about your child

When you create a story, you can describe your child's situation in your own words. This is free text. It may, even unintentionally, include information about health, a disability, beliefs or other sensitive matters. We therefore treat this text as sensitive personal information, whatever you write:

• We use it only to write your child's story. We never use it for advertising, profiling or training AI models, and we never show it to anyone other than you.
• The text is sent to Anthropic, the AI provider that writes the story (see section 5).
• We delete the raw text within 90 days at the latest (see section 7). You can ask us to delete it sooner (see section 8).
• Writing this text is optional: you can create a story using only the ready-made options in the story steps.
• We ask for your explicit consent before you can write this text. The first time you open the free-text field, the app shows a notice that summarises the points above, with a consent box that is not pre-ticked. Until you consent, the field cannot be typed in and a story cannot be started with written text. If you do not consent, you can keep making stories with the ready-made options. You can withdraw your consent at any time from the Profile screen (see section 3).
• If text is processed without that consent step (for example, a request sent directly to our server from outside the app), we record the event in an audit log: your user ID, the hour it happened, the consent state ("never given" or "withdrawn") and a size band of the text (short, medium or long). The text itself, any part of it, a summary of it or an encrypted trace of it is never written to that log. We keep this log only to check that the consent step works and, if needed, to notify you. It is deleted automatically after 180 days (see section 7).

2.2 Error reports (Sentry)

When the app hits an error, it sends an error report to Sentry, our error monitoring provider. We build each report ourselves, and a filter in the app removes everything except these fields: an error code, the error type, where the error came from in the app, the name of the screen, the app version and build number, and the time.

Error reports do not include your user ID, email, name, your child's information, the text you write, story content, screen text, device details or a record of what you tapped. Automatic crash, hang and session tracking are switched off. When a report arrives, Sentry's servers see the network address of the connection, as any internet service does; the app does not send it as part of the report.

Our servers also send error reports to Sentry when story creation fails. These reports contain a short error summary chosen from a fixed list, the error type, where the error came from and technical details of our own code. They do not include your user ID, email, your child's information, the text you write or story content.

3. Legal bases (Türkiye, EU and UK)

Where the law requires a legal basis for processing personal information (for example the Turkish data protection law, KVKK, and the EU or UK GDPR):

• Account, stories, library, subscription and credits: performance of our contract with you (KVKK Art. 5(2)(c), GDPR Art. 6(1)(b)).
• Your child's profile (name, birth month and year, gender): performance of our contract with you, because a story suited to your child cannot be made without it (KVKK Art. 5(2)(c), GDPR Art. 6(1)(b)). We do not ask for a separate consent for this data; section 2 lists what we process and you can use your rights in section 8 at any time.
• The text you write about your child: your explicit consent (KVKK Art. 5(1) and KVKK Art. 6(2), GDPR Art. 6(1)(a) and GDPR Art. 9(2)(a)). Because we treat this text as sensitive, the basis is your explicit consent, not the contract. We record who gave consent, when, and for which version of this notice. Writing the text is optional, so not consenting does not stop you from using the app.
• You can withdraw your consent at any time (Profile → Sensitive data consent; KVKK Art. 11, GDPR Art. 7(3)). Withdrawal applies from that moment on: stories already made, their text and pictures stay; the app only stops accepting new free text. Raw text already given is still deleted under section 7, and you can ask for earlier deletion under section 8.
• Error reports and security measures: our legitimate interest in keeping the app secure and working.
• Push notifications: the notification permission you give on your device.
• Records we must keep by law (for example purchase records): legal obligation.

4. Why we use information

• To create your child's story text and pictures
• To run the story library, reading progress, favourites and reading streak
• To tell you that a story is ready (push notification)
• To manage your account, subscription and story credits
• To keep the app secure and working, including error reports

We do not use your information for advertising and we do not sell it.

5. Who receives information

We share information only with service providers that process it for us, and only as far as they need it:

• Supabase, Inc. — authentication, database, file storage and server functions. Holds all account, child-profile, story and usage data. Our project is hosted in the United States (AWS us-east-1).
• Anthropic, PBC — writes the story text with AI. Receives the text you wrote and the story settings (such as your child's age band and your choices).
• QuickDesign — draws the story pictures with AI. Receives scene descriptions made from the story, not the text you wrote.
• RevenueCat, Inc. — subscription status and purchase events. Identifies you by our internal user ID, not by your name or email.
• Apple (App Store) and Google (Google Play) — sell and bill subscriptions and handle refunds under their own privacy policies.
• Apple (Sign in with Apple) and Google (Google Sign-In) — only if you choose to sign in with them.
• Apple Push Notification service — delivers push notifications. Receives the device token and the notification text.
• Functional Software, Inc. (Sentry) — error reports, with only the fields in section 2.2. Our Sentry organisation is in the United States data region.
• Resend — sends sign-in and verification emails. Receives your email address and the email content.

We may also disclose information if the law requires it, to protect rights and safety, or as part of a sale or merger of our business, in which case the buyer must follow this policy.

6. International transfers

We are based in Türkiye. Our database and files are stored in the United States, and most of our service providers are in the United States. Your information is therefore stored and processed in the United States and may be accessed from Türkiye by our staff for support and operations.

7. How long we keep data

Most of your information is kept until you delete your account. One type of data is deleted automatically, without you asking:

• The text you wrote about your child's situation is deleted automatically within 90 days at the latest, whatever stage the story is at. The same period applies whether the story is finished, failed, stopped after the text step or left half-way. The period starts when the story's text was last written for that story; if no text was ever written, it starts when the story was created. If you ask the app to write the story text again, the period starts again, because your text is read again at that moment. Refreshing the pictures, changing the cover or editing the story text yourself does not restart the clock, because none of these read the text you wrote. So "90 days at the latest" is a real upper limit, and using the app more does not extend it. The only exception is a generation that is running at that moment: because the running step may need the text, the text stays until that step finishes, and the period continues as soon as it does. Only the raw text is deleted; your story, its pictures and its PDF files stay.
• Account information, child profiles, stories, pictures and PDF files: until you delete them or delete your account.
• Earlier versions of a story's text you edited: only the last 20 edits for each story are kept; older ones are deleted automatically. They are deleted with the story or your account, and only you can see them.
• Feelings answers and reading days: kept on our servers linked to the child profile, and shown only to you on the Profile screen. They are deleted when you delete the child profile or your account.
• Subscription status and the story-credit history: until you delete your account.
• Store purchase event log (event ID, event type, time and internal user ID): kept after you delete your account, for accounting, refund and fraud handling.
• Push token: until you delete your account or turn off notifications on your device.
• The audit log of text processed without consent (user ID, hour, consent state, size band; not the text): deleted automatically after 180 days. This is longer than the 90 days for the text on purpose, so that we can still check the consent step after the text is gone. You cannot see this log in the app; we will tell you about it if you ask under section 8.
• Error reports: kept by Sentry under the retention settings of our Sentry account. They contain no information that identifies you (section 2.2).
• A story form you left unfinished (your text and choices): kept only on your device, never sent to our servers, and deleted automatically after 7 days. It is deleted at once when the story is created, when you choose "Start over" or when you sign out.
• Your reading summary (the story and page counts on the Profile screen): kept only on your device and never sent to our servers. To calculate it, the app stores the dates you read and the highest page reached in each story, for up to the last 400 reading days. It is deleted when you sign out or delete your account. If you move to a new phone, the summary starts from zero.

Information kept only on your device may be included in your own device backups (for example iCloud or Google backups). Those backups are in your own account and we cannot access them. A restored unfinished story form still follows its own 7-day limit.

When the raw text is deleted, it is replaced with a deletion marker. After that, in-app search finds the story only by its title, not by the words you wrote. If the story has no title yet, search does not show it, but the story stays in your library.

When you delete your account, your information is deleted immediately from our database, except the store purchase event log described above and records we must keep by law. Your story pictures and PDF files are removed from our file storage shortly after. Backup copies of our database may still contain deleted information until those backups are deleted. Your subscription record held by RevenueCat and the stores is kept under their own rules. We do not delete accounts because they are inactive; deleting your account is your decision.

8. Your rights

Depending on where you live (including under US state privacy laws, KVKK Art. 11 and GDPR Art. 15–21), you may have the right to:

• know what personal information we hold about you and get a copy of it
• correct inaccurate information
• delete your information
• restrict or object to processing
• withdraw consent at any time
• not be treated differently for using these rights

We do not sell or share personal information for targeted advertising and we do not make automated decisions that have legal or similar effects on you.

In the app you can edit or delete child profiles and delete your account (Profile → Delete my account). Deleting your account does not cancel a subscription bought through Apple or Google; cancel it in your store account settings. For a copy of your data, early deletion of the text you wrote, or any other request, email info@hicatcher.co from the email address on your account. You can also complain to your data protection authority or, in the US, your state attorney general.

9. Children's information

The account holder must be an adult parent or legal guardian. Children do not create accounts, do not sign in and are not asked for information by the app. A child may watch or listen to a story on your device and, at the end of a library story, tap a face to show how the story made them feel; that answer is stored under your account.

Only you enter information about your child (name, birth month and year, gender and the text you write). We process it to provide the service to you. We use the minimum we need: we ask for the birth month and year, not the full date, because that is what we need to choose stories for your child's age. We treat the text you write as sensitive: we use it only to make the story and we delete the raw version within 90 days at the latest (see sections 2.1 and 7).

If you believe a child has given us information without a parent, email info@hicatcher.co and we will delete it.

10. AI-generated content

The stories, pictures and narration in the app are created with generative AI. The text and pictures you see were made by AI models, not written or drawn by a person. We state this in line with Art. 50 of the EU AI Act.

11. Security

Each account can read only its own data; this is enforced in the database. Connections are encrypted (HTTPS). Passwords are stored only as hashes by our authentication provider. Error reports are reduced to a fixed list of fields before they are sent. If a security breach affects your information, we will notify you and the authorities as the law requires.

12. Changes to this policy

If we change this policy in a way that matters (for example a new type of data, a new recipient or a longer retention period), we will show the new version in the app and ask you to accept it before you continue. The version and date are at the top of this page.

13. Contact

Mamonta Dış Ticaret A.Ş. Akyapı No:23 D:49, İkitelli OSB Mah., Bedrettin Dalan Bulvarı, Başakşehir, Istanbul 34490, Türkiye Email: info@hicatcher.co