SewConnect Privacy Policy

Version 2026-08-05 · in effect from 5 August 2026

SewConnect is a private app for two people. It holds your messages and, if you choose to track it, your menstrual cycle. That is sensitive, and this page says plainly what happens to it.

Who we are

SewConnect is operated by a private individual based in Türkiye ("we", "us"). We are the data controller for the information described here, and the veri sorumlusu under Turkish law.

Contact for anything on this page, including privacy requests: admin@resonateapp.online.

What we hold, why, and for how long

We do not collect a name, a phone number, a photo, contacts, a location, or an advertising identifier. We do not currently ask for an email address. Server logs record the fact of a request; they are not used to build any profile of you.

Cycle data gets special treatment

Data about menstruation is health data — a special category under Art. 9 GDPR and Art. 6 of Turkish law 6698 (KVKK). We therefore:

• ask for it separately and explicitly at signup, never bundled into accepting these documents, and never pre-ticked;
• never share it with your partner unless you switch sharing on yourself. Sharing is off until you turn it on, and you can turn it off again at any time on the Cycle page;
• share only a phase and a countdown when you do turn it on — your symptoms and your written notes are never shown to your partner;
• let you decline cycle tracking entirely and still use the rest of the app.

Withdrawing this consent is as easy as giving it, and does not affect anything we did while it was valid.

What we never do

• No advertising, and no data sold, rented or shared for marketing.
• No analytics, no tracking pixels, no third-party scripts of any kind. The app loads nothing from anyone else's server.
• No automated decision-making and no profiling.
• No use of your messages or cycle data to train anything.

Who else is involved

Deliberately almost nobody.

• Our hosting provider operates the server the app runs on, in Türkiye. They can physically access the machine, as any host can.
• Your browser vendor's push service (Google for Chrome, Mozilla for Firefox, Apple for Safari) delivers notifications. We send them the notification encrypted, so they cannot read its contents — but they necessarily see that a message was sent, when, and to which device. We also send them a contact address (admin@resonateapp.online) with every push, as the push standard requires. If you never enable notifications, none of this happens.

That is the complete list. There is no third party we hand your data to for their own purposes.

Where your data is, and transfers

Everything is stored on a single rented server in Türkiye, and backed up on that same server.

If you are in the European Economic Area or the United Kingdom, this means your data is transferred to a country that does not have an EU adequacy decision. We rely on your explicit consent to that transfer, which is why the signup screen names it specifically. You can withdraw it by deleting your account. You should know that this also means your data is subject to Turkish law and to lawful access requests made under it.

Deletion, and what "deleted" means

You can delete your account yourself, from the You tab, at any time. It is immediate and there is no undo. See the deletion page for exactly what goes.

Two honest caveats:

• Backups are kept for up to 3 days. A copy of your data may survive in them briefly before they expire and are overwritten.
• An empty row survives briefly. Our database links your messages and your partnership to your account, so the account row itself cannot vanish the same instant. Everything identifying is destroyed at once — username, password, settings, everything above — leaving a numbered row that points at nobody, and a routine sweep removes even that once nothing refers to it. Your username is free for someone else immediately.

Your rights

Under the GDPR, the UK GDPR and the KVKK you have the right to know what we hold, to get a copy of it, to correct it, to have it erased, to restrict or object to how it is used, to take it elsewhere in a portable format, and to withdraw consent at any time.

Two of these are buttons rather than requests, because they should be:

• Download my data (You tab) gives you everything above as a single JSON file, immediately.
• Delete my account (You tab) erases it, immediately.

For anything else, write to admin@resonateapp.online. We will answer within 30 days. We may ask you to confirm you control the account before we act on a request, which is a protection for you.

If you think we have got this wrong, you can complain to your local data protection authority — in Türkiye, the Kişisel Verileri Koruma Kurumu (kvkk.gov.tr); in the EEA or UK, your national supervisory authority. We would rather you told us first.

Security, told straight

• Everything travels over HTTPS.
• Passwords are stored as salted scrypt hashes and are never recoverable, by us or by anyone.
• Sign-in is rate limited, so a stranger cannot grind passwords against your account.
• Messages are not end-to-end encrypted. They are encrypted in transit and stored on a server we control, which means we could technically read them. We do not. If that is not good enough for something you want to say, this is the honest place to find that out rather than to assume otherwise.
• By default, a notification shows the message text on your lock screen. Anyone holding your unlocked-enough phone can see it. You can turn that off in the app.

Children

SewConnect is for adults. You must be 18 or over to have an account. We ask for your date of birth at signup and keep only the year. If we learn an account belongs to someone under 18, we delete it. If you believe a minor has an account, tell us at the address above.

Changes to this policy

If we change anything that matters, we bump the version at the top and the app asks you to read and accept it again the next time you open it. Small corrections that do not change what happens to your data are made without asking.