Privacy Policy
Last updated: 23 October 2026
This describes how the KimGitti mobile app and kimgitti.com handle personal data. It also serves as the disclosure notice required under Turkey’s Personal Data Protection Law (KVKK, no. 6698).
In short
- We never see your Instagram password. You log in inside the app, on Instagram’s own page; the resulting session never leaves your device.
- Your account is read on your phone. Our servers never log in to Instagram and run no bots or proxies.
- What we store is your own account’s follower and following lists and your post statistics. The analytics are made by comparing those over time.
- No ads, no ad tracking, no data sales.
- Delete your account in the app and everything goes with it, immediately.
What we process
Account information
When you sign in with Apple or Google, all we receive is your email address and the identifier your provider issues. We create your account from those. There is no password to store, because the app has none.
Subscription information
If you subscribe to Premium: which plan you bought, the state and end date of the subscription, and the transaction number the store assigns. We never see your card; payment happens at Apple or Google, and only the outcome reaches us.
Instagram data
When you connect your Instagram account, and on every update afterwards, the app reads the following about your own account, on your device and in your own session:
| Data | Example |
|---|---|
| Connected account identity | username, account id, profile details, follower/following counts |
| Follower list | usernames and ids of the accounts that follow you |
| Following list | usernames and ids of the accounts you follow |
| Post statistics | like and comment counts on your posts, publication dates |
| Post content | the caption you wrote, the post’s type, and a link to its cover image (the picture itself is never stored) |
| Places you tagged | when a post carries one, the venue’s name and its coordinates |
| Interactions | accounts that liked or commented on your posts |
That data is sent to our servers and stored there. We also compute and store what changed between one update and the next (who left, who joined), because that difference is the only way to show you history over time.
Working out what your posts are about
To show you your “Instagram DNA” (the share of your posts that are travel, food, fashion and so on), we send each of your own posts to Google’s Gemini API and ask it to classify the topic. For each post that is:
| Sent | Not sent |
|---|---|
| the post’s cover image | your username or anyone else’s |
| its caption, if it has one | your follower or following lists |
| the place name you tagged, if any | who liked or commented |
| how far that place is from where you usually post | your email or account identifier |
| whether it is a photo, video, reel or carousel | anything identifying you |
The request carries no name, no identifier and no way to tell whose account it is. What comes back is a set of topic scores, which we store against the post.
Each post is classified once and the result is kept, so the same post is never sent again unless we change how the classification works.
Google’s terms for the paid tier state that Google does not use these prompts or responses to improve its products, and logs them only briefly to enforce its own abuse policy.
Technical and diagnostic data
When the app crashes or hits an error we receive a report. Those reports are deliberately narrow: error codes, counts, durations, and your account’s opaque identifier. Follower lists, Instagram usernames and profile URLs cannot technically reach a report. The code is written not to send them, and a second filter strips them before transmission. IP addresses are not collected.
What we do not process
- Your Instagram password. We never see it, send it, or store it.
- Your Instagram session. Those cookies live only in the in-app browser on your device and never reach us. We could not sign in as you if we wanted to.
- Location, contacts, photo library, microphone, camera.
- Advertising identifiers or any tracking for advertising. (Apple tells us only whether an install came from one of our App Store search ads; that is not tracking, and no identifier is involved.)
Why we process it, and on what basis
| Purpose | GDPR basis | KVKK basis |
|---|---|---|
| Creating your account and signing you in | Performance of a contract (Art. 6(1)(b)) | Necessary for a contract (Art. 5/2-c) |
| Producing the follower analytics (the service itself) | Performance of a contract (Art. 6(1)(b)) | Necessary for a contract (Art. 5/2-c) |
| Seeing errors, preventing abuse, keeping the service secure | Legitimate interests (Art. 6(1)(f)) | Legitimate interests (Art. 5/2-f) |
Other people in your follower lists
This deserves saying plainly: your follower and following lists contain the usernames of people other than you. You can already see these people on Instagram; we show that list only to you, and only for your own account.
Our rules for this data:
- It is kept at the level of username and account id only. We collect no one’s email, phone number, posts or messages.
- Only you can see it. No other user can reach your lists; row-level database rules enforce that rather than trusting application code.
- It is never sold, never used for advertising, and never used to profile anyone.
- When you delete your account, these records are deleted with it.
The basis here is legitimate interests (GDPR Art. 6(1)(f)): the service only works if these lists can be compared, and the data collected does not go beyond what the account owner already sees on Instagram.
Who we share it with
We do not sell data. We use these processors to run the service:
| Processor | Purpose | What it sees |
|---|---|---|
| Supabase | Database, authentication, hosting | Your account and your Instagram analytics data |
| Sentry (EU region) | Error and crash reports | Error codes, counts, durations, opaque user id |
| Cloudflare | Website hosting, email routing, site analytics | Site visits (cookieless), emails you send us |
| Apple, Google | Sign-in providers | Your email address at sign-in |
| Expo (EAS) | App updates | App version information |
| Resend | Letting us reply to you by email | The emails we exchange |
| RevenueCat | Managing subscription and purchase state; measuring our App Store search ads | Your opaque account id, the plan you bought and its state, and, only if you installed from an App Store search ad, that ad’s campaign and keyword (Apple’s own attribution, no advertising identifier). Never your card |
| Google (Gemini API) | Working out what your posts are about | One post’s cover image, caption and place name at a time, never your name or identifier |
Beyond these, we share only where legally compelled, for example by a court order.
Where data is stored
Data is stored on Supabase infrastructure in Ireland (AWS eu-west-1). Error
reports are held in Sentry’s Germany region. Outbound email is sent from
Ireland as well (Resend, eu-west-1). Subscription records are held by
RevenueCat in the United States; the transfer rests on standard contractual
clauses, and what is transferred is your opaque account id, the plan you bought and
the subscription’s state, plus an App Store search ad’s campaign and keyword if you
came from one, nothing more.
So your Instagram data (the lists, the history, the post statistics) is held inside the European Union. Two things sit outside it, and we would rather name them than bury them.
The first is that subscription record: an opaque account id, a plan and its state (and an ad’s campaign and keyword, if you came from one), held by RevenueCat in the United States for as long as the store bills the subscription, with nothing in it that identifies you or your Instagram account.
The second is the topic classification described above. It is the only part of the service that sends any of your content outside the EU. Google’s Gemini API has no European-only option, and Google’s own terms say the data “may be stored transiently or cached in any country in which Google or its agents maintain facilities”. What travels is a single post’s cover image, its caption and its place name, with nothing attached that says whose post it is. The transfer rests on the standard contractual clauses in Google’s terms.
If you would rather this did not happen to your posts, the “DNA” tab is the only feature that uses it. Every other part of the app works without it, and deleting your account removes the stored results along with everything else.
The data controller is in Türkiye and reaches that data from there. For users in the EU or EEA that access is a transfer to a country with no EU adequacy decision. It is limited to what running the service requires, and it is necessary to perform the agreement you enter into by using the app.
For users in Türkiye, holding the data in the EU is a transfer abroad under KVKK. It is necessary to provide the service and rests on the bases set out above; the receiving countries are EU member states subject to EU data protection law. The subscription record alone goes to the United States, under standard contractual clauses.
Retention and deletion
We keep your data for as long as your account exists, because showing history requires it.
You can delete your account from inside the app: Settings → Delete account. The deletion is not deferred: your account, every update, your follower history and your post statistics are removed in the same operation. No copy is retained afterwards.
Details: Delete your account.
The one exception is the subscription record: we keep the store’s transaction number and the account id it was claimed by after the account is deleted, and, while the store can still bill that subscription, its plan, state and end date. It is what lets Restore subscription reconnect a subscription to your new account, with the Premium you are paying for, if you return while the store is still billing it, and it is a financial record we are required to hold (GDPR Art. 17(3)(b) and (e)); it links to no name, email or Instagram data. The plan, state and end date are removed once the subscription has ended.
Your rights
Under the GDPR and KVKK you have the right to:
- Know whether we process your data and to access it
- Ask for rectification
- Ask for erasure (you can also do this yourself, in one tap)
- Ask us to restrict processing
- Receive your data in a portable form
- Object to processing based on legitimate interests
To exercise any of these, email the address below. We reply within 30 days at the latest.
You may also complain to a supervisory authority. In Türkiye that is the Personal Data Protection Authority (KVKK). In the EU or EEA it is the authority of the country you live or work in.
Age
KimGitti is not for anyone under 13. Instagram’s own minimum age is 13, and someone without an Instagram account cannot use this app in any case.
Cookies
kimgitti.com sets no cookies on you. The Cloudflare Web Analytics we use for site statistics is cookieless and does not track anyone between visits. That is why you see no cookie consent banner.
The in-app Instagram browser naturally carries Instagram’s own cookies. Those are Instagram’s, they stay on your device, and they never reach us.
Changes
If we update this policy we change the date on this page. For a meaningful change we also say so inside the app.