KVKK Information Notice

Data controller

Data controller: Kerem Eyüboğlu. Address: Körfez Mah. 5169. Sk. No: 11, Atakum / Samsun / Türkiye. Contact: info@roama.tech.

Information and purposes

Parent account information includes email, optional name, account identifier, account status, password hash, session and password-reset records. Child and Explorer information includes display names, avatar, age band, internal identifiers, progress, XP, level, mission outcomes, evidence answers, child-authored text, interpretations, certainty and structured metadata, rewards, collections, companion state, timestamps and revision history.

Explorer Spot records may contain the label and description chosen by a child, metadata and prior Spot versions. ROAMA does not use GPS tracking for Explorer Spot.

This information is used to provide and secure accounts, authenticate parents, reset passwords, manage child profiles and Explorers, save and display progress and memories, tailor content to an age band, and manage subscription entitlements.

Technical security information includes a network address used by the API's in-memory request limiter to help prevent abuse.

Collection and recipients

The parent enters account and profile information; other records are generated as the app is used and sent to the ROAMA API. Data is collected directly from the parent or child through the app and generated by service use.

Recipients and processing purposes: Render (API hosting, Singapore); MongoDB Atlas on AWS (application database, Frankfurt, Germany, eu-central-1; daily snapshots retained 8 days); Resend (password-reset email, configured sending domain roama.tech, Tokyo, Japan); RevenueCat (subscription entitlement management, production entitlement pro); and Apple App Store or Google Play (store purchase and billing operations). Provider services may involve international transfers. No specific transfer safeguard or mechanism is stated here because one has not been verified.

If the parent opts in to notifications, ROAMA also processes the Expo push token, device platform, app language and notification preference linked to the parent account. While that preference is enabled, ROAMA stores the catalog identifier and time of adventure views or mission starts to evaluate reminders; these records are separate from product analytics, expire after 90 days and are deleted with the account. Expo Push Service delivers generic notification text and an allowlisted destination to Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM); notification payloads exclude child names and child-authored or gameplay content.

Legal basis and retention

For parent account creation and management, authentication, session management and account recovery, ROAMA processes personal data strictly necessary to establish, maintain and perform the parent account service under KVKK Article 5(2)(c). For child profiles, Explorer profiles, age bands used to adapt content, mission completion, progression and XP, and discoveries, journal entries and rewards necessary to provide the service, ROAMA processes only data necessary to provide the ROAMA service requested and managed by the parent under Article 5(2)(c); this does not apply automatically to all child data. Free-text evidence and Explorer Spot records are processed when the parent or child uses those features as part of the ROAMA service; Article 5(2)(c) applies only to data strictly necessary to provide the feature. For security, abuse prevention and rate limiting, ROAMA processes data under Article 5(2)(f) where necessary for the controller's legitimate interests, provided those interests do not override the data subject's fundamental rights and freedoms. The parent subscription relationship, RevenueCat identity binding, purchase and restore operations, and entitlement verification are processed as necessary to provide and manage the paid service requested by the parent, under Article 5(2)(c) only for data strictly necessary for that service relationship. During account closure, ROAMA sends a RevenueCat deletion request as part of provider-side deletion handling.

Data is retained for as long as necessary for the stated purposes. Parent-account deletion removes associated parent, child, Explorer, gameplay, refresh-session, password-reset, notification-token, notification-preference and push-delivery records through the implemented deletion flow. Individual child or Explorer deletion removes associated gameplay records and marks the profile deleted. MongoDB Atlas daily snapshots are retained for 8 days; removed data may remain in a snapshot until it expires. Store subscriptions are not cancelled by ROAMA account deletion.

Additional collection and retention details

When a parent opens the notification area in Parent Settings, the app sends ROAMA an app-generated notification-device identifier, the operating-system permission state (granted, denied or undetermined), and whether another permission prompt is allowed. The identifier is stored on the device and linked to the parent account when sent. Parent Settings also sends the device time zone, which is saved with the parent's notification preferences for delivery scheduling. If push registration is enabled and the parent opts in, ROAMA stores the Expo push token, device platform, app language and notification preferences linked to the parent. The generated identifier is not a hardware advertising identifier.

When child-engagement notifications are enabled, reminder-eligibility activity records the parent and Explorer identifiers, an allowed activity type, a catalog content identifier and a timestamp. It is separate from product analytics, expires after 90 days and is deleted with the account. Expo Push Service receives the push token, generic notification text and an allowed destination, then forwards the notification through APNs or FCM. Delivery receipts are retained for up to 7 days and notification idempotency records for up to 90 days; these records are removed with the account.

Product analytics records contain the parent account identifier, event type and time, and may contain a limited catalog content identifier. Events include signup, Explorer creation, adventure or mission interactions, paywall views, and subscription purchase or restore actions. They do not contain free text or mission answers. These are ROAMA's own product-event analytics records; the app does not integrate a third-party analytics SDK. Server-recorded signup, Explorer-creation and first-mission-completion events are collected only while analytics is enabled in the service configuration; typed client events are also accepted only while analytics is enabled. Product-event records expire after 90 days and are deleted with the parent account.

Operational render-error reporting stores a fixed error category, a request correlation identifier and a timestamp, not an account or Explorer identifier, stack trace or child-authored content. These records expire after 14 days. This is limited operational error reporting, not native crash reporting.

Provider deletion and notification-device records

If RevenueCat deletion fails or its server-only credential is unavailable, ROAMA attempts to queue the parent account identifier and retry deletion. A queued identifier is kept until RevenueCat returns success or reports that the customer is not found; retries run while the service is running and pause while it is stopped. There is no fixed expiry for a pending retry. If the retry record cannot be saved, the failure is logged and follow-up may be needed. Local account deletion proceeds independently.

Account deletion removes all push-token associations, notification preferences and activity, delivery receipts, idempotency records and device-permission records for all of the parent's devices. When a logout request includes the current installation's notification-device ID, logging out removes only that installation's push-token association and device-permission record; other devices and parent-level notification preferences and activity remain unchanged. A legacy logout request without a notification-device ID revokes authentication only and does not remove push records. While retained, each device-permission record contains the parent and app-generated device identifiers, permission state, whether another prompt is allowed, and timestamps, with no automatic expiry configured. The app-generated identifier remains in local app storage until that storage is cleared or the app is removed.

Requests and rights

Under KVKK Article 11, a data subject may ask whether their data is processed; request information about processing; learn the purposes and whether data is used accordingly; learn recipients in Türkiye or abroad; request correction of incomplete or inaccurate data and notification of recipients; request deletion or destruction under Article 7; object to an adverse result produced solely by automated analysis; and seek compensation for damage caused by unlawful processing. Contact Kerem Eyüboğlu at info@roama.tech to exercise these rights. The controller may need to verify identity and will handle requests within applicable legal requirements.