Privacy Policy

1. Who We Are

The data controller for the Wear22 app ("the App") is:

GUNAYDIN APP STUDIO YAZILIM HIZMETLERI LIMITED SIRKETI ("Günaydın App Studio", "we", "us", "our")
Istanbul, Turkey
Email: hello@gunaydinappstudio.com

Wear22 helps you track how long you wear your clear aligners or retainers each day, follow your tray-change schedule, and get gentle reminders. This policy applies to the App on iPhone and Apple Watch, including its widgets, Live Activities, controls, and Siri shortcuts, as distributed through the Apple App Store. It explains what data the App handles, where it is kept, who receives it, how long it is kept, and what rights you have. Please read it together with our Terms of Use.

2. Summary

• No account. You never give us a name, email address, phone number, or password.
• Your record stays with you. Your wear record (when your aligners came out and went back in, your trays, your plan, your nights) and your smile photos are stored on your devices and in your own iCloud account. We cannot see them.
• Our server is involved in only two cases. (1) Share with family: only while you choose to share, a compressed copy of your wear record (never photos) is kept on our server so that the people you invite can see it. (2) Live Activity relay: to show the removal timer on your iPhone's Lock Screen when a removal is recorded on your Apple Watch or in the background, our server briefly handles push tokens and the times of that removal, and forgets them within two days.
• Smile photos and face data never reach us. Face tracking used to line up your photos runs on your device, in real time. Only the angle and distance of your head when each photo was taken are kept with that photo, on your device and in your iCloud; nothing from it is sent to us.
• No ads, no analytics SDKs, no tracking. We do not sell or share your data for advertising, and we do not track you across other companies' apps or websites.
• Purchases are processed by Apple; subscription status is managed through Adapty, which receives a random device identifier, never your health record.

3. Data That Stays on Your Devices and in Your iCloud

Most of what Wear22 does happens on your device. The data in this section is created and stored by the App on your iPhone or Apple Watch and, if you are signed in to iCloud, synced through your own iCloud account. It is not sent to us.

3.1 Your Wear Record

Your wear record relates to your orthodontic treatment, so we treat it as health information wherever it is handled (see Section 8).

3.2 Smile Photos

If you use the Smile tab, the App asks for camera access so you can take progress photos of your teeth (front, left, and right). Photos are stored inside the App, not in your photo library, and sync only to your own iCloud account. They are never uploaded to our servers, never included in family sharing, and never included in backup files. You can delete any photo at any time. If you choose to share a time-lapse video or collage, it is created on your device and handed to the destination you pick through the iOS share sheet.

3.3 Face Tracking (Smile Camera)

To help you take each photo from the same angle, the smile camera uses Apple's ARKit face tracking (on devices with a TrueDepth camera) and Apple's Vision framework to estimate the position and angle of your face and the outline of your lips. This information is used only in real time, on your device, to guide you while you take the photo and to center and crop the photo around your smile. The only part that is kept is the angle and distance of your head at the moment each photo is taken (four numbers, with no image or shape of your face), stored with that photo on your device and in your iCloud so that your next photos can be lined up the same way. Nothing from face tracking is sent to us or to any third party, used to identify you, or used for advertising or any other purpose.

3.4 iCloud Sync

When you are signed in to iCloud, Wear22 syncs your wear record, settings, and smile photos across your devices using Apple's CloudKit, in the private database of your Apple Account. This data is held by Apple under the Apple Privacy Policy; as the developer, we have no access to it. You can turn syncing off for Wear22 in iOS Settings → [your name] → iCloud.

3.5 Apple Watch, Widgets, Live Activities and Controls

• The Apple Watch app keeps its own copy of your record, synced through your iCloud account and directly with your iPhone using Apple's WatchConnectivity, which runs device to device.
• Widgets, Live Activities, watch complications, and controls read your data from a container shared only between the App and its own extensions on the same device. They never write or send data.

3.6 Reminders and Notifications

If you allow notifications, reminders (for example while your aligners have been out for a while, before your allowance runs out, on tray-change days, or at night for retainers) are scheduled locally on your iPhone, and their text is generated on your device. Some are marked time-sensitive so they can reach you during a Focus. iOS may forward them to your Apple Watch. We do not send marketing notifications. You can turn notifications off at any time in iOS Settings → Notifications → Wear22.

3.7 Calendar (Optional)

If you turn on calendar sync, Wear22 creates its own calendar named "Wear22" and adds your tray-change dates to it. Keeping that calendar up to date (moving or removing the dates when your plan changes) needs full calendar access, but the App does not read your other calendars or events. Where available the Wear22 calendar is created in your iCloud calendar account; otherwise it uses your default calendar account or a local calendar on your device, and it syncs according to that account's settings. You can remove the calendar or revoke access in iOS Settings → Privacy & Security → Calendars.

3.8 Photo Library (Add Only)

When you choose to save a share card, collage, or video, the App asks for permission to add to your photo library. It never reads your library.

3.9 Siri and Shortcuts

You can log removals and check your status with Siri, Shortcuts, or the Action button. Voice requests are processed by Apple under Apple's privacy policy; the App only receives the resulting action.

3.10 Backup and Export Files

From Settings → Export data you can create a backup file (JSON) and spreadsheets (CSV) of your plan, trays, removals, and nights. Photos are not included. These files are created on your device and go only where you send them. When you restore a backup, the App reads only the file you pick.

4. Data That Reaches Our Servers

Our backend (api.wear22.app) runs on Cloudflare Workers with a Cloudflare D1 database. It is used only for the features below.

4.1 Device Identifier

On first launch, the App generates a random identifier (UUID) and stores it in your device's Keychain. It is not derived from your Apple Account, phone number, or any hardware identifier, and it does not reveal who you are. Under the GDPR and similar laws it is still personal data, because it is linked to your device over time. It is shown in Settings → User ID so you can give it to us when asking for support or deletion. It is used:

• with Adapty, to keep track of your subscription status (Section 5); and
• with our server, only if you share with family or follow someone (Section 4.2).

4.2 Share with Family (Optional)

Share with family lets a parent, guardian, or anyone you choose follow your wear time from their own iPhone. It is off by default and starts only when you create a code in Settings → Share with family. Before your first code, the App explains what is kept on our server and asks you to continue.

Registering a device

When you first open Share with family or People You Follow, your device registers with our server using its device identifier, a random secret that only your device holds (we store only a one-way hash of it), and Apple's App Attest service, which confirms that the request comes from a genuine copy of Wear22 on a genuine Apple device. We store the App Attest key identifier, its public key and usage counter, the environment, and when the device was first and last seen. Your device then receives a session token valid for 30 days, kept in its Keychain.

What is shared while sharing is on

• Your whole wear record as described in Section 3.1: plans, trays, removals with their start and end times, and nights
• Your time zone and first day of the week, so your followers see the same days and weeks you do
• When your phone last sent an update, and when it last checked in in the background, so followers can tell a quiet day from a phone that has gone silent

The record is compressed on your phone, sent over an encrypted connection, and stored on our server as received. It replaces the previous copy each time your record changes. Our server does not open or read it; note that it is compressed, not end-to-end encrypted. Smile photos and the names your followers type are never shared.

Codes and followers

• A code has 9 digits, works once, and expires after 24 hours.
• A follower is known to our server only by their own random device identifier. Any name a follower gives you in their app stays on their phone.
• A follower's device downloads your record and keeps a copy on that device, so it can show your days in the App and in a widget. Their widget is refreshed by a silent WidgetKit push; for that we store their widget push token. Followers do not receive notifications about you.
• You can see who follows you (with the date they started), remove any follower, or stop sharing at any time. Stopping deletes your record, your codes, and your follower list from our server immediately.

4.3 Live Activity Relay

iOS does not let an app start a Live Activity from the background. So when a removal is recorded on your Apple Watch, or while the App is in the background, the device that recorded it asks our server to send an Apple push notification that starts or ends the removal timer on your iPhone's Lock Screen and Dynamic Island.

• Sent with each request: the ActivityKit push token(s), the start time of the removal, the time your daily allowance runs out, and your daily allowance. No device identifier, name, or other record is sent.
• Kept on our server: a SHA-256 hash of your iPhone's push-to-start token (not the token itself), the start time of the removal last started, and the update token of the running Live Activity, so that your watch can end it even when your iPhone is out of reach. If a removal ends before your iPhone can be reached, the end (the removal's start time and the times of your allowance) waits there until your iPhone picks it up. These entries are deleted within 48 hours: each is removed by the daily clean-up once it is 24 hours old.
• The push itself is delivered by the Apple Push Notification service.

You can turn off Live Activities for Wear22 in iOS Settings → Wear22.

4.4 Technical Data

Like any internet service, Cloudflare processes your IP address to deliver requests to our server. We use it, briefly, to apply rate limits that protect the service against abuse (counters that reset within about a minute). We do not store IP addresses in our database. To stop people from guessing codes, we also count wrong codes per device identifier and per hour; these counters are deleted after 48 hours.

5. Subscriptions and Purchases

Wear22 may offer optional premium features through in-app purchases and auto-renewing subscriptions. Payment is handled entirely by Apple; we never see your payment details.

We use Adapty to manage subscriptions and to show subscription offers. Adapty receives:

• Your device identifier (Section 4.1), as the profile ID
• Apple transaction and subscription data: product, purchase and renewal dates, trial and renewal state, price tier, and storefront
• Standard device data from its SDK: the Apple Identifier for Vendor, device model, iOS version, app version, locale, and the IP address at the time of a request
• An Apple Ads attribution token, obtained through Apple's AdServices framework, which tells us whether the App was installed from an Apple Ads campaign. It contains no advertising identifier

Adapty never receives your wear record, smile photos, or any other health information. The App never asks for permission to track you, so the Apple advertising identifier (IDFA) is not available to the App or to Adapty.

6. What We Do Not Collect

• Your name, email address (unless you write to us), phone number, or Apple Account details
• Your smile photos or any face data
• Your wear record, unless you turn on family sharing
• Precise or approximate location from GPS
• Contacts, calendar events other than the ones the App creates, or the contents of your photo library
• Data from Apple Health or other apps
• The advertising identifier (IDFA)
• Analytics, session-replay, crash-reporting, or advertising SDKs: the App contains none

If you have chosen to share analytics with app developers in iOS Settings → Privacy & Security → Analytics & Improvements, Apple may share crash reports and aggregated usage statistics with us under Apple's own terms.

7. Why We Process Data and on What Legal Basis

For users in Turkey, the corresponding grounds under the Personal Data Protection Law No. 6698 (KVKK) are the performance of a contract, our legitimate interests, compliance with legal obligations, and, for health data (special category data under Article 6 of the KVKK) and transfers abroad where required, your explicit consent.

8. Your Health Information

Your wear record is information about your orthodontic treatment. We treat it as health data under the GDPR and the KVKK, and as consumer health data under US state laws such as the Washington My Health My Data Act, Nevada SB 370, and the Connecticut Data Privacy Act.

• What we collect: nothing, unless you turn on family sharing. Then we receive your wear record as listed in Section 4.2, plus the removal times needed for the Live Activity relay (Section 4.3).
• Source: you, through the App.
• Purpose: only to show your record to the people you invite, and to show your removal timer on your own Lock Screen.
• Who receives it: only the devices that used a code you created, and Cloudflare as our hosting provider. Never advertisers or data brokers.
• We never sell health data, never use it for advertising, never use it to build profiles, and never use geofencing around health-care locations.
• Your rights: you can confirm whether we hold your health data, access it, have it deleted, and withdraw consent by stopping sharing or by contacting us. If we decline a request, you can appeal by replying to our answer; we respond to appeals within 45 days, and if you remain unsatisfied you may contact your state Attorney General.

9. Third Parties Who Receive Data

We share data only with the providers below, and only as described in this policy. We do not sell personal data.

Instagram and Snapchat. If you choose to share a progress card to an Instagram story or to Snapchat, the App places the card image on your device's pasteboard and opens that app; the link to Instagram includes our public Meta app ID so Instagram can show where the sticker came from. We do not send any data to Meta's or Snap's servers ourselves. What you post is then governed by the Instagram or Snap privacy policy.

We may also disclose information if required by law or a binding order from a competent authority, or to protect the rights, property, or safety of our users or others.

10. International Transfers

We are established in Turkey. Cloudflare operates a global network, and Adapty processes data mainly in the United States. When personal data of users in the EU/EEA, the UK, or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum) agreed with each provider, or on the EU–US Data Privacy Framework where the provider is certified. For users in Turkey, transfers abroad are made in accordance with Article 9 of the KVKK, on the basis of standard contracts and, where required, your explicit consent. You can ask us for a copy of the relevant safeguards.

11. How Long We Keep Data

We may keep data longer where the law requires it (for example, accounting rules) or to establish or defend legal claims.

12. Deleting Your Data

Because Wear22 has no account, your data lives in a few places, and you control each of them:

• Single entries and photos: delete any removal or smile photo inside the App. The deletion syncs to your other devices through iCloud.
• Shared data: Settings → Share with family → Stop sharing deletes your shared record, codes, and follower list from our server immediately. Followers can stop following at any time, and you can remove any follower.
• Data on your device: deleting the App removes it from that device. The device identifier in your Keychain may survive a reinstall, as iOS can keep Keychain items.
• Data in iCloud: deleting the App does not delete your iCloud copy. To remove it, go to iOS Settings → [your name] → iCloud → Manage Account Storage → Wear22 → Delete Data from iCloud.
• Calendar: delete the "Wear22" calendar in the Calendar app.
• Server and subscription records: email hello@gunaydinappstudio.com with your User ID (Settings → User ID), and we will delete your device registration and ask Adapty to delete your profile. Apple keeps purchase records under its own terms. Deleting data does not cancel a subscription; manage subscriptions in iOS Settings → [your name] → Subscriptions.

13. Your Rights and Choices

Depending on where you live, you have the right to:

• Access the personal data we hold about your device and receive a copy
• Rectify inaccurate data. Your record can be edited directly in the App
• Erase your data (Section 12)
• Restrict or object to processing based on our legitimate interests
• Data portability: Settings → Export data gives you your full record as JSON and CSV at any time
• Withdraw consent at any time, without affecting processing that happened before (stop sharing; turn off Live Activities, notifications, or calendar access)
• Lodge a complaint with a supervisory authority, in particular in the EU/EEA country where you live, the UK Information Commissioner's Office, or the Turkish Personal Data Protection Authority (KVKK)
• Not be subject to a decision based solely on automated processing with legal or similarly significant effects. The App makes no such decisions

To exercise any right, email us, ideally with your User ID. We may ask for information needed to confirm that the request relates to your device. We respond within one month (GDPR), 30 days (KVKK), or 45 days (US state laws), extendable where the law allows.

California and other US states. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use sensitive personal information for any purpose other than providing the App. You may exercise your rights to know, access, delete, and correct, and you will not be treated differently for doing so. Because we do not sell or share personal information, we have no opt-out to apply to Global Privacy Control signals.

14. Children and Families

Many people who wear aligners or retainers are children and teenagers, and family sharing exists so that a parent or guardian can support them. Wear22 is designed so that a child's use involves as little data as possible: the App never asks for an age, email address, or contact details (the first name it may ask for during onboarding is optional and stays on the device), and a child's record and photos stay on their device and in their family's iCloud.

• Children under 13 (or under the age of digital consent in their country, up to 16 in the EEA) should use Wear22 with a parent or guardian, who decides whether to turn on family sharing. We recommend that the parent creates the code on the child's device and follows from their own.
• The only data from a child's device that can reach our server is the random device identifier and, if family sharing is turned on, the wear record, which is visible only to the devices that used the code.
• A parent or guardian can review who follows the child in Settings → Share with family, stop sharing at any time, or contact us to have any data related to the child's device deleted.

We do not knowingly collect personal information from children under 13 beyond what is described here. If you believe a child's data has reached us without a parent's or guardian's consent, contact us and we will delete it promptly.

15. Security

• All traffic between the App and our server is encrypted with TLS (HTTPS).
• Data in our Cloudflare D1 database is encrypted at rest by Cloudflare.
• Only genuine copies of the App on genuine Apple devices can register for sharing (App Attest). Device secrets and push-to-start tokens are stored only as one-way hashes.
• Sessions are signed tokens that expire after 30 days and are stored in the Keychain.
• Sharing codes have 9 digits, work once, expire after 24 hours, and wrong guesses are limited per device and globally.
• Requests are rate-limited to prevent abuse.

No system is perfectly secure. If we become aware of a breach that affects your data, we will notify you and the competent authorities as required by law.

16. Advertising and Tracking

The App shows no third-party ads and contains no advertising SDKs. We do not combine data from the App with data from other companies' apps or websites, and we do not "track" you as Apple defines it, which is why the App never shows Apple's App Tracking Transparency prompt. Marketing measurement is limited to Apple Ads attribution, which does not share a user-level identifier with us.

17. Changes to This Policy

We may update this policy as the App changes, for example when we add a feature that handles data differently. We will post the new version here with a new "Last updated" date. If a change materially reduces your rights or adds a new purpose for using your data, we will tell you in the App before it takes effect and, where the law requires it, ask for your consent again.

18. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

GUNAYDIN APP STUDIO YAZILIM HIZMETLERI LIMITED SIRKETI
Istanbul, Turkey
Email: hello@gunaydinappstudio.com