Privacy and Personal Data Notice
Last updated: 2 November 2026 · Data controller: Lunify Yazılım ve Ticaret A.Ş. · Product: Qaderno
Under Turkey’s Personal Data Protection Law No. 6698 (KVKK), this notice explains which personal data Qaderno, Lunify’s pen-and-paper digital planner, processes, why, and what your rights are. It supplements Lunify’s corporate KVKK notice.
1. Data controller
Lunify Yazılım ve Ticaret A.Ş. · Saraylar Mah. 464 Sk. Durmuş Ali Çoban İş Merkezi No:1 İç Kapı No:12 Merkezefendi / Denizli, Türkiye · Contact: luna@lunify.world
2. Data processed in Qaderno
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account | Email address, name (optional), password (stored only as an irreversible hash), time zone, sign-up and last sign-in time | Creating and securing your account, signing you in | Performance of contract |
| Planner content | Your handwriting (pen strokes) for each day, page title, tags, page background, to-do items and their status | Showing and saving your planner on every device | Performance of contract |
| AI results (only if you use them) | An image of the page you ask to transcribe; the resulting text, summary and extracted to-dos | Turning handwriting into text, summarising a day and suggesting to-dos | Your request / explicit consent for transfer abroad |
| Google Calendar & Tasks (optional) | Your Google account email, access and refresh tokens, granted scopes, the ID of your task list; the events of the day you open and the tasks you sync | Showing the day’s events, creating events, syncing to-dos with Google Tasks | Your Google consent |
| Password reset | A hashed email address and a hashed one-time token, creation and expiry time | Resetting a forgotten password | Performance of contract / legitimate interest |
| Security | A hashed (SHA-256) form of your IP address in short-lived rate-limit counters; technical error logs without page content | Preventing abuse and keeping the service available | Legitimate interest |
3. Cookies and local storage
- rota_sid — session cookie that keeps you signed in (HttpOnly, Secure, SameSite=Lax; up to 30 days). Strictly necessary.
- qaderno_lang — remembers your language choice (1 year). Strictly necessary for the language you chose.
- Pen settings (colour, thickness, tool, sidebar state) are stored only in your browser’s local storage and are not sent to us.
- Qaderno uses no advertising or analytics cookies.
4. Recipients and transfers abroad
Qaderno runs on a Lunify server in an IONOS data centre in the United Kingdom. Because the United Kingdom is outside Turkey, keeping your data on this server counts as a transfer of personal data abroad under KVKK Article 9. We base this transfer on the routes Article 9 allows: appropriate safeguards (such as a standard data-transfer contract with our hosting provider) and, where those do not cover it, your explicit consent, which you can withdraw at any time. Data is not sold and is not used for advertising. Data leaves that server only in these cases: (a) when you ask Qaderno to transcribe handwriting, the page image is sent to OpenRouter (USA) and the vision model it routes to; (b) when you ask for a summary or to-dos, the page text is sent to DeepSeek (China); (c) if you connect Google, the related calendar and task data is exchanged with Google (USA); (d) password-reset emails are sent through Lunify’s own mail server. Features (a)–(c) are optional and only run when you use them; using them means your data is transferred abroad on the basis of your explicit consent under KVKK Article 9.
5. Retention and deletion
- Your account and planner content are kept while your account is open.
- When you delete your account in Settings, your account, all pages, to-dos, password-reset records and Google connection are deleted immediately from the live database.
- Password-reset records are deleted after 30 days at the latest.
- When you disconnect Google, Qaderno revokes the token at Google and deletes it from its database.
- Server backups are overwritten in a cycle; deleted data disappears from backups when that cycle completes.
6. Your rights
Under KVKK Article 11 you may ask whether your data is processed, request information about it and its recipients, ask for correction or deletion, object to processing and claim compensation where applicable. Write to luna@lunify.world; requests are answered free of charge within 30 days.
Google user data and Limited Use
Qaderno requests only the userinfo.email, calendar.events and tasks scopes. It does not access Gmail, Google Drive or your contacts. Qaderno’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: Google data is used only to provide the calendar and task features you see, is not sold, is not used for advertising or to train AI models, and is not shared with others except as needed to provide those features. You can disconnect at any time in Qaderno Settings or in your Google Account permissions.
7. Security
- All traffic is protected with HTTPS/TLS; passwords are stored only as irreversible hashes.
- Each query is limited to the signed-in user’s own records.
- Session cookies are HttpOnly, Secure and SameSite.
- Rate limiting, backups and server hardening are in place.