1. Controller and local-first approach
Omer Yildirim is the developer, provider, and data controller of the DietMaxx mobile app under Turkish Personal Data Protection Law No. 6698. DietMaxx is designed as a privacy-first, zero-server, local-first mobile app. Omer Yildirim does not create a central user account, collect email, password, or authentication credentials, or remotely access app data stored on your device.
Management, storage, and protection of data processed in the app primarily take place on the device where the data is entered.
2. Data processed
Profile and physical data may include a name or profile label, date of birth or age, height, weight, sex preference, body measurements, goals, and training type, intensity, and schedule entered by the user.
Nutrition and wellness data may include meals and food logs, macro values, water and caffeine records, sleep and recovery inputs, digestive comfort, personal sensitivities, symptom records, and user notes.
If weekly planning is used, the shopping day, chosen template, targets and the profile preference needed for calculation at plan creation, the chosen 3–15 days of meals and amounts, shopping list, preparation allocations, user-created foods and macros, and earlier plan revisions are stored on the device. A new plan may replace the remaining days of an older plan, which remains in history. Deleting a plan removes its snapshot and revisions while retaining logged meals. Plans created earlier may contain a broader profile copy.
The app may store local notification preferences, the version, language, and timestamp of accepted legal documents, a manually entered city, and a profile image if selected by the user.
3. Purposes and storage
Data is processed to calculate personalized calories and macros, plan meals, create hydration targets, display nutrition and recovery records, provide digestive wellness context, and run local reminders selected by the user.
Weekly plan data is processed automatically on the device to generate meal, shopping, and preparation suggestions from the chosen template and targets, recalculate remaining meals after food changes, and preserve history. Ordinary profile and preference data needed to provide the app features chosen by the user is processed under Article 5(2)(c) of Turkish Law No. 6698; health-related special-category data is processed under Article 6(3)(a) and the separate Explicit Consent for Health Data.
If the user chooses, an image summary of the shopping list for the selected plan duration is prepared on the device. The image contains list items and amounts and the sport selected in the profile. The content is shown in a preview; sending it to another app starts only after the user separately chooses to share.
A weekly food-personality card from completed meals and a macro card for one completed meal may also be prepared on the device. These cards may show completed meal counts, food categories, the recipe or meal name, macros, and the selected sport. A card is sent to another app only if the user chooses to share it.
Profile, log, setting, and consent records are stored in SQLite- and MMKV-based local storage allocated to the app on the device. DietMaxx does not promise central cloud backup or cross-device synchronization for this data.
4. Notifications and device permissions
The app may request notification permission for meal, hydration, recovery, and wind-down reminders. Reminder schedules and preferences are stored on the device and can be disabled in the app or operating-system settings.
If the user selects a profile image, photo-library access is requested to use the image chosen by the user in the app. Saving a share card requests write access to the photo library; DietMaxx does not read other photos for this action.
5. Network connections and third parties
A city manually entered by the user may be sent to Open-Meteo geocoding and weather services to obtain city suggestions and weather data. Coordinates returned by the service are used only to request weather for that city. Health data, food logs, and detailed profile records are not included in these requests.
App download, updates, premium purchases, subscription validation, restoration, and management are handled through Apple App Store or Google Play infrastructure. DietMaxx does not access payment-card details.
If the user chooses to share, food names, amounts, categories, macros, and the selected sport from a shopping, weekly personality, or completed-meal card may be handed to Instagram Stories or an app selected in the device share menu. The cards may reveal dietary preferences. DietMaxx does not add a name, profile photo, health goal, or symptoms to the card; subsequent processing by the selected app follows that app’s terms.
The current mobile app does not use centralized authentication, product analytics, or remote crash-reporting systems.
6. Retention, security, and data loss
Local data may remain on the device for as long as it is needed for the relevant feature. Replacing or removing an ingredient from a weekly plan does not erase past days or earlier plan revisions; these are kept to show plan and consumption history correctly. Delete Account & Data removes weekly plans, previous revisions, custom foods, and other local user records. Operating-system data clearing or app removal may also delete local records.
Loss, theft, or failure of the device, deletion of the app, or clearing local storage may cause permanent data loss. Device-access security and operating-system backup preferences remain under the user’s control.
7. Rights and acceptance records
Users can view and correct data through profile and log screens and can delete local profile/account data, app data, and acceptance records by running Delete Account & Data.
The privacy-notice acknowledgement and separate acceptance/consent decisions for terms and health documents are stored on the device with the relevant document version, language, and time. The User Rights Procedure explains how these rights are exercised.
Adults aged 18 and over
DietMaxx is only suitable for adults aged 18 and over who have legal capacity. Individuals under 18 must not use the app, create a profile, or start a subscription. Everyone using the service represents and undertakes that they are at least 18 years old.
External services and user-controlled sharing
For city search and weather forecasts, your manually entered city name, the city coordinates returned by the search, and your device IP address during the connection are sent directly to Open-Meteo servers. Health data and food logs are not included in these requests.
The card you choose to share and any optional background photo you select are transferred at your direction to Instagram Stories or the destination app selected in the system share menu. Cards may include food, macro, and sport information; subsequent processing follows the destination platform’s terms.
Website services, recipient roles, and security
For website bot protection, Cloudflare Turnstile receives IP addresses, browser/device signals, site information, and verification tokens. Cloudflare acts as a processor for website security and as a separate controller when improving its bot detection. Resend processes name, email, organization, inquiry type, and message as an email delivery processor, and may separately act as controller for its own service and account security data. These website services are outside the mobile health-data consent.
Contact information is processed to respond to and follow up on requests; security signals are processed to prevent abuse. Contact processing relies on KVKK Article 5/2(c) and, where applicable, 5/2(e); security relies on 5/2(f), provided fundamental rights and freedoms are protected. Safeguards include data minimization, HTTPS, server-side verification, access restrictions, and providers’ data processing/security arrangements. Transfers to recipients abroad also require the conditions and appropriate safeguards under KVKK Article 9; a provider’s general DPA does not replace these requirements.
If optional website measurement is separately enabled and the user permits it, limited website interactions are sent to PostHog EU. Form contents, email, and health records are excluded. Website data requests: hello@dietmaxx.app. Details: https://dietmaxx.app/website-privacy. Provider notices: https://www.cloudflare.com/turnstile-privacy-policy/ and https://resend.com/legal/dpa.