Privacy Policy

My Bestie turns what you say into a task and reminds you about it. The short version of this policy: your tasks are created on your phone, reminders are scheduled on your phone, and by default your voice never leaves it (server-side voice recognition is off unless you turn it on — see 5c). You can use the app without an account. If you choose to sign in with Google or Apple, we also hold your name and e-mail address (see 3-e). The fields of your tasks are synced to our server so they can work across devices (see 3-b); the sentence you spoke is not written into our AI log (see 3-c).

1. Who is responsible

Data controller: İksero Bilişim Hizmetleri Ticaret Ltd. Şti.
Address: Cumhuriyet Bulvarı No:36 Kapani İş Merkezi Kat:7 D:711 Konak/İzmir
Tax details: Kemeraltı V.D. 4701347254
Contact: destek@iksero.com

2. What we do not collect

We list these first, because in a voice app they are the first things people ask about:

• Your voice recording (by default). Speech is normally turned into text by your own phone's speech recognition, and the audio never leaves your device. This changes only if you turn on server-side voice recognition; see 5c below. Either way, we do not store your audio.
• Your calendar and contacts. When you say "add to calendar", the entry is written straight into your phone's calendar. It never reaches us.
• Your phone number. The app never asks for it and never stores it.
• Your password. When you sign in with Google or Apple you type no password here; for those accounts our password field stays empty. There is no password of yours for anyone to crack on our side.
• Location, address book, advertising identifiers. Not collected, not shared.

3. What we do collect

a) Device record

The first time the app opens, it creates an anonymous device record on our server. It contains: a random identifier generated by the app itself (not your phone's hardware or advertising ID), the device model, the app version, the operating system version, your language and time zone, and the time you were last seen.

Its only purpose is to count your free AI allowance and to prevent abuse. It holds nothing that identifies you as a person.

b) Task content

Your tasks are created on your phone first and reminders are scheduled entirely on your phone. In addition, the task fields are synced to our server: title, note, status, date and time, time zone, reminder interval, repeat count, notification/alarm preference, priority flag and, if present, the verification rule (step target, the display name of the person to call).

The reason is to let the same account work across several devices in future, and to allow an extra notification for tasks marked “important”.

What does not reach the server: the raw sentence you spoke (by default it stays on your phone only — this changes if you turn on server-side voice recognition, see 5c), phone numbers and e-mail addresses (the ones you pick for “Call” and “Send mail”), your calendar entry and your step count.

c) AI usage counters

When you use AI parsing we record measurements: request type, model used, the number of characters processed, token counts, response time, outcome (success or failure) and cost. The text itself is not recorded — our database has no column for it.

d) Server access logs

Like every web server, ours records the IP address, time and path of incoming requests for security purposes. These logs are used only to investigate attacks and abuse.

e) Account details (only if you sign in)

Signing in is optional: the app works fully without an account. If you choose "Continue with Google" or "Continue with Apple", we verify the identity token the provider gives us and store:

• Your provider user id — the stable sub value issued by Google/Apple. We identify your account by that id, not by your e-mail address, so changing your e-mail does not cost you your tasks.
• Your e-mail address, if the provider supplies one. If you pick Apple's "Hide My Email", only Apple's relay address reaches us; we never see your real address.
• Your name, if the provider supplies one. If it does not, the account is created as "My Bestie kullanıcısı".
• The time of your last sign-in.

We take nothing else from your Google or Apple account: your contacts, calendar, photos, files and mail contents are closed to us. The only permission we ask for is to verify who you are.

You can delete your account from inside the app; doing so deletes your account record, your devices and the tasks attached to them in the same transaction.

4. Health and phone data (only if you allow it)

For a task like "walk 10,000 steps a day" or "call Ali", we can check on your behalf whether it actually happened. This is optional; if you decline, the app works exactly as before and you tick the task yourself.

Step count

With your permission, your daily step count is read through Health Connect on your phone, so steps taken with your smartwatch are counted too. Step data is never sent to our servers and does not leave your device. We do not store your step history; we record only whether the goal was met, plus a single total for that day, next to the task. No other health data (heart rate, sleep, weight) is requested. You can withdraw the permission from Health Connect at any time.

Phone calls

When you press "Call", the app places the call and sees only that the conversation started and ended, which gives us its duration.

Your call history is never read. The app does not request the call log permission at all; we already know who you were calling from the task itself. No record of who you spoke to, or when, is kept or transmitted.

If the task has no number yet, pressing "Call" opens your phone's own contact picker and you choose someone. The app does not request address book access; it sees only the entry you picked. That number is stored inside the task on your phone and is never sent to our servers.

E-mail

For "send an e-mail" tasks, your mail app opens with a prepared draft. Your inbox is never read and your message content does not reach us.

5. How the AI works

The app uses two different parsing methods and tells you which one is running:

• On-device parsing. The text is parsed without ever leaving your phone. When the server cannot be reached, or when AI parsing is turned off, the app falls back to this method and tells you so on screen.
• Server-side AI parsing. When this method is used, only the transcribed text is sent to our server and from there to our AI provider, Google (United States), which returns structured task details.

Under the provider's commercial API terms this text is not used to train models. We do not store it either; we keep only the counters described above. If you never use the AI feature, no text ever leaves your device.

5a. Photos you upload as task proof

If you attach a photo as proof to a task (for example a photo showing that "clean the cat litter" is done), that photo is sent to our server and from there to our AI provider Google (United States). The only purpose is to check whether the photo is related to the task.

• The photo is not stored on our servers: the review happens inside the request and the file is never written to disk.
• Under the provider's commercial API terms it is not used for model training.
• An accepted photo is kept as proof on your phone only; it is not synced to your other devices. A rejected photo is not stored anywhere.
• Only the task title is sent alongside the photo, and the title is not stored on the server either.
• Uploading a photo is optional. Unless you put a proof requirement on a task, no photo is ever sent — and you can always mark tasks done by hand.

⚠ Screenshots you add for a step goal are not covered by this. They count as health data, so they are never sent for review; they stay on your phone (see "Health data" below).

5b. Widget, shortcuts and Google Assistant

The home-screen widget, the quick-settings tile and the shortcuts shown when you long-press the app icon simply open the app on its listening screen; they create no additional flow of data.

When you say “Hey Google, add … to My Bestie”, however, Google Assistant transcribes your speech and hands us only the resulting text. In that case your speech is governed by Google's own privacy policy; we neither hear nor store the audio. Text coming from Assistant is never saved directly — it is shown to you as a confirmation card.

5c. Your voice recording

By default, your speech is turned into text by your own phone's speech recognition. The audio never leaves your device and never reaches us.

If you turn on server-side voice recognition in the app's settings (it is off by default), your audio is sent to our server and from there to our recognition provider Google (United States), which returns text only. We added this option because on-device recognition is weak for Turkish.

• The audio is not stored on our servers: the conversion happens inside the request and the file is never written to disk.
• The resulting text is not stored either; we keep only the character count and the language code as counters.
• This processing relies on your explicit consent: you turn it on and you can turn it off at any time. When it is off the app falls back to your phone's own recognition and keeps working.
• The app shows you which engine did the recognition, so you always know whether your voice left the device.

6. How long we keep things

• Anonymous device record: deleted automatically if unused for 60 days.
• Task data: tied to the device record; when the device record is deleted your tasks are deleted at the same moment (cascade delete at the database level). There is no separate retention period.
• App access token: invalidated if unused for 90 days.
• Account details: kept until you delete the account. When you tap "Delete my account" in the app there is no waiting period; it is deleted there and then.
• Usage counters: kept for accounting and capacity planning. When the device record is deleted, these rows lose their link to it; what remains are totals that cannot be traced to anyone.

These deletions are carried out by automated weekly jobs, not by hand.

7. Who we share with

• Google — AI parsing (United States). Only the text described above, and only when you use that feature.
• To be updated — server hosting (To be updated).
• Google / Apple — only if you choose "sign in with". We call the provider's public key endpoint to verify your identity token; we send nothing about you to that endpoint. The provider does see, on its own side, that you signed in to My Bestie.

Beyond these, no data is sold, rented or passed to any third party for advertising. The app contains no ad network, no analytics tracker and no social media cookie.

8. Children

My Bestie is not directed at children and does not knowingly collect data from users under 13.

9. Your rights

To delete your data, find out what is held or object to processing, see Account & Data Deletion. Your rights under Turkish law are set out in the Data Protection Notice.

10. If this policy changes

Changes are published on this page and the "last updated" date above is renewed. If a change widens the kinds of data collected, it is also announced inside the app.