Post OvenPost Oven

Privacy Policy

Post Oven Last Updated: May 9, 2026 Effective Date: March 21, 2026

Introduction

This Privacy Policy describes how Mehmet Can Bil Karamalli ("we," "us," or "our"), the developer of Post Oven ("the Application"), collects, uses, stores, and shares information about you ("User," "you," or "your") when you download, install, and use the Application.

By using the Application, you agree to the collection and use of your information in accordance with this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Application.

Age Requirement: The Application is intended solely for users who are 18 years of age or older. We do not knowingly collect information from individuals under the age of 18.

Data Location: User data is stored primarily on servers located in Turkey. Some data may be processed by trusted service providers in the United States and, where necessary, other countries as necessary to operate, secure, and deliver the Application. If you are using the Application from outside Turkey — including from the European Union — you acknowledge that your data may be transferred to Turkey, the United States, and other countries in accordance with this Privacy Policy and applicable law.

1. INFORMATION WE COLLECT

1.1 Information You Provide Directly

Account Information: When you create an account, we collect your email address and a hashed password. We do not store your password in plain text.

Company Profile Information: When you create a company profile within the Application, you may provide: company name, industry, tone of voice, brand colors, company logo, website URL, phone number, address, company description, and key product descriptions. This information is used solely to power AI content generation tailored to your brand.

Reference Images: You may upload images to the Application to serve as style references for AI-generated posts. These images are stored on our servers and used solely for the purpose of generating content at your request.

Post Topic and Edit Instructions: When generating posts, you provide text inputs such as a topic description (up to 500 characters) or edit instructions for refining generated images. These inputs are processed to generate your requested content.

Display Name: You may optionally provide a display name associated with your account.

1.2 Information Generated Through Use of the Application

Generated Content: The Application generates AI-powered captions, hashtags, and images based on your inputs. These generated posts are stored in your account history and associated with your account.

Credit Transaction Records: We maintain records of your credit balance, credit grants (including the reason, such as sign-up, subscription, or purchase), credit deductions, and the associated operations (e.g., which generation mode was used).

Post Generation Metadata: When you generate a post, we store metadata including the aspect ratio, generation mode, generation timestamp, and company profile used.

1.3 Information Collected Automatically

Technical Data: When you use the Application, we may automatically collect certain technical information necessary for the Application to function, such as your device's operating system type and version, app version, and error logs. This information is used solely for debugging and improving the Application.

Authentication Tokens: The Application uses JSON Web Tokens (JWTs) to authenticate your sessions. These tokens are generated upon login and used to verify your identity with our server for each request.

1.4 Information We Do Not Collect

We do not collect:

  • Precise geolocation data
  • Device contacts, call logs, or SMS data
  • Biometric data
  • Social media account credentials or data (we do not integrate with social media accounts)
  • Payment card numbers or banking information (all payment processing is handled entirely by Apple App Store or Google Play Store on our behalf; we receive only a notification that a purchase was completed)

2. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

To Provide and Operate the Application: We use your account information, company profiles, reference images, and post inputs to operate the Application and deliver the features you request, including AI content generation.

To Process AI Generation Requests: Your company profile data and post inputs are included in prompts sent to third-party AI services to generate captions, hashtags, and images tailored to your brand. See Section 4 for more on third-party AI services.

To Manage Your Credits: We use your credit transaction records to maintain an accurate credit balance for your account and to process in-app purchases and credit grants.

To Communicate With You: We may use your email address to send you essential account-related communications, such as password reset emails, email verification, and important notices about changes to the Application or this Privacy Policy. We do not send marketing or promotional emails without your consent.

To Improve the Application: Technical data and usage patterns (aggregated and anonymized where possible) may be used to diagnose issues, fix bugs, and improve the Application's features and performance.

To Ensure Security and Prevent Fraud: We use technical data and authentication information to protect the security of the Application and to detect, investigate, and prevent fraudulent or unauthorized activity.

To Comply With Legal Obligations: We may use or disclose your information to comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

3. HOW WE STORE AND PROTECT YOUR INFORMATION

3.1 Data Storage

User data — including account information, company profiles, generated posts, and credit records — is stored primarily on servers located in Turkey. Uploaded images, generated images, and certain technical data may be stored or processed by trusted service providers in the United States and, where necessary, other countries as necessary to provide the Application. We do not sell your personal data or share it with third parties for their own marketing purposes.

3.2 Data Retention

We retain your data for as long as your account is active or as needed to provide the Application's services. If you delete your account, we will delete your personal data and generated content from our systems within a commercially reasonable time period, except where we are required to retain data by applicable law. Anonymized or aggregated data that cannot identify you may be retained indefinitely.

You may delete individual generated posts or reference images at any time through the Application's interface. You may delete your entire account — and all associated data — at any time through the Application's privacy and security settings.

3.3 Security Measures

We implement industry-standard technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

  • Encrypted data transmission (HTTPS/TLS) between the Application and our servers
  • Password hashing — passwords are never stored in plain text
  • JWT-based authentication with cryptographic validation for all server requests
  • Server-side access controls and input validation to prevent unauthorized data access

However, no method of transmission over the internet or method of electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you as required by applicable law.

4. THIRD-PARTY SERVICES

The Application uses the following categories of third-party services. We do not sell your personal data to any third party.

4.1 AI Generation Services

To generate captions, hashtags, and images, the Application sends your content inputs to Google Gemini API, a service operated by Google LLC. The data sent to Google Gemini API includes your company profile information (such as business name, industry, brand tone, and description), post topic text, and reference image URLs (where applicable). This processing is necessary to deliver the core functionality of the Application.

Google processes this data in accordance with its own Privacy Policy and Generative AI Terms of Service. Google does not use API-submitted data to train its models by default. Per Google's Generative AI Terms of Service, Google retains API prompts and responses for a limited period solely for detecting and preventing violations of Google's Prohibited Use Policy; this data is not used for any other purpose.

The Application stores your generated outputs (captions, hashtags, and images) in your account for as long as your account remains active or until you delete them. You may delete individual generated posts or your entire account at any time through the Application.

We encourage you not to include sensitive personal information in your post topic inputs or company descriptions.

4.2 In-App Purchase Processing

In-app purchases are processed exclusively by Apple (for iOS devices via the App Store) or Google (for Android devices via Google Play). We do not receive, store, or process your payment card details or banking information. We receive only a notification from the platform confirming that a purchase has been made, along with the product purchased and the associated user account, for the purpose of crediting your account.

4.3 No Other Third-Party Data Sharing

Beyond the services described above, we do not share, sell, rent, or trade your personal data with any other third parties for their own marketing or commercial purposes.

5. IN-APP PURCHASES AND FINANCIAL DATA

All payment transactions for in-app purchases are processed entirely by Apple App Store or Google Play Store, as applicable. We do not handle, store, or have access to your credit card information, banking details, or other financial data. Any questions or disputes about payment charges should be directed to Apple or Google, as applicable, in accordance with their respective policies.

6. YOUR RIGHTS AND CHOICES

6.1 Access and Correction

You can access and update most of your account information — including your display name and company profile information — directly within the Application.

6.2 Deletion

You may delete individual posts, reference images, or company profiles at any time through the Application. You may delete your entire account and all associated personal data at any time through the Application's privacy and security settings. Once your account is deleted, this action is permanent and cannot be undone.

6.3 Data Portability

You may request a copy of the personal data we hold about you by contacting us at [email protected]. We will respond to such requests within a reasonable timeframe.

6.4 Withdrawal of Consent

Where we process your data on the basis of your consent, you may withdraw your consent at any time by discontinuing use of the Application and deleting your account.

6.5 Objection and Restriction

You may object to or request the restriction of certain processing of your personal data. We will consider and respond to such requests in accordance with applicable law.

7. EUROPEAN UNION USERS — GDPR

If you are located in the European Union or European Economic Area, the following additional information applies to you under the General Data Protection Regulation ("GDPR").

7.1 Data Controller

The data controller responsible for your personal data is:

Mehmet Can Bil Karamalli Email: [email protected]

7.2 Legal Bases for Processing

We process your personal data on the following legal bases:

  • Performance of a Contract: Processing necessary to provide you with the Application's services as described in our End User License Agreement (e.g., account management, AI content generation, credit management).
  • Legitimate Interests: Processing necessary for our legitimate interests, such as security, fraud prevention, debugging, and improving the Application, where such interests are not overridden by your rights and interests.
  • Legal Obligation: Processing necessary to comply with applicable legal obligations.
  • Consent: Where we rely on consent (e.g., optional communications), you may withdraw your consent at any time.

7.3 International Data Transfers

Your personal data is stored primarily in Turkey and may be processed in the United States and, where necessary, other countries by trusted service providers as necessary to provide the Application. Turkey, the United States, and those other countries may not provide the same level of data protection as the European Union. We take appropriate measures to ensure that your data receives an adequate level of protection.

7.4 Your GDPR Rights

Under the GDPR, you have the following rights:

  • Right of Access: You have the right to request a copy of the personal data we hold about you.
  • Right to Rectification: You have the right to request the correction of inaccurate or incomplete personal data.
  • Right to Erasure: You have the right to request the deletion of your personal data. You can exercise this right directly through the Application's account deletion feature, or by contacting us.
  • Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances.
  • Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
  • Right to Object: You have the right to object to the processing of your personal data in certain circumstances.
  • Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within thirty (30) days. We may ask you to verify your identity before acting on your request.

You also have the right to lodge a complaint with the supervisory authority of the EU member state in which you reside, work, or where the alleged infringement occurred.

8. CALIFORNIA USERS — CCPA

If you are a California resident, you may have certain rights under the California Consumer Privacy Act ("CCPA"). We do not sell your personal information to third parties. For more information about your rights or to submit a request, please contact us at [email protected].

9. CHILDREN'S PRIVACY

The Application is not intended for and may not be used by individuals under the age of 18. We do not knowingly collect personal information from anyone under 18 years of age. If we become aware that we have collected personal information from a person under 18 without parental consent, we will take steps to delete that information and terminate the associated account as soon as possible. If you believe we may have collected information from a person under 18, please contact us immediately at [email protected].

10. LINKS TO THIRD-PARTY WEBSITES AND SERVICES

The Application may contain links to third-party websites or services that are not owned or controlled by us. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party websites or services. We encourage you to review the privacy policies of any third-party services you visit or use.

11. COOKIES AND LOCAL STORAGE

The Application uses local device storage (such as shared preferences) to persist certain user preferences, including your selected language and theme (light/dark mode), and to maintain your authentication session. This data is stored locally on your device and is not transmitted to our servers as preference data.

12. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last Updated" date at the top of this Privacy Policy and, where appropriate, notify you through the Application or by other means (such as email).

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of the Application after any changes to this Privacy Policy constitutes your acceptance of the revised policy.

13. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Mehmet Can Bil Karamalli Email: [email protected] Location: Beykoz, Istanbul, Turkey

We are committed to working with you to resolve any concerns you may have about our privacy practices.

This Privacy Policy is effective as of the date listed above and applies to all users of the Post Oven application.

← Back to Home