Privacy Policy

Last updated: October 11, 2026

Masalona lets parents have stories written by our editors read to their children, with the child's name, by a narrator or by an AI copy of the parent's own voice. This policy explains what data we process, why and how, who receives it, how long we keep it and your rights, as required by the Turkish Personal Data Protection Law No. 6698 ("KVKK", art. 10) and, where they apply to you, other data protection laws.

Who we are

The data controller is cesaapps.com (Masalona). Contact: cesaapps@proton.me.

Data we process

• Account: email address; the identifier and email given by Apple or Google if you sign in with them (with Apple, also an encrypted key Apple gives us so that deleting your account can remove the sign-in at Apple); a one-way hash of your password (never the password itself); app language; when you accepted the Terms of Use. If you start without an account, you get an anonymous guest account with no email.
• Child profile: only a first name, and optionally an age range, gender, a sibling's and a pet's name, interests and how the name is pronounced. We never ask for a surname, school, address or photo. A child's voice is never recorded.
• Parent voice recording: the live recording of about one and a half minutes you make in the app to copy your voice, the spoken consent sentence at its start and when you gave it, and the voice copy made from it. File uploads are not accepted.
• Prepared stories: which story was prepared for which child and voice, and the resulting audio file.
• Device and notifications: push token, platform and language; your notification choices.
• Device identifier hash: a one-way hash of the app's device identifier (it cannot be reversed; the identifier itself is not stored), used only so that the free plan's one story with your child's name can be used once per phone.
• Support messages: the messages you send through "Contact us" in the app and our replies.
• Usage and technical records: screen views and app events (identifiers and choices only; children's names and anything you type are never included), crash reports, IP address and request details in server logs, and records of actions (for example a voice recorded, a voice or account deleted).
• Subscription: plan, period and renewal details. Payment details stay with Apple and Google.

How we collect it

From what you enter and record in the app, automatically while you use the app, and from Apple, Google and RevenueCat when you sign in or buy a plan. Only the parent enters information about a child.

Why we process it (purpose and legal basis)

• Creating your account, preparing and playing stories with your child's name, running your subscription, support: performance of a contract (KVKK art. 5/2-c).
• Copying your voice and reading stories in it: your explicit consent (KVKK art. 6/2). Because the voice copy is made by specific technical processing of your voice, we treat your recording as special-category (biometric) data and process it only with your explicit consent. You give it by ticking the box before recording and by reading the first sentence of the recording aloud. Not consenting does not stop you from using the rest of the app; the narrator voices are always available. Withdraw it any time by deleting your voice.
• "Story ready" notifications: performance of a contract. New story notifications: only if you turn them on; legitimate interests (art. 5/2-f). You can turn both off in Settings.
• Service emails: only emails about the service, such as password reset, sign-in and account security; performance of a contract (art. 5/2-c). We never send you commercial electronic messages (offers, promotions or newsletters).
• Preventing abuse of the free plan (device identifier hash): legitimate interests (art. 5/2-f).
• Security, troubleshooting, improving the service, action records: legitimate interests (art. 5/2-f) and establishing, exercising or defending a right (art. 5/2-e).
• Legal obligations and requests from authorities: where the law requires it (art. 5/2-a, 5/2-ç).

Who receives it

We never sell your data or use it for advertising. We share only what is needed to provide the service with:

• Speech and voice copying: ElevenLabs technology, through an authorised partner. Your recording, the story text and how your child's name is pronounced are processed for this.
• Servers and backups: our servers are in Türkiye; backups of the database and voice recordings are stored on Cloudflare R2.
• Email: Resend (sign-in, password reset and account emails; servers in the EU).
• Notifications and crash reports: Google Firebase (Cloud Messaging, Crashlytics) and Apple Push Notification service.
• Sign-in: Apple and Google, if you use them.
• Subscriptions: Apple App Store, Google Play and RevenueCat, which checks your subscription status (your account identifier and purchase details).
• Public authorities: only where the law requires it.

Transfers abroad

ElevenLabs, Google, Apple, RevenueCat, Resend and Cloudflare may process data on servers outside Türkiye. These transfers rely on the cases in KVKK art. 9/6: the transfer is necessary to perform our contract with you (account, sign-in, purchases, email, running the app), and, for the voice copy, the explicit consent you give before recording (ElevenLabs).

How long we keep it

• Account, child profiles, voices, stories, support messages: while your account exists. "Delete my account" deletes all of it at once. A guest account (not signed in, no email) that is not opened for 12 months and has no active paid plan is deleted automatically with all its data.
• Voice recording and voice copy: until you delete them. "Delete my voice" removes the recording, the voice copy at the provider and every story read with it. A recording that could not be copied is deleted automatically after 7 days.
• Usage events: 90 days; at once when the account is deleted.
• Server logs (including IP addresses): at most 14 days.
• Crash reports: 90 days in Firebase Crashlytics.
• Action records: 1 year.
• Backups: 14 days; deleted data leaves the backups within 14 days at the latest.
• Plan, purchase and usage record of a deleted account: when you delete your account we keep a record of your plan, purchases and usage (not your voice, children or stories; your email only as a one-way hash) for 10 years, for our accounting and tax obligations (Turkish Tax Procedure Law art. 253, Commercial Code art. 82) and so we can restore what you bought to a new account if you ask; the usage summary is deleted after 2 years.
• Device identifier hash: while the free plan has this rule, with no other personal data and no link to an account (it stays after the account is deleted, so the free named story cannot be claimed again on the same phone).

Children

The app is for parents; whoever creates an account must be over 18. Children do not use the app; they only listen. The parent provides the information about a child and we keep the minimum needed to personalise a story. There are no ads, no chat aimed at children and no third-party advertising or analytics tracking.

Your rights

Under KVKK art. 11 you can learn whether your data is processed and request information about it, learn the purpose and whether it is used accordingly, know who it was transferred to, have it corrected, deleted or destroyed and have recipients told, object to a result against you that comes solely from automated analysis, and claim compensation for damage from unlawful processing. Other laws may give you similar rights, such as access, portability and objection.

In the app, use Settings → Download my data for a copy, and Delete child data, Delete my voice and Delete my account to delete your data at once.

For anything else, write to cesaapps@proton.me from the email address registered to your account (guest accounts without an email can use Settings → Contact us), stating your request clearly. We answer free of charge within 30 days. If you are not satisfied, you can complain to the Turkish Personal Data Protection Board or your local data protection authority.

Changes

When we update this policy we change the date above and announce important changes in the app.