Weki Privacy Policy
Last updated: 20 October 2026 · Türkçe
Weki is an alarm app. Your alarms run on your phone; they ring even if the server is unreachable and there is no internet connection. The server exists only for what you share with your friends: shared alarms, "Awake" status, plans, nudges and wake-up voice messages. That is why the data we collect is limited to what these features need to work.
1. Data controller
iPhone app: Yusuf Uygar (an individual, not a company).
Android app: Burak Albayrak (an individual, not a company). Address: Beytepe Erkek Öğrenci Yurdu,
Hacettepe Üniversitesi Beytepe Kampüsü, No: 19/7, Çankaya/Ankara, Türkiye.
Both apps use the same server and the same accounts; this policy applies to both.
Contact for all questions and requests: destekwekicompany@gmail.com
2. What data we process and why
| Data | Why | How long |
|---|---|---|
| Account: username, display name, time zone, a hash of your password and recovery code (not the values themselves; argon2id), your discoverability, nudge and voice preferences | To create your account, let your friends find you and apply your preferences | Until your account is deleted |
| Device: platform, app and operating system version, time zone, last seen time, notification permission status, notification key (push token), app language | To keep your session secure and send you notifications in your own language | Until you sign the device out or delete your account |
| Session: hashes of your session keys, when the session was opened and last used | To verify your sign-in and to detect and close a stolen session | Until the session is closed or expires |
| Friends: friend requests, friendships, people you have blocked | Social features; keeping unwanted people away | Until you remove them or delete your account |
| Alarms: the definition of alarms you share or sync (time, repeat, label, snooze, vibration) and which device they are set on | Syncing between your devices; shared alarms | Until you delete the alarm or your account |
| Shared alarms and groups: group membership, participation, "Awake" time, streak | So the group can see who is awake | Until you delete your account |
| Plans: plan details, invitations, your response | The plans feature | Until you delete your account |
| Nudges: who nudged whom for which alarm | Nudge notifications and the one-nudge-per-person limit | Until you delete your account |
| Wake-up voice: a voice message of up to 12 seconds that you record for a friend's alarm | So your friend can hear it when their alarm rings | The audio file is deleted 24 hours after the alarm time. The record of who sent it to whom and when is kept until the account is deleted, for the one-voice-per-person limit. |
| Reports: who reported whom, the reason, the description you wrote, the moderation decision | To prevent harassment and abuse | Until one of the accounts is deleted |
| Time counter (Android only): your alarm time, for the "how many people wake up at this time" count | Showing an anonymous count. Other users see only the number, not who is included | As long as your alarm exists |
| Server logs: time, path and result of requests; your IP address in the HTTPS layer's access log | Security, rate limiting, debugging | At most 14 days. The application log does not record IP addresses. |
What we do not collect: your contacts, your email list, your location, your advertising ID. Your contacts or address book are never uploaded to the server. The app contains no advertising or analytics SDK.
Legal basis and how we collect data
We collect data electronically, from what you enter when you use the app and the website and from records the app creates automatically. Legal bases (Article 5 of the KVKK; for users in the EU, Article 6 of the GDPR):
- Performance of a contract (KVKK 5/2-c; GDPR 6(1)(b)): account, device, session, friends, alarms, shared alarms and groups, plans, nudges and wake-up voice messages. Without them we cannot run the feature you ask for.
- Legitimate interests (KVKK 5/2-f; GDPR 6(1)(f)): reports, server logs and rate limits. Our interest is keeping the service secure and preventing harassment and abuse. The anonymous number in the time counter also relies on this.
- Consent (KVKK 5/1; GDPR 6(1)(a)): entering your email address in the website's waiting list yourself. You can withdraw it at any time (section 11).
3. What stays only on your phone
- Your alarms themselves are set and ring on your phone. On iPhone they are set with Apple's alarm system; the alarm name appears on the phone's alarm screen and on a paired Apple Watch.
- App diagnostic logs (for example, whether an alarm was set and rang on time) contain no personal data and never leave your phone.
- Downloaded wake-up voice messages are stored encrypted on your phone and deleted within 48 hours at the latest.
- Weekly summary (iPhone): when each alarm rang and was stopped, and how many times it was snoozed, is kept only on your phone, deleted after 35 days and never sent anywhere.
- Profile photo (iPhone): the photo you choose or take is stored only on your phone and is not sent to our server; your friends see your initials. It is deleted from the phone when you remove it or delete your account.
- Home screen widgets (iPhone): the time and name of your next alarms, the status of the featured shared alarm and the names of up to two friends who are not up yet are written to a shared area on your phone between the app and the widget, so the widget can read them. This information is not sent anywhere. If you add the widget to your home screen, anyone who unlocks your phone can see it.
- Create with Voice: your speech is converted to text and the draft is created on your phone. Raw audio is not recorded and not sent to our server. Recognition happens on the phone whenever possible. If your phone has no on-device recognition for the language, your speech goes to Google's speech recognition service on Android and Apple's on iPhone; the screen tells you when this happens.
4. Who we share data with
We do not sell data and do not share it for advertising. We use the following service providers to run the service:
| Provider | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Server and database hosting | Germany |
| Google Firebase Cloud Messaging (Android) | Sending notifications. Only the notification key and a generic text are sent (such as "You have a voice message"); no names, times or message content | USA and other countries |
| Google speech recognition (Android; only if on-device recognition is unavailable) | Create with Voice | Google's infrastructure |
| Apple speech recognition (iPhone; only if on-device recognition is unavailable) | Create with Voice | Apple's infrastructure |
Your friends see only what you share: your username, your display name, your status in shared alarms, your responses to plans, and the voice messages they send you or you send them.
These providers process your data only to run the service and on our behalf. Each of them commits to protecting your data under its own data processing terms; we expect them to provide the same or equivalent protection as this policy.
5. International transfers
Our server is in Germany; the notification infrastructure is Google's. In Create with Voice, if on-device recognition is unavailable, your speech goes to Google (Android) or Apple (iPhone). This means personal data is transferred abroad. Transfers are made with safeguards in line with Article 9 of Türkiye's Personal Data Protection Law No. 6698 (KVKK). For users in the European Union, see section 9.
6. Deleting your account
- In the app: Profile → Delete account. We ask for your password and a final confirmation, so that someone who gets hold of an open session cannot delete your account.
- Without the app: follow the steps on the account deletion page.
Deletion is immediate and permanent; there is no waiting period. Your account, profile, devices, sessions, friendships, alarms, group and plan records, nudges, the voice message records you sent and received, and the audio files are deleted. Your username becomes available to others.
Server backups are kept for 14 days; deleted data is removed from backups at the end of that period.
7. Security
Passwords are hashed with argon2id; session keys are stored as hashes and never logged. The connection to the server is encrypted (HTTPS). If a stolen session key is reused, the whole session chain is closed. Access to anyone else's data is checked on the server for every request.
If we learn that your data has been accessed by unauthorised people, we will notify the Turkish Personal Data Protection Board and you within the period the law requires.
8. Your rights
Under Article 11 of the KVKK, you have the right to:
- learn whether your personal data is processed;
- request information if it has been processed;
- learn the purpose of the processing and whether the data is used for that purpose;
- know the third parties in Türkiye or abroad to whom it is transferred;
- request correction if it is incomplete or inaccurate;
- request its deletion or destruction;
- request that corrections and deletions be notified to the third parties it was transferred to;
- object to a result against you that arises solely from automated analysis;
- claim compensation if you suffer damage from unlawful processing.
Requests: write to destekwekicompany@gmail.com with your username. Accounts have no email address, so we may ask you to confirm your identity in the app. We handle your request free of charge within 30 days at the latest. If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Board (KVKK).
9. Users in the European Union (GDPR)
If you live in the European Union or the European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):
- Access: to know what data we process about you and to request a copy.
- Rectification: to have inaccurate or incomplete data corrected. You can also change your display name, time zone and preferences yourself in the app.
- Erasure: to have your data deleted. You can delete your account in the app immediately (section 6).
- Objection and restriction: to object to the processing of your data or ask for processing to be restricted.
- Portability: to receive the data you gave us in a commonly used, machine-readable format.
- Complaint: to lodge a complaint with the data protection supervisory authority in the EU country where you live, work or where you believe the infringement took place.
Requests: destekwekicompany@gmail.com. We reply within 30 days at the latest.
For the legal bases, see "Legal basis and how we collect data" in section 2. Where processing is based on consent (the waiting list), you can withdraw your consent at any time; this does not affect the lawfulness of processing before the withdrawal.
The data controller is outside the EU (Türkiye; section 1). A username, display name and password are required for an account; without them you cannot use friends, shared alarms or plans. Setting alarms needs no data at all. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects, and we do not profile you.
Our server and database are in the EU, in Germany (Hetzner). Data leaves the EU only for sending notifications (Google) and, if on-device recognition is unavailable, for speech recognition (Google, Apple). Transfers to the United States rely on the EU-US Data Privacy Framework or on the provider's Standard Contractual Clauses.
List of data protection supervisory authorities in the EU: edpb.europa.eu.
10. Children
Weki is not intended for children under 13.
11. Website
The website at wekicompany.online does not use cookies and
contains no third-party analytics or advertising tracking; even the fonts are served from
our own server, so opening the site is not reported to any other company.
When you open the site, the time and path of the request and your IP address are written to the HTTPS layer's access log and deleted after 14 days at the latest; the purpose is security and debugging.
Waiting list form: if you enter your email address, we store it on our own server (Germany, Hetzner). No third-party form service is used; the address goes to no other company.
- What is stored: the email address, which part of the page the form was sent from (for example "hero") and the time of signup. Your name, IP address or any other information is not written to this record.
- Why: only to let you know once when the app is released. The address is not used for advertising or marketing lists, and is not sold or shared.
- How long: deleted within 30 days after the announcement email, or, if the app is not released, within 1 year after the form closes.
- Removal: just write to destekwekicompany@gmail.com and we will remove the address from the list. No account is needed.
The form does not tell you whether an address is already on the list: both submissions get the same response. If it did, anyone trying the form could find out whether someone else's email is on the list.
12. Changes
If this policy changes, we update the date at the top of this page. We announce important changes on the website before they take effect and, where possible, in the app too. For the rules for using the service, see the Terms of Use.