Eclosion
Privacy Policy
Last updated: 7 November 2026
In short
Eclosion is a habit and self-improvement app. Your quests, mood entries, vows and chat history are not kept on your device: they sit in the cloud database that runs the app, tied to your account. Some of these records may relate to your health. The app uses Google ads, Firebase Analytics, Sentry error logging and our own account-linked usage records.
Who is responsible
Eclosion is published by Neuvikon. Neuvikon is the data controller under the GDPR and Turkey's Law No. 6698 (KVKK).
- Data controller
- Neuvikon
- neuvikon@gmail.com
Privacy contact: neuvikon@gmail.com
What this covers
This policy covers the Eclosion Android and iOS apps, the app's server on Convex and the web account deletion page. The developers are Vural Bilgin and Oğulcan Bozkurt.
What we process and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Account details: an anonymous account ID for guests; email address for email sign-in; name, email and profile photo address for Google; name and email (or Apple's relay address) for Apple | Creating the account, signing you in, carrying your data across devices | GDPR Art. 6(1)(b): performance of a contract | While the account exists. The profile photo address is not used in the app today; it only sits in the record |
| Quests, completion logs, habit counters, streaks, focus sessions and notes, calibration answers, stat history, rewards, shadow army, raid and duel records, the system log, language and time zone offset | The app's core function: keeping your progress, running the daily cycle, suggesting quests that fit you | GDPR Art. 6(1)(b): performance of a contract | While the account exists, or until you reset from the Danger Zone |
| Mood score and note | Keeping and showing your mood log; shaping the chat assistant's replies on your device | GDPR Art. 6(1)(b): performance of a contract. If this counts as health data, Art. 9 also applies; see Data that may be sensitive below | While the account exists, or until you reset from the Danger Zone |
| Dragon vow: the vow text (a suggested one or your own), dragon name, daily answer counters and streak | Tracking the one habit you chose, day by day | GDPR Art. 6(1)(b): performance of a contract. If this counts as data about health or sex life, Art. 9 also applies; see Data that may be sensitive below | The vow record until you abandon it or the account is deleted; an abandoned vow's text stays in the system log while the account exists |
| Your messages with the in-app assistant | Showing your chat history. Replies come from a rule-based engine on your device | GDPR Art. 6(1)(b): performance of a contract | The last 80 messages are kept, older ones are deleted. You can clear the history |
| Player card: friend code, player name, title, rank, level, total XP, army power and squad, streak, stats. Ally links and duel results | Running the ally and duel features | GDPR Art. 6(1)(b): performance of a contract | While the account exists. A card is created automatically for every user |
| Push token, device platform, notification preferences, a log of notifications sent | Sending the reminders you allow, not sending the same one twice | GDPR Art. 6(1)(b): performance of a contract | Token and preferences while the account exists; send log for 21 days |
| Advertising ID (Android AAID, iOS IDFA if you allow it), IP address, device and ad interaction data; on our server, a daily rewarded-ad counter | Showing and measuring ads, preventing fraud, granting rewarded-ad gold | GDPR Art. 6(1)(a): consent where the consent form is shown. Elsewhere, Art. 6(1)(f): legitimate interest in funding a free app with ads | Google's own periods (see its policy); our reward counter while the account exists |
| Firebase Analytics events: sign-in method, finishing calibration, quest completion (stat type, level-up), app instance ID, device details | Seeing in aggregate how the app is used | GDPR Art. 6(1)(a): consent where the consent form is shown. Elsewhere, Art. 6(1)(f): legitimate interest in improving the product | As long as our Firebase project's retention setting. Your account ID is not sent to Firebase |
| Product events: profile creation, calibration, quest completion (category, XP), focus time, raid, duel, ally, reward purchase and rewarded-ad events | Measuring which features are used and where people stop | GDPR Art. 6(1)(f): legitimate interest in improving the product | While the account exists. These records are tied to your account and are kept regardless of the ad consent form |
| Crash and error logs: error message, stack trace, name of the function called, device model, operating system, app version | Finding and fixing faults | GDPR Art. 6(1)(f): legitimate interest in keeping the app working | As long as our Sentry account's retention period. Your account ID is not added to the log |
| Consent records: type, text version, date, platform | Proving which text version and ad choice applied to you | GDPR Art. 6(1)(f): legitimate interest in keeping evidence for legal claims | While the account exists |
| Sign-in code, rate limit counters (by account ID or email address), server request logs and IP address | Verifying sign-in, blocking brute force and abuse | GDPR Art. 6(1)(f): legitimate interest in protecting accounts and the service | The deletion code is valid for 15 minutes. Counters are not cleared automatically and stay after account deletion. Server logs for the provider's period |
| Your email address and message when you write to us | Answering your support request | GDPR Art. 6(1)(f): legitimate interest in answering you | Up to 1 year after the matter closes |
How data is collected
You enter most of this data while using the app, and the app writes it to the server automatically. The app works online. With Google and Apple sign-in, account details come from that provider. Ad, analytics, error and product event records are created automatically. Home screen widgets keep your quest and level summary on your device only.
Do you have to provide it
You do not have to create an account; you can start as a guest. A guest account has no email tied to it, so you may lose access if you change devices. Mood, vow, chat and ally features are optional; if you do not use them, this data does not exist. The app cannot work without quest and progress data. Product events and error logs have no off switch in the app; write to us to object.
What we do not collect
- Microphone. The permission is blocked on Android and the app does not record sound.
- Location permission. The app does not ask your device for location.
- Contacts. Allies are added by code or QR.
- Camera images. The camera only reads a duel QR on your device and nothing is uploaded.
- Payment details. The app has no real-money purchases.
- AI provider access. Your chat messages do not go to a third-party AI service.
Data that may be sensitive
Your mood entries, vow text (such as "I won't smoke", "I won't drink", "I'll stay clean"), habit counters (such as "I smoked"), sleep and movement quests, calibration answers, notes and chat messages may reveal something about your health or sex life. Under GDPR Art. 9 and KVKK Art. 6 such data is a special category and as a rule needs explicit consent.
The app has no separate consent screen for this data. The "by continuing you accept" note at sign-in is not explicit consent and does not replace it. These features are optional: if you do not enter a mood, make a vow or write such quests, this data does not exist.
Vow and mood text is not sent to ad or analytics services and does not appear in notifications. Product events on our server hold a quest's category and XP, not its text.
Ads and analytics
Google AdMob shows the ads. In the EU, the UK and some US states, Google's consent form (UMP) opens first, and your answer decides whether ads are personalised. If the form is not completed, no ads are requested and Firebase Analytics stays off. You can change your choice in Settings, Legal, Ad privacy choices.
Where the form is not shown, Turkey included, no form appears: on Android ads may be personalised and Firebase Analytics turns on. On iOS, Apple's tracking permission (ATT) is asked after the form; if you refuse, IDFA is not used and ads still appear.
How Google uses this data: https://policies.google.com/technologies/partner-sites . Ad cookies and advertising IDs: https://policies.google.com/technologies/ads . Your ad settings: https://myadcenter.google.com . On Android you can reset or delete your advertising ID in device settings.
What other users see
Someone you give your friend code to, or who scans your duel QR, sees your player card: player name, title, rank, level, XP, stats, streak, army power and squad. Your allies keep seeing this up to date. Your email address, quests, mood, vow and chat are not on the card.
Who receives data
| Party | Role | Location |
|---|---|---|
| Convex | Server and database. Stores all of the app data above. | United States (AWS, Northern Virginia) |
| Resend | Emails sign-in and account deletion codes. Receives your email address and the code. | US-based |
| Sentry | Stores crash and error logs. | Germany (EU data region) |
| Expo | Delivers notifications to your device through Apple and Google. Receives the token and the notification title and text. | US-based |
| Google AdMob | Shows ads. Processes advertising ID, IP address, device and ad interaction data under its own policy. | Global |
| Google (Firebase Analytics) | Usage analytics. Receives the events above and the app instance ID. | Global |
| Google and Apple sign-in | If you choose this method, they verify you and pass your account details to us. | Global |
| Google (Gmail) | Email service where support messages are stored. | Global |
We use these parties only for the purposes above and expect them to protect the data to the same or an equivalent standard as this policy. We do not sell your data. We may disclose information where a lawful request from an authority requires it.
International transfers
Your app data, including records that may relate to your health, is hosted in the United States through Convex. For users in Turkey this is a transfer abroad under KVKK Art. 9; for users in the EU and UK it is a transfer to a third country. Error logs are processed in Germany, email and notification data by US-based providers, and ad and analytics data on Google's global infrastructure.
Security
Data is encrypted in transit with TLS. Every server operation is checked against your account, session tokens sit in the device's secure storage, account deletion codes are stored hashed, and attempts are limited. No system is perfectly secure; if a breach happens we make the notifications the law requires.
Deleting your data
In the app: Settings, Delete Account. On the web: https://precise-sockeye-895.convex.site/delete-account with a code sent to the email on your account. Guest accounts can only be deleted in the app. Uninstalling does not delete data on the server; if you uninstall without deleting a guest account, the data stays on the server and you need to write to us. Deletion removes progress, mood, vow, chat, player card, ally, duel, notification, product event and consent records. What stays: rate limit counters, Sentry, Firebase, AdMob and email records held for those providers' own periods, and server logs. Before deleting you can take a copy with Settings, Export my data (JSON).
Children
You must be at least 16 to use Eclosion; users aged 16 to 18 accept the Terms with a parent's or guardian's permission. The limit exists because the app records mood, alcohol, smoking and similar sensitive habits. The app has no age check. If we learn an account belongs to someone under 16, we delete it and its data.
Your rights
You may ask for access to your data, correction, erasure, restriction and portability, and you may object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time, without affecting earlier processing. Turkish users have the rights in KVKK Art. 11, listed on our data protection notice page.
Write to the address above with your name and request. It is free, and we answer within one month at the latest (30 days under KVKK). KVKK applications are made in Turkish.
Complaints
You can complain to us first. You may also complain to your local data protection authority (in the UK, the ICO) or, in Turkey, to the Personal Data Protection Board (KVKK).
Changes
When this text changes, the date at the top changes too. Significant changes are also announced in the product or its release notes. We do not respond to browser Do Not Track signals.