Gram Gram — Privacy Policy
Last updated: 8 November 2026. If a translation differs, this English version prevails, except where local law requires the local language.
In short
- We don't know you. No account, no name, email or phone number. No tracking, nothing sold. The only ad is one clearly labelled spot in the Kuyumcular tab for a nearby jeweller's gold deal, chosen without knowing who you are (§5).
- Your data stays on your phone. If you turn on backup or family sharing, it is end-to-end encrypted on your phone before it leaves; we cannot read it.
- What reaches our servers is limited to what is described below, and we keep no logs of who you are.
- Shop owners who claim their shop are the only people with an account; what we ask of them and how long we keep it is in §6.
1. Who is responsible
Gram Gram is made by Servet Dağ, an independent developer based in Denmark (the "controller"). Contact: merhaba@gramgram.app.
2. Data that stays on your phone
Everything you enter — gold you own, skipped purchases, things you buy often, goals, the gold book (gifts and loans, including other people's names you type), photos of your gold, the shops you follow, settings — is stored only on your iPhone. Photos are saved without location or camera metadata.
3. Data that leaves your phone
| What | When | What our server sees | Kept |
|---|---|---|---|
| Gold prices & exchange rates (fiyat.gramgram.app) | to show prices | an ordinary internet request (IP address and time, as with any connection); no ID, no account | nothing stored about you; no logs |
| Encrypted backup (yedek.gramgram.app), optional | when backup is on | an ID derived from your recovery code (it reveals nothing about you), encrypted data, its size and time, a fingerprint (SHA-256) of a write proof | last 10 copies + photos; deleted 13 months after the last upload or when you delete it |
| Family sharing (aile.gramgram.app), optional | when you share with family | a random space ID, encrypted changes, their size and time; a one-time sealed invite when you add someone | changes: until the family space is deleted; unused spaces deleted after 13 months · invites: deleted when read, at most 10 minutes |
| Nearby jewellers | when you open Kuyumcular and allow location | your approximate location is used by Apple Maps on your phone; we never receive your exact location | — |
| Local ad (Kuyumcular) | when you open Kuyumcular | a rounded area of about 1 km (around you or the place you searched); no ID, no exact location | nothing stored about you; shops see only anonymous counts |
| Reports ("Report"), optional | when you report a post, story, showcase item or shop | what you reported, the reason, an optional short text and an anonymous token used only for the daily limit; no name, no account | the report: deleted 6 months after its decision · the token: 24 hours · the decision log (tax number, decision, reason, date; never who reported): 2 years · the shop never sees who reported |
| Business account and verification (shop owners only) | when you claim a shop | your email address from Sign in with Apple (it can be Apple's Hide My Email address), never your name; the shop document and a location check — see §6 | see §6 |
| Email to us | if you write to us | your email address and message | up to 1 year after we reply |
Encryption: AES-256-GCM with keys made on your phone. The backup key comes only from your recovery code and never leaves your phone. The family key is handed over in person: the QR code shown on the inviting phone holds the key to a sealed one-time invite, which our server keeps for at most 10 minutes and cannot open. If you lose your recovery code, nobody — not even we — can open your backup.
The website (gramgram.app): it uses no cookies, no analytics and no trackers. Like every website, it is delivered by Cloudflare, which processes your IP address and browser details briefly so the page can be delivered and protected against abuse; we don't keep server logs of visits.
4. Purchases
Gram Gram+ (a yearly subscription or a one-time lifetime purchase, both with Family Sharing), the shop Pro plan (a yearly subscription) and shop ad packs (prepaid, 30 or 90 days) are bought through Apple. Apple handles payment; we never see your payment details.
5. Ads
Verified shops can buy prepaid local ad packs (30 or 90 days; they never renew automatically). An ad is always about gold, for your gain: a gold deal, a discount or the shop's gram price — never other products. There is one ad slot, in the Kuyumcular tab, and it is always labelled "Ad". Everyone sees it, with or without Gram Gram+; there is no setting to turn ads off. To choose an ad, your phone sends only a rounded area of about 1 km — no identifier and no exact location. Ads are never based on a profile or on anything you keep in the app. Shops see only anonymous counts. The shop list and the map are always sorted by real distance; paying never moves a shop up. With a long press you can hide one shop's ads. Ads open in a city only once it has enough users and verified shops; to know that, we count how many times Kuyumcular is opened in each city per week: only one number per city, no identifier, no location.
6. Business verification (shop owners only)
The Kuyumcular tab shows every real jeweller from Apple Maps, claimed or not. Customers never have an account and are never asked for anything. If you own a shop and claim it in the app:
- Account: you sign in with Apple. We ask Apple only for your email address — you may use Apple's Hide My Email — and never for your name. We use it only when we need to write to you ourselves about your claim, a dispute or your account; no automatic emails, never marketing. The review result comes in the app and as a notification on your phone. This business account is separate: your personal gold, savings and the things you buy often never go to it.
- Document: before the upload the app shows a short notice. You share an e-Devlet barcoded PDF (Vergi Levhası or Esnaf Sicil); we read the tax number, name and address and check them against the shop. The document is stored encrypted and deleted 30 days after the decision.
- Location check: one tap while you are at the shop; your phone's location at that moment is compared with the shop's place on the map. It is used only for this check and is not stored.
- Decision log: the tax number, the decision, its reason and date, kept for 2 years for disputes and bans. It never contains who reported.
- What you publish (prices, hours, photos, stories, showcase) is public on your shop page. Customers' views and taps reach you only as anonymous counts. Reports about your shop are anonymous; you never see who reported.
- If you leave: you can delete the business account in the app (business Settings). Your page goes back to an unclaimed page with Apple Maps data at once, and your own content (photos, cover, stories, showcase, prices, hours, texts, stats) is deleted within 30 days; only the decision-log entry stays, for the 2 years above. If Pro ends, Pro content is hidden at once and kept for 90 days, so it comes back if you subscribe again, then deleted; your Basic page stays.
7. What we don't do
No analytics or advertising SDKs, no advertising identifier (IDFA), no tracking across apps or websites, no profiling, no sale or sharing of personal data.
8. Service providers and transfers
Our servers run on Cloudflare (data may be processed outside your country, including the US; transfers rely on the EU Standard Contractual Clauses / Data Privacy Framework as applicable). Apple provides the App Store, purchases, Sign in with Apple and maps. Gold prices come from public sources (TCMB EVDS, Gold-API, ECB exchange rates, World Bank, US BLS); no personal data is sent to them.
9. Legal bases (EU/EEA/UK)
Prices and the app's functions: performance of the service you request (Art. 6(1)(b) GDPR). Backup and family sharing: your choice to use them (Art. 6(1)(b)). Location: your consent via iOS (Art. 6(1)(a)), withdrawable in iPhone Settings. Business account, its email and verification: the steps needed for the shop service you ask for (Art. 6(1)(b)) and our legitimate interest in keeping fake shops out (Art. 6(1)(f)). Reports, the rounded ad area and the 2-year decision log: our legitimate interest in a safe, fair jeweller list and in handling disputes and bans (Art. 6(1)(f)). Emails: our legitimate interest in answering you (Art. 6(1)(f)).
10. Your rights and how to use them
You can delete everything in the app: Settings › Your data › Delete all my data (optionally including the cloud backup; you get a deletion receipt). Deleted items wait 30 days in "Recently deleted" before they are gone.
Because we hold no identity, we usually cannot link server data to you; you control it through the app with your codes. You can still contact us at merhaba@gramgram.app. Shop owners manage their page and can delete the business account in the app (§6).
EU / EEA (incl. Norway, Iceland) — GDPR: access, rectification, erasure, restriction, portability (CSV export in the app), objection, withdrawal of consent, and a complaint to a supervisory authority (Denmark: Datatilsynet).
United Kingdom — UK GDPR: the same rights; complaints to the ICO.
Türkiye — KVKK (Law No. 6698, Art. 11): the rights listed in Article 11; complaints to the Personal Data Protection Authority (KVKK).
United States (incl. California — CCPA/CPRA): we do not sell or share personal information and do not use it for targeted advertising; you may request access or deletion.
Canada — PIPEDA: access and correction rights; complaints to the Office of the Privacy Commissioner of Canada.
We answer within 30 days (or the time your law allows).
11. Children
Gram Gram is not directed at children under 13 (16 where local law requires) and does not knowingly collect their data.
12. Security
End-to-end encryption, signed price data, no personal logs, data protection on the device, shop documents stored encrypted and deleted after 30 days. Your iPhone's own iCloud device backup (Apple's service) may contain the app's data until Apple's next backup.
13. Changes
We update this policy as the app changes; the date above changes and important changes are announced in the app.