Privacy Policy

1.Who we are#

The App is developed and published by Mustafa OZ, an independent developer based in İzmir, Türkiye (“OZ”, “we”, “us”, “our”). We are the data controller (in Turkish, veri sorumlusu) for the processing described in this policy under the EU and UK General Data Protection Regulation (“GDPR”), the Swiss Federal Act on Data Protection (“FADP”), Türkiye’s Law No. 6698 on the Protection of Personal Data (“KVKK”) and similar laws — except where a partner acts as an independent controller, as explained in Who receives data.

For any question or request, email thehelloworld.apps@gmail.com.

2.Information that stays on your device#

In shortMost of what you do in the App never leaves your device.

The App works without an account. The information below is saved only in the App’s private storage on your device. It isn’t sent to us or to anyone else, and we have no way to see it.

Notes are stored with iOS Data Protection encryption. If you updated from an earlier version of the App, your saved statuses and notes were moved into the new version once, on the device itself.

Like other app data, this information can be included in your device backups (iCloud Backup or a backup on your computer), which are controlled by you and Apple. Deleting the App removes it from your device. Because we never receive a copy, we can’t restore it for you.

3.Atlas, the AI assistant (OpenAI)#

In shortYour questions are sent through our server on Cloudflare to OpenAI to write Atlas’s answers — without your name or any ID from us — and aren’t used to train AI.

What is sent. When you ask Atlas a question — typed yourself or tapped from the suggested questions — the App sends the following over an encrypted connection to our server on Cloudflare, which passes it on to OpenAI’s API:

• your question;
• for follow-up questions, up to three earlier questions and answers from the same chat, so Atlas understands the context;
• reference facts about the selected country from the App’s built-in data (such as its name, capital, population, languages and currency), the App’s language, today’s date, and instructions that keep Atlas on topic.

What isn’t sent. We don’t send your name, email address, an account or user ID, your advertising identifier or your location. As with any internet connection, our server receives your device’s IP address and basic technical information about the connection, such as the App’s name and version and the iOS version. It uses the IP address only to limit how many questions can be sent from one network each minute, keeps that count for about a minute, and stores neither your IP address nor your questions. Cloudflare, which runs the server for us, may also use connection data to protect its network from attacks, as described in Cloudflare’s Privacy Policy. OpenAI receives your questions from our server, not from your device, so it doesn’t receive your IP address.

Protecting Atlas from misuse. So that only the genuine App can use Atlas, the App proves it’s an unmodified copy running on a real Apple device, using Apple’s App Attest and Google’s Firebase App Check (where App Attest isn’t available, such as on a Mac, Apple’s DeviceCheck instead). App Attest creates a key on your device that never leaves it; Apple confirms the key belongs to the App, Firebase checks that confirmation, and the App gets a token, valid for a limited time, that goes with your questions. Apple and Google receive information about the App and this check, and your IP address. The token identifies the App, not you, and the check doesn’t use your name, advertising identifier or location. It happens only around Atlas — when a country page shows its Ask AI card or you ask a question — not when you open the App.

How OpenAI handles it. OpenAI processes this information to write the answer and sends it back to the App through our server. Under OpenAI’s API data policies, content sent through the API isn’t used to train OpenAI’s models unless the developer opts in — and we have not opted in. OpenAI may keep it for up to 30 days to detect abuse and then deletes it, unless keeping it longer is required by law or needed to prevent harm. We don’t store or read your questions.

On your device. The App counts how many questions Atlas answers each day to apply the daily allowance, and keeps the latest answer for each country so you can read it again. The Listen button reads answers aloud using the voices built into iOS, entirely on your device. Atlas also appears as your guide in the Explore lessons; those lessons are built into the App and don’t use AI or send anything.

Earlier versions. Version 3.2.6 and earlier of the App send questions directly from your device to OpenAI, which then also receives your IP address, and download the settings they need from Google Firebase Remote Config at launch. Updating the App switches to the setup described here.

Atlas currently uses OpenAI’s GPT-6 Luna model. Learn more in OpenAI’s Privacy Policy, how OpenAI handles API data and Cloudflare’s Privacy Policy.

4.Ads in the free version (Google AdMob)#

In shortThe free version shows occasional ads from Google. You decide whether they can be personalized, and Premium removes them.

The free version of the App is supported by ads from Google AdMob, a service of Google LLC (for users in the European Economic Area and Switzerland, Google Ireland Limited). Full-screen ads appear occasionally as you open country pages — currently at most once every four pages, and never on the first page after you open the App.

Your choice comes first. Before any ad is requested, the App uses Google’s User Messaging Platform to check whether a consent message applies where you are — for example, in the EEA, the UK and Switzerland — and, if so, shows it so you can make your choices. (This check sends Google your IP address and basic device and app information.) The App then shows Apple’s App Tracking Transparency prompt, unless you’ve already answered it.

What Google may collect when ads are requested and shown:

• your IP address, and an approximate location derived from it (city or region level — never GPS);
• device identifiers: the Identifier for Advertisers (IDFA) only if you allow tracking, and the Identifier for Vendors (IDFV);
• device and app information, such as the device model, operating system, language and app version;
• ad interactions, such as which ads were shown or tapped, and diagnostic information about how the ads software performs.

Google’s software also saves your consent choices on your device and stores and reads data used to deliver and measure ads there (such as identifiers or cookies) — where the law requires it, only with your consent.

How it’s used. To deliver ads, limit how often you see the same ad, measure ad performance, prevent fraud and abuse and — only with your permission — personalize ads. If you choose “Ask App Not to Track” or decline personalization, Google may still show non-personalized or “limited” ads, which rely on context such as the App itself and your general location. The App also supports Apple’s SKAdNetwork, a privacy-preserving way for advertisers to measure app installs without identifying you.

Learn more: How Google uses information from sites or apps that use its services · Google Privacy Policy · My Ad Center.

5.Notifications (Firebase Cloud Messaging)#

In shortOff unless you switch them on. Free version only. Easy to switch off.

Notifications are off by default, and the App never asks for them on its own. iOS asks for permission only when you turn on the Notifications switch in the App’s Settings.

• What you’ll get: occasional messages about new features and offers. Only users of the free version receive them; Premium subscribers don’t.
• How it works: your device registers with Apple Push Notification service and with Firebase Cloud Messaging, a Google service, which assign it a push token, a registration token and a Firebase installation ID. Your device then joins a general topic shared by all free users. We send the same message to everyone on that topic — we don’t target you individually. Firebase may also receive technical information about message delivery.
• Turning them off: use the switch in the App’s Settings — your device leaves the topic, its Firebase registration token is deleted, and notifications already delivered are cleared — or go to iOS SettingsNotificationsAll Countries.

6.Maps and flags#

In shortMap data and flag images are downloaded from Mapbox, Apple and flagcdn.com. They receive standard technical data such as your IP address — never your device’s location.

• Built-in maps. The world map, country outlines and the pictures used in games are built into the App and work offline. Using them sends nothing anywhere.
• The globe (Mapbox). The 3D globe is displayed with Mapbox. When you use it, map data is downloaded from Mapbox, which receives your IP address, device and software information, the map areas requested and usage data (such as map loads and an identifier used to count active devices). The App never turns on location for the globe, so Mapbox receives no location from the App — and Mapbox doesn’t collect advertising identifiers. The ⓘ button on the globe shows map attributions and Mapbox’s telemetry setting. See Mapbox’s Privacy Policy.
• Country maps (Apple Maps). Satellite, 3D and Look Around views of a country are provided by Apple’s MapKit. To place a capital on the map, the App searches Apple Maps for the capital’s name. Apple receives these requests under the Apple Privacy Policy; the App doesn’t share your location with Apple Maps.
• Flag images (flagcdn.com). Flags are downloaded from flagcdn.com, a public flag-image service, and saved on your device for offline use. Like any website, the service receives your IP address and standard request information (such as the App’s name and iOS version). Nothing else is sent.

7.Built-in browser and web search#

In shortWebsites you open have their own privacy policies. The built-in browser forgets cookies when you close the App.

Country pages link to Wikipedia and Wikivoyage articles, YouTube search results and a web search using the search engine you choose in Settings (Google by default; Brave Search, DuckDuckGo, Baidu or Bing). These open in the App’s built-in browser. For searches, the search term is just the country’s name and the word “country” in the App’s language (for example, “Spain country”). From then on, you’re browsing third-party websites: they receive your IP address and information about what you do there, under their own privacy policies — for example, the Wikimedia Foundation Privacy Policy for Wikipedia and Wikivoyage.

• Private by design. The built-in browser keeps cookies and website data in memory only. Nothing is saved to disk, and it’s all discarded when the App is closed. Links using insecure http are upgraded to https where possible.
• Camera and microphone. Websites can’t use your camera or microphone live — the App refuses those requests. If a website lets you upload a picture (for example, an image search), iOS lets you choose a photo or take one; only the file you pick is sent, and only to that website.
• Saving images. If you save an image from a web page, iOS asks for permission to add it to your Photos. This permission is add-only: the App can’t see your photo library.
• Location. The App itself never asks for your location. If a website asks for it, iOS asks you first, and anything you allow goes to that website, not to us.

8.Purchases, ratings and sharing (Apple)#

In shortApple handles payments, ratings and sharing. We never see your card or Apple Account.

• Purchases. Premium is bought through Apple’s App Store. Apple processes the payment and your Apple Account details; we never receive your name, email address, payment card or billing address. The App checks your subscription status on your device using Apple’s StoreKit, which provides signed transaction information, and remembers the status on the device. Apple gives us sales and subscription reports that don’t identify you personally. Restoring purchases asks Apple to re-check your Apple Account’s purchases. Prices, renewals, cancellation and refunds are covered in the Terms of Use.
• Ratings and reviews. If you rate or review the App, Apple’s rating prompt and the App Store handle it; we only see public reviews and overall ratings.
• Sharing and copying. When you share or copy something — an Atlas answer, a country or a game result — iOS’s share sheet and clipboard are used, and you choose where it goes. We don’t receive it.
• Links into the App. Links such as those in the App Store’s in-app events (for example, smartworldmap://daily) just open a page in the App. They don’t send any information to us.

See the Apple Privacy Policy.

9.Crash reports, app opens and emails#

Crash reports. The App contains no crash-reporting or analytics SDKs. If you’ve chosen to share analytics with app developers in iOS SettingsPrivacy & SecurityAnalytics & Improvements, Apple may give us crash reports and aggregated performance data about the App. They don’t include your name or contact details, and we use them only to fix problems.

App opens. Each time you open the App, it adds an anonymous record to our database at Google Firebase (Realtime Database), so we can count how many times the App is opened each day and in which countries. The record contains only which app and platform it comes from, the date and time, and the country of your device’s region setting (iOS SettingsGeneralLanguage & Region) — not your location. It contains no name, account, device or advertising identifier, so it can’t be linked to you or to your other opens. Like any server, Firebase receives your IP address to accept the record; the IP address isn’t part of it.

Emails. If you email us, we receive your email address, your name if you include it, and your message. We use them only to reply to you and to keep a record of our conversation. Our email is provided by Google (Gmail).

10.What we don’t do#

• We don’t offer or require accounts or logins.
• We don’t collect your location. The App’s own features never request location access; if a website in the built-in browser asks, the choice is yours and the location goes to that website. (Services such as Google may estimate a general location from your IP address, as described above.)
• We don’t access your contacts, calendars, photo library, health data or other personal files.
• We don’t use analytics or crash-reporting SDKs (such as Google Analytics for Firebase or Firebase Crashlytics), and we don’t build profiles about you.
• We don’t sell your personal information, and we don’t use it to make automated decisions that have legal or similarly significant effects on you.
• We don’t read your Atlas questions or use them to train AI.
• We don’t knowingly collect information from children.

11.Why we use data — legal bases#

Where the GDPR, the FADP, KVKK or similar laws apply, we rely on these legal bases:

Withdrawing consent doesn’t affect processing that happened before you withdrew it.

How it’s collected. Electronically: automatically by the App and the services described above when you use a feature, and directly from you when you email us.

You’re never required to give us personal information. Some features simply can’t work without it — Atlas can’t answer without receiving your question — and if you decline tracking or ad personalization, you’ll still see ads in the free version, just not personalized ones.

12.Who receives data#

In shortOnly the services the App needs to work — never data brokers.

We share information only as described in this policy. The companies whose services the App uses to handle your data — OpenAI, Cloudflare, Google (AdMob and Firebase), Mapbox and Apple — are bound by their terms, data processing agreements and privacy commitments to protect it with the same or equal protection as described in this policy and required by applicable law and Apple’s App Store Review Guidelines. flagcdn.com, which only serves flag images, and websites you choose to open apply their own policies.

We may also disclose information if the law or a valid legal request requires it; to protect the rights, property or safety of our users, the public or us, or to prevent fraud; to a successor if the App is transferred, who must respect this policy for information collected under it; or with your consent.

13.International transfers#

We’re based in Türkiye, and our providers process data in other countries — mainly the United States and the European Union. Where the law requires, these transfers rely on recognized safeguards, such as adequacy decisions (including the EU–U.S. Data Privacy Framework for providers that participate in it) and the European Commission’s Standard Contractual Clauses. For transfers from Türkiye, we rely on the grounds available under Article 9 of KVKK, such as appropriate safeguards or, where applicable, transfers that are necessary to provide a service you’ve requested.

14.How long data is kept#

Because we don’t attach any identifier to your Atlas questions and our server doesn’t store them, we can’t look up or delete specific questions ourselves; OpenAI deletes them automatically as described above.

15.Your choices and controls#

• Allow or stop tracking

  iOS SettingsPrivacy & SecurityTracking · Apple’s guide

• Change your ad consent choices

  In the App: SettingsPrivacyAd Privacy Settings — shown where Google’s consent rules apply

• Remove ads entirely

  Subscribe to Premium

• Notifications

  The switch in the App’s Settings, or iOS SettingsNotificationsAll Countries

• Delete everything on your device

  Delete the App: touch and hold its icon, then tap Remove App › Delete App. Travel statuses can also be cleared in the App’s Settings. Deleting the App doesn’t cancel Premium.

• Mapbox telemetry

  Tap the ⓘ button on the globe

• Crash data shared with developers

  iOS SettingsPrivacy & SecurityAnalytics & Improvements

• Parental controls

  Screen Time and Ask to Buy

16.Your privacy rights#

In shortYou have rights over your personal data wherever you live. Email us and we’ll help — free of charge.

Depending on where you live — for example, under the laws described below, Brazil’s LGPD or Canada’s PIPEDA — you may have the right to access, correct, delete, restrict or receive a copy of your personal data, to object to its use, and to withdraw consent at any time. To make a request, email thehelloworld.apps@gmail.com. We’ll reply within 30 days, or sooner where the law requires. Because the App has no accounts and we keep almost no personal data ourselves, we often can’t link information to you — but we’ll explain what we can do, and help with requests to our providers.

European Economic Area, United Kingdom and Switzerland

Under the GDPR, the UK GDPR and the FADP, you have the right of access, rectification, erasure, restriction, data portability and objection (including to processing based on legitimate interests), the right to withdraw consent, and the right not to be subject to decisions based solely on automated processing that significantly affect you. You can also complain to a supervisory authority: in the EEA, the authority where you live or work (list of authorities); in the UK, the Information Commissioner’s Office; in Switzerland, the FDPIC.

Türkiye (KVKK)

Under Article 11 of KVKK, you have the right to:

1. learn whether your personal data is processed;
2. request information about the processing, if it is;
3. learn the purpose of the processing and whether your data is used accordingly;
4. know the third parties, in Türkiye or abroad, to whom your data is transferred;
5. request correction of incomplete or inaccurate data;
6. request deletion or destruction of your data under the conditions in Article 7 of KVKK;
7. request that third parties who received your data be notified of any correction, deletion or destruction;
8. object to a result against you that arises from analysis exclusively by automated systems; and
9. claim compensation for damage caused by unlawful processing.

Send your request to thehelloworld.apps@gmail.com. We’ll respond free of charge within 30 days at the latest, as required by Article 13 of KVKK. If you’re not satisfied, you can complain to the Personal Data Protection Board (kvkk.gov.tr).

United States

Residents of California and other U.S. states with comprehensive privacy laws may have the right to know about and access, correct, delete and get a copy of their personal information; to opt out of the “sale” or “sharing” of personal information and of targeted advertising; and not to be discriminated against for exercising these rights.

Sale, sharing and targeted advertising. We don’t sell personal information for money. If you allow personalized ads, Google and its partners may use identifiers and ad-interaction data for cross-context behavioral advertising, which some state laws treat as “selling”, “sharing” or “targeted advertising”. To opt out, choose “Ask App Not to Track” (or turn off tracking in iOS Settings), use Ad Privacy Settings in the App where shown, or subscribe to Premium; these choices are made on your device, and if you email us, we’ll help you set them. The App isn’t a web browser, so it can’t receive Global Privacy Control signals — please use these controls instead. We don’t knowingly sell or share the personal information of consumers under 16.

Categories of personal information handled in the last 12 months:

We don’t collect sensitive personal information. The information comes from you and your device, and is kept as described in How long data is kept. You can use an authorized agent, and we may need to verify a request before acting on it. If we decline your request, you can appeal by replying to our decision; if we deny the appeal, you can contact your state Attorney General.

17.Children#

The App is rated 16+ on the App Store and isn’t directed to children. We don’t knowingly collect personal information from children, and the App never asks for a name, age or contact details. Parents and guardians can use Screen Time parental controls and Ask to Buy to manage a child’s use and purchases. If you believe a child has given us personal information — for example, in an Atlas question — please contact us and we’ll take appropriate steps.

18.Security#

• All of the App’s connections use encryption (HTTPS/TLS).
• Notes are stored with iOS Data Protection, and the built-in browser doesn’t save cookies or website data to disk.
• We don’t run servers that store your personal information, which limits what could ever be exposed.

No method of transmission or storage is completely secure, so we can’t guarantee absolute security. If you find a security issue, please tell us at thehelloworld.apps@gmail.com.

19.Changes to this policy#

We may update this policy as the App or the law changes. We’ll change the effective date above and, for significant changes, tell you in the App or on this page before they take effect — and ask for your consent where the law requires it. Earlier versions are available on request.

20.Contact us#

OZ · İzmir, Türkiye · thehelloworld.apps@gmail.com

We aim to reply within a few days, and always within 30 days for privacy requests.