Privacy Policy
Privacy policy
Last updated: 17 October 2026
1. Introduction
This privacy policy explains how Seyfi Can Zeyrek (trading as Morrowline Apps) handles personal data when you use Ketogo, our keto meal-planning and recipe app for iOS and Android. It describes what data the app uses, why, who receives it, how long it is kept and the choices you have. This policy applies from 17 October 2026.
Our Terms of use are published at https://ketoeggo.morrowline.app/en/terms/. If you live in Türkiye, our separate information notice under Law No. 6698 (KVKK) is published at https://ketoeggo.morrowline.app/en/kvkk/.
In short:
- Your profile answers, nutrition targets, meal plans and food, water and activity logs are stored on your device. We also process identifiers, app usage events, crash reports, advertising data and subscription status in the cloud with Google (Firebase), Google (AdMob) and RevenueCat to run the app, keep it stable, show ads and check subscriptions.
- The free version shows ads served by Google (AdMob); Premium subscribers do not see ads.
- Whether ads are personalized depends on your choices in Google's consent form (where Google requires it), in Apple's tracking prompt on iOS and in your device's ad settings on Android (section 11).
- You can ask us by email to delete the data we hold about you (section 14).
2. Who we are
The controller responsible for your personal data is Seyfi Can Zeyrek, an individual trading under the brand Morrowline Apps.
- Address: Esenyali Mahallesi 52/75 Sk. Izmir/Türkiye
- Email: zeyrekseyfican@gmail.com
We have not appointed a data protection officer. Send privacy questions and requests to zeyrekseyfican@gmail.com.
3. Scope
This policy applies to the Ketogo app (application ID com.eggo.keto.diet) on iOS and Android, including its notifications, its Premium subscription and the consent screens shown in the app. It also covers requests you send us by email about the app.
It does not cover websites, apps and services run by others, such as the App Store, Google Play or the advertisers whose ads you see, or features of your operating system. They have their own privacy policies. Screens in the app may give you extra information at the moment a feature uses data.
4. Data we collect
"Collect" here means data that leaves your device and reaches us or a provider working with us. Data that stays on your device is listed separately below.
We collect automatically
We collect usage analytics and crash diagnostics through Google (Firebase). The table lists everything the app sends automatically.
| Data | What it includes | Why we use it | Who receives it |
|---|---|---|---|
| Account identifier (user ID) | An anonymous user ID created when you first open the app. The same ID is used as your customer ID for subscription checks and is attached to analytics events and crash reports. | To provide the features you use (recipe and food catalog download, Premium status) and to secure the service | Google (Firebase), RevenueCat |
| Device identifiers and push token | The push token of your device with the platform (iOS or Android) and the time it was last updated, only if you allow notifications; the Firebase installation ID of the app | To send notifications, to load remote settings and to understand how the app is used | Google (Firebase); Apple delivers notifications on iOS |
| Device identifiers: advertising identifier | On iOS the advertising identifier (IDFA), only if you allow tracking; on Android the advertising ID, unless you deleted it in your device settings | To show and measure ads; on Android and, when you allow tracking, on iOS, Firebase Analytics also receives it | Google (AdMob), Google (Firebase) |
| App usage and interactions (analytics) | Events such as opening a recipe, saving a food entry, opening the subscription screen, buying Premium, seeing or skipping an ad, unlocking content with a rewarded video and opening a notification; device model, operating system and app version, language and country derived from the IP address | To understand how the app is used and keep it stable | Google (Firebase) |
| Crash reports | The error and stack trace, device model, operating system and app version and the state of the app at the time of the crash, linked to the account identifier | To find and fix errors | Google (Firebase) |
| Other diagnostics | Attestation tokens from Apple App Attest or Google Play Integrity that confirm requests come from a genuine copy of the app | To keep the service secure and prevent abuse | Google (Firebase), Apple, Google Play |
| Advertising data | Ads shown to you, clicks, completed rewarded videos, ad performance and the consent signals sent with ad requests | To show and measure ads and limit how often you see them | Google (AdMob) |
| Approximate location | An estimate of your region that Google derives from the IP address of ad requests. The app does not ask for location permission. | To show ads suited to your region and apply regional advertising rules | Google (AdMob) |
We receive from others
| Data | What it includes | Why we use it | Who receives it |
|---|---|---|---|
| Purchase and subscription status | Which subscription you bought (weekly or annual), purchase, renewal and expiry dates, the store transaction ID and whether Premium is active. Card and payment details stay with Apple or Google. | To unlock Premium, restore purchases and handle billing questions | RevenueCat, Apple, Google Play |
Stays on your device
The following data is stored only on your device. It is not sent to us or to our providers, and it is removed when you uninstall the app:
- Health and fitness information you enter during onboarding: age, sex, height, current and goal weight, main goal, activity level, keto experience and food preferences.
- Your nutrition targets, meal plans and daily food, water and activity logs.
- Name or nickname you choose to enter (optional).
- Settings such as measurement units, your acknowledgement of the health note and plan disclaimer, ad frequency counters, your consent choices for ads (stored on the device by Google's consent tool and read by the app) and the downloaded recipe and food catalog.
What we do not collect
The app does not request access to your location, contacts, camera, microphone, photos, Apple Health or Health Connect. We do not receive your payment card details.
Is providing data required?
The account identifier, the installation ID, crash reports and analytics are part of how the app works and are created when you use it. Notifications and tracking are optional: you can refuse them and keep using every feature. The answers you give in onboarding are needed to calculate your targets and plan, but they stay on your device.
5. How we collect data
- Directly from you: what you type or choose in onboarding and in your logs (stored on your device), and your answers to the notification, tracking and consent prompts.
- Automatically: the Firebase, Google Mobile Ads and RevenueCat software in the app sends the identifiers, events, diagnostics and advertising data listed in section 4 while you use the app; your device creates a push token after you allow notifications.
- From other sources: Apple and Google Play report your purchases through RevenueCat; Google's consent tool records the choices you make in its form; iOS tells the app whether you allowed tracking.
6. How we use data
We use personal data to:
- provide the app: create the anonymous identifier, download the recipe and food catalog, load remote settings and check whether Premium is active;
- send notifications you allowed, such as reminders about your plan;
- process and restore purchases and answer billing questions;
- keep the app working by finding and fixing crashes;
- understand how the app is used so we can improve it;
- keep the service secure and prevent abuse (App Check);
- show ads in the free version and measure them, personalized only as described in section 11;
- answer your emails and requests and meet legal obligations.
We do not use your health and body information for advertising or analytics, and we do not create profiles about you beyond the ad personalization by Google (AdMob) described in section 11.
7. Legal bases
If the GDPR, the UK GDPR or Turkish Law No. 6698 (KVKK) applies to you, we rely on these legal bases:
| Purpose | Data | Legal basis (GDPR / UK GDPR) | KVKK (art. 5) |
|---|---|---|---|
| Providing the app, catalog download and Premium | Account identifier, installation ID, purchase and subscription status | Contract: we need this to provide the service you asked for (art. 6(1)(b)) | Performance of a contract (5/2-c) |
| Notifications you allowed | Push token | Contract (art. 6(1)(b)); the system permission is your choice | Performance of a contract (5/2-c) |
| Security and abuse prevention | Other diagnostics, installation ID | Legitimate interests in keeping the service secure and preventing abuse (art. 6(1)(f)) | Legitimate interest (5/2-f) |
| Crash reports | Crash reports, account identifier | Legitimate interests in keeping the app stable (art. 6(1)(f)); you can object | Legitimate interest (5/2-f) |
| Analytics | App usage and interactions, installation ID, advertising ID on Android | Legitimate interests in understanding aggregate usage (art. 6(1)(f)); you can object | Legitimate interest (5/2-f) |
| Personalized ads and ad measurement | Advertising identifier, advertising data, approximate location | Consent (art. 6(1)(a)) given in Google's consent form and, on iOS, in Apple's tracking prompt; you can withdraw it at any time in Profile > Ad privacy or in iOS Settings without affecting earlier processing | Explicit consent (5/1). On iOS this is your answer to Apple's tracking prompt. On Android the app does not yet show a separate consent step for users in Türkiye; you can stop personalized ads at any time in your device's ad settings (section 11). |
| Non-personalized ads in the free version | Advertising data, approximate location | Legitimate interests in funding the free version (art. 6(1)(f)); where storing or reading information on your device needs consent, the choice you make in Google's consent form | Legitimate interest (5/2-f) |
| Purchase records and legal requests | Purchase and subscription status, your emails | Legal obligation, such as tax and accounting rules (art. 6(1)(c)) | Legal obligation (5/2-ç) |
Where the law requires consent before information is stored on or read from your device for advertising, Google's consent form asks for it before the advertising SDK starts. Firebase Analytics and Crashlytics run without a separate consent step; for them we rely on legitimate interests, and you can object by writing to zeyrekseyfican@gmail.com.
8. Device permissions
The app asks only for the permissions below. Ordinary install-time permissions (internet access, network state, billing and, on Android, the advertising ID permission) need no prompt.
Notifications (Android notification permission, iOS notifications)
Why we ask: to send reminders about your plan and updates about the app through Firebase Cloud Messaging (and Apple's push service on iOS). The app asks during onboarding, and Profile > Notifications takes you to the setting. What we do not do: notifications are not required to use the app, and the app does not read notifications from other apps. Stored or sent: If you allow notifications, a push token identifies your device to the push service so we can reach you. The token is stored in our Firebase database under your account identifier, with the platform and the time of the last update. How to turn it off: on Android, Settings > Apps > Ketogo > Notifications; on iOS, Settings > Notifications > Ketogo.
Tracking (iOS App Tracking Transparency)
Why we ask: Apple requires apps to ask before they let ad partners use the advertising identifier (IDFA) to track you across apps and websites owned by other companies. We ask so Google (AdMob) can show you personalized ads in the free version and measure them. What we do not do: your answer does not change which features you can use or whether you can buy Premium. If you do not allow tracking, ads are not personalized and the IDFA is not used for tracking. Stored or sent: iOS stores your answer. If you allow tracking, the IDFA is sent to Google (AdMob) with ad requests and to Google (Firebase) with analytics events. How to turn it off: Settings > Privacy & Security > Tracking, then switch Ketogo off (or turn off "Allow Apps to Request to Track").
9. Health and wellness data
During onboarding Ketogo asks for your age, sex, height, current and goal weight, main goal, activity level, keto experience and food preferences, and you can log food, water and activity. The app uses these answers on your device to calculate your nutrition targets and build your meal plan.
Your health and body information stays on your device; we do not use it for advertising and we do not sell it. It is not included in analytics events or crash reports. Because it is stored only on your device, uninstalling the app removes it and we cannot restore it.
The app is a wellness tool, not a medical device. It does not diagnose, treat or prevent any condition. The health note you confirm in the app and our Terms of use explain the limits of the information it shows.
Consumer health data (United States)
We do not receive the health information you enter, so we do not collect, share or sell consumer health data within the meaning of Washington's My Health My Data Act or Nevada's consumer health data law.
10. Who receives data
Service providers
These providers process data for us under contracts that limit their use of it:
| Recipient | What it does for us | Data |
|---|---|---|
| Google (Firebase) | Anonymous sign-in, a database for push tokens, delivery of the recipe and food catalog (Cloud Functions and Cloud Storage), analytics, crash reports, remote settings, App Check and Cloud Messaging | Account identifier, installation ID, push token, advertising ID where available, app usage events, crash reports, attestation tokens, IP address |
| RevenueCat | Checks and stores the status of your subscription | Account identifier, purchase and subscription status, device and app information, IP address |
Independent services
These companies decide how they use the data they receive, under their own privacy policies:
- Google (AdMob) serves and measures the ads in the free version and runs Google's User Messaging Platform consent form. It receives the advertising identifier when permitted, advertising data, consent signals, device information and your IP address (from which it estimates your approximate location). Google uses this data as described in its own privacy policy and partner policies.
- Apple processes App Store purchases, delivers notifications on iOS, provides App Attest and shows the tracking prompt.
- Google Play processes Google Play purchases, provides Play Integrity and shows the in-app review prompt.
Legal and corporate
We disclose data to authorities when the law requires it, and when needed to protect our rights or the safety of others. If the app is transferred to another owner, your data goes with it and this policy continues to apply until you are told otherwise.
Sale and sharing
We do not sell personal information for money. When ads are personalized, Google (AdMob) uses your advertising identifier and advertising data to show ads based on your activity in other companies' apps and websites. Some US state laws call this "sharing" or "targeted advertising" (section 17).
11. Advertising and tracking
The free version shows ads served by Google (AdMob); Premium subscribers do not see ads. The ads are full-screen ads between screens, rewarded videos you can choose to watch to open a locked meal or recipe, and native ads in recipe lists. For Premium subscribers the advertising SDK is not started.
An ad request carries device and app information, your IP address, the consent signals from Google's form and, only where permitted, your advertising identifier.
Order of the consent steps
After the onboarding questions and the health note, and before the subscription offer, the app shows a holding screen while it runs two steps in this order: first Google's consent step, then, on iOS, Apple's tracking prompt. The advertising SDK starts only after these steps. Subscribers skip them.
Google's consent form (EEA, UK and other regions)
In the European Economic Area, the United Kingdom and other places where Google requires it, Google's consent form asks for your choices before the advertising SDK starts, and you can change them later in Profile > Ad privacy. The form is Google's User Messaging Platform and follows the IAB Transparency and Consent Framework. If your choices do not allow ads to be requested, the app does not start the advertising SDK. The Ad privacy row in Profile appears when Google reports that privacy options are required for you.
Apple's tracking prompt (iOS)
On iOS we ask for permission to track once, after the onboarding questions and the health note and before the subscription offer, and only after Google's consent step. If you close the app before answering, the prompt appears on a later app start; once you have answered, iOS does not show it again.
In regions where Google's consent form applies, Apple's prompt appears only if you agreed in that form to storing information on your device and to personalized advertising. If you did not, the prompt is not shown and ads are not personalized.
On iOS, if you do not allow tracking, ads are not personalized and your device's advertising identifier (IDFA) is not used for tracking. The same applies when tracking is restricted on your device or the prompt was not shown.
"Tracking" here means that Google (AdMob) links your advertising identifier and your ad interactions with data from other companies' apps and websites to personalize and measure ads. The data used for tracking is your device identifier (IDFA) and advertising data. You can change your choice at any time in Settings > Privacy & Security > Tracking.
Android
Android has no tracking prompt. Outside the regions where Google's consent form applies, ads may be personalized using your Android advertising ID. You can stop this by deleting your advertising ID or opting out of ads personalization in your device settings (on most devices Settings > Google > Ads, or Settings > Privacy > Ads). In regions where Google's consent form applies, your choices in the form decide.
Age
The app is for adults aged 18 and over. We do not knowingly show personalized ads to anyone younger.
12. International transfers
We are based in Türkiye. Google (Firebase), Google (AdMob), RevenueCat, Apple and Google Play process data in the United States and in other countries where they or their sub-processors operate. Our Cloud Functions run in the United States.
For data of users in the EEA we rely on the European Commission's standard contractual clauses in the providers' data processing terms and, for Google, on its certification under the EU-U.S. Data Privacy Framework. For users in the UK we rely on the UK International Data Transfer Addendum or the UK Extension to the Data Privacy Framework. Transfers of data of users in Türkiye rely on one of the conditions in article 9 of Law No. 6698. You can ask for a copy of the safeguards at zeyrekseyfican@gmail.com.
13. Retention
| Data | How long | What triggers deletion |
|---|---|---|
| Account identifier | Until you ask us to delete your data | Your deletion request (section 14) |
| Push token | Until you ask us to delete your data; a new record is added when your device's token changes | Your deletion request |
| Installation ID, app usage events, advertising ID in analytics | For the period Google (Firebase) sets in its own retention settings; we have not shortened it | Automatic expiry at Google |
| Crash reports | For the period Google (Firebase) sets in its own retention settings; we have not shortened it | Automatic expiry at Google |
| Other diagnostics | For the period Google (Firebase), Apple and Google Play set; we have not shortened it | Automatic expiry |
| Advertising data and approximate location | For the period Google (AdMob) sets under its own policies | Google's retention rules |
| Purchase and subscription status | As long as your subscription history is needed for Premium and billing questions, and as long as tax and accounting law requires; store purchase records stay with Apple or Google under their rules | Your deletion request, subject to legal record-keeping |
| Data stored only on your device | Stored only on your device until you remove the app | Uninstalling the app |
| Your emails to us | As long as needed to handle your request and any follow-up | End of the request, or legal limitation periods |
Deleted data can remain in encrypted backups and logs for a limited time until they are overwritten.
14. Account and data deletion
The app creates an anonymous account identifier when you first open it; it is not tied to your name unless you add one. A name or nickname you enter stays on your device and is not sent to us.
The app does not yet offer an in-app option to delete your account identifier; you can ask us to delete it by email. Write to zeyrekseyfican@gmail.com with the subject "Delete my data". Because the identifier is anonymous and not shown in the app, tell us your platform (iOS or Android), the approximate date you installed the app and, if you subscribed, the order or transaction ID from your App Store or Google Play receipt, so we can find your records.
When we delete your data we remove:
- the anonymous identifier in Firebase Authentication;
- the push token records stored under it;
- your customer record at RevenueCat.
We also ask Google to delete analytics data linked to the identifier where Google's tools allow it. Crash reports and diagnostics expire under the retention periods in section 13. Apple and Google keep their own purchase records under their rules, and we keep billing records as long as tax and accounting law requires. We complete deletion within 30 days of confirming your request.
Uninstalling the app removes the data stored on your device, but it does not delete the data held by us or our providers and it does not cancel a subscription. Subscriptions renew automatically until you cancel in your App Store or Google Play account settings.
15. Your rights and choices
Depending on where you live, you can:
- ask whether we hold data about you and get a copy;
- correct inaccurate data;
- ask us to delete data;
- restrict or object to processing, including processing based on legitimate interests such as analytics;
- receive data you gave us in a portable format;
- withdraw consent at any time, without affecting processing before the withdrawal;
- complain to us or to a data protection authority.
Choices in the app and on your device:
- Notifications: turn them off in your device settings.
- Tracking on iOS: Settings > Privacy & Security > Tracking.
- Ad consent in regions where Google's form applies: Profile > Ad privacy.
- Advertising ID on Android: delete it or opt out of ads personalization in your device settings.
To use a right, write to zeyrekseyfican@gmail.com. We may ask for information that helps us find your records and confirm the request is yours. We answer within one month in the EEA and UK, within 45 days in US states and within 30 days in Türkiye; where the law allows an extension, we tell you why. If we refuse a request you can appeal by replying to our message; we answer within the period the law sets. You can use an authorised agent where the law allows it; we may ask the agent for proof of authority. We do not treat you differently for using your rights.
If the data protection law where you live gives you other rights, such as access, correction, deletion or objection, we honour them. Write to us and tell us where you live; we answer within the time your law sets.
When you email us, we use your email address and message only to handle your request.
16. Additional information for the EEA and UK
The controller is named in section 2. Under the GDPR and the UK GDPR (with the UK Data Protection Act 2018) you have the right of access (art. 15), rectification (art. 16), erasure (art. 17), restriction (art. 18), data portability (art. 20) and objection (art. 21), and the right not to be subject to a decision based solely on automated processing with legal or similarly significant effects (art. 22). We do not make such decisions: the meal plan and targets are calculated on your device and have no legal effect.
You can withdraw consent at any time as easily as you gave it, in Profile > Ad privacy or in iOS Settings > Privacy & Security > Tracking. You can object at any time to processing based on legitimate interests and to any direct marketing.
You have the right to complain to the supervisory authority in the EEA country where you live or work or where an infringement took place. In the UK you can complain to us first; we acknowledge a complaint within 30 days and investigate it without undue delay. You can also complain to the Information Commissioner's Office.
The account identifier and the installation ID are needed to provide the app; without them it cannot download content or check Premium. Giving consent to personalized ads is optional.
17. Additional information for US residents
These rights apply to all US residents, including residents of California and other states with consumer privacy laws.
Categories of personal information (last 12 months)
| Category (California) | Examples | Source | Purpose | Disclosed to | Sold or shared |
|---|---|---|---|---|---|
| Identifiers | Account identifier, installation ID, push token, advertising identifier | Your device and the software in the app | App features, analytics, security, advertising | Service providers: Google (Firebase), RevenueCat; third party: Google (AdMob) | Shared: advertising identifier with Google (AdMob) when ads are personalized |
| Commercial information | Purchase and subscription status | Apple, Google Play, RevenueCat | Premium, billing | RevenueCat, Apple, Google Play | No |
| Internet or other electronic network activity | App usage events, crash reports, diagnostics, advertising data | The software in the app | Analytics, stability, security, advertising | Google (Firebase); Google (AdMob) for advertising data | Shared: advertising data with Google (AdMob) when ads are personalized |
| Geolocation data | Approximate location estimated from the IP address | Google (AdMob) | Advertising | Google (AdMob) | Shared when ads are personalized |
We do not collect sensitive personal information. Health information you enter stays on your device. Retention periods are in section 13.
Sale and sharing
We do not sell personal information for money. When ads are personalized, we share identifiers, advertising data and approximate location with Google (AdMob) for cross-context behavioral advertising (targeted advertising). We have no actual knowledge of selling or sharing personal information of anyone under 16; the app is for people aged 18 and over.
You can opt out of this sharing at any time: on iOS, do not allow tracking or switch it off in Settings > Privacy & Security > Tracking; on Android, delete your advertising ID or opt out of ads personalization in your device settings. Where Google shows privacy options for your state, you can also use Profile > Ad privacy.
Your rights
You have the right to know what personal information we collect, use and disclose, to get a copy, to delete it, to correct it, to opt out of sale, sharing and targeted advertising, and not to be discriminated against for using these rights. Send requests to zeyrekseyfican@gmail.com; we verify requests as described in section 15, accept requests from authorised agents and offer the appeal described there.
18. Additional information for Türkiye
The data controller under Law No. 6698 on the Protection of Personal Data (KVKK) is Seyfi Can Zeyrek, named in section 2. The information notice under article 10 of the law is a separate document: https://ketoeggo.morrowline.app/en/kvkk/. Under article 11 you can learn whether your data is processed, request information, learn the purpose and the recipients in Türkiye and abroad, ask for correction or deletion, object to results of solely automated analysis and claim compensation for unlawful processing. Send applications to zeyrekseyfican@gmail.com; we answer within 30 days.
19. Children
The app is for people aged 18 and over. In onboarding you confirm the health note with the button "I understand and I'm 18 or older". The app is not directed to children, and we do not knowingly collect personal data from anyone under 18. If we learn that we hold such data, we delete it. Parents or guardians who believe a child has used the app can write to zeyrekseyfican@gmail.com.
20. Security
We use these safeguards to protect data:
- data travels to Firebase, Google (AdMob) and RevenueCat over encrypted connections;
- database rules allow each anonymous identifier to read and write only its own records, and the catalog storage cannot be accessed directly by apps;
- catalog requests require a signed-in identifier, and Firebase App Check with Apple App Attest or Google Play Integrity helps block requests that do not come from the genuine app;
- data stored on your device is kept in the app's private storage, protected by your device's operating system; it is not separately encrypted by the app, so keep your device locked.
No system is perfectly secure. If a breach affects your personal data, we notify you and the authorities as the law requires.
21. Changes to this policy
We update this policy when the app or the law changes. We change the "Last updated" date at the top and, for material changes (new data, new recipients or new purposes), we tell you in the app or in the store listing before the change applies. If a change needs your consent, we ask for it again. Earlier versions are available on request.
22. Contact
Seyfi Can Zeyrek (trading as Morrowline Apps) Esenyali Mahallesi 52/75 Sk. Izmir/Türkiye Email: zeyrekseyfican@gmail.com Website: https://ketoeggo.morrowline.app/
We answer privacy requests within the periods in section 15. This contact information is also our trader identification for consumers in the European Union. You can also contact your local data protection authority. Applications under KVKK go to the email address above.
