Privacy Policy
Antren is a scheduling app for personal trainers and their trainees: trainers open hours, trainees book them or join a waitlist for full ones (web at app.antren.app, plus iOS and Android apps). This policy explains what personal data we process, why, and your rights. It is issued under Türkiye's Personal Data Protection Law No. 6698 (KVKK) and, for people in the European Union and the United Kingdom, the GDPR / UK GDPR; the relevant sections are written to satisfy both. Where the Turkish and English texts differ, the Turkish text prevails for users in Türkiye.
1. Who we are
Mehmet Kunter Barlak (sole proprietorship)
Istanbul, Türkiye
Email: info@antren.app
2. Data we process
- Email address: your account, sign-in codes and notification emails.
- Name: shown in calendars and notifications. A trainer may also add a trainee by a name of their choosing.
- Optional profile: photo, birth year, gender. All optional and removable.
- Trainers only, optional: phone number and training location, shown to their trainees.
- Calendar data: hours, bookings, cancellations, waitlist entries, daily limits.
- Invites: the invited email address and who invited them.
- App data: language preference and a push notification token for your device.
- Technical records: sign-in times and a log of notifications sent, for security and support.
We do not collect passwords (sign-in is a one-time code sent to your email), location, contacts or advertising identifiers. There are no ads and no third-party tracking in the app. We do not sell your data.
3. Why, and on what legal basis
- Providing the service (account, calendar, bookings, waitlist, notifications, paid subscription): necessary to perform our contract with you (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
- Security and abuse prevention (sign-in attempt limits, technical records): our legitimate interest in keeping accounts and the service secure (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)). These records are used for nothing else.
- Legal obligations (requests from authorities, invoicing and accounting records): legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)).
- Optional profile details (photo, birth year, gender): your consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)). You enter them yourself and can remove them, and withdraw consent, at any time; withdrawal does not affect earlier processing.
4. Service providers and international transfers
We use these providers, which process data only on our behalf: Fly.io (servers and database, Frankfurt, Germany), Resend (email delivery, USA), Expo / 650 Industries (push notification delivery, USA), Apple and Google (push notifications and app distribution, USA), Cloudflare (DNS, website, email forwarding, global). Your data is stored inside the European Union (Frankfurt). For users in Türkiye, transfers abroad follow KVKK Art. 9 (standard contractual safeguards or your explicit consent).
For users in the EU and the UK: transfers to our US providers (Resend, Expo, Apple, Google) rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses (GDPR Art. 46). Because the controller is in Türkiye, access to your data from Türkiye is also a transfer; it happens only to the extent necessary to perform our contract with you (GDPR Art. 49(1)(b)). You can ask for a copy of the safeguards at info@antren.app.
Within the service, trainers see their trainees' names, emails and bookings; trainees see their trainer's name, location and, if provided, phone number. Trainees do not see who else holds an hour.
5. Retention and deletion
We keep your data while your account exists. You can delete your account yourself in the app under Settings (Profile for trainees) → Delete account; if you cannot sign in, email info@antren.app from the address on your account. Your personal data is then deleted or anonymised (past session records stay, no longer linked to you); records we must keep by law (if any) are kept only for the required period. Sign-in codes expire after 15 minutes; used or expired codes are deleted within a day. Sign-in times and the log of notifications sent are kept for at most 12 months. Subscription invoices are kept for as long as tax law requires.
6. Your rights
You may ask whether we process your data, get a copy, have it corrected or deleted, learn who it was shared with, and object to decisions made solely by automated means (KVKK Art. 11).
If you are in the EU or the UK, you also have the GDPR / UK GDPR rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection to processing based on legitimate interest (Art. 21) and withdrawal of consent at any time. You may also lodge a complaint with the data protection authority of the country where you live; in the UK that is the ICO (ico.org.uk). In Türkiye the authority is the Personal Data Protection Board (KVKK).
Write to info@antren.app from the address on your account; we answer within 30 days (one month under the GDPR), free of charge. We do not make automated decisions about you or profile you.
7. Children
In Türkiye, people under 18 use Antren with the knowledge and consent of a parent or legal guardian. In the European Union you must be at least 16 (or the lower age set by your member state), and in the United Kingdom and elsewhere at least 13, or have a parent's consent, to use Antren. We do not knowingly collect data from children below these ages; if we learn of such an account, we delete it. Minors' data is processed only for scheduling, as described here.
7a. Residents of the United States
We do not sell your personal information, share it for advertising, or use it for targeted advertising, so no "do not sell or share" choice is needed. You can exercise the rights that state privacy laws (for example California's CCPA/CPRA) give you, to access, correct and delete your data and not to be discriminated against for doing so, by writing to info@antren.app from the address on your account, which is how we verify your identity.
8. Security
All connections use HTTPS. Sign-in codes are stored hashed, with limits on attempts and requests. Profile photos are served from unguessable addresses.
9. Changes
When we change this policy we update the date above and tell you about significant changes in the app or by email.