This policy explains what Reduct (“the app”, “we”) collects, why, who else sees it, and how to get rid of it. Reduct is operated by Eymen Demirol (“we”), the data controller for the purposes of the GDPR and of Turkish law no. 6698 on the Protection of Personal Data (KVKK).
| Data | Why | Legal basis |
|---|---|---|
| The text you type describing what you are avoiding | It is the input the app exists to act on. It is sent to our AI provider to generate a micro-task, and stored so the app can build on what you have already done in the session. | Performance of a contract (GDPR Art. 6(1)(b)) |
| An anonymous account identifier — a random UUID created automatically the first time you open the app | To keep your sessions and your free-tier allowance attached to your install, and to connect your subscription. It contains no personal detail and is not linked to your name, email, phone number, or Apple ID. | Performance of a contract (GDPR Art. 6(1)(b)) |
| Generated tasks and your responses (“I did it” / “shrink it”) with their timestamps | So each next task follows on from the last, and to count your free-tier usage. | Performance of a contract (GDPR Art. 6(1)(b)) |
| Subscription status — whether an entitlement is active and when it expires | To unlock the app after the free allowance. We never see or store your card details: payment happens entirely inside Apple's system. | Performance of a contract (GDPR Art. 6(1)(b)) |
| Technical server logs — IP address, request time, error traces | Security, abuse prevention, and diagnosing failures. | Legitimate interests (GDPR Art. 6(1)(f)) in keeping the service running and unabused |
We use the following processors. Each is bound by a data processing agreement and may use the data only to provide their service to us.
| Processor | What they receive | Where |
|---|---|---|
| Supabase — database, anonymous authentication, server functions | Everything in section 1 except subscription status | European Union (Stockholm, eu-north-1) |
| hCaptcha — bot and abuse protection on account creation | Your IP address and the device signals hCaptcha's widget uses to tell a person from a script. Runs once, the first time the app opens on a device (and again if you delete and recreate your account) — not on every later launch. | United States |
| Groq — AI inference, generates the micro-tasks | The text you type, plus the tasks already generated in that session. It is sent for processing only; it is not sent with your identifier attached. | United States |
| RevenueCat — subscription management | Your anonymous account identifier and your subscription status | United States |
| Apple — App Store distribution and payment | Purchase and billing data, under Apple's own privacy policy | Per Apple's terms |
Transfers to processors in the United States are made under the European Commission's Standard Contractual Clauses, and, for KVKK purposes, on the basis of your explicit consent to the transfer as described here, given by using the app.
The tasks and the accompanying sentences in Reduct are generated by a large language model, not written by a person. They are produced automatically from the text you type. The app is designed to be blunt, and generated text can occasionally be wrong, unhelpful, or poorly judged.
This processing produces suggestions only. It has no legal effect on you and does not significantly affect you within the meaning of GDPR Art. 22. You can report a response you consider harmful from Settings → Report a harmful response, and we will review it.
Under the GDPR (Arts. 15–21) and KVKK (Art. 11) you have the right to access your data, to have it corrected, to have it erased, to restrict or object to its processing, to receive it in a portable form, and to withdraw consent where processing is based on consent.
Because Reduct has no login, we cannot identify you from an email alone — so the fastest and most complete route is built into the app:
You may also complain to a supervisory authority — in Türkiye, the Personal Data Protection Authority (KVKK); in the EU/EEA, your national data protection authority.
All traffic between the app and our servers is encrypted with TLS. Data is encrypted at rest by our database provider. Access to production data is restricted to the people who operate the service. Row-level security rules mean one account cannot read or modify another account's records, and the keys for our AI and subscription providers exist only on the server and are never shipped inside the app.
No system is perfectly secure. If a breach affects your rights and freedoms, we will notify the competent authority within 72 hours and, where required, notify affected users.
Reduct is not directed at children. Do not use it if you are under 13, or under the minimum age of digital consent in your country (up to 16 in parts of the EU). We do not knowingly collect data from children; if we learn that we have, we will delete it.
If we change this policy we will update the date at the top of this page. Material changes will be announced in the app before they take effect. The current version always lives at this URL.
Eymen Demirol
demiroleymen@gmail.com