Kefelon
Start a project
Dopa

Dopa

Privacy Policy

Last updated: 7 October 2026

This Privacy Policy explains what information the Dopa mobile app ("Dopa", "the app", "we") processes, why, who receives it, how long it is kept and what rights you have. It applies to Dopa for iOS and Android.

Data controller: Onur Emre Karadağ, trading as Kefelon, Istanbul, Türkiye · E-mail: privacy@kefelon.com. For the purposes of Türkiye's Personal Data Protection Law No. 6698 (KVKK) and the EU/UK General Data Protection Regulation (GDPR), the data controller is Onur Emre Karadağ.

1. The short version

  • Dopa has no account system. Most of what you enter stays on your device.
  • Without your permission, Dopa's daily suggestions are general: only your four in-app levels and your app language are sent to our AI service, which uses OpenAI. With your permission, to personalize suggestions and to autofill tasks, Dopa also sends part of your profile, your mood and the text of your tasks. Your name and exact date of birth are never sent (section 4).
  • Your journal stays on your device. A journal entry is sent only if you are a Premium user and tap AI comment on that entry, with your permission; it is not stored on our servers (section 4).
  • Dopa sends usage statistics and crash reports to Google Firebase (section 5).
  • Subscriptions are handled by Apple or Google and managed with RevenueCat (section 6).
  • Dopa shows no ads. We do not sell your data and do not use it for advertising.

2. Data stored on your device

  • Profile (from onboarding and settings): name, gender, date of birth, activity level, sleep duration, social preference, stress level
  • Activity: tasks you create and complete, their scores, mood selections and mood history, level history, streaks, breathing sessions, AI suggestion history
  • Journal: the entries you write
  • Settings: notification times, theme, home screen and journal lock preferences

This data is kept in the app's private storage. Dopa does not add its own encryption layer; the data is protected by your device's built-in encryption and screen lock. The journal lock is an access lock that asks for your device authentication before showing the journal.

Device backups: your device's own backup includes Dopa's data — on Android, Google's automatic app backup and device-to-device transfer; on iOS, iCloud and computer backups. These backups are handled by Google or Apple under their policies.

Export: if you use Settings → Backup to export your data, Dopa creates a readable file containing your profile, activity and journal and saves it wherever you choose. Keep that file safe; anyone who has it can read it.

3. How we use your data

  • To provide the app: tracking your tasks, mood, levels, streaks and journal
  • To personalize your daily task suggestions and autofill scores with AI (section 4)
  • To write an AI comment on a journal entry when you ask for one (section 4)
  • To understand how the app is used and to fix crashes (section 5)
  • To manage your subscription (section 6)
  • To answer your support messages (section 7)

Dopa uses your profile and recent activity to tailor suggestions automatically. This has no legal or similarly significant effect on you.

4. AI features (OpenAI)

Dopa's AI suggestions and AI autofill are provided by OpenAI, L.L.C. (USA). Requests go from the app to our backend, hosted by Supabase, which forwards them to OpenAI and returns the result.

Your permission comes first. Before Dopa sends any personal data to OpenAI, the app explains what will be sent and asks for your permission — separately for personal suggestions and autofill, and for journal AI comments. If you decline, the app keeps working: you get general suggestions, and autofill and journal comments stay off. You can turn either permission off at any time in Settings → AI features; sending stops right away.

When data is sent:

  • Daily suggestions: the app requests new suggestions automatically when you open the home screen for the first time each day. Without your permission these are general suggestions, and only your four in-app levels (scores from 0 to 100) and your app language are sent.
  • Autofill: only when you tap Autofill while adding a task.
  • Journal AI comment (Premium): only when you tap AI comment on a journal entry.

What is sent to OpenAI for personal suggestions and autofill (with your permission): your age (calculated from your birth year), gender, activity level, sleep duration, social preference, stress level, your current four levels, today's mood, your app language, and task text — for suggestions, the titles of up to 50 current, completed and previously suggested tasks; for autofill, the task you typed (up to 200 characters) and the titles and scores of your last 20 AI-scored tasks. Text you type into a task is sent as written, so avoid putting personal details about yourself or others in task titles. Autofill text is also checked by OpenAI's moderation service.

For a journal AI comment, only this is sent: the text of that one entry, your mood for that day and your app language. The entry is also checked by OpenAI's moderation service so that the reply can be gentle and point to support if the entry suggests you may be at risk. Our backend does not store the entry or the comment and does not write them to its logs; the comment is saved only on your device, together with the entry.

What is never sent: your name, your exact date of birth, and any journal entry you did not ask an AI comment for.

What our backend receives in addition: your random subscription ID (to check whether you have Premium) and your IP address (to limit abuse). Neither is passed to OpenAI, and no identifier is attached to what we send to OpenAI.

According to OpenAI's API terms, data sent through the API is not used to train OpenAI's models and may be kept by OpenAI for up to 30 days to detect abuse. See OpenAI's privacy policy.

5. Usage statistics and crash reports (Google Firebase)

Why: to understand which features are used, to improve the app and to find and fix crashes.

Dopa uses Firebase Analytics and Firebase Crashlytics by Google LLC. They receive:

  • Identifiers: a random Firebase app-instance ID and your random subscription ID from RevenueCat (used to connect statistics with subscription status); on Android, your device's advertising ID unless you have deleted it; on iOS, the identifier for vendor. Dopa does not access the iOS advertising identifier (IDFA).
  • App events: screens viewed; onboarding completed; that a mood was selected (not which mood); tasks created and completed with their four level scores; journal saved (the length only — never the text); breathing sessions; notification time changes; streak milestones; subscription screens and purchases. Versions before 2.6.1 also sent your questionnaire answers (gender, activity level, sleep, social preference, stress level) and the selected mood as coded values; from version 2.6.1 these are no longer sent to Firebase.
  • Device information: device model, operating system, app version, language and country or region (derived from your IP address).
  • Crash reports: the error, a code trace and the app state at the time.

Firebase keeps event-level analytics data for at most 14 months and crash reports for 90 days. These statistics are not used for advertising. Current versions do not have an in-app switch to turn them off; see section 11.

6. Subscriptions (RevenueCat, Apple, Google)

Dopa Premium is sold through the Apple App Store or Google Play; we never see your payment details. RevenueCat, Inc. (USA) manages subscription status. It receives a random app user ID, your purchase history and device information. See RevenueCat's privacy policy.

7. Support messages (Supabase, Resend)

If you send feedback from the app's Help screen, your subject and message, your device brand and model, operating system, app version and Premium status are stored in our Supabase database and delivered to us by e-mail through Resend (USA). If you write to us by e-mail, we receive your e-mail address and message. We keep support messages only as long as needed to handle them, and delete them on request.

8. What our backend stores

Our backend on Supabase stores:

  • support messages, as described in section 7;
  • your IP address or your random subscription ID and which AI feature you used, to limit abuse — deleted automatically within a day;
  • short technical logs, for example the first characters of an autofill task and the resulting scores, kept for a limited period by our hosting provider to diagnose errors.

It does not store your profile, your task list, your mood history, your journal entries or AI comments on them.

9. Sensitive information

Some information you enter — such as mood, stress level, sleep duration and journal entries — may be treated as health-related or otherwise sensitive data under some laws. Dopa uses it only to provide the app's features as described above, and sends it to AI only with your explicit permission (section 4). We do not use it for advertising and we do not sell it. Dopa is not a medical app (see the Terms).

10. Legal bases

  • Providing the app: performance of our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c))
  • AI features (suggestions, autofill and journal AI comments): your explicit consent, which you can withdraw at any time in Settings → AI features (GDPR Art. 6(1)(a) and, for health-related information, Art. 9(2)(a); KVKK Art. 5(1) and Art. 6). Withdrawing does not affect processing that happened before.
  • Usage statistics, crash reports, abuse prevention and support: our legitimate interest in running, securing and improving Dopa (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f))
  • Subscriptions: performance of the contract and compliance with legal obligations

11. Your choices and rights

  • On your device: you can view and change your profile and delete tasks and journal entries (including their AI comments) in the app.
  • AI permissions: turn task suggestions and autofill, or journal AI comments, off at any time in Settings → AI features. Uninstalling Dopa removes its data from the device; copies may remain in your device backups and in exported files until you delete them.
  • Advertising ID: on Android you can delete it in Settings → Google → Ads (or Settings → Privacy → Ads).
  • Server-side data: ask us to delete your support messages at any time. Analytics records are linked only to random identifiers and expire after the periods in section 5.

Depending on where you live, you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to data portability, and to withdraw any consent you gave. In Türkiye these rights are set out in Article 11 of the KVKK. Send requests to privacy@kefelon.com; we answer within 30 days. Because most server-side data is linked only to random identifiers and not to your name or e-mail, we may not be able to find records that belong to you; we will tell you what we can and cannot do.

You also have the right to complain to a data protection authority: in Türkiye the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, kvkk.gov.tr), in the EU/UK the authority of your country.

12. International transfers

OpenAI, Google, RevenueCat and Resend process data in the United States; Supabase hosts our backend in the cloud. These transfers are necessary to provide Dopa's features and rely on the providers' data processing terms, including standard contractual clauses.

13. Security

Data sent by the app travels over encrypted connections (HTTPS). We send only what each feature needs and keep server-side data to a minimum.

14. Children

Dopa is not intended for children under 13 (or the higher age of digital consent that applies in your country), and we do not knowingly collect personal data from them. If you believe a child has provided personal data, contact us and we will help remove it.

15. Changes

We may update this policy when the app changes. The date at the top shows the latest version; material changes are announced in the app's release notes.

16. Contact

Kefelon · Onur Emre Karadağ, Istanbul, Türkiye E-mail: privacy@kefelon.com