Who we are
The My Tree service (the servers that store trees, messages and reports) and the website decomytree.link are run by Ercaap Mobile App Yazılım Teknolojileri Limited Şirketi (“we”, “us”), the data controller for them:
- Ercaap Mobile App Yazılım Teknolojileri Limited Şirketi
- Email: mytreeapplink@gmail.com
- Phone: +90 552 258 8648
The Android app is published on Google Play by Ömer Ercan and the iOS app on the App Store by Savaş Ercan. Each publisher is responsible for their app and for purchases made in it; both apps keep trees and messages in our service. You can reach all of us at the address above, in English or Turkish, about anything in this policy.
What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Your tree: its name (up to 30 characters), type (Christmas, birthday or Valentine’s), opening day, the artwork you picked, its share code and when it was created or changed | To create, show and share your tree and to open its messages on the right day | Performing our contract with you (GDPR art. 6(1)(b); KVKK art. 5(2)(c)) |
| Birthday trees: only the day and month of your birthday, saved as the date the tree opens. We never ask for your birth year | To open the messages on your birthday | Performing our contract with you |
| Ownership key: a random key kept on your device; our servers store only a one-way hash of it | So only you can read and manage your tree, without an account or password | Performing our contract with you |
| Messages: the gift chosen, the message (up to 500 characters), the name the sender typed, whether that name is shown to everyone or only to the owner, whether the owner has read it and when it was sent | To deliver the message to the tree owner and show the gift on the tree | Performing our contract with the owner and the sender |
| Sender key: a keyed one-way hash (HMAC) of the sender’s IP address, stored with the message | So a tree owner can block a sender without anyone seeing an IP address | Our legitimate interest in preventing harassment (GDPR art. 6(1)(f); KVKK art. 5(2)(f)) |
| Reports: the tree code, the message reported, the reasons and details given, whether the owner or a visitor reported it and when | To review reports and act on harmful or illegal content | Legal obligations (Law No. 5651; the EU Digital Services Act where it applies) and our legitimate interest in a safe service |
| Traffic log: the action (tree created, message sent, report filed), the tree code and record it concerns, the time and the IP address, which is stored encrypted | Turkish Law No. 5651 requires hosting providers to keep traffic data and to hand it over only to a court or public prosecutor. We keep it for 12 months | Legal obligation (KVKK art. 5(2)(ç)); for users in the EU and UK, our legitimate interest in complying with the law that applies to us and in investigating abuse |
| Request data: IP address, time and basic device and browser details that every request carries; short-lived request counters per IP address | To deliver the service, stop spam and abuse with rate limits and keep it secure | Our legitimate interest in a working, secure service |
| Age check: your birth year and month, asked when you first open the app or, on the web, before you send a message or create a tree | To keep the service for people aged 13 and over (15 and over in Türkiye). Only the result (passed or not) and the version of the terms you accepted are saved, on your device; the year and month are never stored or sent | Legal obligation and our legitimate interest in protecting children |
| Purchases (app only): the product, price, purchase and renewal status, store transaction details, a random app user ID created on your device and basic device details | To sell, renew, restore and check My Tree Pro | Performing our contract with you; legal obligations (tax and accounting records kept by the store) |
| Emails you send us: your email address and what you write | To answer you | Performing our contract with you; our legitimate interest in support |
| Website visits: the page address (without anything after a #), the site you came from, your browser, operating system, device type and the country worked out from your IP address. Our analytics provider Plausible uses no cookies or other identifiers and doesn’t store IP addresses; it tells visits apart with a hash that changes every day | To see, as totals only, which pages people use and to fix problems | Our legitimate interest in running and improving the website (GDPR art. 6(1)(f); KVKK art. 5(2)(f)) |
What we don’t collect: no accounts, passwords, email addresses or phone numbers (unless you write to us), no contacts, location, photos or advertising IDs. You can’t upload images. There are no advertising trackers and no cross-site tracking, the app has no analytics at all, we don’t sell or share personal data for advertising, and we don’t make automated decisions about you.
Notifications: if you allow them, the app can show you notifications. The app doesn’t send us a push token or any other device identifier for this.
Who can see what
- Anyone with a tree’s link or code sees the tree’s name and artwork, how many gifts it has, the gifts on it and the sender names their senders chose to show. Never the text of a message.
- The tree owner sees every message with the name the sender typed, including names hidden from everyone else. The text of a message unlocks on the tree’s opening day.
- The sender sees their own message right after sending it.
- We can access stored data when it’s needed to run the service, review a report or comply with the law.
- Names aren’t checked: senders type whatever name they like. Don’t share anything in a message you wouldn’t want the owner to keep, as they can take screenshots.
Who processes data for us
- Cloudflare, Inc. (USA) hosts the service and the website: servers, database, network security and rate limiting.
- RevenueCat, Inc. (USA) manages My Tree Pro subscriptions for the app.
- Plausible Insights OÜ (Estonia, EU) counts website visits without cookies and keeps the statistics in the EU.
- Google LLC and Google Ireland Ltd. run Google Play: distribution, payments, renewals and refunds. Google also hosts our support mailbox (Gmail).
- Authorities: courts, public prosecutors and police, when the law requires it. We report apparent child sexual exploitation to the relevant authorities and hotlines, such as the US National Center for Missing & Exploited Children (NCMEC).
These providers process data only on our instructions or, for Google Play, under their own terms as the store. We don’t sell personal data.
International transfers
Our providers process data in the United States and other countries, wherever their networks run. For transfers from Türkiye we use the safeguards of KVKK article 9, namely the standard contracts set by the Personal Data Protection Board. For transfers from the EU/EEA and the UK we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum) or on an adequacy decision such as the EU–US Data Privacy Framework where the recipient is certified. You can ask us for a copy of the safeguards.
How long we keep data
| Data | How long |
|---|---|
| Trees and their messages | Until the owner deletes them. A tree with no new messages or changes for 13 months is deleted automatically with all its messages and blocked senders |
| A deleted message or tree | Removed from our database at once |
| Reports | 12 months |
| Traffic log (encrypted IP addresses) | 12 months, as Law No. 5651 requires, even if the tree was deleted earlier |
| Request counters | About one minute |
| Website visit statistics | Totals only, with no personal data, for as long as we use Plausible. The daily hash that tells visits apart is deleted after 24 hours |
| Data on your device | Until you delete it in the app, clear the site data in your browser or uninstall the app |
| Purchases | As long as Google and RevenueCat keep them under their own terms and tax laws |
| Emails to us | Up to 12 months after your question is resolved, unless we need them for a legal claim |
Deleted data can remain in our hosting provider’s automatic recovery history for up to 30 days before it is gone for good.
Your rights
Depending on where you live, you can ask us to tell you whether we hold data about you and give you a copy, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. In Türkiye, KVKK article 11 also lets you learn the purpose of processing and who received your data, ask that third parties be told about a correction or deletion, object to a result reached purely by automated analysis and claim damages for unlawful processing.
- Fastest: in the app, delete a message, block a sender or delete a tree from its menu, or delete everything at Settings → Privacy & Data → Delete all my data. On the web, delete the tree you created on the create page.
- By email: write to mytreeapplink@gmail.com. There are no accounts, so tell us the tree code and enough detail (for a message: the name used, roughly when it was sent and what it said) for us to find the data and check it is yours. We reply free of charge within 30 days.
- Complaints: you can complain to the Turkish Personal Data Protection Authority (kvkk.gov.tr) after contacting us first, to the data protection authority where you live in the EU/EEA, or to the UK Information Commissioner’s Office (ico.org.uk).
- California: we don’t sell or share personal information and don’t track you across sites, so a Do Not Track signal changes nothing here: we treat every visitor as if it were on.
Children
My Tree is for people aged 13 and over (15 and over in Türkiye) and isn’t directed at children under 13. A neutral age question keeps younger children out, and we don’t knowingly collect data from them. If we learn that a child under the minimum age has used My Tree, we delete their data. Parents can contact us at any time.
Security
Everything between your device and our servers travels over HTTPS. Ownership keys are stored only as hashes, IP addresses only as a keyed hash (for blocking) or encrypted (traffic log), and access to the data is limited to the people who run the service. Messages are not end-to-end encrypted: they are stored on our servers so the owner can read them on the opening day, and we can access them when we review a report. No system is perfectly secure; if a breach puts you at risk, we will tell you and the authorities as the law requires.
What is stored on your device
App: your trees’ ownership keys (in the system’s encrypted storage), the list of your trees and the one you picked, the age-check result and the terms version you accepted, your language and theme, the trees you’ve already sent a gift to and your cached subscription status.
Website: in your browser’s local storage, the age-check result, the trees you’ve sent a message to, the tree you created on the web (its code and ownership key) and tips you’ve closed; for the current visit only, a language you picked by hand. Pages follow your device’s language otherwise. Neither our pages nor Plausible set cookies, and these entries are only used for the features you use, so no cookie banner is needed.
Changes to this policy
When we change this policy we update the date at the top. If a change matters for how your data is used, we tell you in the app before it applies.
Contact
Questions or requests: mytreeapplink@gmail.com or +90 552 258 8648. See also our Terms of Use and Community Guidelines.