Privacy Policy
Last updated: 2026-11-02 · Effective date: 2026-11-02
This policy explains what personal data the Mochi Pack app ("Mochi Pack", "the app") processes, why, with whom it is shared, how long it is kept and what rights you have. It applies to the iOS app and to the mochipack.app website.
1. Who we are
Mochi Pack is published by BUBIAPPS Bilgi Teknolojileri Arge Ltd. Şti. ("BubiApps", "we", "us"), Eğribucak Mah. Alkaya Sk. No:9/5, Melikgazi / Kayseri, Türkiye. MERSİS no. 0187151766100001 · Trade registry no. 57312 (Kayseri Chamber of Commerce) · Tax office Mimarsinan, tax ID 1871517661.
We are the data controller (veri sorumlusu) under the Turkish Personal Data Protection Law No. 6698 (KVKK), the EU and UK General Data Protection Regulation (GDPR, UK GDPR) and, where they apply, US state privacy laws such as the California Consumer Privacy Act as amended by the CPRA (CCPA).
Contact for privacy questions and requests: privacy@mochipack.app. General support: support@mochipack.app. Company: info@bubiapps.com.
We have not appointed a data protection officer because the law does not require one for our processing; privacy@mochipack.app reaches the person responsible for data protection. Users in the EU and the UK can contact us directly at the same address. A Turkish notice under KVKK Article 10 (Aydınlatma Metni) is available at https://mochipack.app/kvkk.
2. Summary
- You can use Mochi Pack without creating an account. We do not ask for your name, e-mail address or phone number.
- We do not track you across other companies' apps or websites, we show no ads, we do not use the advertising identifier (IDFA) and we do not access your location.
- AI features run only after you agree in the app. Your trip details are then sent from our servers to our AI providers: Anthropic (lists and suggestions) and Google (trip pictures). Neither uses this data to train its models.
- We do not sell your personal information and do not share it for cross-context behavioral advertising.
- You can export your data and delete your account and all of your data in the app at any time.
3. Data we process
| Category | What | Source | Why |
|---|---|---|---|
| Identifiers | A random user ID created by Firebase Authentication (anonymous by default) and a Firebase installation ID. If you choose Sign in with Apple (offered only after a purchase, for sharing, or on a second device) we receive an Apple user identifier; we request no name and no e-mail address. The same random user ID is used as your RevenueCat customer ID and as the Firebase Analytics user ID. | Created by the app | To run your account, sync your lists, connect your purchases, prevent abuse |
| Trip and list content ("User Content") | Trip titles, destinations (cities you pick), dates, number of nights, traveler labels and age groups (adult, child, infant, pet; optional age), activities, luggage, packing items and their state, notes, to-dos and reminders, templates you save, what you packed or did not use (to improve your future lists) | You | To provide the app: your lists, sync across devices, sharing, reminders |
| Imported content | Text you paste or dictate, and photos or screenshots you choose to import (for example a handwritten list) | You | To turn them into list items with AI (only after AI consent) |
| AI requests | The trip details and text above, as needed for the AI feature you use (list generation, suggestions, "What did I forget?", the Mochi assistant, import, trip pictures) | You | To provide AI features |
| Purchases | Products bought (Yearly, Lifetime, Trip Pass), transaction and renewal status, store country | Apple App Store via RevenueCat | To unlock what you paid for, restore purchases, prevent fraud |
| Usage data | In-app events (for example "list created", "paywall shown"), trip characteristics in grouped form (for example number of nights in ranges, destination country code), app version, device model, OS version, language | The app (Firebase Analytics) | To understand and improve the app |
| Approximate region | Country or region that Google derives from your IP address when the app connects. We never receive your precise location or a city from your device. | Google (Firebase Analytics) | Aggregated statistics |
| Diagnostics | Technical data about app performance and errors | The app (Firebase) | To fix bugs and keep the app stable |
| Advertising attribution | Whether the app was installed from an Apple Ads campaign, and that campaign's identifiers (campaign, ad group, keyword, ad), obtained with Apple's privacy-preserving AdServices token | Apple (AdServices), RevenueCat | To measure our own Apple Ads campaigns |
| App integrity | An Apple App Attest / DeviceCheck attestation | Your device (Firebase App Check) | To make sure requests come from the genuine app and to stop abuse |
| Support | Your e-mail address and the content of your message, if you write to us | You | To answer you |
What we do not collect: your name (a name you may type in the app stays on your device), e-mail address (unless you write to us), contacts, precise or coarse location from your device, the advertising identifier (IDFA), payment card details (Apple handles payment), health or financial data. Voice: dictation uses Apple's on-device speech recognition only; audio is not sent to us or to Apple's servers; only the resulting text is used. Reminders are local notifications scheduled on your device; we do not use push notification tokens.
Our providers' servers receive your device's IP address when the app connects to them; we do not store IP addresses in our database and do not use them to locate you. Google Analytics does not log or store IP addresses.
Please do not enter sensitive information (for example health details) in free text. If you add something like a medicine to your list, we process it only to show, sync and share your list, and send it to an AI provider only when you use an AI feature after giving consent.
4. AI features: Anthropic and Google
AI features are optional. Before the first AI request the app shows a consent screen; nothing is sent to an AI provider until you agree. You can turn AI off at any time in Settings › AI; the app then uses its built-in rules and stops sending AI requests. Withdrawing consent does not affect processing that took place before.
Our backend (Google Cloud Functions) calls the AI providers; the app itself never contacts them, and the providers never receive your name, contacts or user ID.
- Anthropic, PBC (Claude models) writes your lists, suggestions and assistant answers. We send the trip details and the content you type or import that the feature needs. Anthropic acts as our service provider (processor) under its Commercial Terms and Data Processing Addendum and does not train its models on this data. Anthropic deletes API inputs and outputs within 30 days of receipt; content flagged by Anthropic's automated trust-and-safety systems for a possible usage-policy violation may be kept for up to 2 years. Anthropic stores data in the United States and may process requests in other regions where it operates.
- Google LLC (Gemini API, paid service) draws the picture shown on a trip. We send only the destinations (city and country), the month or season, trip types, activities, trip length and how many adults, children, infants and pets are traveling; never names, notes, traveler labels, exact ages or the trip title. Google processes this data as our processor under its data processing terms and does not use it to improve its products; Google keeps prompts and responses for a limited period only to detect and prevent abuse. The picture contains no personal data and may be reused for other trips with the same characteristics.
AI output can be wrong or incomplete. AI never changes your list on its own: apart from your first generated list, AI changes appear as suggestions that you accept or reject. Text and pictures created by AI are machine-generated.
5. Legal bases
| Purpose | GDPR / UK GDPR Art. 6(1) | KVKK Art. 5 |
|---|---|---|
| Providing the app, sync, sharing, reminders, purchases, export and account deletion | (b) contract | 5(2)(c) contract |
| AI features (including sending data to Anthropic and Google) and photo/text import | (a) consent; withdraw any time in Settings | 5(1) explicit consent (açık rıza); withdraw any time in Settings |
| Analytics, diagnostics and Apple Ads attribution | (f) legitimate interest in understanding, fixing and improving the app and measuring our own campaigns | 5(2)(f) legitimate interest |
| Security, abuse and fraud prevention (App Check, AI quotas, logs) | (f) legitimate interest | 5(2)(f) legitimate interest |
| Answering support requests | (b) contract and (f) legitimate interest | 5(2)(c) and 5(2)(f) |
| Complying with legal obligations and defending legal claims | (c) legal obligation, (f) legitimate interest | 5(2)(ç) legal obligation, 5(2)(e) establishing, exercising or defending a right |
Where we rely on legitimate interests, you can object at any time (see §10). Children's ages you enter for packing are trip parameters, not identity data; do not enter children's names or other details in free text.
6. Who receives your data
We share data only with the service providers below, which process it on our behalf and under our instructions (processors). Each is bound by a data processing agreement that requires it to protect personal data at least to the standard described in this policy and to use it only to provide its service to us.
| Provider | Service | Data | Location |
|---|---|---|---|
| Google LLC — Firebase and Google Cloud (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Analytics, App Check, Remote Config, Hosting, Cloud Logging) | Hosting, database, backend, analytics | All categories in §3 | United States (Firestore multi-region nam5, Functions us-central1) |
| Google LLC — Gemini API (paid service) | Trip pictures (AI) | Destinations, month or season, trip types, activities, trip length, traveler counts by age group; only after AI consent | United States and other countries where Google has facilities |
| Anthropic, PBC | Lists, suggestions, assistant (AI) | AI requests; only after AI consent | United States; processing may run in other regions where Anthropic operates |
| RevenueCat, Inc. | Purchase management | Random user ID, purchase data, store country, Apple Ads attribution token | United States |
| Apple Inc. | WeatherKit weather data | Our backend sends only a destination's coordinates and dates, never your identity | United States |
Apple also processes data as an independent controller under its own privacy policy when you buy in the App Store, use Sign in with Apple, or when the app requests Apple Ads attribution. Exchange rates come from the European Central Bank's public reference rates; no personal data is sent.
People you share a trip with: members of a trip you share can see that trip's list, traveler labels and who packed what. If you join someone else's trip, its owner and members see your membership and what you packed in it.
We may also disclose data if the law requires it, to protect the rights, property or safety of our users or others, or as part of a merger, acquisition or sale of assets; in that case we will tell you before your data becomes subject to a different privacy policy.
7. International transfers
We are based in Türkiye and our providers process data in the United States and other countries.
- From the EEA, the UK and Switzerland: we rely on the European Commission's Standard Contractual Clauses (with the UK and Swiss addenda) included in our providers' data processing terms and, where a provider is certified, on the EU–US Data Privacy Framework and its UK and Swiss extensions.
- From Türkiye: we transfer data abroad under Article 9 of KVKK on the basis of standard contracts approved by the Personal Data Protection Board, which are notified to the Personal Data Protection Authority within five business days of signature.
You can ask us for information about these safeguards at privacy@mochipack.app.
8. How long we keep data
| Data | Retention |
|---|---|
| Trips, lists, to-dos, templates, learning data | Until you delete them or your account. Deleted items, trips and to-dos stay in "Recently deleted" for 30 days so you can restore them, then are permanently deleted |
| Imported photos | Deleted automatically 24 hours after upload |
| AI usage counters (daily quota) | 7 days |
| AI request logs (feature, token counts, cost, timing, model; no prompt text) | 13 months, or until you delete your account if earlier |
| Data at Anthropic | Up to 30 days (up to 2 years if flagged; see §4) |
| Data at Google Gemini API | A limited period for abuse monitoring only (see §4) |
| Server logs (Google Cloud Logging) | 30 days |
| Analytics data linked to your user ID | 14 months, then only aggregated reports that do not identify you |
| Purchase status and purchase events | As long as your account exists; deleted with your account. Apple, as the seller, keeps its own transaction records |
| Support e-mails | 2 years after the conversation ends |
We may keep data longer only where the law requires it or to establish, exercise or defend legal claims, and only for as long as needed for that purpose.
9. Deleting your account and data
In the app go to Settings › Account › Delete account. This permanently deletes, from our systems: your trips and everything in them (a trip you shared is also deleted for its members), your membership in other people's trips, your templates and learning data, imported files, AI logs and counters, purchase records, your RevenueCat customer record and finally your login. It cannot be undone. Analytics data linked to your former user ID is no longer connected to an account and expires under §8.
Subscriptions are billed by Apple: deleting your account does not cancel a subscription. Cancel it first in your Apple Account settings (Settings › your name › Subscriptions). If you cannot use the app, e-mail privacy@mochipack.app and we will delete your data.
You can also delete single trips and items at any time, and export your trips in Settings › Your data (JSON or PDF).
10. Your rights
Depending on where you live, you have the right to: access your data and receive a copy; correct it; delete it; restrict processing; object to processing based on legitimate interests; data portability; withdraw consent at any time without affecting earlier processing (turning AI off in Settings withdraws AI consent); and lodge a complaint with a supervisory authority. We do not make decisions with legal or similarly significant effects based solely on automated processing.
To use your rights, write to privacy@mochipack.app. Many rights can be used directly in the app (export, delete, AI switch). To protect your data we may ask you to confirm that the request comes from the account holder, for example by sending it from the app's Help screen or by sharing details only the account holder knows. We answer within 30 days (KVKK and GDPR); we may extend the GDPR period where the law allows and will tell you if so.
EU and UK: you can complain to the data protection authority of your country of residence, work or the place of an alleged infringement (in the UK, the Information Commissioner's Office).
Türkiye (KVKK Art. 11): you may apply to us under the Communiqué on the Procedures and Principles of Application to the Data Controller: in writing to our address in §1, or by e-mail to privacy@mochipack.app. We answer free of charge within 30 days. If your application is rejected or not answered, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). The Turkish notice is at https://mochipack.app/kvkk.
California and other US states: in the last 12 months we collected the following categories of personal information: identifiers; commercial information (purchases); internet or other electronic network activity (usage data and diagnostics); approximate (not precise) geolocation derived by Google from IP addresses; audio, electronic or visual information (photos you import); and other information you provide (trip and list content). Sources and purposes are in §3 and §5, retention in §8. We disclosed these categories for business purposes to the service providers in §6. We do not sell personal information, do not share it for cross-context behavioral advertising, do not process it for targeted advertising or for profiling with legal or similarly significant effects, and do not use or disclose sensitive personal information to infer characteristics about you. We have no actual knowledge of selling or sharing personal information of consumers under 16. You have the right to know, access, correct and delete your personal information, to data portability, and not to be discriminated against for using these rights. You or an authorized agent can contact us at privacy@mochipack.app. If we decline your request, you can appeal by replying to our answer with the subject "Appeal"; we will respond within the time required by your state's law, and if you are not satisfied you can contact your state attorney general.
11. Children
Mochi Pack is rated 13+ in the App Store and is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you are younger than the age at which you can consent to data processing in your country, ask a parent or guardian before turning on AI features. Parents may enter children's age groups as trip travelers; this is the parent's data about their trip. If you believe a child under 13 has given us personal data, contact privacy@mochipack.app and we will delete it.
12. Security
Data is encrypted in transit (TLS) and at rest by our providers. Access to trips is limited to their members by server-side security rules; only our backend can change purchases, AI quotas and logs; AI provider keys exist only on our servers; App Check limits our backend to the genuine app. Access to production systems is limited to the people who need it. No method is completely secure; if a personal data breach affects you, we will notify you and the competent authorities as required by law (for example within 72 hours to the KVKK Board and EU authorities where required).
13. Changes to this policy
We will post changes on this page and update the "Last updated" date. For material changes we will also tell you in the app before they take effect and, where the law requires, ask for your consent again.
14. Contact
BUBIAPPS Bilgi Teknolojileri Arge Ltd. Şti. · Eğribucak Mah. Alkaya Sk. No:9/5, Melikgazi / Kayseri, Türkiye · privacy@mochipack.app · support@mochipack.app · info@bubiapps.com · Phone (WhatsApp): +44 7586 553454