AllBell Privacy Notice

Version 5 · Effective 5 October 2026

This notice explains, under Article 10 of Türkiye's Personal Data Protection Law No. 6698 (KVKK) and Article 13 of the EU General Data Protection Regulation (GDPR), which of your personal data is processed when you use AllBell, why, and how. It is information: it is not an agreement you accept, and it does not ask you for any separate consent.

1. Data controller

AllBell is provided by Şakir Şek, who is the controller of your data. Contact: sakir.sek@gmail.com

Until 5 October 2026 AllBell was called CoWake.

2. Data processed

• Account: the identifier and email address of your Google account; the name shown in the app (taken from your email address at first sign-in, and changeable in Profile).
• Which rules apply to you: a region (Türkiye, EU/EEA/UK or other) inferred from your phone's time zone. It is an estimate, and it is not used to track where you are.
• Device: your phone's make and model, operating system version, time zone, AllBell version, a random identifier the app gives this installation, notification token, and when your phone last connected.
• Events: the name, time, days, snooze setting, alarm sound and participants of the events you set or join; when you joined and left.
• Mornings: whether the alarm is set on your phone; the moments you said you were up, snoozed, the alarm stopped by itself, rang silently, or did not ring at all.
• Agreement and notice records: which version of the Terms of Use you accepted and when; which version of this notice was shown to you and when; when you deleted your account.
• If you write to us: your email address, your message and our correspondence.

Our server does not record your IP address. Cloudflare, which carries the connection, processes it to deliver and protect the traffic. AllBell contains no advertising, analytics or crash-reporting tools. AllBell is not meant for children under 13.

3. Where it comes from

• From you: your name, the events you set, what you do, such as joining, leaving or tapping "I'm up", and what you write to us.
• From your phone: device information, and what the alarm did on the phone (set, rang, rang silently, snoozed, did not ring).
• From Google: your account identifier and email address, when you sign in with Google.

All of it is collected electronically, through the app, its server and email.

4. Purposes and legal bases

• Opening your account, setting up an event, setting the alarm on participants' phones, delivering changes to those phones, showing who got up and keeping History: performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6/1-b).
• Being able to prove who accepted which version of what, and which text was shown to whom: establishing, exercising or protecting a right (KVKK Art. 5/2-e) and legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6/1-f).
• Answering your requests and anything you write to us, and being able to prove that we did: legal obligation (KVKK Art. 5/2-ç and Art. 13; GDPR Art. 6/1-c) and legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6/1-f).
• Deciding which data-protection rules apply to you and protecting the service from abuse: legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6/1-f).

The checks that show phone settings which would stop an alarm ringing ("Make sure your alarm can ring") run on your phone; their results are not sent to us.

AllBell shows no advertising and does not sell your data. It does not use your personal data for advertising or behavioural profiling, and makes no decisions about you based solely on automated processing that have legal or similarly significant effects. Inferring a region from a time zone is a classification; it does not assess you.

5. What is required

You need to sign in with a Google account to use AllBell; without an account you cannot join an event. If you do not allow notifications, alarms stay set on your phone and still ring, but changes to an event reach your phone only when you open the app.

6. Who sees it

• People in the same event: your name, whether your alarm is set on your phone, whether and when you got up, how many times you snoozed, whether your alarm rang silently, and whether your phone reported anything at all that morning.
• Somebody who opens an invite link: the event's name, time, number of participants and the name of the person who set it.

An event's name is visible to its participants and to anybody who opens its link. So do not put special categories of personal data, such as health or beliefs, into an event's name.

Service providers, only to provide the service:

• Google: signing in with Google, delivering notifications to your phone (Firebase Cloud Messaging), and keeping the correspondence when you email us (Gmail). A notification only tells your phone to sync; it contains no names and no event details.
• Cloudflare: carrying and protecting the connection to the server.
• Amazon Web Services: encrypted backups of the database.

7. Transfers abroad

The server and the database are in Türkiye. Backups are kept on Amazon Web Services servers in Germany (Frankfurt). Google and Cloudflare may also process data outside Türkiye, including in the United States, while providing their services. These transfers are made only for the purposes in section 4, to provide the service.

If the GDPR applies to you: Germany is in the European Union; Google and Cloudflare participate in the EU-U.S. Data Privacy Framework, and these providers' data processing agreements include the EU standard contractual clauses.

You can write to the address above to ask about the transfers.

8. How long it is kept

• Events and their mornings are deleted automatically two years after the event ended. The mornings of an alarm that is still running are also deleted after two years. History shows the last two years.
• Agreement and notice records are kept while your account is open and for 10 years after it closes (the general limitation period), because they may be needed to prove or defend a right; then they are deleted.
• What you write to us: requests under the KVKK or the GDPR, and our answers, are kept for 10 years to prove they were answered; other correspondence is kept for 2 years after it was answered.
• Data that is no longer useful is deleted automatically: delivered notifications after 7 days; undelivered notifications, expired sessions and invite links after 30 days.
• When you delete your account, your email address and the link to your Google account are deleted (signing in again with the same account starts you as somebody new), your name is deleted, your phones and notification tokens are deleted, you leave every event, and the alarms you set are switched off. When you got up, when you snoozed and what the alarm did on your phone are deleted too; mornings in other people's History stay without you. Only your agreement and notice records remain, pseudonymised under a random identifier instead of your name, for the period above.
• Backups roll over within 30 days; deleted data leaves the backups within that time at the latest.

9. Your rights

Under KVKK Art. 11 you have the right to: learn whether your personal data is processed; request information if it is; learn the purpose of processing and whether it is used for that purpose; know the third parties it is transferred to in Türkiye or abroad; ask for correction if it is incomplete or wrong; ask for erasure or destruction under the conditions of KVKK Art. 7; ask for correction and erasure to be passed on to the third parties it was transferred to; object to a result against you that comes solely from automated analysis; and claim compensation if you suffer damage from unlawful processing.

If the GDPR applies to you, you also have the right to: access your data and receive a copy; rectification; erasure; restriction of processing; object to processing based on legitimate interest; receive your data in a structured, machine-readable format (portability); lodge a complaint with the supervisory authority of the EU/EEA country where you live, work or where the infringement took place; and compensation as provided by law.

You can change your name and delete your account yourself in the app (Profile). For anything else, write to the address above, preferably from the email address registered with AllBell; you will get an answer within 30 days at the latest. Under KVKK you can apply to us first, and then complain to the Personal Data Protection Board.