Application: NoLoss — Habit & Streak Tracker
Data Controller: JUPMADS L.L.C-FZ (“NoLoss,” “we,” “us,” or “our”)
Last Updated: 24 June 2026
Contact: support@jupmads.com — Website: https://noloss.app
1. Introduction
This Privacy Policy (“Policy”) explains how JUPMADS L.L.C-FZ collects, processes, stores, shares, and protects your personal data when you (“you,” “user,” or “data subject”) use the NoLoss mobile application, the noloss.app website, and all related services (collectively, the “Service”).
NoLoss is a personal habit-tracking tool that helps adults build healthier routines, track their streaks, log their moods, and see their progress. Because the Service may interact with signals that can be considered sensitive — such as mood logs and user-reported financial information — we designed this Policy to meet the strictest applicable standards (EU GDPR, UK GDPR, and Law No. 6698 (KVKK)).
By installing, accessing, or using NoLoss, you confirm that you have read, understood, and accepted this Policy.
2. Data Controller
JUPMADS L.L.C-FZ
Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates
For data-protection requests (access, deletion, rectification, complaints): support@jupmads.com
3. Age Requirement
The Service is only for users over the age of 18. We do not knowingly collect data from minors. If we determine that an account belongs to someone under 18, we delete the account and the data without undue delay.
4. Categories of Personal Data Processed
4.1 Account and Authentication Data
- Email address (registration via email or Sign in with Apple)
- Apple Private Email Relay address — when “Hide My Email” is used; we never attempt to resolve it to the real address
- Anonymous user identifier (UUID)
- Authentication tokens, display name/nickname (optional), account creation and last login timestamps
4.2 Subscription and Transaction Data
- Subscription status, product ID (weekly/yearly), App Store transaction ID, receipt-validation metadata
- We do not collect full card/bank details or billing address; all payments are processed by Apple
4.3 Habit, Behavioral, and Wellness Data
- Streak counters (number of days since you started a goal)
- User-reported financial savings (amounts the user enters as “money saved”)
- Mood logs, urge/trigger notes, journal entries, goal milestones, achievement badges, activity timestamps
These data are encrypted at rest and synchronized with our cloud infrastructure for cross-device sync, recovery after device loss, and continuous service. These data are never sold, never shared with advertisers, and never used for advertising profiling.
4.4 Device and Technical Data
- Device model, OS version, language/region; app version, build number, install referrer
- IP address (only during API requests; for security and abuse prevention)
- Crash logs, performance traces, diagnostic events
4.5 Push Notification Tokens
- FCM (Android) tokens; only to deliver notifications you have approved. Automatically revoked when you uninstall the app or turn off notifications.
4.6 Support and Communication Data
- support@jupmads.com correspondence; in-app feedback messages
4.7 Cookies and Web Tracking
- Our website noloss.app uses strictly necessary cookies and, with your consent, analytics cookies. The mobile app does not use traditional HTTP cookies.
5. Data Sources
- Directly from you (account creation, in-app inputs, support emails)
- Automatically from your device (device model, OS, crash data, push tokens)
- From a third-party authentication provider when you choose Sign in with Apple
- From subscription processors (Google Play) for subscription-status verification
6. Legal Bases for Processing (GDPR / KVKK)
| Processing Activity | Legal Basis |
|---|---|
| Creating and verifying your account | Conclusion/performance of a contract (GDPR 6(1)(b); KVKK 5/2-c) |
| Providing habit- and streak-tracking features | Performance of a contract |
| Subscription billing verification | Performance of a contract |
| Crash reporting and security monitoring | Legitimate interest (GDPR 6(1)(f); KVKK 5/2-f) |
| Marketing attribution (with ATT/equivalent consent) | Explicit consent (GDPR 6(1)(a); KVKK 5/1) |
| Service-related email (subscription receipts) | Performance of a contract |
| Promotional email | Explicit consent |
| Mood logs and behavioral self-reporting (potentially health-related) | Explicit consent (GDPR 9(2)(a); KVKK 6/3) |
| Compliance with legal obligations | Legal obligation (GDPR 6(1)(c); KVKK 5/2-a) |
You may withdraw your consent at any time; withdrawal does not affect the lawfulness of processing before it.
7. Purposes of Processing
- Service provision — habit tracking, streaks, mood logs, achievements, cross-device sync
- Account management — registration, authentication, subscription management
- Customer support
- Service improvement — crash detection, bug fixing, feature performance via aggregated and pseudonymized analysis; third-party analytics where you consent
- Security and abuse prevention
- Legal compliance
We do not use your data for: selling to data brokers; advertising profiling based on habit/mood/financial data; automated decision-making producing legal effects; any purpose not described in this Policy.
8. Third-Party Processors
To provide the Service, we share your personal data with categories of processors that act on our written instructions and have signed a Data Processing Agreement (GDPR Article 28 / KVKK Article 12) with us:
- Cloud hosting and infrastructure providers
- Database and authentication providers
- Subscription-verification providers
- Crash-reporting, performance-monitoring, and product-analytics providers
- Push-notification providers
- Customer-support tool providers
We share only the data required for the purpose with each processor. You may request the named processor list from support@jupmads.com.
9. International Data Transfers
For transfers outside the EEA/UK/Türkiye we rely on the European Commission’s Standard Contractual Clauses (SCC), the UK Addendum, and adequacy decisions; for transfers from Türkiye, on explicit consent under KVKK Article 9 or other mechanisms recognized by the Board.
10. Data Retention
We retain personal data only for as long as necessary for the purposes in Section 7, considering the nature and sensitivity of the data (account duration, necessity for providing the Service, legal/tax retention obligations, dispute/fraud prevention). When data is no longer needed, it is irreversibly deleted or anonymized. When you delete your account, your data in active systems is deleted within a reasonable time; residual copies in backups are cleared in the ordinary backup-rotation cycle (except records that legislation requires us to keep).
11. Security Measures
- Transmission encryption with TLS 1.2+; encryption at rest with AES-256
- Least-privilege principle, access logging, multi-factor authentication for administrative access
- Regular vulnerability scanning, dependency monitoring, incident response plan (72-hour breach notification)
- Secure software development, code review, penetration testing on major releases
12. Your Rights under GDPR / UK GDPR
Access (15), rectification (16), erasure/right to be forgotten (17), restriction of processing (18), portability (20), objection (21), withdrawal of consent (7/3), not being subject to automated decisions (22 — we do not carry out such processing), complaint to a supervisory authority. To exercise: support@jupmads.com or in-app Settings → Account → Delete Account. We respond within one month.
13. Automated Decision-Making and Profiling
We do not carry out automated decision-making that produces legal or similarly significant effects on you. Aggregate analytics may be used to improve features; no decision is automated at the individual level.
14. Sensitive Permissions Disclosure
The Service explains the following permissions in plain language:
- Notifications — for streak reminders, mood check-ins, and subscription events. Declining does not disable the Service.
- Background processing — to keep streak tracking and synchronization running even when the app is not in the foreground.
You may revoke these permissions at any time in your device settings; doing so may disable the corresponding features.
15. KVKK Disclosure Statement
This section is provided under the disclosure obligation of Law No. 6698 (KVKK). The Turkish version is binding for users resident in Türkiye.
Data Controller: JUPMADS L.L.C-FZ — Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, UAE — support@jupmads.com
Purposes of Processing: Provision of the Service, account creation/management, subscription transactions, customer support, service quality and security, legal obligations, and — where you consent — marketing attribution, promotions, and app improvement via third-party service providers.
Categories Processed: Identity (anonymous user ID, nickname), contact (email, Apple Private Email Relay), customer transaction (subscription status, transaction IDs), transaction security (IP, device information, session logs, push tokens), marketing (only with consent), user-reported financial information (amounts claimed to be saved — not actual financial account information), potentially health-related behavioral/emotional data (mood logs, journal entries).
Collection Method and Legal Ground: Collected via the app, website, electronic communication channels, and — where you consent — third-party attribution/marketing partners, under KVKK Articles 5/2 and 6/3 and, where necessary, your explicit consent.
Transfer: May be transferred to the cross-border categories in Section 8 under explicit consent per KVKK Article 9 or mechanisms recognized by the Board.
Your Article 11 Rights: To learn whether data is processed, request information, learn the purpose, know the third parties to whom it is transferred, rectify, delete/destroy, request notification of these to recipients, object to automated analysis, and demand compensation for damages. Application: support@jupmads.com; concluded within 30 days at the latest under KVKK Article 13.
16. Children
The Service is not directed at children under 18. We do not knowingly collect data from minors.
17. Changes to the Policy
Material changes are communicated via in-app notice or email at least 30 days before they take effect.
18. Contact
Email: support@jupmads.com — JUPMADS L.L.C-FZ, Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, UAE — https://noloss.app
If you are dissatisfied with our response, you may file a complaint with the data-protection authority of your country of residence (e.g., KVKK for Türkiye).