Watchover is an app built to protect people who are fighting gambling and the people close to them who support them. Privacy sits at the core of the app: we collect as little data as possible, sell nothing and never track you.
The service is provided, and the data described here is controlled, by Batuhan Engin, an individual developer. For anything about your data, write to destek@goz-kulak.com. If you are in the EU/EEA or the UK and need to reach us about your data, use the contact above.
Where the GDPR or UK GDPR applies, each processing activity rests on one of the legal bases in Article 6(1):
| Purpose | Data used | Legal basis |
|---|---|---|
| Running the protection service — the DNS filter, the locks, purchase status, time zone and lock settings | Device identifier, protection status, purchase status, time zone, lock settings, Screen Time status | Art. 6(1)(b) — necessary to perform the contract you enter when you use the app |
| The supporter link — pairing, notifying the supporter when protection stops, the weekly summary, early-unlock requests | Device identifier, display name, push token, protection status, lock settings | Art. 6(1)(b) — necessary to perform the contract; the link itself forms only when both people act |
| Abuse prevention and keeping the service running — rate limits on pairing codes, short-lived technical logs, error counters without device identity | Request metadata (IP address seen at the edge, timestamps), aggregate error counts | Art. 6(1)(f) — our legitimate interest in keeping the service secure and available; we judge the impact on you minimal because nothing is tied to a person |
| Optional notifications — e.g. self-warnings on your own device, the weekly summary to a supporter | Push token, protection status | Art. 6(1)(a) — your consent, given through the iOS notification permission and the toggles in Settings; you can withdraw it at any time |
| Help requests | The note you write, timestamp, our reply | Art. 6(1)(b) — handling the request you made |
| Data | Retention |
|---|---|
| Device record (identifier, display name, push token, protection and lock state, purchase status, time zone) | While the app is in use. Deleted immediately when you ask on the data deletion page or in the app; any residual copies in infrastructure backups are purged within 30 days of the request. |
| Supporter notification history | Only the most recent 20 events per supporter are kept; older ones are overwritten. Removed when the link is broken or either device's record is deleted. |
| Pairing codes and invitations | Pairing codes expire after 1 hour, invitations after 7 days; failed-attempt counters after 10 minutes. |
| A pending "Was that you?" question (timestamps, a count and one-byte source markers — no site name) | Up to 24 hours; deleted as soon as it is answered. |
| "That wasn't me" markers (one byte derived from a salted hash of the source, so the same source isn't asked about again; it cannot be turned back into a site name) | 90 days, at most 6 at a time. |
| Help-request notes | 90 days. |
| Server and edge logs (request metadata, no browsing content) | Up to 30 days. |
| Site classification records (site name and result only, no device) | Up to 30 days. |
| Error counters (platform, version, place — no device identity) | Kept as aggregate counts; contain no personal data. |
Protection routes your device's DNS queries (the request that resolves a site's address) through a secure server. That server blocks only addresses belonging to gambling sites; every other site resolves normally. We keep no list of the ordinary sites you visit. Only the count of blocked gambling attempts, a timestamp showing that protection is alive and the "Was that you?" records described in sections 5 and 7 are stored, tied to the anonymous device identifier; none of them contains a site name.
The gambling site list covers sites outside Türkiye as well. Sports news, live-score sites and gambling-addiction help organisations are deliberately not blocked.
Sites not on the list: the home page of a site whose name suggests gambling and that appears on no list may be visited once by our server and classified by its content. That record contains only the site name and the result; which device asked is not recorded.
Gambling apps: the list of known gambling apps ships inside the app. On iPhone, Screen Time hides those apps; on Android, the ones installed are shown to you. Which apps are installed or hidden is never sent anywhere.
This feature is entirely consent-based:
Advertising messages from gambling sites are among the strongest triggers in fighting addiction. Watchover can use iOS message filtering to move these messages to the "Junk" folder.
We do not sell personal data and do not share it for advertising. We use only the infrastructure providers (processors) needed to run the app:
We use no ad network, data broker or third-party tracking tool. We disclose data to authorities only where the law obliges us to.
Our servers run on Cloudflare's global edge network, so a request is handled at the location nearest to you and stored data may be held in data centres outside your country, including in the United States. Cloudflare is certified under the EU-US Data Privacy Framework and its UK and Swiss extensions, and its data processing terms include the European Commission's Standard Contractual Clauses for transfers not covered by an adequacy decision. Push notifications are delivered through Apple (and Google on Android), which likewise process them under their own transfer safeguards. Because the data involved is an anonymous device identifier and technical state — never your browsing history — the transfer risk to you is low.
Depending on where you live, you may have the following rights over your personal data. We honour them for everyone, wherever you are:
To exercise a right that the app itself doesn't cover, email destek@goz-kulak.com. Because we hold no real name or email, we will ask for your device identifier (shown in the app under Settings) to find your record. We answer within one month.
Watchover is intended for adults, is not directed at anyone under 18 and does not knowingly collect data from them. If you believe a minor has provided data to us, contact us and we will delete it.
We do not sell personal information and do not share it for cross-context behavioural advertising, and have not done so in the preceding 12 months. We use no "sensitive personal information" as defined by the CPRA. The categories we collect are identifiers (a random device identifier, push token) and internet activity limited to protection status — see sections 2 and 4 for the sources and purposes. You have the right to know, delete, correct and to not be discriminated against for exercising these rights; use the data deletion page or the contact above. There is no "Do Not Sell or Share" link because there is nothing to opt out of.
We may update this policy from time to time. The date at the top shows the current version. Important changes are announced in the app or on this page; if a change would materially reduce your rights, we will ask again before it applies.
For privacy questions: destek@goz-kulak.com
Watchover is not a substitute for treatment. For free, confidential support the app shows a verified helpline for your country where one exists (Türkiye: YEDAM 115, 24/7); everywhere else, gamblingtherapy.org.