Privacy Policy

This text explains how the Mecra desktop app and the mecrastudio.com website, developed by Barış Özsoy (sole proprietorship) ("Mecra", "we", the data controller), process personal data.

1. Your app data stays on this computer

The Mecra desktop app stores your YouTube API keys, your AI and image service keys, your channel settings, your YouTube (and, if used, Instagram/TikTok) connection tokens and the videos and texts it produces only in local files on the computer where it is installed. This data is not sent to our servers.

2. Data sent to the license server

To verify your license the app sends our license server: a device ID (a non-reversible digest derived from hardware), your license key, the app version and the IP address of the request. This data is used only to check the license period, the device limit and your trial allowance. Retention: the IP address itself is never stored; only a keyed digest and a masked view (for example 203.0.113.x) are kept to prevent abuse, and that is deleted after 30 days; server event logs are kept for 90 days; your order key (so we can show it to you again if you lose it) is kept encrypted for 365 days; to prevent abuse the device digest and the trial counter record are kept indefinitely. The app also sends a request without identifying information to fetch the latest version and announcements.

3. AI requests on “AI Included” plans

On “AI Included” plans you do not enter your own Gemini key; your text-generation request (topic, source text and instructions) is sent from the app to our license server and relayed with our key to Google Gemini, with a free OpenRouter model as a fallback. The content of the request and the reply is not stored and not written to logs on our server; only the monthly usage (token) count per license is recorded. The content is subject to the privacy policy of the provider (Google, OpenRouter). If you don't want this, choose a “Bring your own keys” plan; requests then go from your computer straight to Google.

4. Your website account (My account)

When you create an account on mecrastudio.com or sign in with Google, we keep the following on our license server:

• Identity and contact: email address, first name, last name and an optional phone number. With Google sign-in, the first name, last name, email address and email-verification status that Google shares (only the openid email profile scopes).
• Password: your plain password is not stored; only a one-way digest is kept.
• Session and security: session records (valid for 30 days) and only a masked view and a one-way digest of the IP address of your last sign-in, used for abuse prevention. Account status (active/disabled) and email-verification status.
• Support tickets: subject, message, your email address and our reply.
• Order and license records: plan, amount, status, date; the masked view of the license key.

This data is processed to manage your account, match licenses and orders, provide support, send verification and password-reset emails and prevent abuse; the legal bases are the performance of a contract, compliance with legal obligations and our legitimate interest. Emails are sent through our own mailbox (with an email delivery service as a fallback). When you ask us to delete your account, your account record (identity and contact details), sessions and support tickets are deleted. Order and license records, including your email address, are kept for the statutory retention period because of accounting and legal obligations and are then deleted or anonymized.

5. Purchases and payment

Payments are taken through Lemon Squeezy or directly by bank transfer. Your card details never reach us; with Lemon Squeezy, card data is processed directly by the payment provider, which is the merchant of record for your order, and the invoice is issued in its name. Name, email and billing details for an order are subject to Lemon Squeezy's own privacy policy. For bank transfers only the reference code in your transfer description and the details on your bank receipt are used to match the payment.

6. The website

mecrastudio.com is static; it uses no tracking or analytics cookies or third-party scripts beyond what is necessary for it to work and collects no visitor data; fonts and images load from our own server. The server may keep standard access logs (IP address, request, time) for technical operation and security. For what is kept in your browser when you sign in or dismiss the announcement bar, see the Cookie Policy.

7. Third-party services

The app calls services such as Google (Gemini, YouTube Data API), Pexels and Wikimedia with your own API keys, directly from your computer. Data sent to those services (for example search queries) is subject to each service's own privacy policy. Hosting of the website and license server (Hostinger), payment (Lemon Squeezy) and sign-in with Google (Google) are the other providers in scope. Some of these providers are located abroad; transfers are made in line with applicable law and only as far as the service requires.

8. Retention periods

• App data: on your computer until you delete it.
• Masked digest of the IP address: 30 days. Server event logs: 90 days. Order key (encrypted): 365 days.
• Session records: at most 30 days.
• Account and support tickets: until you have your account deleted.
• Order and license records: for the statutory retention period (including the email address), then deleted or anonymized.
• Device digest and trial counter: indefinitely to prevent abuse (a one-way digest that contains no personal data).

9. Your rights

Under Article 11 of the Turkish Personal Data Protection Law (KVKK) and related legislation you can: learn whether your data is processed; request information if it has been processed; learn the purpose of processing and whether it is used accordingly; learn the third parties it is transferred to in Turkey or abroad; request correction if it is incomplete or wrong; request its deletion or destruction; and claim compensation if you suffer damage. Write to destek@mecrastudio.com from the email address registered to your account; we verify your identity and reply within 30 days at the latest. You can also ask for your account and the records on our license server to be deleted at the same address.

10. Contact

For questions: destek@mecrastudio.com. When this policy changes we update the date at the top.