sandıkGDPR

GDPR Notice — sandık

Effective date: October 8, 2026 Last updated: November 7, 2026 Version: 1.7

This document supplements the Privacy Policy and Terms of Service with EU/EEA-specific information required by the General Data Protection Regulation (Regulation (EU) 2016/679).

1. Identity of the Controller

Yasin Çıralı is the controller of your personal data within the meaning of GDPR Article 4(7).

Address: Istanbul, Türkiye
Email: support@murphysoft.app
EU representative (Art. 27): Not appointed — see the distribution note below.
Data Protection Officer (Art. 37): Not appointed. Data protection contact: support@murphysoft.app

Distribution note. The App is distributed only in Türkiye: its availability on Google Play and the App Store is restricted to the Turkish storefront, and it is not offered or marketed to data subjects in the EU/EEA. On that basis no representative is designated under Art. 27, which applies to controllers offering goods or services to data subjects in the Union. This notice is provided for transparency and for EU/EEA residents who use the App while in Türkiye. If distribution is extended to any EU/EEA country, an Art. 27 representative will be designated beforehand and this section updated.

2. Categories of Personal Data Processed

See Privacy Policy §3 for the detailed inventory.

We do not process special categories of personal data (Art. 9): no health, racial/ethnic origin, political opinions, religious beliefs, biometric, genetic, sexual orientation data.

3. Legal Bases for Processing (Art. 6)

Processing	Legal basis
Account creation, authentication, providing core service	Art. 6(1)(b) — performance of a contract
Push notifications (after you grant the operating system's notification permission)	Art. 6(1)(b) — performance of a contract
Storing legal text acceptance records (incl. the investment disclaimer)	Art. 6(1)(f) — legitimate interests (proof of acceptance); Art. 6(1)(c) — legal obligation where applicable
Security measures (single active device, rate limiting, abuse detection, sign-in security log, error logs)	Art. 6(1)(f) — legitimate interests
Crash reports and usage statistics (Firebase Crashlytics, Firebase Analytics); sign-up funnel	Art. 6(1)(f) — legitimate interests (diagnostics, product improvement)
Race (optional; period return %, asset-type shares %)	Art. 6(1)(b) — performance of a contract (feature you turn on)
Top Portfolios anonymous pool (period return %, asset-type shares %, per-asset shares % by TEFAS fund code or public market symbol)	Art. 6(1)(a) — consent (opt-in in the App; withdrawable at any time)
Premium subscription verification (only if you buy Premium; RevenueCat)	Art. 6(1)(b) — performance of a contract
International transfer (Firebase and RevenueCat USA; Supabase pre-migration copy in Japan until deleted)	Art. 49(1)(a) — explicit consent + Art. 46(2)(c) SCCs

4. Recipients (Art. 13(1)(e))

See Privacy Policy §5 (Supabase, Google Firebase and Gmail email infrastructure, Apple Push Notification service, Sign in with Apple / Google Sign-In, RevenueCat for Premium subscription verification). Public market-data providers (exchanges, banks, fund platforms, official institutions, exchange-rate and price services) receive no personal data and are therefore not listed individually.

All processors are bound by Data Processing Agreements (DPAs) under Art. 28.

Other users who have also joined Top Portfolios receive only the anonymous output of the pool — rank, return percentage, asset-type shares and each asset's TEFAS fund code or public market symbol with its share, with no identity, amounts or quantities — see Privacy Policy §5.1.

5. International Transfers (Art. 44-49)

Since October 18, 2026 the database is hosted in Germany (AWS Frankfurt, EU); database storage involves no third-country transfer. A pre-migration copy stays in Japan (AWS Tokyo) until it is deleted; Japan benefits from the EU adequacy decision (Commission Implementing Decision (EU) 2019/419). Supabase Inc. (a U.S. company) and Google act as processors under the mechanisms below:

Service	Mechanism	Reference
Supabase Inc. (processor; data in Germany, pre-migration copy in Japan until deleted)	EU storage; EU adequacy decision for Japan; EU-U.S. Data Privacy Framework + Standard Contractual Clauses for remote access	https://supabase.com/privacy
Google Firebase and Gmail	EU-U.S. Data Privacy Framework + SCCs	https://firebase.google.com/support/privacy
Apple (Push Notification service, Sign in with Apple)	EU-U.S. Data Privacy Framework + SCCs	https://www.apple.com/legal/privacy/
RevenueCat, Inc. (only if you buy Premium)	SCCs under RevenueCat's Data Processing Addendum	https://www.revenuecat.com/privacy

Risk assessment: The U.S. is a recipient of the EU-U.S. Data Privacy Framework adequacy decision (10 July 2023). However, due to evolving CJEU jurisprudence, we additionally rely on SCCs and supplementary measures (encryption in transit and at rest, access controls, RLS).

You may request a copy of the SCCs by emailing support@murphysoft.app.

6. Retention Periods (Art. 13(2)(a))

See Privacy Policy §7.

7. Your Rights (Art. 15-22)

7.1 Right of Access (Art. 15)

You may request confirmation that we process your data and obtain a copy in a structured, machine-readable format.

7.2 Right to Rectification (Art. 16)

You may correct inaccurate or incomplete data.

7.3 Right to Erasure / "Right to be Forgotten" (Art. 17)

You may request deletion. In-app deletion takes effect immediately. Legal text acceptance records and the anonymous deletion record (a one-way hash of your account ID and your email domain) are kept for 3 years after deletion (Turkish Code of Obligations Art. 146 limitation period); the sign-in security log (IP, device/browser) is kept for 90 days. Both are deleted automatically when their period ends; other records kept after deletion are listed in Privacy Policy §7.

In-app: Profile → Settings → Delete Account. Web: https://yasincirali.github.io/sandikapp/data-request

7.4 Right to Restriction (Art. 18)

You may ask us to limit processing in specific situations (e.g., contesting accuracy, unlawful processing without erasure request).

7.5 Right to Data Portability (Art. 20)

You may request your data in a structured, commonly used, machine-readable format (JSON). You can also ask us to transmit it directly to another controller, where technically feasible.

In-app: Profile → Settings → Download My Data (JSON export).

7.6 Right to Object (Art. 21)

You may object to processing based on legitimate interest (Art. 6(1)(f)). We will stop processing unless we demonstrate compelling legitimate grounds.

7.7 Automated Decision-Making (Art. 22)

We do not make decisions based solely on automated processing (including profiling) that produce legal effects on you. Technical analysis signals, where shown, are informational and require your manual decision.

7.8 Right to Withdraw Consent (Art. 7(3))

You may withdraw consent at any time. Withdrawal does not affect lawfulness of processing prior to withdrawal.

7.9 Right to Lodge a Complaint (Art. 77)

You may complain to your local Supervisory Authority. Common contacts:

France: CNIL — cnil.fr
Germany: BfDI — bfdi.bund.de (federal) + state DPAs
Ireland: DPC — dataprotection.ie
Netherlands: AP — autoriteitpersoonsgegevens.nl
Spain: AEPD — aepd.es
Italy: Garante — gpdp.it

Find yours: https://edpb.europa.eu/about-edpb/about-edpb/members_en

8. How to Exercise Your Rights

Method	Address
In-app	Profile → Settings (Delete / Download)
Email	`support@murphysoft.app`
Web form	`https://yasincirali.github.io/sandikapp/data-request`

Identity verification: We may ask you to verify your identity (e.g., confirm via the email associated with your account). If we have reasonable doubts about your identity, we may request additional information (Art. 12(6)).

Response time: Within 1 month of receipt (Art. 12(3)). May be extended by 2 months for complex/numerous requests, with notice within the first month.

Cost: Free, except for manifestly unfounded or excessive requests (Art. 12(5)).

9. Data Breach Notification (Art. 33-34)

If we detect a personal data breach likely to result in a risk to your rights and freedoms:

We notify the competent Supervisory Authority within 72 hours of becoming aware (Art. 33).
We notify you directly without undue delay if the breach is likely to result in a high risk to your rights and freedoms (Art. 34) — via email and in-app notification.

10. Children (Art. 8)

Our service is not directed to children under 16. We do not knowingly process data of children under 16 without parental consent. If you believe a child has provided data, contact us at support@murphysoft.app for immediate deletion.

11. Changes to This Notice

Material changes to the legal documents are announced in the App: on the next launch the current documents and a summary of the changes are shown. Your acceptance of the Terms of Service and your explicit consent under the Explicit Consent Notice are requested again; the information documents (Privacy Policy and KVKK Disclosure) are presented to you and you state that you have been informed. The current version of this notice is always available at https://yasincirali.github.io/sandikapp/legal/gdpr.

12. Contact

Role	Contact
Controller	`Yasin Çıralı` — `support@murphysoft.app`
Data Protection Officer (if appointed)	`Not appointed — inquiries to support@murphysoft.app`
EU Representative (Art. 27)	Not designated — distribution limited to Türkiye (see §1)

This document is provided in English. The Turkish KVKK Disclosure, which covers Turkish KVKK obligations, is available at https://yasincirali.github.io/sandikapp/legal/kvkk.