Privacy Policy
1. Data Controller
The sandık app is developed and operated by Yasin Cirali ("we", "us").
| Developer | Yasin Cirali |
|---|---|
| sandikapp.destek@gmail.com | |
| Website | yasincirali.github.io/sandikapp |
2. Scope
This policy explains what personal data we collect when you use sandık, why we collect it, who we share it with, and your rights. It is designed to comply with KVKK (Turkish Personal Data Protection Law No. 6698), GDPR (EU 2016/679), Apple App Store Privacy Guidelines, and Google Play Data Safety requirements.
3. Data We Collect
Account data (required): Email address, password (hashed), display name.
App content: Asset records (symbol, quantity, purchase price, date, notes), portfolio history snapshots, partnership invite codes.
Device & notifications: Push notification token (FCM), device model/OS/app version (crash diagnosis only), locale setting.
Legal consent logs: Disclaimer acceptance timestamp, platform, version (required as legal proof under Turkish CMB regulations).
What we do NOT collect: Location, contacts, photos/camera, advertising identifiers, bank account information.
4. How We Use Your Data
- Account creation and session management
- Portfolio tracking and performance chart calculations
- Delivering partnership invitations to other users
- Sending notifications (only when permission is granted)
- Fulfilling legal obligations
- Crash diagnosis and service quality improvement
5. Third-Party Services
| Service | Provider | Purpose |
|---|---|---|
| Backend / Database | Supabase Inc. (USA) | Storage, authentication |
| Push Notifications | Google Firebase (Global) | Notification delivery |
| Price Data | Yahoo Finance, TEFAS | Symbol queries only — no personal data sent |
6. International Data Transfers
Since Supabase and Firebase are hosted in the USA, your data is transferred outside Turkey. For Turkish users, transfer is based on explicit consent given at registration under KVKK Article 9. For EU users, Standard Contractual Clauses (SCCs) apply.
7. Data Retention
| Data | Retention Period |
|---|---|
| Account and asset data | Until account deletion |
| Portfolio history snapshots | Rolling 365 days |
| Disclaimer consent log | 3 years after account deletion (Turkish Obligations Code Art. 146) |
| Crash reports | 90 days |
When you delete your account, all your data is permanently deleted within 30 days (except legally required retention periods above).
8. Your Rights (GDPR Art. 15-22 / KVKK Art. 11)
- Right to know whether your data is being processed
- Right of access and data portability
- Right to rectification and erasure
- Right to withdraw consent
- Right to object to legitimate interest processing
How to exercise your rights:
- In-app: Profile → Settings → "Delete My Account"
- Web form: Account Deletion Request
- Email: sandikapp.destek@gmail.com
We respond within 30 days. To file a complaint: kvkk.gov.tr (Turkey) or your local Data Protection Authority (EU).
9. Children's Data
The app is not designed for users under 18. If we become aware of data from an underage user, the account will be deleted immediately.
10. Security
- Transit: TLS 1.2+ (HTTPS enforced)
- At-rest: AES-256 encryption (Supabase)
- Access control: Row-Level Security — each user can only access their own data
- Passwords: Bcrypt hashed
In the event of a data breach, we will notify the Turkish DPA within 72 hours and notify affected users directly.
11. Local Storage
The app does not use web cookies. On-device storage includes only session token, theme/language preference, and disclaimer consent status. No third-party advertising or analytics SDKs are included.
12. Investment Disclaimer
sandık is a portfolio tracking tool only. It is not a licensed investment advisor or brokerage. Prices, performance data, and signals are for informational purposes only and do not constitute investment advice.
13. Policy Changes
For significant changes, we will notify you via in-app notification and email. The "effective date" on this page will be updated.
14. Contact
Email: sandikapp.destek@gmail.com