Effective date: May 11, 2026 Last updated: May 11, 2026 Version: 1.0
Note: Published version. Data controller is an individual developer; VERBIS registration is not required unless commercial activity is initiated in Türkiye (kvkk.gov.tr). Contact for privacy inquiries: sandikapp.destek@gmail.com.
This application (sandık, the "App") is operated by Yasin Çıralı ("we", "us", "Company").
Istanbul, Türkiyesandikapp.destek@gmail.comhttps://yasincirali.github.io/sandikappWe act as data controller under GDPR Article 4(7) and Turkish KVKK Article 3(1)(ı).
This policy explains what personal data we collect when you download and use the App, why we collect it, with whom we share it, how long we retain it, and what your legal rights are.
The policy is designed to satisfy the requirements of GDPR (EU 2016/679), Turkish KVKK (Law No. 6698), Apple App Store Privacy Guidelines and Google Play Data Safety.
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Account creation, login, password reset | GDPR 6(1)(b) — contract |
| Password (hashed) | Authentication | GDPR 6(1)(b) |
| Display name | Visible to other users in the partnership feature | GDPR 6(1)(b) |
| Data | Purpose |
|---|---|
| Asset records (symbol, quantity, purchase price, date, note) | Portfolio tracking (core functionality) |
| Portfolio snapshot history | Performance charts |
| Partnership invite codes & mutual links | Multi-user sharing feature |
| Data | Purpose |
|---|---|
| Push notification token (FCM) | Partnership invite & signal notifications |
| Device model, OS version, app version | Diagnostics (only at disclaimer acceptance) |
| Locale | Language/date format |
| Data | Purpose | Legal basis |
|---|---|---|
| Disclaimer acceptance timestamp, IP, version, platform | Proof of investment-advice disclaimer | GDPR 6(1)(c) — legal obligation |
| Data | Purpose |
|---|---|
| Crash reports (Crashlytics) | Crash diagnostics (no personal data, anonymous device id) |
| Structured error logs | Only in production for errors; sensitive fields (email, password, token) are masked |
| Service | Provider | Data | Purpose | Location |
|---|---|---|---|---|
| Backend & database | Supabase Inc. | All account & app data | Storage, authentication | USA (AWS) |
| Push notifications | Google Firebase Cloud Messaging | Push token, notification content | Notification delivery | Global (Google) |
| Crash reports (when added) | Google Firebase Crashlytics | Device model, OS, error stack trace | Crash diagnostics | Global |
| Stock/fund prices | Yahoo Finance, TEFAS, finans.truncgil.com | NONE — only symbol query is sent | Price retrieval | Global |
These providers act solely as data processors on our instructions. Controllership remains with us.
Because Supabase and Firebase are hosted in the USA, your data is transferred outside the EEA / Türkiye. Under GDPR Articles 44-49 and KVKK Article 9:
The destination country (USA) is not on the Turkish DPA's list of countries with adequate protection; therefore international transfer is based on explicit consent.
| Data | Period |
|---|---|
| Account data | Until account deletion |
| Asset records | Until account deletion |
| Snapshot history | Last 365 days (rolling, older entries auto-deleted) |
| Disclaimer acceptance log | 3 years after account deletion (Turkish CO Art. 146 statute of limitations) |
| Push token | Auto-deleted on app uninstall or logout |
| Crash reports | 90 days |
| db_logs (errors only) | 30 days |
When you delete your account, all your data — except records with statutory retention listed above — is permanently deleted within 30 days.
You may exercise the following rights by contacting us:
How to request:
1. In-app: Profile → Settings → "Delete Account" / "Download My Data"
2. Email: sandikapp.destek@gmail.com with identity-verification information
3. Web form: https://yasincirali.github.io/sandikapp/data-request
We respond to requests within 30 days (GDPR Art. 12(3) / KVKK Art. 13(2)).
Right to lodge a complaint: - EU/EEA: Your local Data Protection Authority - Türkiye: Kişisel Verileri Koruma Kurumu — kvkk.gov.tr
The App is not intended for users under 18. You confirm being 18+ at registration. If we learn that a user under 18 has provided data, the account is deleted promptly. We do not accept users under 16 (GDPR Art. 8 parental consent threshold).
Technical and organizational measures we apply:
Breach notification: - Within 72 hours to the relevant supervisory authority (GDPR Art. 33 / KVKK Art. 12) - Direct notification to affected users - Compliance with GDPR Art. 33-34
The App runs in a mobile environment, so web cookies are not used. Local storage (SharedPreferences, SQLite cache) is used only for:
No third-party tracking, analytics, or advertising SDKs are included.
sandık is a portfolio tracking tool. We are NOT a licensed investment advisor or brokerage. Prices, performance figures, signals and charts shown in the App are for informational purposes only and do not constitute investment advice. Consult a licensed advisor before making investment decisions.
This disclaimer is shown and acknowledged at first launch; the acknowledgement is recorded as legal evidence.
When we change this policy: - An in-app notification is shown - The "Last updated" date is refreshed - Material changes are also sent via email - Changes that require a new KVKK consent will trigger re-acceptance
If you do not object within 30 days, you are deemed to have accepted the changes.
For all data protection questions, requests and complaints:
sandikapp.destek@gmail.comIstanbul, TürkiyeNot appointed — inquiries to sandikapp.destek@gmail.comThis policy is provided in [Turkish] and [English]. In case of discrepancy, the Turkish version prevails.