Effective date: October 8, 2026 Last updated: November 7, 2026 Version: 1.14 Consent version: 1.8 Source: TR 1.14 (translation of the Turkish text; the Turkish version prevails)
This application (sandık, the "App") is operated by Yasin Çıralı ("we", "Company").
Istanbul, Türkiyesupport@murphysoft.apphttps://yasincirali.github.io/sandikappNot registered (individual developer) (where applicable)We act as data controller within the meaning of KVKK Article 3(1)(ı).
This policy explains which personal data we collect when you download and use the App, why we collect it, with whom we share it, how long we keep it and your legal rights.
The policy is prepared to meet the requirements of KVKK (Turkish Personal Data Protection Law No. 6698), the GDPR (EU 2016/679), the Apple App Store Privacy Guidelines and Google Play Data Safety.
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Account creation, sign-in, password reset, new-device verification code | KVKK 5(2)(c) — contract; GDPR 6(1)(b) |
| Password (hash) | Authentication (no password with Apple or Google sign-in) | KVKK 5(2)(c); GDPR 6(1)(b) |
| Username (display name) | Name shown to your partner, in notifications and in invite responses | KVKK 5(2)(c); GDPR 6(1)(b) |
| Email and name shared by the provider when you sign in with Apple or Google | Account creation; the name is used only as the initial display name | KVKK 5(2)(c); GDPR 6(1)(b) |
| Data | Purpose |
|---|---|
| Asset records (symbol, type, quantity, purchase price, commission, currency, date, note), time deposit and pension (BES) contract details, dividend records | Portfolio tracking (the App's core function) |
| Watchlist, price alerts, notification preferences (signal settings, quiet hours, briefing time), target amount | Operation of the respective features |
| Portfolio snapshots (hourly total value) | Performance charts |
| Period return (%), asset-type shares (%) and per-asset shares (%; TEFAS code for funds, public market symbol for other assets) — computed on the server | Top Portfolios (anonymous comparison, see §5.1; only if you give explicit consent) |
| Period return (%) and asset-type shares (%) — computed daily on the server | Race (optional; your percentile and comparison with your partner) |
| Partnership invite codes and mutual links | Multi-user sharing feature |
| Your feedback on asset notes (optional): the note's asset and period, a "helpful / not helpful" vote, a "wrong number" flag, an explanation of up to 500 characters | Measuring note quality, finding and correcting faulty notes (see §5.3) |
| AI portfolio comment (optional; only if you give explicit consent and ask for a comment): the return, drawdown and volatility percentages of the period commented on, your assets' names or symbols and their shares of the portfolio (%), inflation and market comparisons for the same period (dollar, gold, BIST 100), the written comment | The comment describing the period you select in Performance › Summary and on the asset detail page, last week or last month (see §5.5) |
| Consent records of AI features (portfolio comment, reading a statement with AI): when consent was given and withdrawn, version of the text shown to you | Proving consent and rejecting requests without consent on the server |
| Premium entitlement: its source (gift, store subscription or support), start and end time, store and product name, whether renewal was turned off | Verifying access to Premium content on the server. Payment and card details never reach us; Apple or Google collects the payment |
Statement import: A bank or brokerage statement you import (PDF, Excel, CSV) is read only on your device; the file is not sent to the server and is not stored. Only the asset records you confirm are saved. If the App is unsure about the statement's columns and you tap "Map with AI", an anonymous skeleton of the tables or, if you consented, the words in the tables (see §5.4) is sent to AI via our server; the file itself is still not sent.
| Data | Purpose |
|---|---|
| Push notification token (FCM) | Notification delivery (price alerts, signals, daily briefing, periodic summaries, partnership, dividend and calendar reminders) |
| Registered devices: device name (model, iOS version), platform, a random device number generated by the App, first and last seen time | Account security: the account stays signed in on one device at a time; email code on a new device |
| Lock-screen Live Activity (iOS, if you turn it on): activity token and the portfolio total and daily change text (masked when "hide amounts" is on) | Updating the portfolio summary on the lock screen |
| Device model, OS version, app version | Diagnostics, registered devices list, acceptance records |
| Locale | Language/date format, acceptance records |
| IP address and device/browser information (at sign-in, code verification and session refresh) | Account security and abuse detection (Supabase Auth security log) |
| Data | Purpose | Legal basis |
|---|---|---|
| Legal text acceptance and information records: the text accepted by you or presented to you and its version, the time, the screen, platform, app version, language, the server country shown to you, whether you opened the document and whether the text was read to the end; for the investment disclaimer also the device model | Proof of which text you accepted, or which text was presented to you, in which version and when | KVKK 5(2)(e) — establishment, exercise or protection of a right; for the investment disclaimer KVKK 5(2)(a) |
The Privacy Policy and the KVKK Disclosure are for information and do not depend on your acceptance: they are offered as links at registration and on the consent screen; the record shows that the text was presented to you and that you stated in the box that you have been informed.
| Data | Purpose |
|---|---|
| Crash reports (Firebase Crashlytics): crash and error record, device model, OS and app version, Crashlytics' random installation ID | Crash diagnostics; email, name and portfolio value are not sent |
| Usage statistics (Firebase Analytics): your account number (random user ID), screens viewed, feature usage events (e.g. asset added and its type, notification opened, signal viewed and its symbol), coarse ranges (e.g. asset count range), device and app information, approximate location (country/city) derived by Google from the IP address | Understanding and improving how the product is used; amounts, quantities and email are not sent, no advertising ID is collected |
| Remote configuration (Firebase Remote Config): Firebase's random installation ID | Turning features on and off remotely |
| Sign-up steps (sign-up funnel): a random installation number generated by the App, the step (first launch, registration screen, code verification, etc.), platform, app version, sign-up error code; linked to your account after sign-in | Detecting problems in the sign-up process |
| Structured error logs | Only on errors; request information and error message, with sensitive fields (email, password, token, IP) masked |
| Data | Purpose | Legal basis |
|---|---|---|
| Your account number (random user ID), store transaction record, product (monthly or yearly), store (App Store or Google Play), start and end dates, cancellation status, whether it is a test purchase | Verifying the purchase with the store, linking Premium to your account, applying renewals, cancellations and refunds | KVKK 5(2)(c) — conclusion and performance of a contract |
Card number, billing address and payment method never reach us: your device's store (Apple or Google) collects the payment and processes this information under its own privacy policy.
| Service | Provider | Data | Purpose | Location |
|---|---|---|---|---|
| Backend & database | Supabase Inc. | All account and app data, security logs | Storage, authentication | Germany (AWS Frankfurt, EU); a pre-migration copy stays in Japan (AWS Tokyo) until deleted |
| Push notifications | Google Firebase Cloud Messaging | Push token, notification content | Notification delivery | Global (Google) |
| iOS notifications and Live Activity | Apple Push Notification service | Notification content, Live Activity token and lock-screen summary | Delivery to the iPhone | Global (Apple) |
| Crash reports | Google Firebase Crashlytics | Error record, device model, OS and app version | Crash diagnostics | Global (Google) |
| Usage statistics | Google Firebase Analytics | See §3.5 | Product improvement | Global (Google) |
| Remote configuration | Google Firebase Remote Config | Random installation ID | Feature settings | Global (Google) |
| Email delivery | Google (Gmail email infrastructure) | Email address, verification / sign-in code | Delivering code emails | Global (Google) |
| Sign in with Apple / Google Sign-In (if you choose them) | Apple Inc. / Google LLC | Verification with the provider during sign-in | Authentication | Global |
| Subscription verification (only if you buy Premium) | RevenueCat, Inc. | Your account number (random user ID), store transaction record and receipt, device and app version, IP address | Verifying the purchase with the store and reporting the Premium entitlement to our server (see §3.6) | USA |
| Price and market data | Public market-data providers: exchanges, banks, fund platforms, official institutions (e.g. CBRT) and exchange-rate and price data services | No personal data is sent; only the asset's symbol, fund code or ISIN is queried. For requests sent from the device, the provider sees the device's IP address as with any internet request; some sources are contacted only from our server | Fetching prices and price history | Global |
| Writing asset notes (AI) | Anthropic PBC | No personal data is sent; only the asset's symbol and market metrics (price, trading volume, fund size, money flow and investor count) | Weekly asset note and monthly report text (see §5.3) | USA |
| Statement column mapping (AI; only if you ask) | Anthropic PBC | An anonymous skeleton of the statement's tables (column headings and generic finance words; names, numbers, amounts and dates masked) or, if you gave explicit consent, the words in the tables (column and asset names; all digits and labelled name, address and email masked) | Finding which column is the symbol, quantity, price (see §5.4) | USA |
| Portfolio comment (AI; only if you give explicit consent and ask for a comment) | Anthropic PBC | Return, drawdown and volatility percentages of the period commented on, your assets' names or symbols and their shares of the portfolio (%), inflation and market comparisons for the same period; amounts, quantities, your name, email and account number are not sent | Writing the comment describing a past period of your portfolio or one of your assets (see §5.5) | USA |
These providers act solely as data processors, on our instructions. We remain the data controller. Apple and Google, which collect the Premium payment, are independent controllers for your payment details.
Market-data providers receive no personal data and are therefore not listed individually; adding a new price source does not change this policy. A new provider that receives personal data is used only after it is added to this table.
Top Portfolios is optional and covers only users who give explicit consent in the App. Once you consent, if your portfolio is older than 5 days, your account is older than 7 days and your portfolio holds at least 2 different assets, your period returns (weekly, monthly, six-monthly, yearly) and asset-type shares (e.g. "gold 56%, funds 28%") are computed on the server twice a day and kept in an anonymous comparison pool. If the pool holds at least 8 portfolios, for at most the 4 best-performing portfolios only the rank, return percentage, type shares and the public identifier of each asset with its share in the portfolio (the TEFAS fund code for funds; the public market symbol for stocks, crypto, gold, currencies, commodities and bonds, e.g. "THYAO 18%, BTC 12%"; items with a share below 1%, manually priced items or items without a public symbol are grouped within their type) are shown to other users who have joined the pool; fund names come from the official TEFAS list. Symbols of non-fund assets are shown only for participants who accepted the 20 October 2026 version of this notice; for those who accepted an earlier version only type shares and fund codes are shown. In return you see, in the same anonymous form, which assets participating users hold in which proportions and their returns; the combined share of the assets your portfolio has in common with the listed portfolios (similarity percentage) is shown only to you. This comparison service is available only to participants; seeing the asset symbols of other portfolios and newly joining the pool may require a Premium membership, which does not change which of your information is shown. Name, email, username, amounts, quantities and the names and notes you give your assets are never shared; the information shown contains no data that would reveal your identity. If you do not consent, your return is neither computed nor stored for this purpose; other features of the App are unaffected. You can withdraw your consent at any time from the Top Portfolios screen; when you do, your measurements in the pool are deleted immediately. The date of consent and the version of the text shown to you are recorded as proof of consent. When you delete your account, these records and your measurements in the pool are deleted too.
A user you have a partnership with sees your username and the assets, quantities and performance in your portfolio. In the Race your identity and amounts are not shown to other participants; you are shown only your own percentile and can compare returns with your partner.
The weekly asset notes on asset pages and the monthly report are written on our server with Anthropic's AI model (Claude). A note is written once per asset, not per user: everyone holding the same asset reads the same note. Opening or reading a note sends no request to the AI; the note is read from the database.
Only the asset's symbol and public market metrics are sent to the model (price change, trading volume, fund size, money flow and investor count). Your name, email, account ID, username, the quantity and amount you hold, or who holds an asset are not sent. The assets that get a note are selected from the aggregate list of assets held in users' portfolios (most-held first); this selection is not sent to the model either.
Notes are generated automatically and checked automatically before publication: every number in the text is compared with the source data, and a note using buy/sell/target-price language is not published. No person reads each note; notes may contain errors. If you flag "wrong number" on a note or write an explanation, that feedback is stored with your account and used only to correct notes; it is not shown to other users.
A statement file is always read on your device. When the App can't tell, in a layout it doesn't recognise, which column is the symbol, quantity or price, it offers you "Map with AI". Nothing is sent unless you tap it. This option is Premium content.
If you tap it, your device builds an anonymous skeleton of the tables and sends it via our server to Anthropic's AI model (Claude). The skeleton contains the table layout, column headings and generic finance words ("Pay Adedi", "Birim Fiyat", "PORTFÖY"); names, customer and account numbers, national ID numbers, addresses, amounts and dates are masked (every letter becomes "A", every digit "9"). Our server rejects a skeleton containing unmasked digits before it reaches the model. The model only says which column is which; the values are still read from the file on your device and shown to you before anything is added.
Reading with the words in the tables (if you give explicit consent). Because the anonymous skeleton also masks words, the model cannot recognise column headings and fund names in some statements. So the first time you tap "Map with AI" the App asks for your explicit consent on a separate card. If you consent, the words in the tables (column headings, asset and institution names) are sent instead of the skeleton; all digits (amounts, quantities, prices, IBAN, national ID, account, customer and phone numbers) are masked with "9", and email addresses and information following labels such as "Sayın", "Ad Soyad", "Adres" are masked with "A". A name written without a label may not be masked; that is why this path is used only with your consent. If you do not consent, the anonymous skeleton path is used. You can withdraw your consent at any time with "Withdraw AI consent" on the same screen; later requests do not send words.
Our server derives a one-way trace (digest) from a table's header row and stores the column order the model found for that table together with the trace (bank template). When a table with the same layout arrives again, the model is not called. A template consists only of the trace and column numbers; the table's text, values and who uploaded it are not kept.
The skeleton, the text sent and the model's answer are not stored. To limit abuse and cost, only the time of the request, the model used and its cost are kept with your account for 40 days.
You can ask for a short comment describing the period you select (from the last week to the last 5 years): for your portfolio in Performance › Summary, and for that asset on the asset detail page; in Performance › Summary last week and last month can also be commented on. This feature is optional and Premium content. The first time you use it the App asks for your explicit consent on a separate card; if you do not consent, nothing is sent.
If you consent and tap "Comment on this period", your device calculates the metrics of the period commented on: return, drawdown and volatility percentages, your assets' names or symbols and their shares of the portfolio (%); together with public market comparisons such as inflation (CPI) and the percentage change of the dollar, gold and BIST 100 in the same period. These metrics are sent via our server to Anthropic's AI model (Claude). Amounts, quantities, your name, email, username and account number are not sent; our server rejects a request containing a currency or a four-digit number before it reaches the model.
Once written, the comment is saved and read from the database when you open it again, without a request to the model: the last week and last month comments for the rest of the period, the selected period comment for the day it was written. The metrics sent with it, the model used and its cost are also stored; for an asset comment, an irreversible digest of the asset key is stored instead of the asset itself. Only you can see your comment. Retention: for each user, the last 4 weeks and the last 12 months of last week/last month comments and the last 7 days of selected period comments; older ones are deleted automatically.
The comment describes the past; it contains no buy, sell or hold suggestion and is not investment advice. Comments are generated automatically and checked automatically before they are shown (numbers are compared with the metrics sent; a comment with directive or forward-looking language is not shown); no human reads them one by one and they may contain errors.
You can withdraw your consent at any time with "Turn off AI commentary" on the same card; when you do, your written comments are deleted and your metrics are no longer sent.
Because the Supabase database is hosted in Germany (AWS Frankfurt, EU; a pre-migration copy stays in Japan, AWS Tokyo, until deleted) and Firebase in the USA, your data is transferred outside Türkiye. The in-app text shows the country of the server you are connected to. Apple's and Google's notification, sign-in, email and store payment services also run on global infrastructure. If you buy Premium, your subscription record is verified through RevenueCat (USA). If you use the AI portfolio comment or reading a statement by its words, the related data is sent to Anthropic (USA); this transfer relies on the explicit consent you give separately in the App the first time you use the feature (see §5.4, §5.5). Under KVKK Article 9 and GDPR Articles 44-49:
The destination countries (Supabase: Germany (AWS Frankfurt, EU); a pre-migration copy stays in Japan (AWS Tokyo) until deleted; Firebase and RevenueCat: USA) are not on the list of countries with adequate protection announced by the Turkish Data Protection Board; therefore international transfer is based on your explicit consent.
| Data | Period |
|---|---|
| Account data | Until account deletion |
| Asset records and contract details | Until account deletion |
| Portfolio snapshots | Last 2 years (730 days) rolling; older entries are deleted automatically every day |
| Top Portfolios pool measurements (return %, type share %) | Last 365 days rolling; immediately on consent withdrawal or account deletion |
| Race measurements (return %, type share %) | Last 365 days rolling; immediately on account deletion |
| Registered devices | Until you remove the device from the list or delete your account |
| Feedback on asset notes | Until account deletion |
| Premium entitlement and subscription records | Until account deletion; deleted immediately when you delete your account. At the same time RevenueCat is asked to delete your subscriber record; payment and invoice records stay with Apple or Google for their own periods. Deleting the account does not cancel the store subscription; you turn off renewal in the App Store or Google Play |
| Statement column mapping request records (time, model and cost only; the skeleton, the text sent and the answer are not stored) | 40 days |
| Statement bank templates (one-way trace of the header row and column numbers; not linked to any user) | As long as the institution's table layout is in use; a template found to be wrong is not used |
| AI portfolio comments (comment, metrics sent, model and cost) | For each user, the last 4 weeks and the last 12 months of last week/last month comments and the last 7 days of selected period comments; immediately when consent is withdrawn or the account is deleted |
| Consent records of AI features | Until the account is deleted (the withdrawal time is also recorded) |
| Legal text acceptance records (Terms of Service, Privacy Policy, KVKK Disclosure, Explicit Consent Notice, investment disclaimer) | 3 years after account deletion (Turkish Code of Obligations Art. 146 limitation period) |
| Push token | Deleted on sign-out; if the App is uninstalled, found invalid and deleted at the next send |
| Notification records (in-app notifications, price alert notifications) | 90 days |
| Signal notifications | Until you delete them or delete your account |
| Notification delivery logs (to avoid sending the same notification twice) | 30 days to 18 months depending on type |
| Structured error logs (db_logs, errors only) | 30 days |
| Sign-up funnel steps | 400 days |
| Crash reports (Crashlytics) | 90 days |
| Usage statistics (Firebase Analytics) | As set in Firebase's retention setting, at most 14 months |
| Anonymous deletion record (one-way hash of the account ID, email domain, time and reason of deletion) | 3 years after deletion (Turkish Code of Obligations Art. 146 limitation period); expired entries are deleted automatically every day |
| Sign-in security log (IP, device/browser; Supabase Auth security log) | 90 days; older entries are deleted automatically every day |
When you delete your account from the App, your account and all the data you entered are deleted from the live database immediately. Exceptions: legal text acceptance records (3 years), structured error logs and sign-up funnel steps (unlinked from the account, until the end of their own periods), crash reports and usage statistics in Firebase (until the end of their own periods), the sign-in security log (90 days), and an anonymous deletion record consisting of a one-way hash of your account ID and your email domain (3 years).
You may exercise the following rights by contacting us:
How to make a request:
1. In-app: Profile → Settings → "Delete Account" / "Download My Data"
2. Email: Apply to support@murphysoft.app with identifying information
3. Web form: https://yasincirali.github.io/sandikapp/data-request
Under KVKK Article 13(2) we respond to your requests within 30 days.
Right to complain: If the response is not satisfactory: - Türkiye: Personal Data Protection Authority — kvkk.gov.tr - EU: Your local data protection authority (DPA)
The App is not designed for people under 18. At registration you declare that you are over 18. If we notice that a user under 18 has entered data, the account is deleted immediately.
Under GDPR Article 8, parental consent is required for under-16s in the EU; we do not accept this age group.
Technical and organisational measures we take:
Under KVKK Article 12, if a data breach is detected: - Notification to the Turkish Data Protection Board within 72 hours at the latest - Direct notification to affected users - A GDPR Articles 33-34 compliant process for EU users
As a mobile app, the App does not use web cookies. Stored on the device:
When you sign out, the session token, your cache and preferences and the widget data are removed from the device. The App contains Firebase Analytics (usage statistics) and Crashlytics (crash reports) (see §3.5); it contains no advertising SDK and no advertising ID. Details: Cookie and Local Storage Policy.
sandık is a portfolio tracking tool. It is NOT an investment adviser or brokerage licensed by the SPK (Capital Markets Board of Türkiye). Prices, performance, signals, charts, market-movement metrics (money flow, volume radar, buyer pressure), AI-written asset notes and portfolio comments shown in the App are for information only and do not constitute investment advice. Make your investment decisions after consulting an SPK-licensed adviser.
The full text of this notice is shown to you during registration (and on the consent screen at the first sign-in with Apple or Google); you accept it at the bottom after reading it to the end. The record of your acceptance is kept as legal evidence.
When we change this policy: - The new text is published with a new version number; the text on the website and in the App is always the same - The "Last updated" date is refreshed - For material changes (new personal data, a new third party receiving personal data, a new purpose or retention period) the "Consent version" is also moved to the new version; the current text and a summary of the changes are shown on the next launch and before continuing you are asked to state in the box that you have been informed by the current text - For corrections that do not change how personal data is processed (wording, clarifications, a market-data source that receives no personal data) only the "Version" and "Last updated" change; no new confirmation is requested - A new processing activity, a third party receiving personal data or a retention period is added only by updating this text
For all questions, requests and complaints about data protection:
support@murphysoft.appIstanbul, Türkiyesupport@murphysoft.appThis policy is provided in Turkish and English. In case of discrepancy, the Turkish version prevails.