Ödeme Takip Privacy Policy

Ödeme Takip keeps your debts, loans, cards, payments, recurring payments and incomes, and accounts only on your phone; if iCloud Drive is on, its backups are also written to your own iCloud account. They are not uploaded to our server. The app has no ads, no analytics, no tracking and no third-party SDK, and we do not sell or share your data. Our server is used only for a few things you start yourself: an e-mail verification code, mailing your backup to your own address, optional Sign in with Apple or Google, and current currency and gold rates.

• Your profile: your name and e-mail address.
• Your optional PIN, stored as a salted hash (PBKDF2), never as the PIN itself.
• Loans, cash advances, credit cards and statements, personal debts and repayment plans, recurring payments and incomes, accounts and cash, transactions, payment records and settings.
• Daily copies of the last 7 days, so nothing is lost.

This data lives in the app's private storage on your phone. Reminder notifications are scheduled on your phone too, not sent from a server. Deleting the app deletes all of it from the phone; an iCloud backup, if you have one, stays in your iCloud.

• If iCloud Drive is on, after your data changes the app writes its backup file to an "ödeme takip" folder in your own iCloud Drive and keeps the backups of the last 7 days. The file holds the same as the e-mailed backup: debts, payments, accounts, transactions and settings. Your name, e-mail address and PIN are not in it.
• These files live in Apple's iCloud service, in your Apple Account, under Apple's privacy policy. We cannot see them, and nothing is sent to our server.
• When you install the app on a new phone or reinstall it, it finds this backup and offers to restore it; nothing is restored unless you say so.
• Turn it off in Settings → backup → "iCloud backup". Delete the backups in the Files app or in iPhone Settings → your Apple Account → iCloud.

• E-mail verification code: when you ask for a code to reset your PIN or to mail your backup, your e-mail address is sent to our server (api.krykftn.dev) and a 6-digit code is mailed to it. The server keeps only a hash of the code, in memory, for at most 10 minutes. Once verified, your phone receives a signed verification token valid for one year, kept on your phone.
• Mailing your backup: when you tap this, your backup file (all your data) reaches our server only to be attached to an e-mail to the address you verified. It is not stored on the server. E-mails are sent through Google's Gmail mail servers; after that the backup sits in your own mailbox.
• Sign in with Apple or Google (optional): if you choose it, an account is created on our server holding your e-mail address, your name and the stable user id the provider gives for your account. Your debt and payment data is not uploaded to it.
• Rates: the app fetches current dollar, euro, pound and gold rates from our server. The request carries no personal data.

Our server is hosted by Hetzner in the EU (Finland). As with any web request, it sees the connection's IP address, which is used only to limit abuse.

The "ask AI about this month" summary is prepared on your phone and shown to you first. It leaves the phone only when you tap share, and goes to the app you pick (for example Claude or ChatGPT), whose privacy policy then applies. We never see it.

Ödeme Takip shows no ads, contains no advertising or analytics SDK, and does not track you across apps or websites.

Ödeme Takip is not directed at children and does not knowingly collect data from children.

• Delete all data on your phone and, if you have one, your account on our server at any time from Settings → account → "delete account and all data". If you signed in with Apple, that link is revoked with Apple too.
• Signing in with Apple or Google is optional; the app works fully without it.
• You can also ask us to delete it through the contact form below.

If this policy changes, the new version will be published at this same address with a new date.