Skip to content
moneyremind

KVKK information notice

This notice tells you, as Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the information obligation require, how personal data is processed in the MoneyRemind app and on this website (moneyremind.com). It is information only: it asks for no consent and you don't need to accept it.

The Privacy Policy explains the same processing in more detail, also for users in the EU. If the two ever seem to differ, write to us at [email protected].

On this page

1. Data controller

MoneyRemind is operated by Metin Yılmaz (Türkiye), the data controller (veri sorumlusu) under KVKK. The controller is an individual, not a company.

Contact: [email protected], or in the app Menu › Help & support.

2. What we process, why, and on which legal basis

Each activity below lists the data, the purpose and the legal basis under KVKK Article 5. We process no special categories of personal data (KVKK Article 6). Financial records are not a special category; please don't write health or similar details into notes or people labels.

Your account

  • Data: name, email address, password (stored only as a one-way hash), app language, profile photo if you add one; with sign-in with Google or Apple, your name, email address and the provider's user id instead of a password.
  • Purpose: creating your account, signing in, keeping it secure and sending account emails (sign-up code, password reset, welcome, password changed, account deleted).
  • Legal basis: establishing and performing the contract with you (Art. 5(2)(c)).

What you enter

  • Data: transactions, payments, repeating payments and installments with amounts, currencies, titles, notes, categories and dates; groups, people labels, budgets, savings goals and photos you attach.
  • Purpose: tracking, reminders, summaries and syncing between your devices.
  • Legal basis: performing the contract (Art. 5(2)(c)).

Shared groups and invitations

  • Data: the email address of the person you invite, their role, and who added which entry.
  • Purpose: delivering the invitation and running the shared group you asked for.
  • Legal basis: performing the contract with you (Art. 5(2)(c)); for the invited person, our legitimate interest in delivering an invitation they can accept or ignore (Art. 5(2)(f)). Invitations that are not accepted are deleted 30 days after they expire, are declined or are withdrawn.

AI features

  • Data: your question or what you said, plus a summary of your entries (amounts, categories, dates, short titles); for AI voice add, also your category, people and group labels; for receipt scan, only when you tap Scan receipt, the receipt photo, the app language and your category list. Never notes, your name or email, or account details.
  • Purpose: Premium AI voice add, receipt scan, AI answers and the weekly brief, only after you turn AI features on.
  • Legal basis: performing the contract, as you ask for the feature (Art. 5(2)(c)). The app asks before the first AI request; that screen is your choice to use the feature, not explicit consent (açık rıza). If you say “Not now”, the app keeps working on your device.

Subscriptions and trials

  • Data: your user id, plan, status, end date and the store's purchase data (via RevenueCat); keyed hashes (HMAC) of your normalized email address and of the app's random device key for the free trial; Apple's DeviceCheck “trial used” mark for the device, which Apple keeps and which gives us no device identifier; gift codes you redeem.
  • Purpose: providing Premium and giving the free trial once per person: once per email address and once per device. The trial is given only to accounts created in the iPhone or iPad app.
  • Legal basis: performing the contract (Art. 5(2)(c)); preventing trial misuse is our legitimate interest (Art. 5(2)(f)).

Notifications

  • Data: your device's push token and the notification text (which may include a payment's title or the start of a support reply). When you write to support, the start of your message goes to our support staff's phones as a notification.
  • Purpose: delivering the reminders you set up and telling you when we answer your support request. You allow notifications in your phone's settings.
  • Legal basis: performing the contract (Art. 5(2)(c)).

Support and data requests

  • Data: your messages and attachments and our replies, name, email, device, app version and language, IP address; while answering, our support staff also sees your plan, sign-up date and last activity.
  • Purpose: answering you and fixing problems; answering requests about your data.
  • Legal basis: performing the contract (Art. 5(2)(c)), our legitimate interest in fixing problems (Art. 5(2)(f)) and, for data requests, our legal obligation (Art. 5(2)(ç)).

Security and diagnostics

  • Data: sessions (IP address, browser or device), server logs (IP address, request path, request id, ids and counts), a security log of important account actions, app error reports and purchase steps (no personal content).
  • Purpose: protecting accounts, stopping abuse and making sure the app and purchases work.
  • Legal basis: our legitimate interest (Art. 5(2)(f)); records the law requires (Art. 5(2)(ç)).

This website

  • Data: the NEXT_LOCALE cookie (your language), your theme choice in local storage, our hosting provider's standard request logs (IP address, browser) and anonymous, aggregate visit statistics (pages, referrer, country, device type, performance).
  • Purpose: showing the site in your language, delivering and protecting it, and understanding aggregate site usage with Cloudflare Web Analytics (cookieless, no IP address stored for analytics, no visitor identification; legitimate interest, Art. 5(2)(f)). There are no advertising or tracking cookies, and no consent banner is needed because nothing is stored on your device for analytics.
  • Legal basis: our legitimate interest (Art. 5(2)(f)).

4. How we collect data

Electronically, partly by automated means: what you type or attach in the app and on this website, records the app and our servers create while you use them (sessions, error reports), your purchase status from the App Store or Google Play through RevenueCat, and, if you sign in with Google or Apple, the sign-in data they send us.

5. Who receives your data

  • Service providers who process data for us, only for the stated purpose: RevenueCat (subscriptions), OpenRouter and the AI model provider it routes to (AI features, only after you turn them on; we ask OpenRouter to route only to providers that don't collect requests or use them for training), Resend (account emails), Expo with Apple Push Notification service and Firebase Cloud Messaging (notifications), Better Stack (server logs and uptime), Cloudflare, Inc. (DNS, CDN and security proxy, tunnel to our server, and cookieless website analytics), and our server and database host (OVH SAS (France)).
  • Apple and Google, for app distribution, payments and on-device speech recognition, under their own policies.
  • Google and Apple, when you choose to sign in with them: they confirm your identity for us and act as independent data controllers for their own sign-in service.
  • People you share a group with, who see that group's entries.
  • Authorities, when the law requires it (KVKK Article 8(2)(a) with Article 5(2)(ç)).

6. Transfers abroad (KVKK Article 9)

RevenueCat, OpenRouter, Resend, Expo and Cloudflare, Inc. are in the United States; the AI model provider OpenRouter routes a request to may be in the United States or another country; Better Stack is in the Czech Republic and our server and database host (OVH SAS (France)) is in France (EU). The Board has no adequacy decision for these countries, so these transfers rely on the standard contracts announced by the Personal Data Protection Board (KVKK Article 9(4)), which we sign with each provider and notify to the Authority within five business days of signing. We don't use explicit consent as the basis for transferring data abroad.

Sign-in with Google or Apple happens with those companies in the United States, as independent controllers under their own policies, and only when you choose it. Store receipts stay with Apple and Google under their own policies. You can ask for the status of our standard contracts at [email protected].

7. How long we keep data

Until you delete it or your account, unless the Privacy Policy names a shorter or longer period for a specific record (for example error reports 30 days, purchase steps 180 days, resolved support requests 2 years). When you delete your account, your data is erased right away, and your customer record at RevenueCat is deleted too.

8. Your rights (KVKK Article 11)

  • to learn whether your personal data is processed, and to ask for information if it is;
  • to learn the purpose of the processing and whether the data is used for that purpose;
  • to know who your data is transferred to in Türkiye or abroad;
  • to ask for incomplete or wrong data to be corrected;
  • to ask for your data to be deleted or destroyed under the conditions in Article 7;
  • to ask that a correction or deletion is passed on to the recipients;
  • to object to a result against you that comes only from automated analysis;
  • to claim compensation if unlawful processing caused you damage.

9. How to apply

  • A copy of your data, right away: in the app, Menu › Legal › Export my data downloads it as a JSON file.
  • In the app: Menu › Help & support › Data request (KVKK/GDPR). The request comes from your signed-in account, so your identity is already verified.
  • By email to [email protected], from the email address registered in your MoneyRemind account. Include your name and surname, your request and how to reach you. If we can't match the request to an account, we ask for confirmation from the account's email before we act.
  • In writing: ask us at [email protected] for our postal address. Applications must follow the Communiqué on application procedures (name and surname, signature, Turkish ID number or for foreigners nationality and passport number, address, and your request).
  • Applying is free. We answer in writing or electronically as soon as possible and within 30 days at the latest. Only if answering costs us something extra (for example more than 10 pages or a data medium) may we charge the fee set by the Board.
  • If we reject your request, you find the answer insufficient or we don't answer in time, you can complain to the Personal Data Protection Board (kvkk.gov.tr) within 30 days of our answer, and at the latest within 60 days of your application (KVKK Article 14).

10. Security and breaches

We take the technical and organisational measures KVKK Article 12 requires (encryption in transit, hashed passwords, access checks on every request, short-lived file links). If a breach affects personal data, we notify the Board within 72 hours of learning about it and tell the people affected as soon as reasonably possible.

11. Changes

If this notice changes, the date at the top changes too. If a change is significant, we'll tell you in the app.

Contact

Operator
Metin Yılmaz, Türkiye
Email
[email protected]
In the app
Menu › Help & support