Your records never leave your phone or reach us. The only data that reaches us: pseudonymous usage statistics and crash reports if you allow them, and the emails you send us.
This notice is prepared under Article 10 of Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, to inform people who use the Kartopu mobile app (“Kartopu”, “the app”) (“you”) about their personal data. In case of any difference, the Turkish text prevails.
1. Data controller
| Data controller | Hakan Eren |
| Address | Gültepe Mah. Eğri Sok. Küçükçekmece/İstanbul, Türkiye |
| destek@kartopu.app | |
| Website | https://kartopu.app |
2. First: your records don’t come to us
Kartopu has no server and the app doesn’t ask you to open an account. What you enter in the app is kept only on your phone, in the app’s own storage:
- your assets, income and expenses, debts and receivables;
- your goals and plans;
- your review answers and change history;
- your settings and, if you choose to enter it, your name.
This information is not sent to us or to any third party. We cannot access, see or store it. You can delete or export it from the app at any time; it is also deleted when you uninstall the app.
The rest of this notice covers the limited data that does reach us or our service providers.
3. Personal data processed, purposes and legal grounds
3.1 Product analytics (only with your explicit consent)
- When: Only if you turn on “Product analytics” during setup or in Settings → Privacy. Otherwise no analytics event is generated or sent.
- Data category: transaction security and usage data.
- Data processed:
- Pseudonymous install ID: a random ID generated when the permission is first turned on. It has no link to your name, device or support ID.
- Event name: from a fixed list, e.g. “record created”, “plan created”, “goal reached”.
- Event parameters: fixed values, e.g. record type, goal category, whether a plan is cash or credit.
- Time of the event.
- Technical information: app version, operating system (Android/iOS), store, app language.
- Purpose: To understand which features are used and where people struggle, and to improve the app.
- Legal ground: Explicit consent (KVKK Art. 5/1).
- Not processed: Amounts, balances, rates, your name, the names and notes of your records, what you tell Karto, your support ID, contacts, location, advertising ID. No profiles are built.
3.2 Crash reports (only with your explicit consent)
- When: Only if you turn on “Crash reports”. Otherwise crash reporting never starts.
- Data category: transaction security.
- Data processed: pseudonymous install ID; error type and where in the code it occurred (stack trace); app version, device type and operating system; time of the error.
- Removed on the device: Numbers longer than 3 digits, amounts with currencies and email addresses in the app’s own error messages are removed before sending.
- Never collected: Screenshots and screen structure.
- Purpose: To find and fix errors and crashes in the app.
- Legal ground: Explicit consent (KVKK Art. 5/1).
3.3 Support requests
- When: If you write to destek@kartopu.app.
- Data category: contact and customer transaction.
- Data processed: your email address, the content of your message and anything you add to it, including your support ID or install ID if you choose to.
- Purpose: To solve your problem, answer your request and conclude your KVKK application.
- Legal ground: being directly related to the conclusion or performance of a contract (Art. 5/2-c); the controller’s legal obligation, for KVKK applications (Art. 5/2-ç); legitimate interest, provided it does not harm your fundamental rights and freedoms (Art. 5/2-f).
- App behaviour: The app never adds your name, amounts or records to your email.
3.4 The app’s internet requests (these don’t reach us)
When online, the app downloads current exchange rates and gold/silver prices from public sources such as the Central Bank of the Republic of Türkiye, and reads app parameters (e.g. the withholding tax table) from a public address.
These requests send no information about you. As with any internet connection, these sources can see the connection’s IP address. They do not process data on our behalf and are subject to their own policies.
3.5 App stores
The store you download the app from (Google Play, Apple App Store, Huawei AppGallery) processes download, payment and device information under its own privacy policy and responsibility. The aggregate statistics stores give us (e.g. download counts) do not identify you.
4. How personal data is collected
- Product analytics and crash reports: Collected automatically by the app from the moment you give permission, and sent electronically to our service providers.
- Support requests: Through the emails you send us, also electronically.
5. Transfers of personal data
| Recipient | Role | Data | Location |
|---|---|---|---|
| PostHog Inc. | Processor (analytics) | Data in 3.1 | EU data centre (Frankfurt, Germany) |
| Functional Software Inc. (Sentry) | Processor (crash reports) | Data in 3.2 | EU data centre (Frankfurt, Germany) |
| Lark Technologies Pte. Ltd. (Lark) | Processor (email) | Data in 3.3 | Outside Türkiye |
| Authorised public authorities | Recipient authorised by law | Requested data | Türkiye |
Transfers abroad. PostHog’s and Sentry’s servers are in the European Union, and the servers of Lark, our email provider, are also outside Türkiye, so the data in 3.1, 3.2 and 3.3 is transferred abroad. The transfer is made under KVKK Art. 9 with the standard contract announced by the Board; the standard contract is notified to the Personal Data Protection Authority within 5 business days of signing.
IP addresses at providers: Your IP address reaches the provider during the connection but is not stored by the provider.
Your personal data is not sold, used for advertising or shared.
6. Retention
| Data | Period |
|---|---|
| Product analytics events | 12 months |
| Crash reports | 3 months |
| Support correspondence | 3 months |
| KVKK applications and replies | 3 months |
| Data on your phone | Stays on your phone until you delete it or uninstall the app. It never reaches us. |
- If you withdraw consent: Data based on consent is deleted unless another reason requires keeping it. See section 7.
- When the period ends: Data is destroyed under the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.
7. Explicit consent and withdrawing it
Two separate explicit consents are requested, one for product analytics and one for crash reports. Before giving them, note:
- They are optional. Without them you can use every feature of the app in the same way.
- They are separate. You can give one and not the other.
- They start off. Both switches are off; consent is given only if you turn them on.
- Their scope is limited. Your amounts, balances, name, records and what you tell Karto are outside any consent and are never sent.
You can withdraw either consent independently at any time in Settings → Privacy. Withdrawal does not affect the lawfulness of processing up to that point and does not restrict any feature. When you withdraw:
- Sending stops. Events and crash reports waiting on your phone are deleted at once.
- The install ID is deleted. This happens only when both permissions are off. Turning them on again creates a new ID with no link to the old data.
- Data already sent is deleted at the end of the period in section 6. Since Kartopu has no server, we cannot learn on our own that you withdrew consent. To have it deleted sooner:
- Before turning the permission off, copy the install ID in Settings → Privacy.
- Send it to destek@kartopu.app.
- The data for that ID is deleted from the providers.
8. Your rights under KVKK Art. 11
By applying to the data controller, you can:
- a) Learn whether your personal data is processed.
- b) Request information about it if it is.
- c) Learn the purpose of processing and whether it is used accordingly.
- ç) Know the third parties in Türkiye or abroad it is transferred to.
- d) Request correction if it is incomplete or inaccurate.
- e) Request erasure or destruction under the conditions of KVKK Art. 7.
- f) Request that actions under (d) and (e) be notified to third parties the data was transferred to.
- g) Object to a result against you arising from analysis exclusively by automated systems.
- ğ) Claim compensation if you suffer damage due to unlawful processing.
9. How to apply
You can apply in line with the Communiqué on the Procedures and Principles of Application to the Data Controller:
- in writing, to the address in section 1;
- by email to destek@kartopu.app, from an email address you have previously notified to us and that is registered with us.
Your application should include: your full name, your signature (for written applications), your Turkish ID number (or, if you are not a Turkish citizen, your nationality and passport or ID number), your postal or email address, and your request. For applications about analytics or crash report data, adding your install ID lets us find your data. Without it we cannot match that data to you, because we don’t keep it under your name.
Response time. Your application is concluded free of charge within 30 days at the latest; if it requires an additional cost, the fee in the Board’s tariff may be charged. If your application is rejected, you find the answer insufficient or it is not answered in time, you can complain to the Personal Data Protection Board (KVKK Art. 14).