Privacy Policy

Under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), the data controller for personal data processed through Para Takibim (the "App", "paratakip.sbabac19.com") is:

• Data controller and operator: Sıddık Ceylan (private individual). Para Takibim is not a company; it is run by Sıddık Ceylan as a personal hobby project. It has no registered trade name and no tax liability.
• Email: [email protected]

When you use Para Takibim, the following personal data may be processed:

• Identity and contact data: full name, email address; only if you choose Google sign-in, we receive your email and basic profile details (name, Google account identifier; email/profile scopes only). Email/password sign-in is always available. When you sign in with Google we never see or store your Google password — authentication takes place entirely on Google’s infrastructure.
• Account security data: your password is stored as an irreversible hash and is never kept or transmitted in plain text; if you choose, your two-step verification (2FA) secret is stored encrypted.
• Financial data: assets, debts, income/expense transactions, custom categories and payment channel details that you enter manually and voluntarily. This data has no direct connection to your bank account or any third-party financial institution; it relies entirely on your own manual entries.
• Transaction security data: technical data such as sign-in records, IP address and browser/device information (for account security and to operate the service).
• Preference data: your interface language (Turkish/English), so that reminder emails are sent in this language.

• Creating, opening and managing your account
• Authentication and account security (encryption, 2FA)
• Storing the financial data you enter and showing it to you in the App
• Sending reports you request and transactional emails such as reminders
• Operating the service, fixing technical problems and improving service quality
• Fulfilling legal obligations and responding to legal requests

Your personal data is collected electronically and directly from you, for example when you sign up, enter data, sign in with Google or open a support ticket.

This data is processed on the following legal grounds under Article 5 of the KVKK:

• Necessary for the conclusion or performance of a contract (art. 5/2-c): processing needed for the membership agreement and to provide the free service.
• Necessary for the data controller to comply with a legal obligation (art. 5/2-ç): retention and notification obligations arising from legislation.
• Legitimate interest of the data controller, provided it does not harm your fundamental rights and freedoms (art. 5/2-f): account security, fraud prevention, monitoring service quality.

To provide the service, your personal data may be transferred to the following recipients, limited to what is necessary for the purpose. The Article 5 grounds below concern processing; transfers abroad are assessed separately under Article 9 of the KVKK.

The Board has not issued an adequacy decision under Article 9 of the KVKK for transfers from Türkiye to the countries where these services are provided. A standard contract is one of the appropriate safeguards provided for in Article 9. A process is underway to establish the safeguards required by Article 9 of the KVKK for these services; please contact us at [email protected] for further information.

• Hosting — Hetzner Online GmbH, Germany; account and application data and backups are hosted in Germany (transfer abroad). Data: all account and application data (including financial data you enter) and backups. Purpose: operating the App and database, data storage and backups. Legal basis: conclusion or performance of a contract (art. 5/2-c); legitimate interest in data and service security (art. 5/2-f).
• Cloudflare (traffic security and Turnstile) — Cloudflare, Inc., USA. Data: IP address, browser/request information, security logs and Turnstile bot verification signals. Purpose: reverse proxy service, traffic security and preventing attacks and bots. Legal basis: legitimate interest in service and account security, provided it does not harm your fundamental rights and freedoms (art. 5/2-f). Transfer abroad: processing and transfer outside Türkiye may occur through the US-based service’s global infrastructure; the Article 9 process is described above.
• Google sign-in — Google LLC, USA. Data: name, email address and Google account identifier, only if the user chooses this method (email/profile scopes only). Purpose: authentication and account access using your chosen method. Legal basis: conclusion or performance of a contract (art. 5/2-c). Google sign-in is optional; email/password sign-in is always available. Transfer abroad: authentication on Google’s infrastructure may involve processing and transfer outside Türkiye, including the USA; the Article 9 process is described above.
• Google email (Google Workspace SMTP relay) — Google LLC, USA. Data: email address and system email content (such as verification, password reset and reminders). Purpose: sending system emails relating to the account and service. Legal basis: conclusion or performance of a contract (art. 5/2-c); legitimate interest in account security (art. 5/2-f). Transfer abroad: email delivery may involve processing and transfer outside Türkiye, including the USA; the Article 9 process is described above.
• Competent public authorities — Türkiye. Data: limited to the personal data required by a lawful request. Purpose: responding to legal requests. Legal basis: the data controller’s legal obligation (art. 5/2-ç). No transfer abroad is envisaged in this context.

Appropriate technical and organisational measures are taken to keep your personal data secure. Your password is stored as an irreversible hash; sensitive fields such as the two-step verification secret are stored encrypted. If you sign in with Google, you never share your password with us.

Your personal data is kept for as long as your account is active; not using the App for a while does not by itself lead to deletion. You can permanently delete your account and all of your data on the Account settings page, or send your request to [email protected]; your data is then deleted or anonymised, subject to our legal retention obligations.

Under Article 11 of the KVKK, by applying to the data controller you have the right to:

• learn whether your personal data is processed
• request information about it if it has been processed
• learn the purpose of processing and whether it is used in line with that purpose
• know the third parties in Türkiye or abroad to whom it is transferred
• request correction if it is incomplete or inaccurate
• request deletion or destruction under the conditions set out in the KVKK
• request that corrections/deletions be notified to third parties to whom the data was transferred
• object to a result against you arising from analysis of the data exclusively by automated systems
• claim compensation if you suffer damage because of unlawful processing.

To exercise the rights above, send your request by email to [email protected]. Depending on its nature, your request is concluded free of charge as soon as possible and within 30 (thirty) days at the latest.

This Privacy Policy may be updated in line with changes in legislation or in how the App works. The current text will always be available at paratakip.sbabac19.com.

Under the KVKK Guidelines on Cookie Practices (2025), the necessary session and security categories below and remembering the language/theme preference selected by the user are assessed as not requiring explicit consent. No advertising or analytics cookies are used.

• Necessary session cookie: used to maintain your session and provide secure account access (art. 5/2-c).
• Language/theme preference: stored in the browser’s local storage (localStorage) only to remember the display preference you select; this is not a cookie (art. 5/2-c).
• Cloudflare security cookies (__cf_bm and security cookies used as part of Turnstile): used when needed for traffic security and bot verification (art. 5/2-f); the related data and transfer abroad information is described in section 5.

This Privacy Policy came into force on 20.09.2026 and was updated on 22.10.2026.