Privacy Policy

In short

Yetir is published in the App Store and Google Play by İlkyaz Taşdemir, who is the seller of the app and of its paid plans. The app, the site and the servers are developed and operated by Passionitech Inc FZE ("we", United Arab Emirates), which is the controller of the personal data described in this policy. The app asks for no account. The income, expenses, accounts and goals you enter stay on your phone. Only if you turn on the optional backup and sign in is a copy kept on our server (in Frankfurt, EU), tied to your sign-in address, so you can restore it on another phone. We do not sell your data.

Data kept on your phone

Everything you enter in the app (records, categories, accounts and balances, debts, goals, templates, recurring items, investments, your settings) is stored only in the app's space on your phone. When you delete the app it is erased from the phone, and "Delete my account" erases it after the 2 days described under "Deleting data and exercising your rights". Unless you turn on the optional backup (next section) we hold no copy of it: if you change phones or delete the app it is gone, so you can export (CSV, PDF) to keep a copy of your own.

Receipt, document and cheque photos are kept on your phone and, if you turn on the optional backup, in the backup too (next section). The camera and photo library are used only when you choose to attach a receipt.

Contacts: when you link a debt to a person you can pick them from your contacts. The name you pick is stored in the debt record on your phone; your address book is not sent anywhere.

Microphone: the in-app assistant has a microphone button for short voice notes. The microphone is opened only when you tap it (your phone's system asks for your permission the first time) and recording stops by itself after 20 seconds; the recording is kept on your phone only in a temporary file until it is sent and then deleted. What is sent, and when, is described under "Optional AI help"; without your AI permission nothing is sent.

Face ID, fingerprint or face unlock is used only for the app lock; the app cannot read your biometric data, the operating system does the check.

Reminders and notifications are created locally on your phone; they do not come from a server.

Optional backup and sign-in

Backup is optional and is off until you turn it on in the app and sign in. Without it, nothing in the previous section leaves your phone, apart from what "Optional AI help" (only if you allow it) and "Market prices" describe.

Once it is on, the app sends a copy of what is stored on your phone to our server over an encrypted connection (TLS): your records, categories, accounts and balances, debts (including the name of a contact you picked), goals, templates, recurring items, investments and your settings (currency, display name, reminders, your own units and similar), and keeps the copy in step as you make changes. The copy is stored in our Supabase database in Frankfurt (EU) and is tied to your account. Its purpose is to let you restore your data on another phone. It is not end-to-end encrypted. Receipt, document, cheque and note photos go up with the backup while “Back up photos too” in Settings is on (it is on by default; turn it off and they stay on your phone only). They are stored in a private storage area of our Supabase project in Frankfurt (EU), in a folder that only your account can read; no photo is used for AI reading or analytics, and a photo that no record points to any more is deleted from the server after about a day. Your address book is not uploaded. App lock, biometrics and payment details are never uploaded.

Start over: Settings has a “Start over” action that clears your records, accounts, goals and the rest of your data from the phone. It is available only while backup is on and you are online; with backup off, or with no connection, nothing is done. Before anything is cleared, our server makes a frozen copy of everything your account holds at that moment: records, accounts, goals, debts, categories, templates, tags, the settings that are backed up and the references to your receipt photos. The copy is kept for 30 days and then deleted automatically (a nightly job); at most three copies are kept per account, and the oldest goes first. “Restore previous data” in Settings lists the copies (date and counts) and lets you put one back; before it does, it makes a copy of what is on your phone at that moment, so a restore can be undone too (also for 30 days). You can delete a copy from the app at any time and it goes at once. Receipt photos that a copy points to stay in the private storage until the copy expires or is deleted, and are then deleted like any photo no record points to. The copy sits in the same database and is covered by the same access rules as the backup (only your account can read it); it is not shared with anyone else and is not sent to analytics or to the AI service.

To use backup you sign in with a six-digit code sent to your e-mail address or, where the app offers them, with Google or Apple. Supabase keeps the account (your e-mail address, or the one Google or Apple gives us, the sign-in method and the technical records of your sign-ins). The code e-mails are sent by our own server through Cloudflare's e-mail service from destek@servicebox.io; to stop misuse we count the e-mails sent per address using a one-way hash of the address, and these counters expire after about a day. Our server logs only the domain of the address, never the address or the code.

The providers involved are Supabase (database and sign-in), Cloudflare (hosting and sending the code e-mails) and, only if you choose them to sign in, Google and Apple, which act under their own privacy policies. We do not collect bank login details or card numbers, and the app has no connection to your bank.

The usage data and crash reports described below are separate from the backup and are not tied to your account.

Optional AI help

The app can use an AI service for four things: reading a scanned receipt, reading a card or bank account statement, turning a sentence you type to the in-app assistant (for example "Migros 480" or "yesterday 200 groceries") into an expense or income draft, and turning a short voice note you speak to the assistant (for example "yesterday two hundred fifty lira groceries") into the same kind of draft. You give one general permission for all four: the app asks once ("Let AI help read what you add?"), the first time the assistant (typed or spoken), a receipt scan or a statement import needs it, and your answer covers all four. It is a single switch in Settings (Settings → AI reading) that you can change at any time; there is no separate permission or switch for receipts or for statements.

When you scan a receipt, the phone first reads it itself (text recognition on the phone). If you have allowed AI help in the app (the one permission described above; Settings → AI reading), the recognised text, together with the names of your own spending categories, your currency and your language, is also sent to our server so that an AI model can read the total, date, category and items more accurately. The photo never leaves your phone.

Our server passes the text to an AI service (OpenRouter, which routes it to the model provider; in the USA) and returns the result to the app, which shows it for you to confirm. We do not store the text or the result on our servers; we keep only a count of how many readings are made each day, tied to a random name of your installation and to a one-way digest of your network address (no account is needed), to apply a daily limit; these counters expire after about a day. The providers act under their own terms.

This is off until you allow it and you can turn it off at any time in Settings; then nothing is sent and receipts, statements and typed sentences are read only on your phone, by the app's own reading. A voice note cannot be read on the phone, so with the switch off the microphone button asks for the permission again, and nothing is sent until you allow it.

When you add a card or bank account statement (a PDF, photos or screenshots, a CSV or an Excel file), the phone first reads the text itself. If you have allowed AI help in the app (the same single permission as for receipts, not a separate one for statements; the app asks the first time any of them needs it; Settings → AI reading), the text of the statement's lines, with card numbers, IBANs, ID and phone numbers, e-mail addresses and the address lines of the header removed as far as we can (best effort: a name may remain), together with the names of your own spending categories, your currency and your language, is sent to our server so that an AI model can read the lines and suggest a category for each. The file and the photos never leave your phone. The service is the same as for receipts (OpenRouter and its model provider, in the USA); we store neither the text nor the result, only a daily counter tied to a random name of your installation and a one-way digest of your network address, which expires after about a day. You see every line and choose what is imported; this is off until you allow it and you can turn it off at any time in Settings.

When you type a sentence to the in-app assistant (for example "Migros 480" or "yesterday 200 groceries") and have allowed AI help, the sentence you typed (at most 300 characters), together with the names of your own spending categories, your main currency, your language, today's date and the random id of your installation (used only to count daily limits; no name and no e-mail), is sent to our server and passed to the same AI service (OpenRouter and its model provider, in the USA), which turns it into an expense or income draft. The app shows you the draft and nothing is saved until you review and confirm it. Because you decide what to type, the sentence may contain personal details of your own. We store neither the sentence nor the result on our servers and do not write them to our logs; we keep only the daily counter described above, which expires after about a day. The providers act under their own terms. If you have not allowed it, or have turned it off, the sentence is read only on your phone and nothing is sent.

When you tap the microphone in the in-app assistant and speak a short voice note (for example "yesterday two hundred fifty lira groceries"; at most 20 seconds) and have allowed AI help, the recording (a small audio file: WAV, mono, 16 kHz), together with the names of your own spending categories, your main currency, your language, today's date and the random id of your installation (used only to count daily limits; no name and no e-mail), is sent to our server and passed to the same AI service (OpenRouter and its model provider, in the USA), which listens to it, returns the words it heard and turns them into an expense or income draft. The app shows you the words and the draft and nothing is saved until you review and confirm it. The microphone is opened only when you tap the button; the first time, your phone's system asks whether the app may use the microphone (you can refuse it, or withdraw it in your phone's settings), and the recording stops by itself after 20 seconds. On your phone the recording is kept only in a temporary file until it is sent and is then deleted. A recording can carry your voice and the voice of anyone speaking near you; it is sent only to be read, and we store neither the recording, the words nor the result on our servers and do not write them to our logs; we keep only the daily counter described above, which expires after about a day. The providers act under their own terms. If you have not allowed it, or have turned it off, the microphone button asks for the permission again, because a recording cannot be read on the phone; nothing is sent until you allow it.

Market prices

When you add an investment from the market search, or have one linked to the market, the app asks our server for prices. To do so it sends the text you searched for, or the market symbols of the holdings you linked (stock tickers, fund codes and crypto codes), together with the app's install id (the random id described under "Usage data and crash reports") and, as with any request, your IP address. It never sends amounts, quantities, the prices you paid, account names or your name. Gold and currency positions are priced from the day's rates the app already downloads, so nothing extra is sent for them.

Our server forwards only the search text and the symbols to ServiceBox's market-data service (servicebox.io, part of the same group and hosted on Cloudflare), which answers from the prices it has stored or, for a search or a symbol it does not have yet, asks its own third-party market-data provider (EODHD) with only that text or symbol. Neither the install id nor your IP address is passed on. Our server stores and caches none of this and writes no search text, symbols, install id or IP address to its logs. The install id and the IP address are used only to limit the number of requests per minute (Cloudflare's rate-limiting counter, which lasts about a minute).

Prices are delayed by 15–20 minutes (some markets give only the end-of-day price), come from third-party market data and are information, not investment advice (see the Terms of Use). Crypto prices exist only for the largest 500 or so coins, and Turkish funds come from TEFAS. A linked holding is refreshed automatically; you can stop that for a holding by editing its price by hand (the holding is then no longer linked to the market) or by deleting it.

Data read from our server

The app downloads two things: the category list and the day's exchange rates with the gold, silver, platinum and copper prices. Both come from yetir.servicebox.io, are public and are the same for everyone. These two requests carry nothing you entered in the app (the price requests for investments are described under "Market prices"); what the app reports about its use is described in the next section.

Cloudflare's infrastructure answers them; as with any website your IP address and the time of the request appear in short-lived server logs. That is not matched with your records. Without a connection the app keeps using the last list and rates it downloaded.

Usage data and crash reports

On first launch the app asks whether you want to share usage data with Mixpanel, our analytics tool (a third party); your answer decides only that. To see which features are used and where the app fails, the app sends our own server a few things, without asking: a random install id it makes on first launch (not a device identifier the platform knows), a random session id, the time of the action, the names of actions such as "expense added" or "plan purchased", the platform, app version, language, plan and country, and, whichever way you answer, when the app crashes or hits an error, a crash report. Amounts, balances, category and account names, people, notes, receipts and your e-mail address are never part of this: the app's types do not allow it, and our server refuses a message that carries anything else.

Usage events go to our server (yetir.servicebox.io), which stores them in our Supabase database in Frankfurt (EU) and, only if you said yes to sharing, sends a copy to Mixpanel, our analytics tool, in its EU region; crash reports go to Sentry, in its EU region. Supabase, Mixpanel and Sentry act as our processors. We keep events in our database for 13 months; the install record (id, first and last seen, platform, version, language, plan and country) is kept until you ask us to delete it; Mixpanel and Sentry keep their copies for no longer than 13 months. The team receives e-mails about purchases and daily totals; they hold aggregates and a shortened install id.

You can change your answer in Settings → Privacy at any time; when you turn sharing off, no further events are passed to Mixpanel, while our own server keeps counting the usage. Whichever way you answer, and each time you change it, the app sends our server a minimal record of your choice: the random install id, your answer and the time, nothing else. We keep it in our own database in the EU (Supabase, Frankfurt) to honour your choice and to count how many people agree and how many decline; it is not passed to Mixpanel, and it is deleted when you ask us to delete the data of the install. Crash reports carry the install id, plan, language and platform; they contain no names or notes (error messages are built by the app without user entries), and amounts and e-mail addresses in messages are masked before they leave the phone; they cannot be turned off. To have the data of an install deleted, write to destek@servicebox.io with the install id shown in Settings → Privacy.

Ads (Basic plan)

For the first seven days no ads are shown. After that, if you choose to continue with ads, the Basic plan shows Google AdMob ads: a full-screen ad now and then when the app opens, and one ad card on the Summary screen. Pro shows no ads. Ads need internet; with no connection none loads and the app works as usual.

To serve ads Google processes data such as your device's advertising ID, IP address, and device and app information, under its own responsibility. We have no access to this data; the financial information you enter is never sent to the ad network. How Google uses data: policies.google.com/technologies/partner-sites.

In the European Economic Area, the United Kingdom and other regions that require it, Google's consent form is shown on first launch and no ad is requested before you answer. You can change your choice later; in your device settings you can reset the advertising ID or turn personalisation off.

Subscriptions

Paid plans are sold by İlkyaz Taşdemir and bought through the App Store or Google Play. The store handles your payment details; we never see or keep your card information.

To check subscriptions and keep them in step across the two stores we use RevenueCat (RevenueCat, Inc., United States) as our processor. It receives the random install id described above as the customer id, the product bought, the purchase, renewal and cancellation times and the store's purchase token, and it tells our server which plan is active. It does not receive your name, your e-mail address or anything you entered in the app. Write to us with the install id shown in Settings → Privacy if you want a customer record deleted.

Children

Yetir is not directed at children under 13 and does not knowingly collect data from them.

Feature votes, ideas and messages

The Requests screen lists features we are considering. When you tap “I want this” (or tap again to take it back), the app sends our server the option, your choice (yes or no) and the time, with the random install id described above. It sends no name, no e-mail address and nothing you entered in the app; as with any request, the IP address reaches our host's short-lived logs.

We keep the votes in our own database in the EU (Supabase, Frankfurt) to count how many people want each option and decide what to build; they are not passed to any third party. The basis is our legitimate interest in deciding what to build (Article 6(1)(f) GDPR). A vote is removed when you take it back or when we process a deletion request; write to destek@servicebox.io with the install id shown in Settings → Privacy to have it removed without deleting an account. A rating, a message or an idea you write (on this screen or in Help) is sent to us with the random install id, the app version, the platform and the language, and is mailed to us; we use it to answer you and to decide what to build, and keep it until you ask us to delete it.

If you ask a question in Help, the app also asks for an e-mail address so that we can answer you (it fills in the address of your backup account when it has one). That address is sent to us with the question, kept with it in the same database, used only to answer you, and deleted with the question when you ask us to delete your messages.

Deleting data and exercising your rights

Your data is on your phone, so you manage it directly: delete it in the app settings, export it, or remove the app.

If you use backup, choose "Delete my account" in the app settings. The app keeps the request for 2 days, during which you can withdraw it, and sends it to us as soon as you are online and signed in. We process it within 30 days of receiving it: we delete the copy of your data on our server (including its photos and your votes on feature options) and your sign-in account. Until we have processed it, the copy stays on our server. After the 2 days the app also erases the data on your phone and signs you out.

If you used “Start over” or “Restore previous data”, the frozen copies are kept for 30 days from the day they were made and then deleted automatically; you can delete a copy at once from the app (Settings → Restore previous data). When we process your account deletion, the copies are deleted with the account and the rest of the data on our server; they do not wait for the 30 days.

You can write to destek@servicebox.io with questions or requests, for example for a copy of your data or to correct it. The section "Your rights by region" below says which law applies where you live; in Turkey the KVKK notice applies as well.

Deleting the app does not delete the usage data held on our servers or a backup. To delete the usage data, including the record of your usage-data choice, write to destek@servicebox.io with the install id shown in Settings → Privacy; to delete a backup, use "Delete my account" before you remove the app, or write to us.

Your rights by region

We process little personal data about you: your IP address and the time of a request in the short-lived server logs of our web host (Cloudflare), the random install id with the record of your usage-data choice and the action names described under "Usage data and crash reports" (which reach Mixpanel only if you agree to share them), the search text and market symbols described under "Market prices" when you search for or link an investment, the e-mail address you write to us from, on the Basic plan, data that Google AdMob processes under its own responsibility and, only if you turn on backup, your sign-in e-mail address and the copy of your data described under "Optional backup and sign-in". Otherwise what you enter in the app stays on your phone. The sections below say which law applies where you live; they summarise your rights and do not replace the law.

Europe: the EEA and the United Kingdom (GDPR)

For the data we process ourselves we are the controller. Server logs are kept short-term to keep the site secure and running (legitimate interest, Article 6(1)(f) GDPR). The e-mails you send us are used to answer you (legitimate interest). Personalised ads in the app depend on the consent you give in Google's form (Article 6(1)(a)); you can withdraw it at any time. Market prices rest on our legitimate interest in providing the feature you asked for (Article 6(1)(f)); you can stop them for a holding as described under "Market prices". Usage data and crash reports rest on our legitimate interest in improving the app and keeping it working (Article 6(1)(f)). Because crash reports carry the install id, they are personal data under this basis too. Sharing usage data with Mixpanel (a third party) rests on your consent (Article 6(1)(a)): it is passed on only if you say yes when the app asks, and you can withdraw it at any time with the switch in Settings; to object to the usage counts we keep on our own server, or to crash reports, write to destek@servicebox.io. If you turn on backup, we process your sign-in account and the copy of your data to provide the service you asked for (Article 6(1)(b)), and the sign-in e-mails and their misuse limits rest on our legitimate interest in keeping sign-in secure (Article 6(1)(f)).

You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. You can export your data from the app and delete a backup as described above. Write to destek@servicebox.io; we answer within one month. You may also complain to the data protection authority of the country where you live or work (in the United Kingdom, the Information Commissioner's Office).

The backup is stored in the EU (Frankfurt). Our web host and e-mail provider (Cloudflare), the ad network and, if you sign in with them, Google and Apple may process data outside the EEA and the United Kingdom. They do so under their own transfer safeguards, such as the European Commission's standard contractual clauses. We take no decisions about you by automated means.

Türkiye (KVKK)

For people in Turkey the KVKK notice applies. It sets out the controller, the purposes, the legal grounds and your rights under Law No. 6698.

United Arab Emirates (PDPL)

We are established in the United Arab Emirates (Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates). Personal data we process is handled under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).

You may ask us for access to your personal data, its correction or erasure, the restriction of its processing, to object to it, to receive it in a portable form, and to withdraw consent you gave earlier. Write to destek@servicebox.io. You may also complain to the UAE Data Office.

Saudi Arabia and the rest of the Gulf

In Saudi Arabia the Personal Data Protection Law (Royal Decree No. M/19 of 2021) gives you the right to be informed, to access your personal data, to ask for its correction and its destruction, and to withdraw your consent.

Where another data protection law applies where you live, we handle your request under that law in the same way. Write to destek@servicebox.io.

Changes

If the app starts sending other data to a server (for example household sharing), this policy is updated before the feature is released and announced in the app.

Contact

Passionitech Inc FZE · Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates · destek@servicebox.io