Privacy Policy

1. Overview and Data Controller

The Bilanco application ("App") is developed and operated by İbrahim Karaduman under the Blacksmoked brand. Under the Turkish Personal Data Protection Law (KVKK) and the GDPR, the data controller is İbrahim Karaduman (contact: [email protected]). This policy explains why your personal data is collected, how it is used, with whom it is shared and how it is protected.

2. Data Collected

To provide the service, the App processes only the following data:

• Account information: username, email address; account identifier when signing in with Google or Apple
• Financial data: the debt, credit card, payment, planned payment, income, expense and asset (foreign currency, gold, crypto, etc.) records you enter
• Device and technical data: push notification token, platform (iOS/Android), app and update version, app language, time zone and region
• Usage and error data: login times, app error/crash reports (error message and technical details)
• Messages you send through the in-app feedback form
• Notification preferences and app settings

We never ask for your real name, national ID number, or bank account or card numbers; the App does not connect to your bank.

3. Purposes of Use

Data is used only for the following purposes:

• Creating your account, session management and cross-device synchronization
• Calculating and showing debt, interest, payment plan and currency conversions
• Sending payment reminders, app update notifications and service announcements
• Detecting and fixing errors and improving the App
• Security and abuse prevention

4. Data Security

The following measures are taken to protect your data:

• Email addresses and usernames are stored encrypted with AES-256-GCM
• Passwords are stored as one-way bcrypt hashes, never in plain text
• All traffic between the App and the server is encrypted with HTTPS/TLS
• Server access is restricted; regular security updates and backups are performed

5. Third-Party Services

The App uses the following services. Only the minimum data required for each function is passed to them:

• Sign in with Google (Google OAuth 2.0): only your email address and account identifier are obtained; your password is never shared with us. policies.google.com/privacy
• Sign in with Apple: only your email address (or Apple's private relay address) and account identifier are obtained. apple.com/legal/privacy
• Expo Push Notification Service (650 Industries, Inc., USA): to deliver notifications to your device, your push token and the notification text are passed through this service to Apple (APNs) and Google (FCM). Your financial records are not shared with this service. expo.dev/privacy
• Market data: currency, gold and crypto prices are fetched by our server from public sources; no data about you is sent in the process.

6. Data Sharing and International Transfers

Your financial records are stored linked to your account; they are not sold, not used for advertising and not shared with any bank, financial institution or ad network. Your data is shared only with the service providers listed in section 5, to the extent their function requires, and with competent authorities where legally required. When you enable push notifications, your push token and the notification text are transmitted via Expo's servers located abroad (USA); you can turn notifications off at any time in your device settings. The admin panel shows only aggregate statistics that do not identify you (e.g. total number of users).

7. Retention Periods

Data is kept for as long as your account is open. When you delete your account, all of your records are permanently deleted; copies in security backups disappear within the normal backup rotation. Accounts whose email was never verified and that never signed in may be deleted 365 days after creation. Server request logs are deleted after 6 months.

8. Cookies and Tracking

The App uses JWT (JSON Web Token) for session management. No advertising, third-party analytics or tracking tools and no third-party cookies are used.

9. Children's Privacy

The App is not intended for anyone under 18 and we do not knowingly collect data from people under 18. If such an account is identified, it is deleted.

10. Not Financial Advice

Calculations, payment plans, suggestions and currency conversions in the App are for information only and do not constitute financial, investment, tax or legal advice. Calculations are based on the data you enter and on public market prices; the official amounts of your bank or institution prevail. You remain responsible for your financial decisions.

11. Your Rights

Under KVKK (Article 11) and the GDPR you have the right to:

• Learn whether your data is processed and access your data
• Request correction of incomplete or inaccurate data
• Request deletion of your data (account deletion)
• Request data portability
• Object to processing and lodge a complaint with a supervisory authority

You can send your requests to [email protected]; they are answered within 30 days at the latest.

12. Account Deletion

You can delete your account at any time from the Settings menu in the App or from the account deletion page. When your account is deleted, all your data is permanently removed.

13. Changes to This Policy

This policy may be updated. Significant changes are announced in the App; the current version is always published on this page.

14. Contact

For questions about this privacy policy, please contact us:

[email protected]