Türkiye data notice (KVKK)
Data controller
Passionitech Inc FZE ("Yetir"), United Arab Emirates, develops and operates the Yetir app, the site and the servers. For users in Turkey it acts, where it processes personal data, as controller under Law No. 6698 on the Protection of Personal Data (KVKK). The app is published in the App Store and Google Play, and its paid plans are sold, by İlkyaz Taşdemir as seller.
Personal data processed
Yetir asks for no account and, by default, does not process the financial records you enter on its servers; they stay in the app's space on your phone. They are therefore not personal data processed by us, except the search text and market symbols described below.
If you turn on the optional backup and sign in, we do process them: your sign-in e-mail address (or the one Google or Apple gives us), the sign-in method and technical sign-in records, and a copy of what is in the app (records, accounts and balances, debts including the name of a contact you picked, goals, templates, recurring items, investments, settings such as currency, display name, reminders and your own units). Receipt, document and cheque photos are uploaded with the backup while the photo switch in Settings is on (it is on by default); they are kept in a private storage area of Supabase (EU, Frankfurt) that only your account can read, and deleted when no record uses them. Your address book is not uploaded. App lock, biometrics and payment details are never uploaded. The copy is stored in Supabase (EU, Frankfurt). The sign-in code e-mails are sent through Cloudflare's e-mail service; our server logs only the domain of the address and keeps per-address counters, as a one-way hash, for about a day at most to stop misuse.
If you use “Start over” in the app (only while backup is on), our server keeps for 30 days a frozen copy of what the backup held at that moment: the same types of data as in the paragraph above, plus the references to receipt photos; no new type of data. At most three copies are kept per account; you can see them in the app and delete one at once, and restoring one first makes a copy of the current data. The copies are stored in Supabase (EU, Frankfurt), can be read only by your account, are not shared with anyone else and are not sent to analytics or to the AI service. The basis is the same as for the backup: it is part of the optional backup you asked for (performance of a contract, art. 5/2-c).
On the Basic plan, Google AdMob processes your device advertising ID, IP address and device and app information as its own controller to show ads. When you visit the site, the hosting provider (Cloudflare) keeps technical access logs (IP address, browser information, page requested) for security and operation. For the app's category-list and rates requests the same infrastructure processes the IP address in short-lived logs; nothing else is sent with them.
On first launch the app asks whether you want to share usage data with Mixpanel (a third party). Whichever way you answer, it sends our server a record of the answer (the random install id, the choice and the time, nothing else), which is kept in Supabase (EU, Frankfurt) to honour the choice and to count how many people agree and how many decline; it is not passed to Mixpanel. The app sends our server, without asking, a random install id, a random session id, the time of the action, the names of actions (never their content), the platform, app version, language, plan and country. The server stores them in Supabase (EU, Frankfurt) and passes a copy to Mixpanel (EU) only if you said yes to sharing (you can change your answer in Settings at any time). Crash reports, which carry the install id, plan, language and platform, go to Sentry (EU); they contain no names or notes, and amounts and e-mail addresses in messages are masked before they leave the phone. The team receives e-mails about purchases and daily totals (aggregates and a shortened install id).
When you search for an investment or link one to the market, the app sends our server the search text, or the market symbols of the linked holdings (never amounts, quantities, prices paid, account names or your name), the random install id and, as with any request, the IP address. Our server forwards only the search text and the symbols to ServiceBox's market-data service, which answers from stored prices or, for a search or a symbol it does not have yet, asks its own third-party market-data provider (EODHD) with only that text or symbol. The install id and IP address are not passed on. Our server stores and logs none of this; the install id and IP address are used only to limit request rates, in a Cloudflare counter that lasts about a minute. Prices are delayed by 15–20 minutes, come from third-party market data and are information, not investment advice.
On the Requests screen, when you vote on a feature option the app sends our server the option, your choice and the time with the random install id, nothing else. We keep it in Supabase (EU, Frankfurt) to count how many people want each option; it is not passed to a third party and is removed when you take the vote back or when your deletion request is processed (legitimate interest, art. 5/2-f).
If you allow AI help (one permission for receipts, card statements, the sentences you type to the in-app assistant and the voice notes you speak to it), the text of a receipt, of the lines of a statement or of a sentence, or the recording of a voice note, passes through our server to an AI service in the USA as described under "Optional AI reading of receipts, statements, typed sentences and voice notes" below; we do not store it. For a typed sentence this is the text you typed (at most 300 characters), your category names, main currency, language, today's date and the random install id; for a voice note it is the recording (at most 20 seconds, a voice that may also carry the voices of people nearby) with the same category names, main currency, language, date and install id.
If you buy a paid plan, the app tells RevenueCat (United States, our processor) the random install id, the product and the purchase times; RevenueCat checks them with the store and tells our server which plan is active. The store keeps your payment details, not us (performance of a contract, art. 5/2-c; legitimate interest, art. 5/2-f).
If you write to destek@servicebox.io, your e-mail address and message are processed to answer your request.
Purposes and legal basis
Providing the optional backup and sign-in you asked for (performance of a contract, KVKK art. 5/2-c) and keeping sign-in secure against misuse (legitimate interest, art. 5/2-f), answering support requests (performance of a contract and legitimate interest), keeping the site secure and running (legitimate interest), improving the product and finding faults (legitimate interest, art. 5/2-f), providing the market prices you asked for (legitimate interest, art. 5/2-f), and meeting legal obligations. Where ad personalisation needs it, the explicit consent you give in Google's consent form is the basis (KVKK art. 5/1). Your data is not sold to third parties for marketing.
Retention
Data on your phone stays there until you delete it. A backup (with its photos) and the sign-in account are kept until you ask for them to be deleted; a photo that no record points to any more is deleted from the server after about a day; your votes on feature options are kept until you take them back or ask for deletion; a deletion requested in the app is processed within 30 days of the request reaching us, and the copy stays on our server until then. A “Start over” copy is kept for 30 days from the day it was made and then deleted automatically, or at once if you delete it in the app; at most three copies are kept per account; deleting the account deletes the copies too, and the photos a copy points to stay in storage until the copy goes and are then deleted like any photo no record points to. Usage events are kept for 13 months in our database; the install record (id, first and last seen, platform, version, language, plan, country) is kept until you ask us to delete it; the record of your usage-data choice is kept until you ask us to delete the data of the install; Mixpanel and Sentry keep their copies for no longer than 13 months. Support correspondence is kept for at most 2 years from the resolution of the request, or longer where the law requires.
Transfers abroad
The controller is in the United Arab Emirates. Cloudflare, which hosts the site, and Google, which serves the ads, operate abroad; these transfers are necessary to provide the service and, for ads, rest on your explicit consent. Supabase (database and sign-in), Mixpanel (analytics) and Sentry (crash reports) receive the data described above in their EU regions as our processors under data-processing agreements. RevenueCat (subscriptions) receives the data described under “Subscriptions” and processes it in the United States, also as our processor. Financial data on your phone is not transferred abroad unless you turn on backup; then the copy is stored in Supabase in Frankfurt (Germany) and the sign-in code e-mail passes through Cloudflare. These transfers happen only because you turned backup on and signed in. If you sign in with Google or Apple, those companies receive the sign-in request under their own policies.
Optional AI reading of receipts, statements, typed sentences and voice notes
If you allow it in the app (one general permission, not a separate one for receipts, statements, the sentences you type to the in-app assistant and the voice notes you speak to it; the app asks for it the first time any of them needs it), the text of a receipt, the text of the lines of a card or bank account statement, a sentence you type to the assistant, or a short voice note you speak to it (the recording itself), is sent to our server and passed to an AI service (OpenRouter and its model provider, in the USA) so that the total, date, category and items, each line and its category, or an expense or income draft from the sentence or from the words heard in the recording, can be read. For a sentence, what is sent is the text you typed (at most 300 characters), the names of your own spending categories, your main currency, your language, today's date and the random id of your installation (no name, no e-mail); nothing is saved until you review and confirm the draft. For a voice note, what is sent is the recording (a small audio file of at most 20 seconds; the microphone is opened only when you tap the button, after your phone's system has asked for microphone permission the first time, and it stops by itself after 20 seconds) together with the same category names, main currency, language, today's date and random id; the recording may carry your voice and the voice of anyone speaking nearby, is sent only to be read, and is kept on the phone only in a temporary file until it is sent and then deleted. Because you decide what to type or say, the text or the recording may contain personal details of your own. For a statement, card numbers, IBANs, ID and phone numbers, e-mail addresses and the address lines of the header are removed first (best effort: a name may remain). Files and photos never leave the phone. We store neither the text, the sentence, the recording, the words heard nor the result and do not write them to our logs; only a daily counter tied to a random name of your installation and a one-way digest of your network address is kept for about a day. The legal basis is your explicit consent (KVKK art. 5/1), which is one permission covering the four uses and which you can withdraw at any time with the single switch in Settings; then nothing is sent (a recording cannot be read on the phone, so with the switch off the microphone button asks for the permission again). Because the service is provided abroad, the transfer rests on the same explicit consent (art. 9).
Cookies
The site uses no cookies beyond what it needs to work and does no advertising measurement. The light or dark theme follows your browser setting; nothing is stored.
Your rights (KVKK art. 11)
You may ask whether your personal data is processed, request information if it is, learn whether it is used for its purpose, ask for correction or deletion, object to processing, and claim compensation for damage. Send requests to destek@servicebox.io; they are answered within thirty days. You can ask for a backup to be deleted with "Delete my account" in the app; it is processed within thirty days of reaching us.
Contact
Passionitech Inc FZE · Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates · destek@servicebox.io