Privacy Policy
Last updated: · Data controller: Anıl Soylu
This policy explains what data we process when you use TrackYourInvestment, why we process it, and your rights. We kept it short.
What data we process
Account details: your email and name. If you sign in with Apple, the name and email Apple sends us, including the relay address Apple hides. If you sign in with Google, the name and email Google sends us.
Your portfolio data: the assets and transactions you add, plus value snapshots over time. This is the core of the app.
A profile photo, if you upload one.
Your subscription status: a record of it if you bought premium.
Your device's notification token, if you allowed notifications.
Your language preference.
Technical diagnostic logs created when the app crashes or errors and, for a sample of sessions, how long the app takes to start and to load screens.
Your IP address, which we use briefly to protect sign-in and limit abuse. To recognise the devices you already sign in from, we keep only a one-way hash of it, for up to 90 days.
A record of basic in-app events, such as when you open the app, and a random identifier for your app install that links the events from before you sign in to your account. This is kept on our own servers. These events carry no email or name and are also sent to PostHog (EU) for product analytics. Along with them, PostHog receives your app settings and a few counts: language, region setting (the country code from your phone's language and region settings, not your location), base currency, time zone, plan (with its price in US dollars on subscription events), app version and how many portfolios and assets you have, never which assets you hold or what they are worth. You can turn this off at any time in Settings → Share usage analytics.
Messages you send to our support team in the app, and our replies, which also reach you by email.
Why we process it
To create your account and let you sign in. Legal basis: performance of a contract.
To store your portfolio and calculate and show its value and profit/loss. Legal basis: performance of a contract.
To manage your premium access. Legal basis: performance of a contract.
To send you notifications and generate AI insights, only if you explicitly ask for them. Legal basis: consent.
To keep the app working and stable. Legal basis: legitimate interest.
To show ads on the free plan, to see which parts of the app get used and which of our ads bring people to the app. Legal basis: legitimate interest, and consent where required for advertising.
Who we share it with
We don't sell your data. On the free plan the app shows ads through Google AdMob. Google receives only what it needs to serve an ad — never your portfolio, your holdings or your transactions. The app never asks for Apple's tracking permission, so Google gets no advertising identifier from us. In the EEA and the UK, Google's own consent form asks how your data may be used for ads; you can reopen it any time from Settings.
We use a few providers to run the service: Apple (sign-in and purchases), RevenueCat (subscriptions, and which Apple Ads campaign, if any, led to your install; Apple provides this without an advertising identifier), Cloudflare (network security for all traffic, profile photo storage, and aggregate visit statistics for our website, with no cookies and no personal profile), Expo (notifications), Sentry (error and performance tracking), PostHog (product analytics), Google (ads on the free plan), OpenRouter (AI insights), Resend (email confirmation, password-reset and support emails) and Hetzner (our servers, in Finland in the EU). Each one sees only the data it needs to do its job. Google also handles sign-in if you choose Sign in with Google.
Some of these providers are US-based. In that case your data is transferred outside Türkiye and the EU. We handle the transfer under GDPR standard contractual clauses and the consent framework of Turkish KVKK.
If you use AI insights or screenshot import, a summary of your portfolio or the screenshot you choose is sent to OpenRouter, which passes it to a third-party AI model provider to generate the result. The app asks for your permission before the first time.
Data that stays on your device
Your Face ID or fingerprint lock stays on your phone; we never see it. Your session token is kept in your phone's secure storage and is sent only to our server, to keep you signed in.
How long we keep it
We keep your data while your account is open. In-app event records are deleted after 180 days. If you delete your account, your portfolio, profile photo and account details are permanently deleted; they also leave our encrypted backups within 15 days. Only records we are legally required to keep remain.
How to use your rights
You can access, correct, delete, port and object to the processing of your data. You can withdraw any consent you gave at any time; in Settings you can turn off usage analytics and AI data sharing yourself.
To use these rights, write to [email protected]. We answer within a reasonable time.
Article 11 of KVKK and the relevant GDPR articles cover these rights. If our response doesn't satisfy you, you can complain to the Turkish Data Protection Authority or the data protection authority in your country.
Security
We move data over encrypted connections and keep access limited. No system is perfect, but we take reasonable measures.
Children
The app is not aimed at anyone under 18. If we notice a child has given us data, we delete it.
Changes
If we update this policy, we change the date above. For an important change, we tell you inside the app.
Contact
For anything about privacy: [email protected].