Official Document / Legal
Last Updated: November 11, 2026

Privacy Policy and Information Notice

Which personal data Hesapyap processes and why, who it is shared with, how long it is kept, and your rights under the KVKK.

2,296 words•14,517 characters•~12 min read
Last updated: 11 November 2026
This Privacy Policy and Information Notice explains, in accordance with Turkish Personal Data Protection Law No. 6698 ("KVKK") and related legislation, which personal data we process within the Hesapyap.net website, the Hesapyap mobile app and related services (the "Service"), for which purposes and on which legal grounds, with whom we share it, and your legal rights.

1. Data Controller and Contact

Under the KVKK, the data controller is the Hesapyap.net ("Hesapyap", "we") platform.
  • E-mail: info@agyuz.com

2. Scope

This notice covers all of the following uses:
  • The Hesapyap.net website and the calculators you can use without signing in,
  • The Hesapyap mobile app (iOS and Android),
  • The personal finance, family budget, community fund, salary/payroll, note, task, link and price-tracking features offered to registered users.

3. Personal Data We Process

3.1. When You Use the Service Without Signing In
  • Technical and Traffic Data: IP address, browser type and version, operating system, pages visited, referring address and time spent on the site (through server logs and, if you consent, analytics tools).
  • Calculation Inputs: The numbers you enter into calculators (amount, rate, term, etc.) are processed only momentarily to produce the result; if you are not signed in, they are not linked to your identity or stored permanently.
  • Contact Details: The name, surname, e-mail address and message content you send us by e-mail or through the contact form.
3.2. When You Create an Account
  • Account and Identity Data: Name, surname, e-mail address and password (your password is stored only as a one-way hash; we cannot know it in plain text). Optionally, the phone number, date of birth, biography, address and profile photo you enter.
  • Social Sign-In Data: When you sign in with Google, GitHub, Apple or Facebook, the name, e-mail address, profile photo and account ID passed on by that provider. Providers do not share your password with us. If you use Apple's "Hide My Email" option, we receive only the relay address.
  • Session and Security Data: Session tokens, sign-in time, IP address and device/browser information, kept so that you can view and end your active sessions.
3.3. Data You Enter While Using the Service
  • Personal Finance Data: Accounts and balances, income/expense transactions, categories, tags, budgets, subscriptions, debt and instalment plans, savings goals, foreign currency and gold balances.
  • Salary and Payroll Data: The names of the people you track, workplace details, wages and benefits, overtime records, calculated taxes/deductions and payment records.
  • Family Data: Family name, members, roles and invitations. Family members can see shared finance data within their permissions (see Section 8).
  • Community Fund Data: Fund details, members (name, e-mail and unit details such as flat or student number), dues and accruals, collections, expenses, invitations and uploaded invoices/receipts.
  • Notes, Tasks, Links and RSS: The content, folders, tags, shares and reminders you create.
  • Files: Profile photo, note and task attachments, fund documents (image and PDF files).
  • Price Tracking: The product links and target prices you add for tracking. If you use the browser extension (Chrome, Firefox), it runs only on supported shopping sites; it sends the address, name, image and price of the product you choose to track to your account, and refreshes the current price and stock of tracked products through your browser. Your browsing history is not collected.
  • AI Prompts: The prompt and related text you enter when you use AI features.
3.4. Mobile App Data
  • Notification Data: If you allow it, a push token specific to your device and your notification preferences.
  • Data Stored on the Device: Your session key is kept in the device's secure storage. For offline use, recently viewed data is kept in a temporary cache and cleared when you sign out or delete your account.
  • Biometric Lock: Face ID or fingerprint verification is performed directly by your device's operating system; your biometric data is never sent to us, and we do not collect or store it.
  • Device Permissions: Camera and photo library access is used only when you want to upload a document/photo; notification permission only when you want to receive notifications. Location data is not collected.
3.5. Automatically Collected Data
  • Cookies and similar technologies (see Section 7),
  • App error and performance reports (error message, device/operating system details and, if signed in, user ID),
  • Server access logs kept for security and troubleshooting.

4. Purposes of Processing

Your personal data is processed for the following purposes:
  • Creating your account, verifying your identity and keeping your session secure,
  • Running the personal finance, family budget, community fund, salary/payroll, note, task and calculation tools,
  • Handling invitation and data-sharing flows between family and community fund members,
  • Sending transactional messages such as password reset, invitation, reminder and security notices,
  • Protecting infrastructure and account security, preventing unauthorized access and misuse, and fixing technical faults,
  • With your explicit consent, measuring and improving service performance with usage statistics,
  • Meeting legal obligations and responding to requests from competent authorities,
  • Resolving your support requests and applications.

5. Legal Grounds for Processing (KVKK Art. 5)

Your data is processed on the following legal grounds set out in Article 5 of the KVKK:
  • Formation or performance of a contract (Art. 5/2-c): Opening your account and providing the Service features.
  • Compliance with a legal obligation (Art. 5/2-ç): Legal retention obligations and meeting requests from official authorities.
  • Establishing, exercising or protecting a right (Art. 5/2-e): Providing proof and evidence in possible disputes.
  • Legitimate interest (Art. 5/2-f): Keeping the system secure, preventing abuse and fixing errors, provided this does not harm your fundamental rights and freedoms.
  • Explicit consent (Art. 5/1): Non-essential analytics and advertising cookies and other processing that requires consent. You can withdraw your consent at any time; withdrawal does not affect lawful processing carried out before it.

6. How Data Is Collected

Your personal data is collected electronically, by automated or partly automated means, through the forms you fill in on the website and mobile app, the social sign-in providers you choose (Google, Apple, GitHub, Facebook), cookies and server/app logs.

7. Cookies and Similar Technologies

  • Essential Cookies: Needed to keep you signed in, for security and to remember your language, theme and cookie preferences; they do not require consent.
  • Analytics Cookies: Google Analytics and Google Tag Manager may be used to understand visitor traffic and which tools are used; they run only with your explicit consent.
  • Advertising Cookies: Cookies from third-party ad providers in the site's ad slots run only with your consent.
Your cookie preferences are kept for at most 180 days and can be changed at any time from the cookie settings at the bottom of the page. You can also delete or block cookies in your browser settings; however, blocking essential cookies may stop some features from working. The mobile app uses the device's secure storage and local cache instead of cookies; no analytics cookies run in it.

8. Sharing and Transfer of Data

Your personal data is not sold to third parties or transferred for commercial marketing. Data is shared only in the cases below and only as far as needed for that purpose:
8.1. Sharing at Your Direction
  • Family Members: When you join a family group, shared finance data (accounts, transactions, budgets, subscriptions, salary records) is opened to family members according to their roles. You decide whom to invite to the family.
  • Community Fund Members: Fund members see their own dues/payment status and the fund's expense list (with attachments); the fund owner and managers see the member list, dues table, collections and receipts.
  • Note Shares: Notes you share are shown only to the people you authorize.
8.2. Service Providers (Data Processors)
  • Hosting and Storage: Application server, database and encrypted/private-access file storage infrastructure.
  • E-mail (SMTP) Service: Sending password reset, verification and invitation e-mails.
  • Authentication and Analytics Providers: Google, Apple, GitHub and Meta/Facebook, depending on your choice and consent.
  • AI Providers (OpenAI, OpenRouter): Only when you use AI features, the prompt you write and the related text are sent to OpenAI, or through OpenRouter to the selected model provider, to generate a response. We recommend that you do not enter sensitive personal data in this field.
8.3. Legal Requirements
Relevant data may be shared with official authorities in line with lawful requests from legally authorized public bodies or courts.
8.4. Transfers Abroad
Because the servers of global infrastructure providers such as Google, Apple, GitHub, Meta, OpenAI and OpenRouter are located abroad, your data may be transferred abroad when you use these features. Such transfers are made in line with Article 9 of the KVKK and the regulations of the Personal Data Protection Board, based on your explicit consent or on the standard contract/safeguard mechanisms set by the Board.

9. Retention Periods

  • Your account and content data is kept as long as your account is active.
  • When you delete your account, your data is deleted under the rules in Section 10 and is also cleared from backups within a reasonable time.
  • Family and fund invitations expire after 14 days.
  • Server and security logs are kept for as long as needed for troubleshooting and security; records that must be kept by law are kept for the periods set in the relevant laws. At the end of the period, data is deleted, destroyed or anonymized.

10. Deleting Your Account and Data

You can permanently delete your account at any time in the web or mobile app (Profile → Security → Delete my account). You can see the steps on the Account Deletion page.
When you delete your account:
  • Your profile, open sessions, linked social sign-ins, personal finance records, notes, tasks and uploaded files are permanently removed from storage.
  • Family data: If you are the only member of a family, the family group and all its shared data are deleted. If the group has other members, the records are handed over to the family manager and the group continues.
  • Community fund data: If you are the only member of a fund, the fund is deleted. If there are other members, fund ownership is transferred; to keep the fund's accounts intact, past collection and dues rows are kept, but your identity is hidden and anonymized as "Former member".
  • Session authorizations granted through Apple, Google and Facebook are revoked.
  • Accounts with the system administrator or content author role cannot be deleted directly in the app; for these accounts you can send an e-mail to info@agyuz.com. If you cannot access the app, you can also send your account deletion request by e-mail.

11. Data Security Measures

  • All data is transmitted over an encrypted connection (HTTPS/TLS); user passwords are kept only as a one-way cryptographic hash.
  • Role-based access controls are applied; each user can access only the data they are authorized for.
  • Files such as invoices and receipts are kept in private storage closed to the outside and are served only to authorized users through short-lived signed links.
  • You can monitor and end your active sessions on the Security screen and use the biometric lock in the mobile app.
  • If personal data is obtained by others through unlawful means, this is reported to the Personal Data Protection Board and the people concerned within the time and in the manner set out in the KVKK.

12. Children's Data

The Service is not offered directly to people under 18. The "child" role in the family feature is only for in-family budget tracking set up by a parent or guardian under their own management and responsibility. If you believe a child's data has been entered without the knowledge of their legal representative, you can report it to info@agyuz.com; the related records will be deleted promptly.

13. Entering Data About Others

When you enter information about third parties (name, e-mail, flat number, wage, etc.) as a family member, community fund member or payroll record, you confirm that you have the legal authority to inform these people and share their data. The user who adds the data is responsible for entering it lawfully.

14. Your Rights Under the KVKK and How to Apply

Under Article 11 of the KVKK, as a data subject you have the right to:
  1. Learn whether your personal data is processed,
  1. Request information about it if it has been processed,
  1. Learn the purpose of processing and whether it is used in line with that purpose,
  1. Know the third parties in Türkiye or abroad to whom your personal data is transferred,
  1. Ask for it to be corrected if it is incomplete or inaccurate,
  1. Ask for it to be deleted or destroyed under the conditions in Article 7 of the KVKK,
  1. Ask for corrections, deletions and destructions to be notified to the third parties to whom the data was transferred,
  1. Object to a result against you that arises from analysis of the processed data exclusively by automated systems,
  1. Claim compensation if you suffer damage because of unlawful processing.
How to Apply: You can send requests about your rights, together with information verifying your identity, by e-mail to info@agyuz.com. Depending on its nature, your application is concluded free of charge within 30 days at the latest; if the process involves an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your application is rejected, you find the answer insufficient or it is not answered in time, you have the right to complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of the application date.

15. Changes to This Policy

This Privacy Policy may be updated in line with changes to the features offered and to applicable law. Significant changes are announced on the website or by in-app notice, and the effective date of the current text is shown at the top of the page. If a new processing activity requires explicit consent, your consent will be obtained separately.

16. Contact

  • E-mail: info@agyuz.com