KVKK Privacy Notice

• Identity and contact data (display name, username, e-mail) and account security data (password hash, verification codes): to create the account and provide the service. Legal ground: establishment and performance of a contract (KVKK Art. 5/2-c).
• User content (plans, categories, items, budget, notes, reminders, photos) and preferences: to provide the service. Legal ground: Art. 5/2-c.
• Optional profile fields (date of birth, phone, social media links) and content you make public: so that your profile and Discover work as you choose. Legal ground: Art. 5/2-c; for content you make public also Art. 5/2-d (made public by the data subject).
• Transaction security data (IP address, session and device data, server logs): security of the account and service, abuse prevention. Legal grounds: legal obligation (Art. 5/2-ç) and legitimate interest (Art. 5/2-f).
• Push notification token and notification preferences: delivering reminders and account notifications. Legal ground: Art. 5/2-c.
• Usage analytics (event records, anonymous identifier): improving the service. Legal ground: legitimate interest (Art. 5/2-f).
• Support correspondence: answering your request. Legal grounds: Art. 5/2-c and Art. 5/2-f.

Data is collected electronically: from what you enter in the app and website, automatically while you use the app, and from e-mails you send us.

A separate opt-in is requested for announcements and promotional messages. It is not a condition for using the service and can be withdrawn at any time in your notification settings.

Data may be transferred, limited to the purposes above, to infrastructure providers we use (servers, database, file storage, e-mail delivery, push notification infrastructure and, if enabled, error monitoring) and to competent public authorities when legally required.

Because push notifications are delivered via Expo (USA) using Apple and Google infrastructure, this data is transferred abroad. The legal basis for transfers abroad under KVKK Art. 9 will be added to this section before release.

Data is not transferred to advertising networks or data brokers and is not sold.

Data is kept for as long as the purpose of processing and applicable law require, then deleted, destroyed or anonymized. Detailed periods are in the Privacy Policy.

You have the right to learn whether your data is processed; to request information if it is; to learn the purpose of processing and whether data is used accordingly; to know third parties in Türkiye or abroad to whom data is transferred; to request correction of incomplete or inaccurate data and its deletion or destruction; to request that these actions be notified to third parties to whom data was transferred; to object to a result against you arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.

Send your request from the e-mail address registered to your account to tech@toostack.com. Requests are answered free of charge within thirty days at the latest (KVKK Art. 13).