Riêng tư

Introduction

This privacy policy explains what personal data Sudeb (the iOS, Android and web apps and sudeb.com) collects, what it is used for, who it is shared with, and your rights.

Data we collect

• Account details: your e-mail address, name and password. The password is hashed with Argon2id and never stored in plain text.
• Content you enter: lists, people (name and, optionally, phone, e-mail and note), debt and receivable records, payments, recurring records, work sessions, rate cards and the feedback messages you send us.
• Preferences: language, time zone, base currency, favourite currencies and reminder settings.
• Device information: your device's notification token (push token), platform, app version and device language, so that we can send notifications.
• Technical records: IP address and browser/app information for security and abuse prevention; an audit log of actions such as deleting an account, locking a list or deleting permanently.
• Usage statistics: in the mobile apps, which screens are opened and events such as sign-in, sign-up and purchases (Firebase Analytics). The advertising identifier (IDFA) is not used and there is no cross-app tracking. On the website, cookieless aggregate visit statistics (Cloudflare Web Analytics).
• Subscription details: the status and term of your Pro subscription. Payment and card details are processed by the App Store or Google Play and never reach us.

How we use data

• Running the app: storing your records, syncing them between your devices and showing them to people you share with.
• Account management: sign-in, e-mail verification, password reset and account deletion e-mails.
• Due-date reminders and the other notifications you choose.
• Verifying your Pro subscription.
• Security, abuse prevention and fixing errors.
• Aggregate usage statistics to improve the app.
• Answering your support requests and feedback.

We do not sell your data and do not use it for advertising.

Service providers

We use the following services to run the app. Each receives only the data it needs for its job:

• Cloudflare: delivering and protecting sudeb.com traffic, website visit statistics and storing database backups.
• Amazon Web Services (SES, Ireland region): sending verification, password reset and account notification e-mails.
• Google Firebase: delivering Android notifications (Firebase Cloud Messaging) and mobile app usage statistics (Firebase Analytics).
• Apple: delivering iOS notifications (Apple Push Notification service) and App Store purchases.
• Google Play: Android purchases.
• RevenueCat: verifying Pro subscriptions with the stores and tracking their status.
• Frankfurter: European Central Bank exchange rates. No personal data is sent to this service.

Some of these providers may process data outside Türkiye and the European Economic Area.

Sharing

When you share a list, the people you add see its records, payments and notes, and your name and e-mail address are visible to the list's members. Lists you do not share are shown to no one. We do not share your data with anyone else unless the law requires it.

Cookies

The website only uses cookies it needs to work: a session cookie that keeps you signed in and a preference cookie that remembers your language, time zone and currency. No advertising or tracking cookies are used.

Retention

• Your account and content are kept until you delete your account.
• With a deletion request the account is deleted permanently after 7 days; with "delete now", immediately.
• Lists moved to the trash are deleted permanently after 30 days.
• Database backups are kept for at most 30 days.
• A record of an account deletion (e-mail, name, date, IP address) is kept for security and legal obligations.

Security

All connections are encrypted with HTTPS. Passwords are hashed with Argon2id. Sensitive actions are written to an audit log. The database is backed up every day and backups are kept in storage separate from the server.

Your rights

Under the GDPR and Turkish data protection law (KVKK) you have the right to access, correct and delete your data, to object to its processing and to data portability. You can edit your records in the app, download every list as CSV and delete your account as described on the account deletion page. For any other request, write to [email protected].

Changes

When we update this policy, the date on this page changes. We announce significant changes in the app or by e-mail.

Contact

Privacy questions: [email protected]