Privacy Policy

1. Introduction

Finside ("we", "the app") is a mobile app that helps users track their own financial portfolios and improve their general financial literacy. Finside is not an investment advisory service; the AI-powered answers in the app are for general information only.

This Privacy Policy explains which personal data is collected when you use Finside, how it is processed, who it is shared with and what your rights are. This policy has been prepared under Turkey's Personal Data Protection Law No. 6698 ("KVKK") and other applicable data protection legislation.

Data controller contact: iletisim@finside.app

2. Data We Collect

2.1 When you create an account

You can sign in to Finside with your Google account, your Apple account or your email address. Authentication is handled through Supabase Auth.

• Sign in with Google: your Google account's full name, email address and, if available, profile photo URL are received.
• Sign in with Apple: your Apple account's email address and (if you choose to share it) your name are received. If you use Apple's "Hide My Email" option, we only receive the relay address generated by Apple, not your real email address.
• Sign in with email: only your email address is received; no password is stored.

2.2 Profile information

To personalize the app, we collect the following information at first use, which you can later change from the Account screen:

• Name
• Investment experience level
• Investment time horizon
• Risk profile
• Market preference
• Sectors you are interested in
• Notification preferences (which types of notifications you want to receive)

2.3 Portfolio data

The asset information you enter manually or import via photo/CSV (symbol, category, quantity, purchase price) is stored by us. This data is not connected to any real brokerage/bank account and is based entirely on your own declaration.

2.4 Favorites and chat history

The symbols you star on the Markets screen are stored, and if you choose to save your chats with Finside Assistant, the full text of those chats is stored.

2.5 Notification tokens and a record of sent notifications

To send push notifications, the Firebase Cloud Messaging (FCM) token of each device you sign in on is stored and linked to your account. If you use the same account on more than one device, a separate record is kept for each device; when you sign out of a device, that device's record is deleted.

We also keep a record of the push notifications sent to you: the notification type (news or KAP), the title and text you saw on your phone, the related news URL if any, and the time it was sent. This record exists so that the in-app Notifications screen can show only notifications that were actually sent. The notification text may include the name of an asset in your portfolio (e.g. "There's news about THYAO today"). These records are kept for at most 30 days; expired records are automatically deleted on the server.

2.6 Photos you upload

If you choose to add your portfolio by photo, the image you select is temporarily sent to a vision-language model via OpenRouter, solely to read the text on it. The image is not stored permanently by us and is not written to our servers.

2.7 Subscription and purchase information

If you subscribe to FinPro, the purchase takes place through the store you downloaded the app from (Google Play or the App Store) and is managed through RevenueCat. We do not see or store your card/payment details; these are processed only by the relevant store. What we store is whether your subscription is active, its end date and when you first became a FinPro user. RevenueCat processes technical data such as your account ID and device/app information to match your subscription status.

2.8 Usage counters

To apply FinStart and FinPro usage limits, we keep counters linked to your account: the number of daily chat messages, monthly investment plan reviews, monthly portfolio imports by photo and daily feedback submissions. These counters are only numbers; they do not include the content of your messages.

2.9 Record of legal consent

When you accept the Terms of Use and the Privacy Policy, we record which document, which version and when you accepted it. This record is kept as proof of consent and cannot be changed afterwards.

2.10 Feedback you send

If you send feedback from within the app, the message you write, the issue type you select and the name of the screen you sent it from are sent to us. This content is linked to your account.

2.11 Technical data collected automatically

The app may occasionally open the store's rating prompt; this prompt is shown by the operating system, and the rating you give goes directly to Google or Apple and does not reach us.

No advertising or user-tracking SDK is used. Supabase, Firebase and RevenueCat generate their own operational logs (e.g. error logs, request logs, device/app version) at the standard service-provider level.

2.12 App usage statistics

To improve the app, we record how long you spend on each screen. This record only contains the screen name, entry time and duration; what you do, tap or type on the screen is not recorded.

This data is kept only on our own infrastructure, is never transferred to third parties and is stored for at most 90 days. You can turn this off under Account → My Profile → Notifications → "Usage statistics"; when you do, the records collected up to that point are also deleted.

2.13 Friend invitation (referral) data

If you join the "Invite a Friend" campaign, your invite code, whose invitation you signed up through, the records of users who signed up with your invitation and the free FinPro time you earned are stored. The identities of the people you invite are not shown to you; you only see how many valid invitations you have. Likewise, the person who invited you does not see your identity.

If you signed up for our website's early access list before the campaign, your email address on that list and the invite code generated for you there are matched to your account, so any code you may have shared earlier remains valid.

2.14 Reading news

When you open a news item in the app, its URL is sent to our server so the full text can be shown, and the text is fetched from there. The fetched text is stored as part of the news item itself; which user read which news item is not recorded. For some sources the full text cannot be retrieved; in that case only a summary is shown and we direct you to the source.

3. Why We Process Your Data

• To create your account and manage your session,
• To sync your portfolio, favorites and chat history across devices,
• To personalize app content (suggested questions, news order, default market tab, etc.),
• To generate AI-powered chat answers (portfolio/profile context is sent to the model only during your request),
• To match KAP disclosures related to stocks in your portfolio and deliver them to you in-app and as push notifications,
• To respect the notification preferences you choose,
• To show the notifications we sent you again on the in-app Notifications screen,
• To see which screens are actually used and improve the app,
• To manage your subscription and apply FinStart/FinPro usage limits,
• To run the friend invitation campaign and correctly calculate the free time you have earned,
• To meet our legal obligations and be able to prove your consent,
• To review the feedback you send and improve the service,
• To operate the service, keep it secure and prevent misuse.

AI answers are not investment advice, and no automated profiling ("profiling" within the meaning of KVKK Art. 3) is carried out to create a personalized recommendation. Context is used only to shape the answer in the current chat.

4. Who We Share Your Data With

We do not sell your data. To provide the service, data is shared to a limited extent with the following subcontractors:

Data may be shared with competent authorities where there is a legal obligation to do so.

Transfers abroad: Some of the providers above (OpenRouter, RevenueCat, Google, Apple, Supabase) are based abroad; your data is therefore transferred abroad under KVKK Art. 9. For AI requests, provider selection is technically fixed to US-based providers.

5. Where and How Long We Store Your Data

Data is stored on Supabase infrastructure. It is kept for as long as your account is open; when you delete your account (see Section 7), your profile, portfolio, favorites, chat history, notification tokens, record of notifications sent to you, usage counters, usage statistics, subscription record, invitation/referral records and legal consent record are deleted permanently and irreversibly.

The app's news feed keeps general news content that contains no personal data on the server for at most 7 days.

App usage statistics (see 2.12) are kept for at most 90 days and the record of notifications sent to you (see 2.5) for at most 30 days; expired records are automatically deleted on the server.

6. Your Rights (KVKK Art. 11)

Under KVKK, you have the right to:

• Learn whether your personal data is processed,
• Request information about it if it has been processed,
• Learn the purpose of processing and whether it is used in line with that purpose,
• Know the third parties it is transferred to in Turkey or abroad,
• Request correction if it is incomplete or inaccurate,
• Request its deletion or destruction,
• Object to an outcome against you resulting from analysis by automated systems,
• Request compensation if you suffer damage due to unlawful processing.

To exercise these rights, contact us at iletisim@finside.app. You can edit your profile information and budget directly in the app, delete portfolio/favorite/chat records from the relevant screens, or delete your entire account as described in Section 7 below.

7. Deleting Your Account

By following "Delete My Account" on the Account screen, you can permanently delete your account and all related data (profile, portfolio, favorites, chat history, notification tokens, record of notifications sent to you, usage counters, usage statistics, subscription record, invitation/referral records, legal consent record and sign-in record) from within the app, without needing to contact support. Before deletion, a summary screen shows which data will be deleted. This action cannot be undone.

If you have an active subscription, it must be cancelled separately through the store you bought it from. Deleting your account does not end the subscription automatically.

8. Children's Privacy

Finside is not intended for users under 18 and does not knowingly collect data from children.

9. Security

Your data is protected with reasonable technical and administrative measures. However, keep in mind that no method of transmission or storage over the internet is 100% secure.

10. Changes to This Policy

We may update this policy from time to time. If the policy changes materially, you will be asked to accept the updated text the next time you open the app. The current version is always available on this page (finside.app/gizlilik-politikasi).

11. Contact

For questions: iletisim@finside.app