Privacy policy

1. Data processed

Account information: your name, email address, a one-way password hash, language and notification preferences, email verification status and optional profile photo. If you choose Google sign-in, your Google account identifier, name and email are also processed; your Google password is not received.

Financial records: asset types and quantities, purchase costs, dates, transactions, names and notes in gift records, vault memberships, savings goals and alerts you enter.

Technical information: session and verification tokens, plus email/IP information and timestamps for failed sign-in attempts. The hosting infrastructure may also process IP addresses, request times and browser details in access and error logs.

2. How information is collected

Information is collected electronically through registration and settings forms, asset and transaction entries, vault invitations, support requests and, if selected, Google sign-in. Session, security and language information is generated automatically during use.

The service does not connect to bank accounts or crypto wallets and does not request bank passwords, payment card details or wallet private keys. Public calculators can be used without an account. Amounts submitted to the zakat calculator are not saved to your portfolio. Inputs in a simulator’s shareable URL can be seen by people who receive that link.

3. Purposes

To create and protect your account; calculate and display asset values and history; manage records, goals and shared vaults; send requested alerts and weekly digests; verify email addresses and reset passwords; respond to support requests; and prevent misuse. You can disable optional notification emails in Settings. Account security messages are separate from that preference.

4. Legal basis

Account and portfolio functions rely on necessity for establishing or performing a contract under KVKK Article 5/2-c. Security and misuse prevention rely on legitimate interests under Article 5/2-f, provided your fundamental rights and freedoms are not harmed. Processing necessary for legal obligations or protecting a right relies on Articles 5/2-ç and 5/2-e respectively. Displaying this notice does not itself obtain explicit consent.

5. Cookies and browser preferences

vh_session is the session cookie used to manage your session and form security. It is set for the browser session; a separate server-side session lifetime also applies.

vh_locale remembers your language preference for one year from when it is set. A local storage entry named vh_privacy keeps your amount-blurring preference in that browser until you clear its data. This preference does not prevent a signed-in person from accessing the underlying information.

The application does not set advertising or analytics tracking cookies. You can delete or block cookies in your browser settings; blocking the session cookie can prevent account features from working. External services such as Google sign-in have their own privacy and cookie rules.

6. Storage and security

Asset and financial goal fields are encrypted at rest in the service database using AES-256-GCM. Names and email addresses use normal columns; passwords are stored only as one-way hashes. The key is kept outside the database. The application server can decrypt protected data for calculations, authorized shared-vault access and notifications; this is not end-to-end encryption. Session files and local email logs are also encrypted. Identifiers/relationships, some operational metadata and public market prices are not encrypted. Downloaded files, shared views and sent emails can be read by their recipients.

7. Sharing and external services

Your data is not sold or shared for advertising. Hosting and email providers process information needed to deliver the service. Email recipients can read alert and digest contents. Information may also be disclosed in response to valid requests from legally authorised bodies.

Shared-vault records are visible to members you authorise. Anyone holding a read-only share link can view allocation and return percentages and, if you enable it, the total value. Quantities and purchase costs are hidden. Links can be revoked; copies already obtained cannot be recalled.

Fonts load through Google Fonts, sending your IP address and connection details to Google. Choosing Google sign-in redirects you to Google’s authentication service. Opening the “Live” tab on a crypto chart connects your browser directly to Binance for a price feed and sends your IP address to that provider. The Binance price feed connection is not opened unless you select that tab.

Depending on the provider’s infrastructure, external connections may result in processing abroad. Overseas transfers require the conditions under KVKK Article 9 to be met; visiting this page does not itself constitute explicit consent to an overseas transfer.

8. Retention and account deletion

Account and portfolio data is kept to provide the service while your account remains open. Failed sign-in records older than one day are removed when the application’s cleanup runs. Verification and password-reset tokens expire and are single-use.

Deleting your account in Settings removes your user record, profile photo, personal vault and its associated records. Shared vaults with other members and records you added to them may remain; ownership may transfer to another member. You can separately request deletion or correction of personal details in those records.

Account deletion does not instantly remove previously downloaded files, recipients’ emails, server logs or separate backups. Infrastructure log and backup retention depends on the services used and the controller’s retention arrangements. Records required by law or to protect legal rights are limited to the period needed for that purpose.

9. Your rights under KVKK

Under KVKK Article 11, you can learn whether and why your data is processed and request information about its recipients. You can seek correction, deletion or destruction when legal conditions are met, and notification of those actions to recipients. You can object to adverse results arising solely from automated analysis and seek compensation for damage caused by unlawful processing.

Turkish Data Protection Authority: Rights of the data subject

10. Policy updates

This page and the date above are updated when service features or processing activities change. Required information is provided before the relevant processing. If a new activity needs explicit consent, it is requested separately; a policy update does not replace that consent.

11. Contact and requests

Use the contact address above for privacy questions and KVKK requests. Sending a request from your registered email address helps verify your identity. Properly submitted requests are answered as soon as possible and within 30 days; additional information may be needed to verify your identity. Your right to complain to the Turkish Personal Data Protection Board where permitted by law is preserved.

[email protected]