Privacy Policy

Last updated: October 13, 2026

This policy explains how Expensia’s iOS app and website process personal data. The data controller and service operator is Ulaş Sancak, Bakırköy, İstanbul, Türkiye. Contact: ulas.san@gmail.com.

1. Data we process

• Account and authentication: email address, account identifier, and Apple or Google sign-in information. If you continue as a guest, your data is stored under an anonymous account identifier until you link Apple or Google or delete the account.
• Expense data: expense names, amounts, currencies, categories, dates, recurring schedules, and category budgets.
• Receipt photos: images you choose to attach to expenses.
• Subscription data: transaction and subscription status used to provide Pro access. Apple processes payment credentials; Expensia and RevenueCat do not receive your full card details.
• Diagnostics and usage: app interactions, account or device identifiers, app and operating-system details, performance information, crash reports, and stack traces.
• Service and security data: IP address, network and authentication logs, notification token, and notification preference.
• On-device data: currency and onboarding preferences and the widget cache. Storing these locally does not by itself transmit them to us.

The website stores only your language choice in browser local storage. It currently uses no advertising, analytics, or tracking cookies.

2. Why we use it

We process data to authenticate you; save, sync, display, export, and delete your records; generate recurring expenses; manage budgets, receipts, widgets, notifications, and Pro access; prevent abuse; diagnose crashes; improve reliability; support users; and meet legal obligations.

3. Legal bases

Depending on your location and the activity, processing is based on performing our agreement with you, complying with law, protecting legal rights, our legitimate interests in operating and securing the service, or consent where the law requires it. You may withdraw consent prospectively where consent is the basis.

4. Service providers and disclosures

We disclose only the data needed for the stated purposes to:

• Apple: Sign in with Apple, App Store payments, subscription management, and platform services.
• Google: Google Sign-In.
• Supabase: authentication, database hosting, and private receipt storage.
• Google Firebase: Analytics, Crashlytics, and Cloud Messaging.
• RevenueCat: subscription and entitlement management.

We do not sell personal data or share it for cross-context behavioral advertising. We may disclose data when legally required, to protect rights and security, or in connection with a lawful business transfer.

5. International transfers

Some providers may process data outside your country. Where required, transfers rely on an applicable adequacy decision, contractual safeguard, statutory exception, or another lawful mechanism. Turkish users should also read the KVKK Notice.

6. Retention and security

Account records, expense data, budgets, and receipt photos are generally kept until you delete them or your account, subject to legal obligations, dispute needs, fraud prevention, and limited backup cycles. Diagnostic, security, and subscription records follow our providers’ retention settings and applicable law. Apple controls its transaction records.

We use access controls, encryption in transit, private owner-scoped storage, and other reasonable safeguards. No internet service can guarantee absolute security.

7. Account deletion and subscriptions

You can permanently delete your account in the app’s Settings after fresh Apple or Google authentication. A guest account is deleted after confirmation in Settings; because a guest cannot sign back in, guest sign-out is not offered. This removes the account data and private receipts controlled by Expensia, subject to the limited retention described above. Account deletion does not cancel an App Store subscription; manage it in Apple Subscriptions.

8. Your choices and rights

You may access, correct, export, or delete data through the app and may contact us to exercise rights available under applicable law. Depending on your location, these may include objection, restriction, portability, withdrawal of consent, and a complaint to a supervisory authority. We may need to verify your identity. We do not discriminate for exercising applicable privacy rights.

9. Children

Expensia is not directed to children under 13, and we do not knowingly collect their personal data. Local law may require a higher age or parental authorization.

10. Changes and contact

We may update this policy as the service or law changes. Material changes will be communicated as required. Questions and privacy requests: ulas.san@gmail.com.