Privacy policy

This policy explains what data is collected when you use the Kervana web app (the “App”), what it is used for and what your rights are. Details on how your personal data is processed under Turkish Personal Data Protection Law No. 6698 (“KVKK”) are in the KVKK notice (in Turkish).

1. Data controller

Address: Istanbul, Türkiye
Email: merhaba@kervana.app

2. Data we collect

• Account details: your email address and password. Your password is stored in a form that can’t be reversed (a hash); nobody, including us, can see it.
• If you sign in with Google: the name, email address and profile photo link that Google shares with us.
• Information you enter in the App: income and expense entries (amount, date, category, note), your categories, budget limits and trips (name, dates, kilometres, note).
• Receipt photos (optional): a receipt photo you attach to an entry. The camera and gallery are only accessed when you choose “Take photo” or “Choose from gallery”, and only at that moment; nothing in your gallery is looked at apart from the photo you choose. Before upload, the photo is shrunk and saved again on your phone, which removes photo information such as location and device details (EXIF). Photos are kept in a private store and only you can see them.
• Notifications (if you allow them): when you allow notifications in the mobile app, your device’s notification token (a random identifier showing which device a notification goes to) and device type (Android / iOS) are saved to your account. Budget alerts and the weekly reminder are sent with this token. Notification texts contain no amounts; they only include information such as the category name, a percentage and the number of entries. Your notification preferences (Settings → Notifications) and your in-app notification history are also stored in your account.
• Entries you add while offline: entries you add without a connection (including receipt photos) wait only on your phone, encrypted, until they are sent; once you are back online they are sent to your account and deleted from the phone. For this screen to work, your category and trip lists are also kept encrypted on your phone.
• Province for fuel prices: the province you choose for the fuel price card on your summary (e.g. İzmir). Your location is not taken from your device; you choose the province and can change it in Settings. Prices are fetched by province once a day on our server from a price provider (UcuzYakıtBul); no information about you is sent to this provider.
• Usage data (PostHog): information about how you use the App — the pages you open, the features you use (e.g. “entry added”, “budget set”, “report viewed”), device and browser type, whether you use the App on the web or on a phone, the method you used to create your account (Google, Apple, email) and whether you are a closed test user. When you are signed in, this data is linked to your account only through a random user number; your email address is not sent to PostHog.
• Feedback: the message you write in the in-app “Feedback” form and the page you opened it from.
• Waiting lists: the email address you leave in forms on our site, which list you left it for, the date of your consent and the version of the consent text. The address is used only for the topic you chose: to announce once that new modules (Kervansaray, Guides) have opened or that the app has been released on Google Play / the App Store. The Gmail address you leave to join the Android closed test is added to the Google Play test list (Google LLC, Google Play Console) so that we can send you the test link; it is removed from the list when the test ends. You can withdraw your consent at any time by writing to merhaba@kervana.app, and your address will be deleted from the list.
• Campaign source: if you came to the site through a campaign link (UTM parameters, e.g. “instagram”) and signed up, this source information is saved to your account.
• Consent record: the date you accepted these documents and the version of the text.
• Technical data: essential cookies that keep you signed in; server logs kept by our hosting provider for security and debugging (IP address, browser information, request time).

Advertising and tracking: Kervana shows no ads and does not track you on other websites or apps. We do not collect your device’s GPS location; trips consist only of the information you type in.

Not sent to PostHog: amounts, notes, category and trip names, feedback texts, your email address and your location (deriving country/city from the IP address is also turned off). Screen recording (session recording) and automatic recording of the text of clicked elements are turned off.

Cookies and information stored on your device

Usage measurement (PostHog) works without cookies: no analytics cookie or local storage (localStorage) entry is written to your device. The temporary identifier used for measurement is kept in browser memory only while the page is open and is lost when the page closes. The only exception is the campaign source: if you came to the site through a campaign link, this information is kept only in that tab and only until you sign up, as explained below.

We only use these cookies, which are essential for the service to work:

• Session cookies (sb-…-auth-token): remember that you are signed in; deleted when you sign out.
• Introduction cookie (kb_tanitim): remembers that you have seen the introduction screens in the app, so they are not shown again; kept for 1 year.
• Legal consent cookie (kb_yasal_onay): carries the consent you gave when signing up with Google until you return from Google, for at most 15 minutes.
• Language cookie (kv_locale): remembers the language you chose (English or Turkish), so pages open in that language; kept for 1 year.

The following are also kept on your device (in browser or app storage):

• Offline entry store (IndexedDB, kervana-cevrimdisi): entries you added while offline that have not been sent yet, plus your category/trip lists. The content is encrypted with AES-256-GCM using a key created on your device that cannot be exported. A sent entry is deleted straight away; when you sign out or delete your account, the store is deleted completely, together with the encryption key.
• Notification information (local storage, mobile app only): the date you were asked for notification permission (kervana:bildirim-soruldu; so you are not asked again) and this device’s notification token (kervana:bildirim-jetonu; so the token can be removed from your account when you sign out). The token is deleted when you sign out.
• Campaign source (session storage, kv-ilk-kaynak): if you came to the site through a campaign link (e.g. from an ad), the source information in the link (UTM parameters: source, campaign, keyword) is kept only in this browser tab, so that it isn’t lost before you sign up even if the page reloads. It is not a cookie and is not shared with other sites; it is deleted when you close the tab or sign in.
• App download banner (local storage, phone browser only, kv-indir-serit): the date you closed the banner, so it isn’t shown again for 30 days.
• Closed test card (local storage, kv-kapali-test-kart): the date you closed the “Join the Android closed test” card in the app, so it isn’t shown again.
• App files (browser cache): icons, style and program files, and the offline entry screen, which contains no data. These contain no personal data.

3. What we use the data for

• To create your account and provide secure sign-in,
• To store the entries you add and show them to you as summaries, budgets and reports,
• To send transactional emails such as account confirmation and password reset,
• If you allow it, to send budget alerts (80% of the limit and going over) and weekly reminder notifications, and to show them in your in-app notification history,
• If notifications don’t reach your phone, to send the weekly summary by email, and if you haven’t added an expense after signing up, to send a one-time “add your first expense” reminder. These emails contain no amounts; you can turn them off in Settings → Notifications or with the “Unsubscribe” link in the email,
• To attach receipt photos to your entries and show them, at your request,
• To improve the App by understanding which features are used (usage data),
• To keep the service secure and fix errors,
• To meet our legal obligations (e.g. keeping consent records).

4. Service providers

We work with the following service providers to run the App:

• Supabase Inc. — database, authentication and storage of receipt photos. Server region: European Union (Frankfurt, eu-central-1).
• Vercel Inc. — hosting of the App. The App servers run in the European Union (Frankfurt); pages are delivered to you from the nearest point of a global network.
• PostHog Inc. — product analytics (usage data). Server region: European Union (Frankfurt, eu.posthog.com).
• Resend — sending emails (account confirmation, password reset, weekly summary and reminder emails; your email address and the content of the email are processed). Sending region: European Union (Ireland).
• Google LLC — for authentication if you use “Continue with Google”; and, if you allow notifications in the mobile app, for delivering notifications to your device with Firebase Cloud Messaging (the notification token and notification text are processed; no amounts are sent).
• Apple Inc. — if you allow notifications in the iPhone app, for delivering notifications to your device with the Apple Push Notification service (APNs).

International transfers. Our main data stores are in the European Union (Supabase and PostHog in Frankfurt; email sending in Ireland). Some of our providers are companies based in the United States (Supabase, Vercel, PostHog, Resend, Google, Apple), and some processing, such as delivering pages through a global network or delivering push notifications, can take place outside the UK and EEA. Where personal data is transferred outside the UK/EEA, it is protected by the European Commission’s Standard Contractual Clauses (and the UK Addendum) and, where the provider is certified, the EU–US Data Privacy Framework.

5. Security

All connections are encrypted with HTTPS. Row-level access rules (Row Level Security) apply in the database: each record can be read and changed only by its owner. Receipt photos are kept in a private store; each user can access only their own photos. Your financial entries are written to your device only when you add them offline, and only until they are sent, in encrypted form.

6. Retention

• Your account and entries: kept while your account is open. When you delete your account, they are deleted from the database immediately and permanently; they disappear completely from backups when the hosting provider’s backup retention period ends.
• Receipt photos: the old photo is deleted when you delete the entry or change the photo; all your photos are deleted when you delete your account.
• Notification token: deleted when you sign out, delete your account, or when the token becomes invalid because the app was removed from the device. You can turn notifications off at any time in Settings → Notifications or in your phone’s settings.
• Offline entries: deleted the moment they are sent; unsent ones are deleted from the phone when you sign out or delete your account.
• In-app notification history (budget alerts, weekly summaries): deleted automatically 90 days after it is created.
• Email sending record (which week’s summary or which reminder was sent; no address or content is kept): deleted when you delete your account.
• Usage data: deleted or anonymised at the end of the analytics provider’s retention period.
• Server logs: kept for the hosting provider’s retention period.

7. Your rights (UK and EEA users)

If you are in the United Kingdom or the European Economic Area, the UK GDPR / EU General Data Protection Regulation (GDPR) applies to how we process your personal data, in addition to the Turkish KVKK.

Legal bases we rely on (GDPR Article 6):

Your rights. You have the right to:

• access the personal data we hold about you,
• have inaccurate data corrected,
• have your data deleted (you can delete your account yourself at any time; see below),
• restrict how we process your data,
• receive your data in a portable format (data portability),
• object to processing based on legitimate interest,
• withdraw your consent at any time, without affecting processing before the withdrawal.

To use any of these rights, write to merhaba@kervana.app. We will reply within one month.

Complaints. You can complain to a data protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EEA, the supervisory authority of the country where you live or work. We would appreciate the chance to resolve your concern first, at merhaba@kervana.app.

Deleting your account. You can delete your account and all your data yourself, immediately, via Settings → Legal and support → Delete my account. To request deletion without signing in, see Delete your account and data; we complete these requests within 30 days.

Users in Türkiye: your rights under Article 11 of the KVKK are set out in the KVKK notice (in Turkish).

8. Children

The App is not intended for people under 18.

9. Changes

We may update this policy. We will announce important changes in the App or by email. The current text is always on this page.

10. Contact

For questions: merhaba@kervana.app