ÇeyizdanPrivacy Policy
In short
- We process your account, lists and documents only to provide the service. We don't sell your data and don't use your content for advertising or to train AI.
- Our database and your files are hosted in the European Union (Frankfurt, Germany). Some of our service providers process data outside Turkey; we list each of them below.
- We never contact the people you put on your lists (guests, people in your jewelry and debt ledgers).
- Ads are shown only on the free plan and are not personalized to your interests unless you consent; on an ad-free plan the advertising components never run. Usage statistics are not linked to your account.
- You can delete your account from inside the app at any time. For your rights: support@ceyizdan.com.
1. Data controller
This text is also the information notice required by Article 10 of Turkey's Personal Data Protection Law No. 6698 (“KVKK”).
Data controller: Talom Studio (Muhammet Talha Sağlam)
E-mail: support@ceyizdan.com
2. Scope
This policy covers the Çeyizdan mobile app, ceyizdan.com and the e-mails we send you. The stores you download the app from and pay through (Google Play, the App Store) are separate controllers under their own policies.
It concerns Çeyizdan users, members of spaces, people users put on their lists, visitors to ceyizdan.com and people who write to us.
3. What data we process
| Data | Examples | Source |
|---|---|---|
| Identity and contact | Full name, e-mail address | You, when you sign up |
| Account security | A hash of your password (the password itself is never stored), verification codes, session data; during sign-up and sign-in, IP address and device/browser signals for bot protection | Use of the app |
| Your planning content | Item lists, quotes, installment plans, budget, tasks, special days, notes, jewelry and debt ledgers, guest list | You |
| Documents and images | Photos and files you upload, such as invoices, warranties and contracts | You — only the file you pick |
| Shared space information | Memberships, roles, who added or changed a record, activity history | Use of the app |
| Subscription | Subscription ID, product, period dates, status, refund record. Your card details never reach us | Google Play, the App Store and our subscription infrastructure provider |
| Device and notifications | Notification token, platform, time zone, app version, language, reminder preference | The app |
| Error reports | Error details cleaned of personal information, user and space IDs, device model, operating system, app version | The app (Firebase Crashlytics) |
| Usage statistics | Screens and events; grouped properties such as plan, number-of-spaces range, account-age range, theme, notification permission and language. Not linked to your account | The app (Firebase Analytics) |
| Advertising (free plan only) | Advertising ID, device and network information, ad impressions and clicks; your ad consent choice if the consent window was shown to you | The app (Google AdMob) |
| Support correspondence | Your e-mail address, what you write to us, in-app suggestions and feedback | You |
| Website | IP address and browser information to deliver pages. No cookies or analytics on the site | Your visit |
What we don't collect: your location, your contacts, your whole photo library (only the photo you pick is accessed), the location and camera details of your photos, your microphone, your card details. We don't aim to process special categories of personal data (such as health, religion or biometrics); please don't upload documents containing such information.
4. Purposes and legal bases
| Purpose | Data | Legal basis (KVKK Art. 5) |
|---|---|---|
| Creating your account and verifying sign-in | Identity and contact, account security | Formation and performance of a contract (Art. 5(2)(c)) |
| Providing lists, shared spaces, documents and reminders | Planning content, documents, shared space information, device and notifications | Performance of a contract (Art. 5(2)(c)) |
| Verifying subscriptions and entitlements, tracking refunds | Subscription | Performance of a contract (Art. 5(2)(c)); legal obligation (Art. 5(2)(ç)); establishing, exercising or protecting a right (Art. 5(2)(e)) |
| Security; preventing abuse and automated attacks | Account security, error reports | Legitimate interest (Art. 5(2)(f)) |
| Finding and fixing errors | Error reports | Legitimate interest (Art. 5(2)(f)) |
| Improving the service (usage statistics, improving the ready-made list) | Usage statistics; item and category names separated from any identity | Legitimate interest (Art. 5(2)(f)) |
| Showing ads on the free plan | Advertising | Non-personalized ads: legitimate interest (Art. 5(2)(f)) — funding the free plan with ads. Interest-based (personalized) ads: explicit consent (Art. 5(1)) — only if you consent in the consent window; you can withdraw it at any time |
| Answering support requests and data protection requests | Support correspondence, identity and contact | Performance of a contract (Art. 5(2)(c)); legal obligation (Art. 5(2)(ç)) |
| Responding to requests from competent authorities | The data the request requires | Legal obligation (Art. 5(2)(ç)) |
| Delivering and protecting the website | Website | Legitimate interest (Art. 5(2)(f)) |
5. Shared spaces
When you are a member of a space, its other members see your name, the records you add and change, and the activity history showing who did what. When you leave or are removed from a space you lose access to it; the records you added stay there. When you delete your account, your name and the link to your account are removed from those records, which then show as “Deleted user”.
6. People on your lists
Through the guest list, the jewelry and debt ledgers or documents you may enter information about other people (names, phone numbers, jewelry or debt details). We process it on your instructions and only to provide the service to you:
- we never contact these people, send them messages or marketing, or sell their information;
- the information is visible only to members of the space it belongs to and is deleted when that space is deleted;
- these people can also exercise their rights by writing to support@ceyizdan.com.
It's your responsibility to enter this information only for your own preparations and to inform the people concerned where needed.
7. Who we share data with
We don't sell your data. To provide the service we share it with the following providers, only as far as needed:
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Database and hosting provider | Database, accounts and sign-in, file storage, server functions | All data in the app | EU — Germany (Frankfurt) |
| Google — Firebase Cloud Messaging | Delivering notifications to your phone | Notification token, notification title and text | Global (incl. USA) |
| Apple — Push Notification Service | Delivering notifications on iPhone | Notification token, notification title and text | Global (incl. USA) |
| Google — Firebase Crashlytics | Error reports | Error reports | Global (incl. USA) |
| Google — Firebase Analytics | Usage statistics | Usage statistics (not linked to your account) | Global (incl. USA) |
| Google — AdMob | Ads on the free plan | Advertising data | Global (incl. USA) |
| Subscription infrastructure provider | Verifying store purchases and tracking subscription status | Your user ID, store purchase record, subscription status (no name or e-mail) | USA |
| E-mail delivery provider | Verification code e-mails | Your e-mail address, the code | EU — Ireland |
| Security and website hosting provider | Bot protection at sign-up and sign-in, delivering the website | IP address, device and browser signals | Global (incl. USA) |
| E-mail hosting provider | Support mailbox | E-mails you send us | Turkey |
In addition:
- Google Play and Apple handle purchases and payments under their own policies as independent controllers.
- Members of a space see the information in the spaces they belong to (section 5).
- Competent public authorities may receive the information they request where they are legally entitled to it.
8. International transfers
Apart from the e-mail hosting provider, which is in Turkey, all the providers above process data outside Turkey; servers in the EU also count as abroad under KVKK. These transfers are made within the framework of Article 9 of KVKK and the Regulation on the Transfer of Personal Data Abroad. Each provider processes the data under its own data protection terms and security commitments.
9. How long we keep data
| Data | Period |
|---|---|
| Account, planning content, documents | Until you delete them or your account |
| Activity history | 365 days (at most 2,000 records per space) if a member of the space can view history; otherwise 7 days |
| Notification inbox | 30 days once read, 90 days if unread |
| Device notification registrations | Deleted after 270 days of inactivity |
| Invite codes | Valid for 24 hours; deleted 24 hours after expiry |
| Error reports | 90 days |
| Usage statistics | 14 months |
| Purchase event records | 400 days |
| Purchase records (subscription, periods, refund trail) | For the legally required retention periods; unlinked from your account when you delete it |
| Item and category names you wrote and later deleted | Up to 24 months, separated from any identity |
| Suggestions and feedback sent from the app | Until your account is deleted |
| Support e-mails | Up to 2 years after the request is closed |
| Backups | Up to 30 days |
Data whose period has ended is deleted or anonymized. If a record becomes the subject of a lawsuit, an investigation or a request from a competent authority, it may be kept until that process ends; in that case your request to delete that record may be postponed until the process is over. What is deleted and what is kept when you delete your account is described in detail on the account deletion page.
Item and category names: When you delete item titles and category names you wrote yourself, delete a space or close your account, those names are kept as you wrote them, without any record of which account or space they came from, to improve the ready-made list, and are deleted within two years at the latest. Don't write personal details such as names or phone numbers in these fields.
10. Notifications and e-mails
- Reminders (upcoming payments, overdue installments, special days) can be turned off in the app. Notifications about your account and spaces (such as membership or permission changes) are part of how the service works and can't be turned off. The operating system's notification permission turns both on or off.
- Notification titles and text pass through Google's and Apple's infrastructure to reach your phone.
- We send only account e-mails (verification codes). We don't send advertising or marketing messages.
11. Advertising and measurement
- On the free plan, ads are shown through Google AdMob. Google uses your device's advertising ID and device information to show ads, limit how often they appear, measure them and prevent abuse. Ads are not personalized to your interests unless you consent. If Google's consent window is shown in your region, personalized ads are shown only if you consent there; you can change your choice at any time under Account ▸ About ▸ Ad consent preferences. Your choice is stored on your device. On iPhone, personalized ads also require Apple's tracking permission; unless it is requested, ads on iPhone are not personalized.
- You can reset or delete your advertising ID in your device settings. On an ad-free plan the advertising components never run and this data doesn't go to Google.
- Usage statistics are collected with Google Analytics for Firebase; they don't use your account identity and don't collect the advertising ID; your searches, the titles on your lists and amounts are never sent. How Google uses this data: information from sites or apps that use Google's services.
- Your name and e-mail are never added to error reports; error messages are cleaned of personal information before they are sent. No screenshots are taken.
12. Security
Data is encrypted in transit. Only the members of a space can access that space's data, and this rule is enforced on our servers. Only a hash of your password is stored. We limit access on a least-privilege basis and clean error reports of personal information. No system is completely secure; if your data is obtained by unauthorized persons, we will inform you and the Board as KVKK requires.
13. Your rights
Under Article 11 of KVKK you have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether it is used accordingly; to know the third parties in Turkey or abroad to whom it is transferred; to request correction if it is incomplete or inaccurate, and deletion or destruction under the conditions set by law; to request that these actions be notified to the third parties it was transferred to; to object to a result against you arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.
How to apply: by e-mail from the address registered in the app to support@ceyizdan.com, with “KVKK request” in the subject line.
As required by the Communiqué on the Procedures and Principles of Application to the Data Controller, include your full name, Turkish ID number (for foreigners, nationality and passport number), postal address for notices, contact details and your request. We may ask for additional information to verify your identity. We respond within 30 days at the latest and free of charge; a fee set by the Board may apply if a written answer exceeds ten pages or is given on a storage medium. If we reject your request we tell you why. If you find our answer insufficient you can complain to the Personal Data Protection Board within 30 days of learning of it; if we don't answer, within 60 days of your application in any case.
You can correct or delete most of your data yourself inside the app; to delete your account, see the account deletion page.
14. Age limit
Çeyizdan is for people aged 18 or over. People under 18 may not create an account; if we notice such an account, we delete it.
15. Website
ceyizdan.com uses no analytics or advertising tools and sets no cookies for those purposes. Pages are delivered through our website hosting provider's infrastructure, which processes your IP address and browser information to deliver the pages and protect the site. This provider may set strictly necessary security cookies (such as __cf_bm) to tell automated attacks apart.
16. Changes
We may update this policy. The current text is published on this page with its effective date; we announce material changes in the app in advance.
17. Language and contact
The Turkish text of this policy prevails; this English text is a translation for information. For any question: support@ceyizdan.com.