Privacy Policy

Effective date: September 17, 2026

This policy explains how your personal data is handled when you use the Zarflo mobile app on iOS and Android. It also serves as our privacy notice under Turkey’s Personal Data Protection Law No. 6698 (KVKK, Article 10). If you live in the European Union or European Economic Area (EU/EEA), section 10 covers your rights under the GDPR.

The short version

• No ads, no ad tracking, and we don’t sell your data.
• No third-party analytics SDKs in the app.
• When you scan a receipt, the photo never leaves your phone.
• Your budget is stored on our server so it’s available on all your devices.
• You can delete your account from the app at any time.

1. Who is responsible for your data

• Data controller: Veli Kesgin (developer of Zarflo, individual). A postal address is provided on request via destek@zarflo.app.
• Contact: destek@zarflo.app

2. What we collect

Account information

You need an account to use Zarflo. You can sign up with email and password, Sign in with Apple, or Google sign-in. We store:

• Your email address
• Your name (optional)
• Your Apple or Google account identifier, if you use those sign-in options
• Your password, never in plain text, only as a one-way hash
• Your language
• Session details: device name (so you can see your active sessions), sign-in refresh tokens, and when your account was created and last seen

If you choose to hide your email with Sign in with Apple, we only see Apple’s relay address.

Budget data

Your envelopes, transactions, bills, cards and installments, goals, and the settings needed for sync. This data is synced to our server so the same budget shows up on each of your devices.

The database on your phone is encrypted (SQLCipher). You can also lock the app with Face ID or a PIN.

Receipt scanning

• Text recognition runs on your device. The photo never leaves your phone; a copy is kept only on the device and is excluded from device backups.
• If you’re a Zarflo Plus subscriber and use AI receipt reading, only the recognized text of the receipt, the e-Arşiv QR code content (if any), and your envelope names are sent to our server. Our server passes them to Anthropic (Claude API), whose model extracts details like the amount, date, and merchant. The result goes back to your app; the receipt text is not saved in our database. To enforce the daily limit, we only count how many receipts you read that day.
• Besides the merchant and items, receipt text can include the last digits of your card, and e-Arşiv invoices can include your name or Turkish ID/tax number.
• Under Anthropic’s commercial API terms, customer data sent through the API is not used to train its models.

Birlikte (expense groups with friends)

• You join a group through an invite link.
• Group members see the group name, each member’s chosen nickname, and all of the group’s expenses and balances.
• Other members never see your email address.
• If you report a member or group, we store the reason and any details you write. We also store who you’ve blocked. Reports are reviewed by Zarflo’s operator.
• Zarflo doesn’t hold or move money. It only records who paid for what.

Subscription information

Apple or Google process Zarflo Plus payments; we never see your card details. To unlock Plus features, RevenueCat processes your purchase receipts and an anonymous app user ID linked to your Zarflo account ID.

Support emails

If you email us, we process your email address and what you write.

Server logs

Our servers keep technical logs to run the service and keep it secure. These may include your IP address, request times, and error details.

3. Why we use your data and on what legal basis

We collect data electronically and automatically: from what you enter in the app, from Apple and Google sign-in, from the app stores (via RevenueCat), and from emails you send us.

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Who we share data with

We don’t sell your data or share it for advertising. We share only what’s needed with these service providers:

• Apple and Google handle payments and their own account services under their own privacy policies.
• Telegram: Zarflo’s operator uses Telegram to receive automatic internal notifications about the business, for example “new member” and “account deleted” (with a masked email such as v***@gmail.com, the sign-in method and language), daily totals, and new report alerts (reason only, no group name). These messages never include your budget entries, receipt text, or full email address.
• Expo: the app connects to Expo’s servers when it downloads an update. We may use Expo for push notifications in the future; if so, we’ll update this policy.
• Authorities: we may disclose data to competent authorities when the law requires it (for example, a court order).

5. International transfers

Most of our providers are outside Turkey (mainly in the US), so your personal data is transferred abroad. We do this in line with Article 9 of the KVKK.

6. How long we keep data

• Account and budget data: for as long as your account exists.
• After you delete your account: your personal data is erased within 30 days, except records we must keep by law.
• Server logs: up to 30 days.
• Birlikte entries: if you leave a group or delete your account, expenses you added stay in the group so its balances still add up. You’re shown as “Former member” (“Eski üye” in Turkish).
• Purchase records: kept by Apple, Google, and RevenueCat under their own policies.
• Data on your phone: removed when you uninstall the app. To remove data from our server, delete your account.

7. Security

• Data is encrypted in transit with TLS.
• Passwords are stored as hashes.
• Access tokens are short-lived.
• The database on your phone is encrypted; app lock (Face ID/PIN) is optional.

No system is 100% secure. If a data breach occurs, we’ll notify the KVKK Board and affected users as the law requires.

8. Children

Zarflo isn’t intended for anyone under 18 in Turkey or under 16 in the EU/EEA. If we learn that someone under these ages has created an account, we may close it.

9. Your rights under the KVKK

Under Article 11 of the KVKK, you have the right to:

• Find out whether we process your personal data
• Request information about that processing
• Learn why we process it and whether it’s used for that purpose
• Know the third parties, in Turkey or abroad, we transfer it to
• Have incomplete or inaccurate data corrected
• Have your data erased or destroyed under the conditions in Article 7
• Have corrections and erasures communicated to the third parties we shared the data with
• Object to an outcome against you that results solely from automated analysis
• Claim compensation if you suffer damage from unlawful processing

How to apply: email destek@zarflo.app from the email address registered to your account, or write to us at the address above. We may ask for more information to verify your identity. We’ll respond within 30 days, generally free of charge.

If your request is rejected, you find our answer insufficient, or we don’t reply in time, you can complain to the Personal Data Protection Board (KVKK Board) within 30 days of learning our answer, and in any case within 60 days of your application.

You can export your transactions as CSV in the app at any time (Menu → Privacy & data export).

10. EU/EEA users (GDPR)

We process your data to perform our contract with you (Art. 6(1)(b)), to meet legal obligations (Art. 6(1)(c)), and for our legitimate interests (Art. 6(1)(f)). You have the right to:

• Access your data
• Have it corrected
• Have it erased
• Restrict processing
• Data portability (including the CSV export in the app)
• Object to processing based on legitimate interests
• Complain to the data protection supervisory authority where you live

To exercise these rights, email destek@zarflo.app.

11. Changes to this policy

We may update this policy. We’ll announce important changes in the app. The current version is always published with its effective date.

12. Contact

Questions? Email destek@zarflo.app.