Privacy Policy

1. Data controller

Your personal data is processed by Ahmet Doğan (Türkiye), the operator of Baralar, as data controller. For privacy questions and requests, write to us through our contact form.

2. Data we process

• Account data: first name, surname (optional), email address, an irreversible hash of your password, session data (device and browser type, sign-in and last activity time, a random device identifier that recognises your browser), if you use a passkey, the public key your device creates and, if you set an app lock PIN, an irreversible hash of your PIN.
• Financial records: accounts, transactions, categories, scheduled payments, budgets, descriptions and notes. These may include information about other people that you enter (for example, the name of someone you lent money to).
• Documents and files: photos, PDFs, spreadsheets and text files you upload to create or import records, or email to the personal document address you can turn on in Settings, and the information read from them. Only the attachments of an email sent to your document address are kept; the sender, recipient and forwarding addresses are read only to check, at that moment, that the email is yours and that the sender is verified or that the email was forwarded from your own mailbox, and are not stored; the body of the email is neither read nor stored. The subject is read only in your email provider’s forwarding confirmation email, to send you its confirmation code as a notification.
• Quick entry notes: short notes you type or say with "Type or say" and the record suggestions read from them; they are stored encrypted to improve reading. When you speak, the microphone is turned on only when you tap it and while recording; the audio is used only to transcribe it and is not stored by Baralar.
• Preferences: language, date and currency format, time zone, theme and notification settings.
• Device and notification data: your browser’s push subscription when you enable notifications, and calendar subscription links.
• Technical and security data: IP address, request time, browser information, error and access logs.
• Referral data: if the sign-up link carried parameters showing how you reached Baralar (for example the campaign name of an advertisement or promotional link and the advertising platform’s click identifier, the address of the site you came from, the first page you opened on our website), they are recorded only at the moment you create your account. They are kept with your account and deleted when your account is deleted; no cookie or similar record is written to your device for these parameters. If you consented to measurement cookies on our website, the fact that you consented is also recorded with the referral data (see our Cookie Policy).
• Legal records: the version of the Terms of Service you accepted and when.
• Communications: messages and requests you send us through the contact form or by email.

Data is collected electronically when you create an account, use the service, upload files, email your document address and contact us. We do not ask for special categories of personal data such as health or biometric data. When you sign in with a passkey, face or fingerprint verification happens only on your device; your biometric data never reaches us. Please do not upload documents containing such information, or cover the relevant parts.

3. Purposes and legal bases

• To create and manage your account; provide record, report, budget and reminder features; provide AI-powered document reading, import, quick entry (typed and spoken notes) and category suggestion features; and send you service-related notifications. Legal basis: entering into and performing our contract with you (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• To secure the service and your account (for example, notifying you when your account is signed in from a new device), prevent abuse, detect errors, enforce usage limits and improve the service. Legal basis: our legitimate interests, provided they do not override your fundamental rights and freedoms (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).
• To measure which promotional channel or advertisement brought you to Baralar and plan our promotion budget accordingly; for this we use only the referral data recorded when you create your account, your account creation date and aggregate counts of whether the service is used. Legal basis: our legitimate interests, provided they do not override your fundamental rights and freedoms (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).
• On our website, if you have consented, to measure the effectiveness of our advertising campaigns with Google’s and Meta’s measurement tools. Legal basis: your explicit consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)); you can withdraw it at any time as described in our Cookie Policy, without affecting processing carried out before withdrawal.
• To comply with our legal obligations and respond to requests from competent authorities. Legal basis: legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)).
• To keep records of contract acceptance and protect our rights in potential disputes. Legal basis: establishment, exercise or defence of legal claims (KVKK Art. 5/2-e; GDPR Art. 6(1)(f)).

We cannot provide the service without your account data and the data needed for the service to work. We do not send marketing messages; if we do in the future, we will ask for your consent separately.

4. AI processing

When you use features to create records from documents, import from files, "Type or say" or get category suggestions, only the data needed for that task is sent to our AI service provider, Google (Gemini API):

• For document reading and import: the content of the file you select or email to your document address and context that helps reading it (such as your account and category names).
• For "Type or say": your note and context that helps reading it (your category, planned item and account names); the note is not sent if it was read well enough on your device. When you speak, your audio is also sent so it can be transcribed; Baralar does not store the audio.
• For category suggestions: the record’s description, amount, date and your category information.

We use the Gemini API under its paid service terms. Under these terms, Google does not use the submitted content to train or improve its models; it may retain the content for a limited period solely to detect abuse and meet legal obligations. AI output is only a suggestion; no automated decision producing legal effects concerning you is made. The original of the file you upload is stored in Baralar’s document storage.

5. Recipients and international transfers

To provide the service, we share your data with service providers that process it on our behalf and on our instructions:

• Oracle (Oracle Cloud Infrastructure, Germany): application server, database and document storage.
• Cloudflare, Inc. (USA, global network): domain name system (DNS), hosting of the web application, network security and bot protection for the contact form.
• Google LLC (USA, global infrastructure): AI-powered features (Gemini API) and storage of off-server copies of the data, encrypted so that only we can open them (Google Drive); and, only on our website and with your consent, measurement of our advertising campaigns (Google Ads and Google Analytics).
• Meta Platforms Ireland Limited (Ireland) and Meta Platforms, Inc. (USA): only on our website and with your consent, measurement of our advertising campaigns (Meta Pixel).
• Namecheap, Inc. (USA): email service; messages sent through the contact form, our email correspondence with you and emails you send to your document address (until they are processed).
• Notification services of browser and device makers (such as Apple, Google, Mozilla): only when you enable notifications, to deliver them.

We may also share data with competent public authorities where required by law, and with a new operator if the service is transferred. We do not sell your data. Your records in the app, your name and your email address are not sent to advertising platforms; Google and Meta also process the information collected through measurement cookies under their own privacy policies.

Because these providers’ servers are located outside Türkiye, your data is transferred abroad. Transfers from Türkiye are carried out in accordance with Article 9 of the KVKK, and transfers subject to the GDPR in accordance with the GDPR’s rules on international transfers.

6. Retention

• Your account data and records are kept for as long as your account is open.
• Records you delete in the app are removed from your view and permanently deleted when your account is closed. Deleted documents can be restored for 7 days, after which they are permanently removed from document storage.
• An email sent to your document address is deleted from our email provider's mailbox within minutes of being processed; emails that are not accepted are deleted without being kept. Accepted attachments are kept and deleted like your other documents. You can turn off or renew your document address at any time; it is turned off immediately when you close your account.
• When you close your account, your data is deleted or anonymised within 30 days at the latest, except where we are legally required to keep it. Copies in backups are deleted within the regular backup cycle (within 30 days at the latest).
• Session records are deleted 30 days after the session ends or is signed out; a passkey or lock PIN you remove is deleted immediately.
• Technical and security logs are kept for a limited period and regularly overwritten.
• Records of acceptance of the Terms of Service and correspondence about your requests are kept for the applicable limitation periods in case of disputes.

7. Security

We take reasonable technical and organisational measures to protect your data: connections are encrypted with TLS; your records, the documents you upload and backups are stored encrypted, including copies kept off our servers; passwords are stored hashed with a strong algorithm; each user can access only their own data, and system access is restricted on a need-to-know basis. No system is completely secure; if we become aware of a data breach, we will notify the relevant authorities and you as required by law.

8. Your rights

Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed and, if so, request information about it; learn the purpose of processing and whether it is used accordingly; know the third parties to whom it is transferred; request correction of incomplete or inaccurate data and, where the conditions are met, its erasure or destruction and notification of these actions to recipients; object to an outcome against you resulting solely from automated analysis; and claim compensation for damage caused by unlawful processing.

If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction of processing, objection and data portability, and you may lodge a complaint with the data protection supervisory authority in your country of residence.

You can send requests through our contact form, giving the email address registered with Baralar; to verify your identity, we reply to that address. Requests are handled free of charge within 30 days at the latest. You can also request a copy of your data at any time in the same way; it is sent in a commonly used, machine-readable format (JSON). If a KVKK request is rejected or left unanswered, you may lodge a complaint with the Turkish Personal Data Protection Board.

9. Changes to this policy

We may update this policy to reflect changes in the service or the law. If we start processing your personal data for a new purpose, we will tell you in the app beforehand. This page always shows the current version, with its last updated date under the title. We keep previous versions, and you can request a copy of a version that was presented to you through our contact form.