Privacy Policy & KVKK Disclosure

This Privacy Policy applies to the mobile applications (iOS, Android), website (masrafo.com), and all associated digital services operated by Masrafo Information and Software Technologies ("Masrafo", "Platform", "Company").

Masrafo considers personal data protection a constitutional right and corporate tenet. Our architecture is built upon an isolated cloud database (Supabase PostgreSQL) with Row Level Security (RLS) and high-speed on-device MMKV offline caching.

Supabase Cloud Storage & Row Level Security (RLS): Income, expense, budget parameters, card nicknames, and billing cut-off days are stored on Supabase PostgreSQL. Each record is cryptographically linked to the authenticated user ID (auth.uid()). Strict database-level RLS policies make unauthorized multi-tenant data access technically impossible. All in-transit data uses TLS 1.3, and at-rest storage uses AES-256 encryption.

On-Device Offline MMKV Cache: To ensure 0ms input latency without internet, data is cached locally in an encrypted MMKV vault and atomically synchronized with Supabase upon reconnection.

Zero Bank Credentials Guarantee: Masrafo never asks for, captures, or stores your banking login passwords, full card numbers, expiration dates, or CVV security codes.

Device ID & Telemetry Data: For device authorization, session management, and Pro subscription validation, Device ID (Vendor UUID), user UUID, OS version, and StoreKit/Google Play receipt tokens are processed. Masrafo NEVER collects, logs, or stores IP addresses (Zero IP Logging Guarantee).

Under Article 28 of KVKK and Recital 26 of the GDPR, data rendered irreversibly anonymous (such that it can no longer identify or be linked to any living individual) falls outside the statutory definition of personal data.

Masrafo reserves the right to aggregate and de-identify spending distributions, budgeting benchmarks, and macro trends stripped of personal identity (such as names and emails). IP addresses are not logged; session Device IDs are strictly excluded from statistical models.

Commercial Analysis & Industry Benchmarks: Masrafo reserves the right to use these anonymized datasets to train AI financial models, publish macroeconomic benchmarks, and prepare industry trend reports with corporate partners. By using the platform, users consent to the processing and analytical evaluation of such de-identified and aggregated data.

Personal data is processed under the legal grounds of contract performance (KVKK Art. 5/2-c, GDPR Art. 6/1-b), establishing and managing Pro subscription access via App Store / Google Play, compliance with legal obligations (KVKK Art. 5/2-ç, GDPR Art. 6/1-c), and legitimate security interests (KVKK Art. 5/2-f, GDPR Art. 6/1-f).

Cloud Infrastructure (Supabase): User database records are encrypted and hosted within SOC 2 Type II, ISO 27001, and GDPR-certified data centers managed by Supabase Inc.

Protection of Personal Identity: Masrafo never sells or transfers personal identities, names, or emails to data brokers or unauthorized third parties.

Commercial Sale of Anonymized Datasets: Irreversibly de-identified macro trends, category allocations, and synthetic analytics may be licensed or sold to commercial partners under KVKK Art. 28 and GDPR Recital 26.

Technical Service Providers: Minimal telemetry is shared with core infrastructure providers (Supabase, App Store, Google Play Billing) and crash analytics engines (Crashlytics/Sentry).

Under KVKK Art. 11 and GDPR Arts. 15-22, you have the right to request access to your data, verify processing, export entries in structured formats (JSON/CSV), and request full account and cloud deletion.

Written inquiries may be submitted to privacy@masrafo.com. Requests are verified and fulfilled free of charge within 30 calendar days.

Masrafo supports hardware biometric authentication (Face ID / Touch ID / Biometric Lock). Biometric templates remain encrypted inside Apple Secure Enclave or Android TEE and cannot be accessed by Masrafo.

When an account is deleted or a "Wipe All Data" action is confirmed, all rows in Supabase PostgreSQL are permanently removed via atomic PL/pgSQL routines, and local MMKV caches are purged.