KVKK notice — PrismaFX

1. Data controller

PrismaFX is built and published by Mustafa Evleksiz acting as a natural person, not under a registered company; that person is the data controller. Contact is by e-mail only: mustafa@mustafaevleksiz.com

2. No account, so no identity data

PrismaFX has no sign-up, no sign-in and no in-app purchases. Your name, address, phone number and payment details are therefore never asked for and never collected. Your portfolio, expenses and notes stay only on your device, in the app's own container, and are never uploaded — not even as a backup. The app does not sync with iCloud.

3. Data processed

The only category leaving your device that could count as personal data under the KVKK is diagnostic data:

• Usage and crash diagnostics — via Google Firebase Analytics and Crashlytics: which screens and features were opened, the app version, device model, iOS version, and the technical detail of a crash.
• Rate requests — as with any internet request, your IP address is visible to the rate providers (openexchangerates.org, for example). Those requests contain none of your portfolio, expenses or notes.
• App configuration — the app only asks for current settings; it sends nothing about you.
• Feedback — only if you use the form in Settings, in which case your message and any contact detail you type are sent.

There is no ad network and the advertising identifier is never accessed. Contacts, photos, calendar, microphone and camera are never requested.

4. Purposes of processing

Diagnostic data is processed only to find faults and to understand which features are used so the app can be improved. Rate requests exist so that conversion — the app's actual function — works. There is no profiling, no marketing and no sale of data.

5. Legal basis

Rate requests fall under Article 5(2)(c) of the KVKK, being directly related to performance of the contract. Diagnostic data rests on the legitimate interest of running the app without faults (Article 5(2)(f)), kept to technical data that carries no identity and does not harm your fundamental rights and freedoms.

6. Transfers, including abroad

Diagnostic data is processed on Google Firebase (Google Ireland Limited / Google LLC), whose servers are outside Türkiye, so a transfer abroad does take place. Rate providers see only the request itself and the IP address. Beyond that, no data is transferred, sold or shared for marketing.

7. Retention

What is on your device stays until you remove it; deleting the app removes all of it. Diagnostic records on Firebase are kept for Google's own retention periods. From the app's Settings you can export everything as CSV or JSON, clear the cache, or reset all content.

8. Your rights

Under Article 11 of the KVKK you have the right to learn whether your data is processed, to request information, to learn the purpose, to know the third parties it is transferred to, to have it corrected, deleted or destroyed, to object to a result reached solely by automated analysis that works against you, and to claim compensation for damage. Because there is no account, no record on our side can be linked to you; you may nonetheless write to the address above about any request and will have a reply within thirty days at the latest.

9. Security

Data sits in the app's container, protected by iOS and your device passcode. The keys used to reach the rate providers are held in the iOS Keychain, and all network requests go over HTTPS.

10. Changes and contact

If this notice changes, the date above is updated. For any question or request: mustafa@mustafaevleksiz.com

11. Legal note

This notice is an engineering statement of what the app actually does; it is not legal advice. A lawyer should be consulted for a final compliance view.