Privacy Policy

Cardper ("the App") is operated by WEBYAP YAZILIM LİMİTED ŞİRKETİ ("we", "us"), a company registered at Adalet Mah. Anadolu Cad. Megapol Tower NO:41 K:8 D:81, Bayraklı, İzmir, Republic of Türkiye. This policy explains what the App collects, why, and what control you have. Cardper is a local first application: by default, the card information you enter stays on your device.

1. Information We Collect

Information you enter

You may add card nicknames, issuing bank names, the last four digits of a card, statement dates, due dates, limits, interest rates, balances, payments and notes. This information is stored locally on your device. We do not ask for full card numbers, CVV codes, PINs or online banking credentials, and the App never connects to your bank.

Optional account

You need an account only to buy Cardper Pro or to use Cloud Sync, which is part of Pro. You create one by signing in with Apple or Google. From that provider we receive a user identifier, your email address (Apple lets you share a private relay address instead) and, if you choose to share it, your name. When you buy Pro, we attach your Cardper account identifier to the purchase so the store can tell us which account it belongs to. Sign in is optional and the App is fully usable without it.

Usage analytics

We collect anonymous usage events (for example, app opened, screens viewed, features used) to understand how the App is used and improve it. Events describe actions, never contents: they do not include card names, bank names, card digits, amounts, balances or notes. Each launch of the App uses a new random identifier that is held only in memory and never stored on your device, so events from different launches cannot be connected. Events are never linked to your Cardper account, even when you are signed in. Each event carries basic device information such as device model, operating system, app version and language. Your IP address is not used to determine your location, and our analytics provider is set to discard it rather than store it. You can turn usage analytics off at any time in the App under Settings, Share usage analytics; while it is off, the App sends no usage events. We do not currently collect crash reports.

Server logs

When the App contacts our servers (to sign in, verify Pro or run Cloud Sync), the servers record technical request logs: the time, the address requested, the response status, your IP address and request headers such as your device's user agent. Sign in tokens and other credentials are removed before anything is written, and request contents are never logged. Some events, such as creating an account or a subscription update from the App Store or Google Play, also record your account identifier or the purchase identifier. We use these logs to keep the service secure, prevent abuse and fix problems. They are deleted after 3 days.

Device and advertising data

Free users see ads. Ad networks may process device identifiers, coarse location derived from IP address, and interaction data as described in section 3.

2. How We Use the Information

We use information to:

• Provide the core service: tracking statement dates, due dates, balances and payments.
• Deliver reminders and notifications you have enabled, including quiet hours settings.
• Synchronize your data across your devices when Cloud Sync is turned on.
• Diagnose problems, fix defects and improve performance.
• Serve and measure advertising to free users, where permitted.
• Process and restore subscription purchases through the app stores.
• Respond to support requests you send us.

We do not sell your personal information and we do not use your financial records for advertising or profiling.

Legal bases

We process personal data only on one of these legal bases:

• Our contract with you (GDPR art. 6(1)(b), KVKK art. 5(2)(c)): your account, Cloud Sync, Cardper Pro purchases and restores, and replies to your support requests.
• Our legitimate interests (GDPR art. 6(1)(f), KVKK art. 5(2)(f)): server logs that keep the service secure and help us fix problems, usage analytics that show us how to improve the App and, outside the regions listed below, advertising that funds the free tier. You can object to this processing as described in section 10.
• Your consent (GDPR art. 6(1)(a), KVKK art. 5(1)): personalized advertising where the law requires consent, including in the European Economic Area, the United Kingdom and Switzerland. You can withdraw it at any time, as described in section 3.
• Legal obligations (GDPR art. 6(1)(c), KVKK art. 5(2)(ç)): records we must keep for tax or legal reasons.

3. Advertising and AdMob

The free tier of the App is supported by advertising delivered through Google AdMob and its partners. Ad networks may use device identifiers and interaction data to select and measure ads. Where consent is required, including in the European Economic Area, the United Kingdom and Switzerland, we present a consent request before personalized advertising is enabled, and you may withdraw consent at any time in the App settings or your device settings.

Your card records, balances and payment history are never shared with ad networks. Pro subscribers see no ads.

Google's advertising practices are described at policies.google.com/technologies/ads.

4. Cloud Sync and Data Storage

Cloud Sync is optional, off by default and part of Cardper Pro. When you enable it, your Cardper records (wallets, cards, statements, payments and reminder settings) and your App preferences are encrypted in transit using TLS and stored on secured, access-controlled infrastructure operated by our hosting providers. Sync exists so that you can restore your data on a new device or use several devices with one account.

You can disable Cloud Sync at any time. Disabling it stops further uploads, and you may request deletion of the stored copy as described in section 10. If you never enable Cloud Sync, no card data is sent to us. Your device's own backup, if you have turned it on in your iCloud or Google account settings, may include the App's data; that backup is held by Apple or Google under your account, not by us.

5. Data Retention

Local data remains on your device until you delete a record or uninstall the App. Synced data is retained while your account is active. When you delete your account in the App, your account and synced content are removed from our active systems immediately and from routine backups within 90 days. Server logs are deleted after 3 days. Usage analytics are anonymous and kept to understand trends over time. Records we must keep for tax or legal reasons are retained for the period required by law.

6. Data Security

We apply appropriate technical and organizational measures: TLS encryption in transit for synced data, optional biometric (such as Face ID or fingerprint) or PIN app lock on device, and access control on our systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Keeping your device passcode and your Apple or Google account secure is an important part of protecting your data.

7. Children's Privacy

The App is intended for adults: users aged 18 and over, or the age of majority where they live if that is higher. We do not knowingly collect personal information from anyone below that age. If you believe a minor has provided us with personal information, contact us at contact@cardper.com and we will delete it.

8. Third Party Services

We rely on a small number of processors and platforms:

• DigitalOcean and Neon: hosting of our servers and database, which hold account data and, for accounts that enable Cloud Sync, synced data.
• PostHog: usage analytics.
• Better Stack: server logs and uptime monitoring.
• Google Workspace: email, including the messages you send to our contact address.
• Apple and Google: app distribution, sign in and subscription billing.
• Google AdMob and its partners: ad delivery and measurement for free users.

DigitalOcean, Neon, PostHog, Better Stack and Google Workspace process data on our behalf and under our instructions. Apple, Google and Google's advertising partners are independent companies that handle data under their own privacy policies.

We share personal data with anyone else only when the law requires it, for example in response to a binding request from a competent public authority, and only to the extent the law requires.

9. International Data Transfers

We are based in Türkiye. To provide the App, we transfer personal data to the providers in section 8, which process it outside Türkiye:

• Germany: our servers and database (DigitalOcean and Neon, in Frankfurt), usage analytics (PostHog) and server logs (Better Stack).
• United States and the other countries where these companies operate: sign in and subscription billing (Apple and Google), email (Google Workspace) and advertising (Google AdMob and its partners).

Data sent to these providers is encrypted in transit.

10. Your Rights

Subject to applicable law, including the GDPR and the CCPA, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data, including your synced records and account.
• Restrict or object to certain processing, including personalized advertising.
• Receive a portable copy of your data.
• Withdraw consent at any time, without affecting processing already carried out.
• Lodge a complaint with your supervisory authority. In Türkiye this is the Personal Data Protection Authority (KVKK).

Most data lives only on your device, so deleting a record or the App removes it directly. You can delete your account and all synced data at any time in the App under Settings, Account. For any other request, write to contact@cardper.com and we will respond within 30 days.

11. Subscriptions and Payments

Cardper Pro is sold as an auto renewing subscription through the Apple App Store and Google Play. Payments are processed by those stores. We never receive or store your card or payment details. The stores share limited transaction information with us (the purchase identifier, product, status and renewal date) so we can validate your entitlement and restore purchases. Manage or cancel your subscription in your App Store or Google Play account settings. Deleting your Cardper account does not cancel a subscription.

12. Changes to This Policy

We may update this policy as the App changes or the law requires. When we make a material change we will update the effective date above and, where appropriate, notify you inside the App. Continued use after an update means you accept the revised policy.

13. Contact Us

Questions, requests or complaints about this policy can be sent to:

WEBYAP YAZILIM LİMİTED ŞİRKETİ
Adalet Mah. Anadolu Cad. Megapol Tower NO:41 K:8 D:81, Bayraklı, İzmir, Republic of Türkiye
MERSİS No: 0800124092500001
contact@cardper.com