Last updated 19 October 2026. The Turkish version is the KVKK information notice and prevails if the two differ.
The data controller is Koray Özcan ("Reelio", "we"). Contact: korayozcan33@gmail.com.
| Data | Why |
|---|---|
| Identity and contact: email address; the account identifier Apple or Google gives us when you sign in with them (if you hide your email with Apple, we only see Apple's relay address) | To create your account, send your sign-in code and recognise you |
| Profile: country, base currency, birth year, language, theme | To show amounts in the right currency and against inflation, and for financial-independence calculations |
| Financial records you enter: assets, liabilities, instalments, income and spending entries, categories, goal and scenario settings, and the daily net worth calculated from them | The core service: showing your net worth, real return and cash flow |
| Subscription: plan, start and end dates, trial status (we never see payment details; Apple takes the payment) | To unlock Premium |
| Push token (if you allow notifications) | To send you notifications |
| Crash reports: the error, where in the code it happened, device model and iOS version | To find and fix bugs. Anything shaped like an email address or a sign-in token is removed before sending; amounts and asset names are never sent. |
We show no ads, do no tracking and never sell your data.
| Provider | Role | Location |
|---|---|---|
| Supabase Inc. | Database, sign-in and server functions: your account and all financial records | Frankfurt, Germany data centre; company in the USA |
| Apple Inc. | Sign in with Apple, App Store payments, notification delivery | USA and Apple data centres |
| Google LLC | Sign in with Google; sending sign-in code emails | USA and Google data centres |
| RevenueCat Inc. | Subscription status (random user ID and purchase records) | USA |
| Functional Software Inc. (Sentry) | Crash reports | USA / EU |
| 650 Industries Inc. (Expo) | Relaying notifications to Apple (push token and notification text) | USA |
Transfers outside Turkey rely on the standard contracts published by the Turkish Personal Data Protection Authority, notified to the Authority as KVKK Article 9 requires. No personal data is sent to the market and inflation data sources the app reads (e.g. the Central Bank of Turkey, TurkStat, TEFAS).
If you turn the benchmark on, your net worth only contributes to an aggregate median for your country and age band. A group with fewer than 30 people is never computed. No other user can see your amounts or who you are.
Importing bank or card statements is currently switched off. Before it is switched on, this policy will be updated and the app will ask for your separate consent before your first import.
We keep your data while your account exists. When you delete your account, the account and all records are deleted immediately and leave system backups within 30 days. Crash reports are deleted within 90 days. Records we must keep by law (if any) are kept for the legal period.
Data is encrypted in transit (TLS) and stored with row-level security, so only you can read your rows. The offline cache on your phone is wiped when you sign out.
You can ask what we hold about you, have it corrected or deleted, learn who it was shared with, object to purely automated decisions and claim compensation for unlawful processing (KVKK Article 11; GDPR rights where it applies). Write from your registered email to korayozcan33@gmail.com; we answer free of charge within 30 days. You can also delete your account yourself in the app (profile icon → Delete account) or as described here.
Reelio is not for children under 13. If you are under 18, use it with a parent's or guardian's consent.
If we change this policy we update the date above and announce important changes in the app.