Privacy Policy

1Introduction

MechEngAta-Finance is a personal finance management platform that helps you track income, expenses, budgets, assets, debts, and financial goals. This policy describes our practices regarding your personal data in compliance with applicable privacy laws, including the EU General Data Protection Regulation (GDPR), the Turkish KVKK, and Google's OAuth verification requirements.

By using our service, you agree to the data practices described in this policy.

2Information We Collect

Account Information

• Email address (used for authentication and communication)
• Display name (optional, sourced from your Google profile or registration form)
• Password (stored only as a cryptographic hash; we never see the plain text)
• Account role and approval status (admin-managed)

Financial Data

• Income, expense, budget, asset, and debt records you create
• Bank account and credit card metadata you add
• Notes, tags, and categories attached to your records
• Financial goals and planned transactions

Google Integration Data (Only When You Connect)

• Google Calendar: creates and deletes only the payment-plan events you choose; it does not read your existing events, availability, or other calendars.
• Google Drive: uploads and lists only documents and receipts that you choose in the MechEngAta-Finance folder in your personal Drive; it does not access unrelated Drive files.
• Gmail: sends an on-demand monthly financial summary or a connection test only to your connected Google address; it does not read, list, or modify messages.
• We request the minimum scopes required: drive.file, gmail.send, calendar.events

Technical Data

• IP address, browser type, device info (security and fraud prevention)
• Session tokens (HTTP-only cookies set by our authentication provider)
• Service usage logs (error tracking, performance metrics)

3How We Use Your Information

• Service delivery: To provide and maintain the finance management features you use.
• Authentication: To verify your identity and secure your account.
• AI assistance: To generate personalised financial insights when you request them. Only aggregated summaries, never your full raw records, are sent to AI providers.
• Integration sync: To sync with Google services you explicitly connect.
• Security: To detect and prevent fraud, abuse, and security incidents.
• Improvement: To analyse anonymised usage patterns and improve the product.

We do not:

• Sell your personal data to third parties.
• Use your data for advertising or marketing profiling.
• Share your data with third parties for their own purposes.

4Data Storage and Security

• Data is stored on Supabase (PostgreSQL) with encryption at rest.
• All communications use HTTPS/TLS.
• Passwords are hashed using bcrypt by Supabase Auth.
• Session tokens are HTTP-only, Secure, SameSite=Lax cookies.
• Google OAuth tokens are stored server-side; refresh tokens are encrypted.
• Documents and receipts you upload are stored directly in your personal Google Drive. We retain only the metadata needed to associate a receipt with your financial record.
• Data is retained while your account is active. After deletion, data is removed within 30 days, except where legal retention is required.
• Access to production data is limited to authorised personnel under MFA-protected accounts.

5Third-Party Services

These services have their own privacy policies. We recommend reviewing them. We require all processors to provide adequate security guarantees through data processing agreements.

6Your Rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your account and associated data.
• Export your data in a portable, machine-readable format.
• Withdraw consent for optional processing (Google integrations, AI features). You can disable Drive access from Settings without deleting documents already in your Drive.
• Object to processing based on legitimate interest.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at info@atakandurmaz.com. We will respond within 30 days.

7Cookies and Local Storage

• Essential cookies: Authentication session (HTTP-only, set by Supabase Auth).
• Local storage: UI preferences (theme, language), PWA cache for offline support.
• Analytics: We do not use third-party analytics or advertising cookies.

8Children's Privacy

Our service is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us immediately for deletion.

9International Data Transfers

Some of our processors (Supabase, Google APIs, AI providers) may store or process data outside your country of residence, including in the United States and the European Union. We rely on Standard Contractual Clauses and other approved transfer mechanisms to ensure your data remains protected.

10Changes to This Policy

We may update this policy from time to time. Material changes will be notified via email or in-app notice at least 14 days before they take effect. The "Last updated" date at the top reflects the latest revision. Continued use after changes constitutes acceptance.

11Contact Us

For any questions about this Privacy Policy or to exercise your data rights:

Email: info@atakandurmaz.com

Data Controller: Atakan Durmaz

Last updated: 29 July 2026