Privacy Policy and Privacy Notice

Last updated: 24 October 2026

This text is the privacy notice under art. 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK). It says which personal data Palbox processes, for which purpose and on which legal basis.

Data controller and contact

The data controller of Palbox is İsmail Yankayış, the developer of the app.

Send questions and requests about this text to: privacy@palboxapp.com

Data we collect

• Account. You sign in with Apple, with Google, or with an e-mail address and a password. You can also add an e-mail address and a password to an account that you opened with Apple or Google. With Apple or Google, the server stores the ID of your account at that provider. At sign-in, the server checks the ID token that the provider issues and does not store it. The server does not store the e-mail address that Apple or Google gives. With e-mail and password, the server stores your e-mail address as plain text, in lower case. It stores your password only as a hash (argon2id); it does not store the password itself. The server does not write the address, the password, its hash or a code to a log. When you sign in with Apple, the app also sends the server the authorization code that Apple issues. The server sends this code to Apple and gets a refresh token for your Apple sign-in. The server stores this token encrypted (AES-256-GCM) and uses it only to end your Apple sign-in when you delete your account.
• E-mail sign-in records. To open an account, to add an e-mail address or to reset a password, the server sends a code to the address. The server stores the code only as a hash. A code is valid for 10 minutes. When you open an account, the server keeps the address and the hash of the new password until you enter the code, for at most 24 hours after the last code. A code to add an address or to reset a password is kept for 10 minutes; a code to add an address also holds the hash of the new password. To prevent abuse, the server counts for each address the failed sign-ins, the e-mails sent and the code attempts. These counts also hold addresses that have no account. A count of failed sign-ins stays until the 15-minute window or the 30-minute lock ends, whichever is later. A correct sign-in or a new password deletes it. The counts of e-mails and code attempts stay for at most 1 hour. The server also counts the e-mails it sends each day; this count holds no address. Regular cleanup deletes these records when they expire. The cleanup runs once an hour, so an expired record can stay for at most 1 more hour.
• Profile. Your display name, your username, your choice to be found by username, and your app language (Turkish or English).
• Ledger records. Ledgers, expenses, payments and their amounts; friendships, group memberships, invites and the activity history. Your people list is part of this. These records can contain names that you enter for other people. An admin of a group ledger can delete the ledger for every member. Then every record of that ledger is deleted for every member: expenses, payments, members, invites, claims and the activity history. Of the deleted ledger itself, the server keeps its ID and the time of the deletion, so that a late change cannot bring the ledger back. The Activity events about the ledger keep a copy of its name until regular cleanup deletes them after 90 days. The notification about the deletion also holds the ledger name; the server deletes it after 24 hours. Person records stay with the names in them, and so do personal links.
• Reminders. The text of a reminder that you set (free text), its time, its repetition and whom it is for (a friend or a record in your people list). The person a reminder is for can mark an occurrence "Done". The server then stores a completion record: the reminder, the time of the occurrence, who completed it and when. If the reminder is for another person, the person who set it sees an Activity line and can get a notification. The person a reminder is for can take a reminder that no longer rings off their list; the server stores this mark with its time. The person who set a reminder can delete it for both people. Its completion records and marks are deleted with it.
• Game sessions. The title of a session, the players, a copy of each player's display name taken into the session, and the scores. A player can take a session off their own list; the other players keep it. The server stores this mark. The scorekeeper can delete a session for every player; its players, rounds and scores are then deleted.
• Gold days. The title of a gold day, its unit and amount, its date rule, start month and time zone; the members (a user or a record in a people list), a copy of each member's name, their roles, the order of the turns and their dates. The server also keeps a history of the changes, with a copy of the name of the member who made each one. An admin can delete a gold day for every member; its members, turns and history are then deleted.
• Activity. The Activity tab shows the changes in your ledgers and the events addressed to you: someone added you to a group, linked their account through your personal link, accepted your friend request or your friend link, completed a reminder that you set, or deleted a ledger that you were in. For each event the server stores who receives it, its type, who acted, a copy of that person's name, a copy of the ledger name and the time. Regular cleanup deletes an event after it is 90 days old. Which lines you saw and which lines you cleared stays only on your device. It does not go to the server, and signing out deletes it.
• Receipt photo. If you pick a receipt with "Scan receipt" in the new expense form, the app shrinks the photo and sends it to the server. The server passes the photo to Anthropic only to read the receipt. The app and the server do not store the photo. The server does not write the photo to disk, to the database or to a log. The amount, date, currency, merchant name and items that are read fill the form; you save the expense yourself. For each scan attempt the server records your account ID, the time and the result (read, unreadable, error). An expense that starts from a receipt carries a "read from a receipt" mark in the ledger.
• Notifications. To send notifications we store the push token of your device (Expo), its platform (iOS or Android), its language and your notification settings. The text of a notification contains the first name of the person who acted, the ledger name and the amount. A gold day notification contains the name of the gold day and your turn number and date. It also shows on the lock screen.
• Sessions. The tokens that renew your session are stored only as hashes.
• Error reports. When the server has an error, it sends a report to Sentry. The report does not contain request headers, the request body, the query string, cookies or variable values. E-mail addresses, push tokens and text shaped like a JWT are removed from it. The report is not linked to a user. The mobile app also sends error reports to Sentry. This happens only from release builds and only if a Sentry address is set. When the app has an unexpected JavaScript error, the report holds the error type and message, the stack trace, the app version, the device model, the operating system version and the release channel. The report also holds the recent network requests (method, address, status code) and system events. The app puts no account ID, e-mail address, name or IP address in the report. Request headers, cookies, the request body, the query string and console logs do not enter it. E-mail addresses, push tokens, text shaped like a JWT and invite link tokens are removed; ID-like parts of addresses are masked. Other free text in the error message can stay in the report (for example the name of a ledger). If the app crashes (Android and iOS), the native SDK sends the report. These reports do not pass the removal described above. The report holds a random ID made for this installation (it is not linked to the account), device and operating system data, the app version, the stack trace of the crash and system events (for example the app moving to the foreground or background, the connection state). The app uses no session tracking, performance tracing, screen recording or screenshots.
• IP address. For rate limits (to prevent abuse), the server application keeps the IP address in memory and does not write it to disk. The access log of the application writes only the method, the path, the status code and the duration; it does not write the IP address. The reverse proxy in front of it (Caddy) can write the client IP address in its error log. Container logs rotate: at most 3 files of 10 MB for each container.

We do not collect your contacts, phone number or location.

Purpose and legal basis

We process the data to open your account and manage your session, to send the codes and notices of e-mail sign-in, to keep your ledgers and sync them between your devices, to run friendships and invites, to keep reminders and game scores, to keep the order and dates of gold days, to send notifications, and to fill the expense form from a receipt photo.

This processing is necessary to conclude and perform the contract (Turkish KVKK Law No. 6698, art. 5/2-c).

For error reports and rate limits (also the e-mail sign-in counts), the legal basis is legitimate interest (art. 5/2-f).

We also measure the use of the app with weekly counts, for example the number of active ledgers, expenses, game rounds and new accounts. The counts are totals and hold no user, ledger or token ID. For this the legal basis is legitimate interest (art. 5/2-f).

Transfers

Keeping data on a server outside Türkiye is a transfer abroad (KVKK art. 9). Data is kept at, or passes through, these recipients:

• Hetzner (Germany). The servers are at Hetzner. The whole database and the daily disk image of the server are kept there.
• Sentry (a US company; the data is kept in the EU data region). Receives the error reports of the server and of the mobile app. The server reports and the JavaScript reports of the app pass the removal described above. Native crash reports do not.
• Expo (US). Delivers push notifications and passes them to your device through Apple (APNs) and Google (FCM). Expo receives the push token, the text of the notification and routing IDs (the ID of a ledger, friendship, transfer, claim, reminder or gold day). The text of a notification also passes through the services of Apple and Google.
• GitHub (US). Keeps the nightly backup of the database as a GitHub Actions artifact for at most 90 days. The backup is encrypted on the server with age. Only the data controller holds the key; it is not at GitHub or on the server.
• Anthropic (US). Provides the receipt reading. The photo goes there only when you pick a receipt with "Scan receipt". Anthropic processes the photo only to read the receipt, under its commercial API terms. The server does not send Anthropic your user ID, a ledger name or member names.
• Resend (a US company). Sends the e-mails of e-mail sign-in: the codes to open an account, to add an e-mail address and to reset a password, and the notice that your password changed. Resend receives the recipient's e-mail address and the content of the e-mail, with the code if the e-mail has one. The server sends Resend no other data. Resend sends no e-mail for sign-in with Apple or Google.
• Apple and Google. For sign-in with Apple or Google. To check the ID token, the server reads the public keys of these providers. With Apple sign-in, the server sends Apple the authorization code and, when you delete your account, the refresh token. Apple uses them to issue and to revoke the token. The server sends no other data to Apple or Google.
• Better Stack. Checks from outside that the server is running. Every few minutes it sends requests to public addresses of the server and records whether an answer comes. These requests and answers carry no personal data. Better Stack receives no personal data.

Retention and deletion

We keep your data while your account is open. You can delete your account in the settings of the app, also when you have open balances.

When the account is deleted, these are removed: your display name, username, language, the Apple, Google and e-mail sign-in records (for e-mail sign-in, the e-mail address and the password hash), the pending codes and the e-mail sign-in counts of your address, push tokens, notification settings, pending notifications, your people list, the record of your receipt scan attempts, the Activity events addressed to you and the marks with which you took game sessions off your list. In the Activity events of other users, the copy of your name is deleted. The reminders that you set are deleted, with their completion records and marks. Reminders set for you that are not over are canceled. Open sessions end. If the server holds a refresh token of your Apple sign-in, the server revokes it at Apple, and the app leaves the "Sign in with Apple" list in your Apple Account settings. If Apple does not answer, the deletion still ends, and the stored token is deleted with your sign-in records. If the app stays in the list, you can remove it yourself in Apple Account › Sign in with Apple. The steps and the details are on the account deletion page.

These stay:

• The expenses and payments in the ledgers, and the expense descriptions, ledger names and group names. They stay so that the balances of the other members do not change. Your name is removed from these records and an anonymous "Deleted user" takes its place.
• Game sessions and scores. The copy of your player name in the sessions is deleted. Open sessions that you lead end.
• Gold days, with their turns and dates. Your member row and your turn stay as an anonymous "Deleted user". The copy of your name in the member list and in the gold day history is deleted. If you were the only admin, the user member who joined first becomes admin; a gold day without another user ends.
• The completion records and the list marks that you made on reminders that others set. They stay with those reminders.
• The person records that you created, with the names in them. A person record belongs to nobody, so it is not deleted.
• Your user record keeps only your internal ID and the dates of creation and deletion.
• The hashes of closed sessions stay until they expire, and routine cleanup then deletes them.

Backups: an encrypted backup of the database is made every night and is kept for at most 90 days. Hetzner makes a disk image of the server every day and keeps the last seven. Deletion does not reach the backups. Deleted data can stay in backups until this period ends.

Expo, Sentry, GitHub, Anthropic and Resend keep data under their own retention rules.

The record of scan attempts (account ID, time, result) is deleted by regular cleanup after it is 90 days old, and with your account when you delete it. The record holds no photo and no receipt content.

Your rights and how to apply

Under KVKK art. 11 you have the right to:

• learn whether your personal data is processed, and ask for information if it is;
• learn the purpose of the processing and whether it is used for that purpose;
• know the third parties in Türkiye or abroad that receive the data;
• ask for correction of incomplete or wrong data;
• ask for erasure or destruction of the data under the conditions of the law;
• ask that the third parties who received the data are told about correction and erasure;
• object to a result against you that comes from the analysis of the data by automated systems;
• ask for compensation if you suffer damage because of unlawful processing.

To apply, write to privacy@palboxapp.com. We answer within 30 days at the latest. You can also delete your account yourself in the app. If you are not satisfied with the answer, you can complain to the Personal Data Protection Board.

Changes

If this text changes, we publish the new text on this page and change the "Last updated" date. Last updated: 24 October 2026.

Terms of UseAccount deletionSupport