Privacy Policy

Frank (“the application”, “we”) processes your personal data in accordance with Turkish Personal Data Protection Law No. 6698 (KVKK) and applicable regulations. This policy explains what data we collect and how, what we use each kind for, who we share it with, how long we keep it, and how you can withdraw your consent.

1. Data Controller

The data controller for personal data processed through this application is Ozan Can Sisman, acting as an individual.

• Name: Ozan Can Sisman
• Email: privacy@unclefrank.app
• Website: unclefrank.app

2. Data We Collect and How

Account information (from you or the sign-in provider you choose)

• Email address
• Your name (typed during setup, or shared by Apple / Google at sign-in)
• Sign-in method (email, Sign in with Apple, Sign in with Google); with email sign-up your password is stored only as an irreversible hash
• Household situation (using Frank alone or with your partner) and which setup steps you have completed

Financial records (entered by you or read from a statement you upload)

Frank is not connected to any bank or financial institution and has no access to any bank API. Financial records come from two places:

• Directly from you: the expenses, income, accounts and balances, cards, instalments, subscriptions and recurring payments, debts and receivables, assets (gold, foreign currency, crypto, deposits, etc.), ceps (spending pockets), limits and notes you enter.
• From a bank statement PDF you upload: the statement’s transaction lines (date, merchant name, amount, instalment details), the card’s last 4 digits, the statement date and the statement balance. The PDF file itself is not stored; only the transactions you confirm are saved.

Household information

• Household membership, your role (owner or member), when you joined, and who entered each record. Other members of your household see the household’s records and members’ names.

Consent records

• The date and version of the legal consent you gave at sign-up
• Whether you agreed to marketing emails, and when
• Each decision you make about AI features: grant, decline or withdraw (date, version and where it was given)

Purchase status

• Frank Pro status: plan (monthly / yearly), status, period end, whether it renews, store and product identifier. Your card details never reach us; Apple takes the payment.

Records the app creates

• Activity history (a summary of records you add, edit or delete, shown on the Activity screen)
• Financial Health Report (the monthly report you generate and Mehmet Amca’s letter)
• Getting-started guide and monthly mission progress, in-app notifications

Technical data

• Server request and error logs (IP address, request time, error message); for security and debugging only
• Cookieless usage statistics that are not linked to your account (page views and a few product events such as sign-up completed; no amounts or personal data)
• In the mobile app, the device identifier (IDFV) to verify Frank Pro purchases. The advertising identifier (IDFA) is not collected.

Chatting with Mehmet Amca

The questions you send Mehmet Amca and the answers you receive are processed only to produce the answer; Frank does not store chat history.

3. What We Use Data For

• Account information: to create your account, let you sign in, send verification and password-reset emails, and show you to your household members by name.
• Financial records: to provide Frank: spending tracking, ceps, limits, 90-day planning, card debt, net worth and reports; and the AI features you turn on (see Section 5).
• Household information: to let you use your household together and show who entered a record.
• Consent records: to respect the consent you give or withdraw, and to be able to prove it.
• Purchase status: to unlock Frank Pro and share it with your household members.
• Records the app creates: to show you your history and reports.
• Technical data: security, abuse prevention, debugging, and seeing in aggregate which screens are used so we can improve the app.
• Email address: important service notices; marketing emails only if you agreed (see Section 9).

No advertising, no selling, no tracking. We do not use your data for advertising, we do not sell it, we do not share it with ad networks, and we do not track you across other companies’ apps or websites.

4. Legal Bases (KVKK Article 5)

• Explicit consent: for transfers abroad, AI features and marketing emails
• Formation and performance of a contract: to provide the Frank service to you
• Our legal obligations: under tax and commercial record-keeping regulations
• Legitimate interest: security, abuse prevention and service improvement

5. Third Parties We Share Data With (KVKK Articles 8 and 9)

Frank works with the following providers. Each receives only the data listed, for the purpose listed.

AI and Anthropic. Statement reading, Mehmet Amca (chat and monthly analysis), cep suggestions and the Financial Health Report run on Anthropic’s Claude AI. These features run only after you explicitly allow them in the app; if you do not allow them, or withdraw your consent, no data is sent to Anthropic. Frank does not add your name, email address, user ID or household ID to these requests. For statement reading, the PDF you upload is sent as it is, so whatever your bank printed on it (such as the cardholder’s name) is part of that file. Under Anthropic’s commercial terms, content sent through its API is not used to train its models. Mehmet Amca’s answers are not stored by Frank; the Financial Health Report’s letter is stored in your account so you can see the report again.

Equal protection. These providers process your data only to provide their service to us and are bound to protect it at least as well as this policy describes.

Transfers abroad (KVKK Article 9): transfers to Vercel, Cloudflare, Anthropic, Adapty, Apple and Google (Gmail included) go to the USA; we ask for your explicit consent to them at sign-up, and separately in the app for AI features. Supabase keeps your data in the EU (Frankfurt, Germany).

Beyond these, your data is shared with competent public authorities only when the law requires it.

6. Retention and Deletion

• Account, financial records, household, consent records, activity history and reports: kept while your account is open, until you delete them or your account.
• Uploaded statement PDFs: not kept after processing; only the transactions you confirm remain.
• Mehmet Amca chats: not stored.
• Server logs: kept briefly, for as long as the hosting provider’s log retention settings allow.
• Payment records: kept by Apple and Adapty under their own retention periods.

Deleting your account: you can delete your account at any time in the app under Settings → Delete account; the steps are on How to Delete Your Account. Deletion takes effect immediately and cannot be undone. When you delete your account, your personal account data is deleted. If your household has other members, the records you entered stay in the household and pass to the household owner; if you are the owner, ownership and these records pass to the household’s longest-standing member. In a single-member household all data is deleted. If you pay for the household’s Frank Pro, the subscription ends at the end of the period; your App Store subscription is not cancelled automatically, so cancel it in your App Store account settings to stop billing.

If you cannot reach the app, or want a copy of your data before deleting, write to privacy@unclefrank.app; we handle your request within 30 days.

7. How to Withdraw Your Consent

• AI features: turn off Settings → Preferences → AI features (“Yapay zekâ özellikleri”). While it is off, statement reading, Mehmet Amca, cep suggestions and the Financial Health Report do not work and no data is sent to Anthropic. You can turn it back on at any time.
• Marketing emails: turn off Settings → Preferences → Marketing emails (“Kampanya e-postaları”).
• Sign in with Apple or Google: on iPhone, Settings → [your name] → Sign in with Apple → Frank → Stop Using Apple ID; for Google, remove Frank’s access on your Google Account’s “Third-party apps and services” page.
• Entirely: delete your account (Section 6). For the other consents given at sign-up, write to privacy@unclefrank.app.

8. Data Subject Rights (KVKK Article 11)

You have the following rights:

• To learn whether your personal data is processed
• To request information if it has been processed
• To learn the purpose of processing and whether it is used appropriately
• To know the third parties to whom your data is transferred, domestically or abroad
• To request correction if it is incomplete or inaccurately processed
• To request deletion or destruction
• To request that corrections, deletions and destructions be notified to third parties to whom the data was transferred
• To object to a result against you arising from analysis exclusively through automated systems
• To claim compensation for damages arising from unlawful processing

To exercise these rights, write to privacy@unclefrank.app from the email address registered in Frank. Under KVKK Article 13, your request is answered free of charge within 30 days.

9. Marketing Emails

Marketing emails are occasional emails we may send about new features, tips and Frank Pro offers. They are entirely optional: if you did not tick the box at sign-up, or turned it off in Settings, we do not send them, and no part of Frank depends on them. To stop them, turn off Settings → Preferences → Marketing emails or write to privacy@unclefrank.app. Service emails such as verification and password reset are not marketing emails.

10. Data Security

• All data is encrypted in transit and at rest (TLS, AES-256)
• Passwords are irreversibly hashed with bcrypt
• Database access is protected by Row-Level Security (RLS); each household sees only its own records
• API rate limiting and input validation are applied

11. Children

Frank does not accept users under 16. Accounts we find to belong to users under 16 are closed immediately and their data deleted. Users aged 16 to 18 need the consent of a legal guardian to open an account.

12. Cookies

For detailed information about our use of cookies, see our Cookie Policy.

13. Policy Updates

Material changes to this policy are announced by email or in-app notification. Updates are published on this page with the last-updated date above.

14. Contact

For questions and requests: privacy@unclefrank.app