Data Protection Notice

fist — Receipt Scanner · Last updated: 24 August 2026 · Türkçe

Under Article 10 of the KVKK and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, we would like to tell you how your personal data is processed while you use fist.

This notice explains, in order: which personal data is processed, for which purposes and on which legal ground it is processed, how it is collected, who it is shared with and which countries it is transferred to, how long it is kept, and the rights you have over it. The identity and contact details of the data controller are in Article 4; how to apply to us is in Article 8.

Using the app requires an account. Your receipts are stored on our servers and synced between your devices, and a copy is kept on your device so the app also opens without a connection.

ARTICLE 1

The app processes the data below. The list was written from what the source code actually does; nothing outside it is collected.

• Identity: first name, last name. Collected from the sign-up form and the profile screen.
• Contact: e-mail address. Collected from the sign-up form.
• Customer transaction: receipt records — store name, date, line items, VAT amount, total amount, category; plus budget limits and app settings. Read automatically from the receipt photo and changed by your own edits.
• Visual records: the receipt images you capture or upload, from your device camera or a file upload. A receipt image may carry extra details such as a name or the last digits of a card number; we do not separately extract that content.
• Transaction security: your password (only as an irreversible hash), session data and usage quota counters. Created during sign-up and sign-in.
• Subscription: plan type, start date, renewal date, cancellation status; group membership and invite records on the Family plan. Created by plan and group operations.

ARTICLE 2

• Creating your account and letting you sign in — identity, contact and transaction security data. Legal ground: art. 5/2-c, conclusion and performance of a contract.
• Storing your receipts and syncing them across your devices — customer transaction and visual records. Legal ground: art. 5/2-c, performance of a contract.
• Reading the store, date, amount and line items from the receipt photo — visual records. Legal ground: art. 5/2-c, essential element of the service.
• Producing the spending analysis report — monthly totals and most-visited store names. Legal ground: art. 5/2-c, service provided at your request.
• Running the shared budget pool on the Family plan — subscription and customer transaction. Legal ground: art. 5/2-c, performance of a contract.
• Applying usage quotas and preventing abuse — transaction security. Legal ground: art. 5/2-f, legitimate interest.
• Maintaining plan and subscription records — subscription, identity, contact. Legal ground: art. 5/2-c, performance of a contract.
• Hosting and processing your data on servers abroad — all of the data listed above. Legal ground: art. 9, explicit consent (see 5.1).

ARTICLE 3

Your personal data is collected by wholly or partly automated means, through the sign-up and profile forms in the app, your device’s camera or file picker, and the records created as you use the app.

ARTICLE 4

Your personal data is processed by the individual developer publishing under the name Omka Labs, acting as data controller, in the manner described in this notice.

• Data controller: the individual developer publishing under the name Omka Labs (a natural person)
• E-mail: fistdestek@gmail.com
• Identity and postal address: the data controller’s name and the address for written applications are available on request at the e-mail address above.
• VERBİS: not required to register. Under the exemption granted by the Personal Data Protection Board, data controllers with fewer than 50 employees a year and an annual balance sheet below TRY 100 million, whose principal activity is not the processing of special categories of personal data, are not obliged to register with VERBİS.

ARTICLE 5

5.1. Transfers abroad and their legal ground

The app’s database and file storage run on Supabase infrastructure in the Germany (Frankfurt / eu-central-1) region. When you create an account, your receipt records, receipt images, profile and subscription details are transferred to those servers.

So that your receipt can be read and the spending analysis report produced, the relevant content is sent to the Gemini AI service provided by Google.

The Personal Data Protection Board has issued no adequacy decision for the countries concerned. Transfers abroad are therefore carried out on the basis of your explicit consent under Article 9 of the KVKK. When you create an account, this notice and the privacy policy are shown to you in full — that is where you read that your data will be hosted on servers in Germany and that your receipt images will be sent to Google’s AI service — and your consent is taken afterwards. Without that consent no account is created.

If you do not want the receipt image to be transferred abroad, do not use the scanning feature — you can add your spending manually. Manually added records are not sent to the AI service; they are only stored on the servers in Germany that hold your account.

5.2. What the analysis report sends

A spending analysis request does not send your receipts. Only the monthly totals for the last 12 months, per-category amounts and the names of at most ten stores you shop at most often are sent to the AI service. Individual receipt records, line items and receipt images are not part of that request.

5.3. Other recipients

• App stores: the app currently charges nothing; no payment is taken in the app and no data is transferred to a payment provider. When paid plans begin, subscriptions will be sold through the Apple App Store and Google Play and the payment will be collected by that store. Your card details are never passed to us and are never stored by us.
• Competent public authorities: within the scope of our legal obligations and limited to what is requested.

Beyond these, your personal data is not shared with third parties, not sold and not used for advertising.

ARTICLE 6

• Account details (identity, contact): while your account is open; immediately upon deletion of the account.
• Receipt records and images: until you delete them; immediately with the account when it is deleted.
• Subscription records: while your account is open. As no payment is collected, no record subject to statutory financial retention is created; once paid plans begin, invoice records will be kept for 10 years under Turkish tax and commercial law.
• Quota counters: until the account is closed.
• Local copy on your device: stays on your device until you delete your account or clear the app’s data. Delete My Account removes that copy too; signing out alone does not.

If you close your account, your personal data is removed from our active systems as the deletion runs, without prejudice to the retention obligations set out above. Copies that may exist in backups are deleted as part of our infrastructure provider’s backup and retention cycle.

ARTICLE 7

Under Article 11 of the KVKK you may apply to the data controller to:

• learn whether your personal data is processed,
• request information about it if it has been processed,
• learn the purpose of processing and whether it is used accordingly,
• know the third parties, in Türkiye or abroad, to whom the data is transferred,
• request correction if it is incomplete or incorrect,
• request erasure or destruction under the conditions in Article 7,
• request that corrections, erasure or destruction be notified to the third parties the data was transferred to,
• object to a result against you arising from analysis carried out solely by automated systems,
• claim compensation for damage suffered because of unlawful processing.

ARTICLE 8

In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may send your requests from the e-mail address registered in our system to fistdestek@gmail.com. If you prefer to apply in writing, you can request our postal address at the same e-mail address. Your application is answered within 30 days at the latest.

You can exercise your right to erasure without applying at all: remove your account and all of your data from inside the app via Profile → Advanced → Delete My Account. It is confirmed with your password and happens the moment you confirm; you do not need to wait for a reply from us.