Kartmetre privacy policy

Last updated: 6 November 2026. Kartmetre is made by Devrim Çatak (Türkiye, "devca", "we"); contact: support@devca.app.

In short

• Your financial data stays on your phone and is never sent to a server. Kartmetre has no server, no bank connection, never asks for a bank password and never reads your SMS.
• We never ask for your card number. You enter a bank name, a name for the card and, if you like, its last four digits.
• We use analytics, crash reports and ads (free version). None of them receive amounts, bank names, limits, rates, notes or categories.

Data on your phone

Your cards, transactions, statements, loans, reminders, monthly income (if you enter it) and settings are stored only in the app on your device, in a database encrypted with a key held in your phone's secure keystore. Deleting the app deletes them.

Backups

Export data creates a file through your phone's share sheet; you choose where it goes and it never reaches us. Encrypted automatic backup (Pro) writes a file encrypted with a password you choose (AES-256-GCM) into the app's own storage, which Apple's iCloud backup or Google's Android backup carry to your own account under their terms. The password is never stored or sent anywhere; if you forget it, the backup cannot be opened, also not by us. CSV export (Pro) works like Export data.

Rules file

To keep legal rates, taxes and public holidays current, the app downloads a public file from devca.app at most once a day. The request carries no information about you or your data; like any web request it reaches our host with your IP address, which the host keeps in its logs for security for up to 14 days.

Analytics and crash reports

We use Firebase Analytics and Crashlytics (Google) to learn which features are used and to fix errors. Events contain product measurements only, for example "a transaction was added", "a statement was marked paid", the number of cards, or which simulation was opened. Crash reports contain technical data (device model, OS version, stack trace) and no data you entered.

Ads

The free version shows Google AdMob ads under the overview, card, loan and calendar lists, never on data entry screens, the lock screen or during onboarding. AdMob may use your device's advertising ID and approximate location. In the EU/UK we ask for consent first; on iPhone, Apple's tracking permission decides whether the ID is shared. You can change your choice in Settings → Privacy choices. Pro and "Remove ads" remove ads; then no ad is even requested.

Purchases

Purchases are processed by Apple or Google and managed with RevenueCat, which receives an anonymous app user ID and your purchase history. Your payment details never reach us.

Notifications and widgets

Reminders are scheduled on your phone. Widgets show what is left to pay; you can hide amounts in notifications and widgets.

App lock

Face ID, Touch ID, fingerprint or your passcode are checked by your phone's operating system; the app only learns whether unlocking succeeded.

Your rights

You can use your rights under the Turkish KVKK (art. 11) and the GDPR (access, correction, deletion, objection and others) by writing to support@devca.app, and complain to the Turkish Personal Data Protection Authority or your local authority. Since your financial data never reaches us, you delete it by deleting it in the app or deleting the app.

Children

Kartmetre is not directed at children under 16.

Changes

If this policy changes we update this page and the date above.