Privacy Policy — RemindPayBee

Effective Date: 11 October 2026

Application: RemindPayBee

Developer / Data Controller: RemindPayBee

1. Data Controller

Within the scope of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the EU General Data Protection Regulation (“GDPR”), RemindPayBee acts as the data controller for personal data processed through the RemindPayBee application. For any inquiries, you may contact us at remindpaybee@gmail.com.

2. Account and Data Storage

RemindPayBee requires you to create an account (via Google Sign-In, Apple Sign-In, or a one-time 6-digit code sent to your email address) in order to use the App. Your expense records, asset portfolio (including the purchase and sale transactions you record for each asset), income records, categories, and settings are stored on our secure backend servers to enable multi-device synchronisation. This means your data is associated with your account and accessible when you sign in from any device.

Your data is never sold or rented. The financial content you create — payment records, incomes, assets, amounts, titles and notes — is never shared with advertisers, analytics providers, or any other third party for commercial purposes.

We do use a limited number of third-party services to measure how the App is used, to diagnose crashes, and to measure the effectiveness of our advertising. What these services receive is strictly limited to the technical and behavioural data described in Sections 3, 7 and 8 — never your financial content.

3. Data We Collect

When you use the App, we collect and store only the minimum data necessary to provide and improve the service:

• Account information: Email address and user ID provided by your sign-in provider (Google or Apple), or — if you sign in with email — the email address you enter. We do not collect your full name, phone number, or other identifying information beyond this.
• Email sign-in codes: When you sign in with email, we generate a one-time 6-digit code, store only a hashed form of it together with the request time and your IP address (for rate limiting and abuse prevention), and send the code to your address through our email delivery provider (see Section 7). Codes expire after 10 minutes; expired codes and request logs are deleted automatically within about one day.
• App content: Expense reminders, asset portfolio entries, income records, categories, and settings you create within the App. This content is stored on our own servers and is not shared with the analytics providers listed in Section 7.
• Device and security information: Device identifier, device model, operating system version, and IP address — used for security, debugging, and service improvement.
• Usage and interaction data: Which screens you open, which features you use, and anonymous counters and flags — for example whether a record was recurring, how many ledgers your account has, or which subscription plan a purchase relates to. The amounts, record titles, notes, category names and ledger names you enter are never included in this data.
• Push notification token: If you allow notifications, the App may register a device push token with our servers, together with your device's time zone and interface language, so that payment reminders can be delivered even when the App has not been opened recently. The token identifies your device for notification delivery only; it is not used for advertising or profiling and is removed when you sign out or turn notifications off.
• Market prices: To value your assets, our servers fetch current prices for the instruments held by our users (for example gold, currencies, stocks, funds and crypto assets) from market data providers and keep an hourly price history for a short period. These requests contain only instrument symbols aggregated across all users — your quantities, purchase prices and account are never sent to a market data provider.
• Crash and error diagnostics: When the App crashes or encounters an error, we receive a technical report containing the error and its location in the code, together with device model, operating system version and app version.
• Session recordings: To understand where users get stuck, Microsoft Clarity and Mixpanel Session Replay record anonymised replays of your interaction with the App (taps, scrolls, navigation between screens) and produce aggregated heatmaps. Your financial and personal content is masked in these recordings: amounts, record titles, descriptions and notes, account, card and bank names, card digits, your e-mail address, and the names you create yourself (ledgers, tags, assets and custom categories) are not readable. Anything you type into an input field and all images are always masked. Standard interface text — menus, buttons, screen titles, built-in category names — and non-monetary details such as dates, counts and percentages remain visible, so that we can tell which part of the interface a recording shows.
• Advertising identifier: The advertising identifier of your device (Apple IDFA / Google Advertising ID) may be shared with Meta to measure whether our advertising led to an app install or a purchase. On iOS this happens only if you grant permission through Apple's App Tracking Transparency prompt (see Section 8).
• Purchase information: In-app purchase and subscription status, processed via RevenueCat (see Section 7).
• Install attribution: To understand which advertising campaign or link led you to install the App, we record the campaign-level source of the install. On iOS this is obtained from Apple's privacy-preserving AdServices framework (the Apple Ads campaign, ad group and keyword, if any) and does not use your advertising identifier or require the App Tracking Transparency prompt. On Android this is read from the Google Play Install Referrer (the install source, medium, campaign and term; for Google Ads installs only the fact that the install came from Google Ads — the click identifier itself is not stored). This information is linked to your anonymous user identifier in RevenueCat and in our analytics tools (see Sections 7 and 8).
• Consent record: When you accept the Terms of Use and Privacy Policy, we record the following for legal compliance: timestamp (server-side UTC), the version of the documents accepted, your IP address at the time of acceptance, device platform (iOS or Android), app version, and a copy of your account email address. This record is retained even after account deletion (see Section 10).

4. Notification Permissions

The App requests notification permissions only after explicit user interaction. Notifications are used solely to remind you of expenses you manually create. They are optional and can be disabled at any time in device settings.

Reminders are scheduled on your device. In addition, when reminders fall beyond what your device has scheduled, our servers may send them as push notifications through the Expo Push Service and Apple/Google notification services (see Section 7). Push notification text contains only the names of the relevant records and a count — never amounts, notes, category names or your email address.

5. Android Permissions and Alarms

Certain Android permissions (POST_NOTIFICATIONS, USE_EXACT_ALARM, RECEIVE_BOOT_COMPLETED) are used only to deliver time-based reminders. These specific permissions are never used for advertising, tracking, or background analytics.

The App additionally declares the com.google.android.gms.permission.AD_ID permission. This is used only to make the device's advertising identifier available for the advertising measurement described in Sections 3 and 8, and can be limited at any time from your device's Android privacy settings.

6. Notification Frequency

The App follows Google Play and App Store anti-spam policies. Reminders are triggered only for user-created expense records. High-frequency alerts require explicit user choice.

7. Third-Party Services

The App uses the following third-party services:

• Google Sign-In / Apple Sign-In: For secure account authentication. These providers may collect information as described in their own privacy policies.
• Resend: To deliver the one-time sign-in codes described in Section 3 to your email address. Resend receives your email address and the code message only. See Resend Privacy Policy.
• Expo Push Service (Expo, Inc.): To deliver payment reminder push notifications from our servers to your device via Apple Push Notification service or Firebase Cloud Messaging. Expo receives your device push token and the notification text (record names and counts only). See Expo Privacy Policy.
• Market data providers: To obtain current prices for the asset types supported by the App. These providers receive aggregated instrument symbols only, never any personal data or holdings.
• RevenueCat: For processing and validating in-app purchases and subscriptions across iOS and Android, and for attributing purchases to the advertising campaign that led to the install (install attribution, see Section 3). RevenueCat may collect purchase-related data and, on iOS, exchanges an Apple AdServices attribution token with Apple to obtain campaign-level information. See RevenueCat Privacy Policy.
• Google Play Billing / Apple App Store: For secure payment processing. No financial payment details are stored by the App or our servers.
• Google Firebase Analytics: To measure which features are used and how users move through the App, so that we can improve it. On iOS, Firebase Analytics is configured not to access the advertising identifier. See Firebase Privacy and Security.
• Google Firebase Crashlytics: To receive crash and error reports so that faults can be found and fixed. See Firebase Privacy and Security.
• Microsoft Clarity: To record anonymised session replays in which your financial and personal content is masked (see Section 3), and produce heatmaps that show where users encounter difficulty in the interface. See Microsoft Privacy Statement.
• Mixpanel: To analyse aggregated product usage and measure how many users complete key flows, and to record anonymised session replays linked to those flows, in which your financial and personal content and all images are masked (see Section 3). Our Mixpanel project uses European Union data residency, and session replay data is sent to the same European endpoint. See Mixpanel Privacy Policy.
• Meta Platforms, Inc. (Facebook / Instagram): To measure the effectiveness of our advertising campaigns. This service may receive your device's advertising identifier and in-app events such as app installs and completed purchases. It does not receive your financial records. See Meta Privacy Policy.

No financial content and no sensitive personal information is shared with any of the above third parties beyond what is technically necessary to operate, measure and improve the service.

8. Analytics, Measurement and Your Choices

Nothing is collected before you accept. None of the analytics, crash reporting, session recording or advertising measurement services described in Section 7 are activated until you have accepted the Terms of Use and this Privacy Policy inside the App.

You can withdraw your consent at any time. Open Settings → About → “Usage Data” inside the App and turn the switch off. Collection stops immediately: usage measurement is disabled, session recording is paused, product analytics is opted out, and advertising measurement is switched off. You can turn it back on at any time. Turning it off does not affect your ability to use any feature of the App.

Install attribution. Install attribution (Section 3) is part of advertising measurement: it is activated only after you accept, and it stops when you turn off “Usage Data”. It works at campaign level only — Apple's AdServices framework and the Google Play Install Referrer do not reveal your identity or the other apps you use.

iOS — App Tracking Transparency. On iOS devices, the App will ask for your permission before your device's advertising identifier can be used for advertising measurement. If you decline, the identifier is not shared with Meta and advertising effectiveness is measured only through Apple's privacy-preserving SKAdNetwork framework. You can change this decision at any time in iOS Settings → Privacy & Security → Tracking.

What is never sent. Regardless of these settings, the amounts you record, the titles and notes of your payments and incomes, your category, ledger and asset names, your backup file names, and your email address are never transmitted to any analytics or advertising provider. The App applies an automatic technical filter that removes such fields before any event is sent.

9. Cross-Border Data Transfer and Server Location

Our backend servers and database infrastructure are hosted on secure cloud servers. As a result, your personal data (including account information and app content) may be stored and processed outside your country of residence.

The third-party services listed in Section 7 also process data on their own infrastructure, which may be located outside your country of residence — in particular in the United States (Google, Microsoft, Meta, RevenueCat, Resend, Expo) and in the European Union (Mixpanel, which we have configured for EU data residency).

By using the App and creating an account, you acknowledge and consent to your personal data being transferred to and processed on servers located outside your country, as required for the provision of the service (pursuant to KVKK Article 9 for users in Turkey).

10. Data Retention and Deletion

Your data is retained on our servers for as long as your account exists. You may delete all your data at any time by using the App's "Clear All Data" option, or by contacting us at remindpaybee@gmail.com to request full account and data deletion.

Push notification tokens are deleted from our servers when you sign out or disable notifications. Email sign-in codes expire after 10 minutes and, together with the related request logs, are deleted automatically within about one day. Market price history contains no personal data and is kept for 8 days.

Analytics and diagnostic data is retained by the providers listed in Section 7 according to their own retention schedules and our configuration — event-level analytics data is retained for a maximum of 14 months, after which it is deleted automatically. Session recordings and crash reports are retained for the shorter periods defined by Microsoft, Mixpanel and Google respectively. This data is not linked to your financial records.

Exception — Consent Audit Log: The record of your acceptance of the Terms of Use and Privacy Policy (including server timestamp, IP address, email address, platform, and document version) is retained even after account deletion. This retention is based on a legitimate legal interest and legal obligation under KVKK Article 5(2)(ç) and GDPR Article 6(1)(c) and (f), as it constitutes evidence of informed consent. This record is not used for any commercial or marketing purpose.

11. File Sharing and Backup

If you export data via the App's backup or document-sharing features, files are saved to your device. We do not automatically upload exported backup files to any external service.

12. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

• The right to learn whether your personal data is being processed.
• The right to request information about how your personal data is processed.
• The right to request correction of incomplete or inaccurate personal data.
• The right to request deletion or destruction of your personal data.
• The right to object to processing of your personal data.
• The right to withdraw your consent to analytics and advertising measurement (see Section 8).
• The right to data portability (export of your data).

Users in Turkey may exercise these rights under KVKK Article 11. Users in the European Economic Area may exercise these rights under GDPR Articles 15–22. To exercise any of these rights, contact us at remindpaybee@gmail.com.

13. No Financial Advice

The App does not provide investment, tax, legal, or financial advice. All features are strictly for personal organisation and reminders. Market prices, valuations, cost and profit/loss figures shown in the App are indicative estimates based on third-party market data that may be delayed, incomplete or inaccurate, and on the purchase prices you enter; they must not be relied upon for investment or tax decisions.

14. Changes to This Policy

This Policy may be updated periodically. Material changes will be communicated within the App and reflected by a new Effective Date. Continued use of the App after such changes constitutes your acceptance of the updated Policy.

15. Contact

Email: remindpaybee@gmail.com