MBS Kasa Privacy Policy
Last updated: 12 November 2026 · Türkçe
This is a translation provided for convenience. The Turkish text is the binding version; if the two differ, the Turkish text applies.
1. Who we are
MBS Kasa is a personal finance app developed by MBS GLOBAL İNŞAAT DANIŞMANLIK SANAYİ VE TİCARET LİMİTED ŞİRKETİ under the MBS Nova Studio brand. This text is the notice we provide as data controller under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK): it explains which of your personal data we process when you use the app, by what method, for what purpose and on what legal basis, to whom we transfer it, and your rights. Contact: MBS GLOBAL İNŞAAT DANIŞMANLIK SANAYİ VE TİCARET LİMİTED ŞİRKETİ · mbsnovastudio@gmail.com · Aydınlar Mahallesi Hürriyet Caddesi 172/3 Sema Apartmanı, Çankaya/Ankara, Türkiye.
2. No account; your financial data stays on your device
- The app asks for no registration, e-mail address or account.
- Your accounts, transactions, bills, budgets, portfolio and goals are kept only on your device, in an encrypted database. This data is not sent to us or to anyone else.
- The optional app lock (PIN and biometrics) is verified on your device; fingerprint or face data never reaches the app.
- Bill and backup reminders are scheduled on your device; amounts are not sent to the server.
3. Data sent to our server
The data below is sent to our server by the app automatically, over the internet (by electronic means).
| Data | When | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Price requests (they carry no install ID or any other identifier; your IP address is visible to Cloudflare) | While the app is open, on screens that show prices; if you added the price widget to your home screen, also while the app is closed, when the widget refreshes in the background (at most about every 30 minutes) | Showing current prices in the app and the widget | KVKK Art. 5/2(c): performance of the service you request; for processing the IP address for security and rate limiting, Art. 5/2(f): legitimate interest | Not stored |
| A random install ID and the platform (Android or iOS) | Only if you use price alerts, and for as long as you have at least one alert (active or triggered) on the server. The ID is created when you save your first price alert and is sent with that alert. After that: when you set, change or delete an alert; each time the app starts, while your alert list is checked; when the alert and price detail screens list your alerts; at notification registration (below). It is sent when you set an alert even if you have not allowed notifications; the server then holds a device record with an empty notification token. | Matching your alerts to your installation and sending the notification to the right device | KVKK Art. 5/2(c): for those who use alerts, setting up and performing the alert service you request | Until you delete your last alert or delete your data on the server, at most for the periods below |
| Notification token (Firebase Cloud Messaging) and the app's interface language (a language code, e.g. “en”; not stored for Turkish) | At notification registration: while there is an install ID (while you have at least one price alert on the server) and if you have allowed notifications; each time the app starts (if your alert list is not empty), when the token changes and right after you save an alert, and also when you change the app's language; together with the install ID and the platform | Delivering the alert notification to your device and writing it in the language you use in the app | KVKK Art. 5/2(c): for those who use alerts, performing the alert service you request | Until you delete your last alert or delete your data on the server, at most for the periods below; if Google reports the token as invalid, the token is deleted immediately |
| Your price alerts: instrument code, quote currency, price source, bid/ask side, direction (rises above / falls below), target price; the time it was set and triggered, and the price at which it triggered | When you set or change an alert | Letting you know when the target price is reached | KVKK Art. 5/2(c): for those who use alerts, setting up and performing the alert service you request | Until you delete the alert, at most for the periods below |
If you do not use alerts, the app sends our server no install ID, notification token or device record; only the identifier-free price requests above are sent. The install ID is generated randomly by the app; it is not linked to your name, phone number or device serial number.
The ID is used only while you have an alert. While there is an ID, the app asks the server for your alert list each time it starts. When you delete your last alert, or when your alert list on the server turns out to be empty at start-up, the app deletes your device record and any remaining alerts on the server and forgets the ID; after that no install ID or notification token is sent. Delete my data on the server does the same whenever you want. If the alert list cannot be fetched (e.g. a connection error), nothing is deleted. If you set an alert again later, a new ID is created.
The notification token is created by Google's Firebase Cloud Messaging service. Automatic creation of the token is switched off in the app: Firebase creates the token only when the app asks for it, and the app asks only for the notification registration above, that is, while there is an install ID and notifications are allowed. On iPhone, Apple's Apple Push Notification service (APNs) delivers the notification to the device.
Our server runs on Cloudflare; Cloudflare temporarily processes your IP address to provide the service and to prevent attacks and abuse (rate limiting). The legal basis is our legitimate interest in the security of the service (KVKK Art. 5/2(f)). We do not record IP addresses.
Retention. Alerts are kept until you delete them; the install ID, the notification token and the device record are kept for as long as you have an alert on the server (they are deleted when you delete your last alert). You can delete all of it at any time in the app with Settings → Privacy → Delete my data on the server. The data of unused installations is also deleted automatically. The time of last contact is updated by every request that carries your install ID (notification registration; listing, setting, changing or deleting alerts): at most once a day for unchanged requests, immediately when the token, the platform or the language changes. Based on the last contact:
- If the last contact of an installation whose notification token was never sent or has become invalid is older than 90 days, its alerts and device record are deleted.
- For other installations, if the last contact is older than 270 days (notification tokens become invalid after about 270 days without use), the alerts and the device record are deleted in the same way.
Expired records are deleted by a maintenance job that runs on the server once an hour.
4. Crash reports (can be turned off)
If the app crashes or an unexpected error occurs, a technical error record is sent to Google automatically, over the internet, by the Google Firebase Crashlytics tool built into the app. The record contains a random installation ID (the Firebase/Crashlytics installation ID), the device model, the operating system (Android or iOS) version, the app version and the error lines. Your financial data is not added to the reports. The purpose is to find and fix errors and to keep the app working safely; the legal basis is our legitimate interest (KVKK Art. 5/2(f)). Sending is on by default; you can turn it off at any time under Settings → Privacy. Google keeps error records and the related identifiers for 90 days, then deletes them.
5. Backups
The backup file is encrypted with the password you choose and saved where you choose (e.g. your own Google Drive or iCloud Drive). We have no access to your backup or your password.
6. Ads (free version)
The free version shows a Google AdMob banner ad at the bottom of the Summary and Market screens; there are no ads on the account, transaction, PIN and lock screens. No ads are loaded in the Premium version. While an ad is shown, Google LLC processes the following data: the advertising ID and the app set ID (device identifiers), the IP address (approximate location), interactions with the ad (impressions, taps) and diagnostic information. The purpose is to serve and measure ads and to prevent fraud. Your financial data is not sent to the ad network.
- Personalization: Off by default, and never offered on iPhone; ads are not chosen according to your interests. With your explicit consent you can turn it on with Settings → Privacy → Personalized ads and turn it off at any time.
- European Economic Area, United Kingdom and Switzerland: Google's consent form is shown; an ad is requested only according to your choice in that form. You can change your choice with Settings → Privacy → Ad privacy options.
- You can reset or delete your advertising ID in Android settings.
- On iPhone the app does not ask for tracking permission (App Tracking Transparency): the advertising ID (IDFA) is not given to the ad network and ads are always non-personalized; Google still processes the other data above (e.g. the IP address, interactions, diagnostic information and device identifiers).
Collection method and legal basis: This data is collected automatically, over the internet, by the Google ads tool built into the app. For personalized ads the legal basis is your explicit consent (KVKK Art. 5/1); you give it with the switch above or with Google's consent form (UMP) and withdraw it in the same place. Non-personalized ads rely on our legitimate interest in offering the free version (KVKK Art. 5/2(f)).
How Google uses advertising data: policies.google.com/technologies/ads.
7. Service providers and transfers abroad
- Cloudflare, Inc. (USA): server hosting and database. Price requests and the IP address; if you use alerts, the install ID, the notification token, the interface language and the alerts are processed on this infrastructure.
- Google LLC (Firebase) (USA): sending notifications (Firebase Cloud Messaging: the notification token and the content of the alert notification) and crash reports (Crashlytics, see section 4).
- Google LLC (AdMob) (USA): showing ads in the free version (see section 6).
- Apple Inc. (USA): delivering alert notifications on iPhone (Apple Push Notification service: the device token and the content of the notification).
These providers process data in data centers outside Türkiye; the data above is therefore transferred abroad. The transfer is made under KVKK Art. 9, only for the purposes listed in this text and to the extent needed to provide the service. Beyond these we do not transfer your data to anyone or sell it. The app has no usage analytics.
8. Price data
Prices are for information only, may be delayed and are not investment advice. The sources are named in the app.
On Android, the Market → World tab and the TradingView screens (crypto heat map, energy and metal charts, Menu → Economic calendar) load TradingView's widgets directly from TradingView's servers. While they do, your IP address and your device's browser information go to TradingView, Inc. (USA), and TradingView's own privacy policy applies. No connection to TradingView is made unless these screens are opened; this data does not reach our server.
9. Your rights and how to apply
Under KVKK Art. 11 you have the right to:
- (a) learn whether your personal data is processed,
- (b) request information about it if it has been processed,
- (c) learn the purpose of the processing and whether the data is used in line with that purpose,
- (ç) know the third parties, in Türkiye or abroad, to whom it is transferred,
- (d) ask for it to be corrected if it is incomplete or inaccurate,
- (e) ask for it to be erased or destroyed under the conditions in KVKK Art. 7,
- (f) ask that the operations under (d) and (e) be notified to the third parties to whom the data was transferred,
- (g) object to a result against you that arises from the data being analyzed exclusively by automated systems,
- (ğ) claim compensation if you suffer damage because your data was processed unlawfully.
You can delete all your data on the server (alerts, install ID, notification token and interface language) yourself, without applying to us, with Settings → Privacy → Delete my data on the server in the app; it is also deleted when you delete your last alert. Uninstalling the app deletes all data on your device.
Application (KVKK Art. 13): For other requests you can send your application in writing to our postal address (Aydınlar Mahallesi Hürriyet Caddesi 172/3 Sema Apartmanı, Çankaya/Ankara, Türkiye) or, from your registered electronic mail (KEP) address or with a secure electronic signature or mobile signature, to mbsnovastudio@gmail.com. The data on the server is tied only to the random install ID and we do not know who you are; we may ask for additional information so that we can find the relevant data. We conclude your application as soon as possible and within 30 days at the latest, free of charge; if the operation requires a separate cost, the fee in the tariff set by the Personal Data Protection Board may be charged.
Complaint (KVKK Art. 14): If your application is rejected, if you find our answer insufficient or if we do not answer in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning our answer and in any case within 60 days of the application date (kvkk.gov.tr).
10. Children
The app is not directed at people under 18 and does not knowingly collect data from children.
11. Changes
If we update this policy we change its date and announce important changes in the app.