AI-powered personal finance assistant

Privacy Policy

Effective: 21 August 2026 · Last updated: 21 August 2026

This policy explains how your personal data is handled when you use the Synora mobile app and the services at synora.yansen.dev. It is written to meet both the Turkish Personal Data Protection Law (KVKK, Law No. 6698) and the EU General Data Protection Regulation (GDPR).

In short: Synora stores your financial records on your behalf. It never asks for your bank password and never stores card numbers or CVV codes. The documents and receipt photos you upload are not retained on our servers. There is no ad tracking, and your data is never sold or shared for marketing.

1. Data controller

Synora is operated by Said Yanak under the Yansen name.

Contact: [email protected]
Service domain: synora.yansen.dev

2. Data we process

2.1 Account data

Data	Why
Email address	Passwordless sign-in; delivering your one-time code
Name (optional)	To address you inside the app. You may leave it blank.
Base currency, subscription status	Showing totals in the right currency
Consent and onboarding timestamps	Legal obligation; not repeating the flow
Your onboarding answers (how you work, your goals, your data sources)	Letting the assistant tailor its suggestions to you

2.2 Financial records

Transaction amounts, dates, merchant names and categories that you enter or that are extracted from your documents; income records; loans, instalments and debts; asset records; your budgets and recurring payment rules.

2.3 Documents and photos

This section matters, because we work differently from most apps:

The contents of the statements, PDFs, Excel and CSV files you upload are not stored on our servers. The file is processed, the transactions inside it are saved, and the file itself is discarded. Only the file name, the number of rows found and the date range it covers are kept so the file can appear in your "Documents" list.
Receipt photos are not stored on our servers. A photo is transmitted only so it can be converted to text (OCR); the extracted amount, date and merchant are shown to you as a preview, and the photo is discarded once processing finishes. If you confirm, only the text is saved.

2.4 Chat

The message you write to the assistant is sent to our server and from there to our AI provider so a reply can be generated. Your chat history is not stored on our servers; it stays on your device and is sent as context with each request. When the assistant proposes a record on your behalf, the confirmation card is held temporarily until you approve it and is deleted when it expires.

2.5 Technical data

Session refresh keys (stored only as a cryptographic hash)
Sign-in codes (stored only as a hash; invalid after 10 minutes)
AI usage records: how much text was processed for which task, and its cost. This is for cost accounting; message content is not part of these records.

3. What we never collect

Card numbers, CVV codes, bank passwords. The app never asks for these anywhere.
Location, contacts, call logs.
Advertising identifiers or tracking. The app contains no analytics, advertising or crash-reporting SDKs (no Firebase, Crashlytics, Facebook SDK, etc.). This is why iOS never shows you a tracking permission prompt.

4. Third parties and international transfers

Your data is never sold or shared for marketing. The following providers are used so the service can function:

Provider	What is transferred	Where
Hetzner Online GmbH	Hosts the entire service and database	Germany (EU)
Anthropic PBC	Your chat message; summarised text extracted from documents	United States
Brevo (Sendinblue)	Your email address, to deliver sign-in codes	European Union

Raw files are never sent to the AI provider. By design, Synora processes documents and images in its own systems first; only simplified, compact text is passed to the AI provider. Your receipt photo or PDF file is never sent to the AI provider.

Because our servers are in Germany, if you live in Turkey your data is processed outside Turkey. In addition, when AI features are used the relevant text is transferred to the United States. Under KVKK Article 9, the explicit consent you give when you start using the app covers these transfers. If you wish to withdraw consent, you can delete your account (see section 7).

5. Purposes and legal bases

Purpose	Basis
Creating your account and providing the service	Performance of a contract — KVKK 5/2-c, GDPR 6(1)(b)
AI categorisation, analysis and chat	Explicit consent — KVKK 5/1, GDPR 6(1)(a)
International transfers	Explicit consent — KVKK Art. 9, GDPR Chapter V
Security and abuse prevention	Legitimate interests — KVKK 5/2-f, GDPR 6(1)(f)

6. Retention

Account and financial records: until you delete your account
Sign-in codes: 10 minutes
Unconfirmed assistant suggestions: deleted automatically on expiry
Uploaded files and receipt photos: never retained

7. Your rights

Under KVKK Article 11 and GDPR Articles 15–22 you have the right to access your data, have it corrected, have it erased, object to processing, and receive it in a portable form.

Account deletion is available inside the app. The delete-account option on the Profile screen permanently erases all of your data, including transactions, income, assets, debts, budgets and onboarding answers. This cannot be undone, and you do not need to contact us to do it.

For any other request, write to [email protected]. Requests are answered within 30 days at the latest. You also have the right to lodge a complaint with the Turkish Personal Data Protection Authority, or with your national data protection authority in the EU.

8. Security

All traffic is encrypted with TLS (HTTPS).
Your session keys are stored on the device in the iOS Keychain / Android Keystore.
Sign-in codes and refresh keys are stored only as cryptographic hashes, never in plain text.
Because card data is never processed, there is structurally no risk of card data being exposed.

9. Children

Synora is not directed at people under 18 and does not knowingly collect data from children.

10. Changes

When this policy is updated, the date on this page changes. You will be notified in the app about significant changes.