Privacy Policy

• We process only the data needed to run the Service: your account, preferences, alerts and watchlists, the content you share and security records.
• No ads, no ad networks, no visitor analytics and no cookies that follow you from site to site. The mobile apps do not track you in the sense Apple defines.
• Your card details never reach us; Creem takes payment as the seller.
• Our servers and database are in Turkey (Istanbul). We work with service providers abroad for some tasks, such as e-mail, payment, sign-in and notifications; each is listed below.
• You can permanently delete your account at any time on the web or in the app.

The data controller for your personal data is LAICOS Bilişim Yazılım ve Bilgi Sistemleri İthalat İhracat Limited Şirketi, which provides services under the PriceONN brand. Where the EU General Data Protection Regulation ("GDPR") applies, the same company is the controller.

Legal name

LAICOS Bilişim Yazılım ve Bilgi Sistemleri İthalat İhracat Limited Şirketi

General contact

info@priceonn.com

For questions and requests about personal data:

info@priceonn.com

This policy applies to the priceonn.com website, the PriceONN iOS and Android apps, the programming interfaces they use, and e-mail and push notifications. People in Turkey should also read the KVKK and GDPR Notice; cookies are covered by the Cookie Policy and retention periods by the Data Retention and Deletion Policy.

The Service is not designed for people under 18, and they may not open an account. If we learn that we hold data about someone under 18, we close the account and delete the data.

Account and identity You provide

E-mail address, username, display name, a one-way hash of your password (the password itself is never stored), language, account creation date and e-mail verification status. With Google or Apple sign-in, the user ID the provider gives you and the e-mail and name the provider shares. If you choose "Hide My Email" with Apple, Apple's relay address.

Profile and community You provide

Profile image, bio, location and website (if you fill them in), posts, replies, likes, the people and symbols you follow, people you block, reports you make and reports about you, and moderation decisions.

Preferences You provide

Watchlist, price alerts and their conditions, saved charts, drawings, templates, multi-chart layouts, and chart and pattern settings.

Notifications You and your device

Notification settings, quiet hours and time zone; the device notification address (push token or browser push endpoint), platform, operating system and app version, notification permission status, messages in your inbox and delivery records.

Sessions and security Automatic

Hashes of session and refresh tokens, sign-in time and method, device name (for example maker and model), browser or app details, and failed sign-in and rate limit counters. Rate limits never store IP addresses or e-mail addresses in clear; only keyed hashes are kept.

Payments From Creem

The customer and subscription IDs, plan, billing period, subscription status, period end, amount and currency reported by Creem, and a record of payment events. Card number, expiry date and security code never reach us.

Technical logs Automatic

Server access logs: IP address, date and time, requested address, response code, bytes sent, browser details and referring address. Error logs.

Correspondence You provide

Your e-mail address, your message and our reply when you write to us.

Contact form and correspondence You provide

When you write to us through the contact form or by e-mail: your name, e-mail address, the topic you choose and your message. To prevent abuse, a one-way hash of your IP address and browser information. If you are a member, the message is linked to your account.

We do not collect your location, contacts, photo library (other than the one profile image you choose) or biometric data. If you turn on Face ID or fingerprint lock in the mobile app, the check is done entirely on your device by the operating system; no biometric data reaches us.

Opening and managing your account and letting you sign in

Entering into and performing the contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).

Providing watchlists, alerts, saved charts and plan features

Performance of the contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).

Sending price alert and pattern notifications and verification and password reset e-mails

Performance of the contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)). Browser and mobile notifications are sent only after you allow them on your device.

Running the community: publishing posts, follows and blocks, reviewing reported content

Performance of the contract and our legitimate interest in a safe community (KVKK Art. 5(2)(c) and (f); GDPR Art. 6(1)(b) and (f)).

Managing paid subscriptions and switching plan access on and off

Performance of the contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).

Account security, preventing abuse, fraud and attacks, rate limiting

Legitimate interest (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).

Keeping access logs, answering requests from authorities, legal obligations

Required by law and legal obligation (KVKK Art. 5(2)(a) and (ç); GDPR Art. 6(1)(c)), in particular Turkish Law No. 5651.

Establishing, exercising and defending legal claims

Establishing, exercising or protecting a right (KVKK Art. 5(2)(e); GDPR Art. 6(1)(f)).

Answering your requests and messages

Performance of the contract and legitimate interest (KVKK Art. 5(2)(c) and (f); GDPR Art. 6(1)(b) and (f)).

Marketing and promotional messages

Only with your separate explicit consent (KVKK Art. 5(1); GDPR Art. 6(1)(a)) and commercial e-message approval under Turkish Law No. 6563. We do not send marketing messages today.

No decision that produces legal effects for you or similarly significantly affects you is made solely by automated processing. Pattern scanning and indicators work on price data, not on people.

We do not sell your personal data or share it for advertising. We share data only with the service providers below, only as far as needed to provide the Service, and under the confidentiality and security duties they owe us as processors. Google, Apple and Creem are also independent controllers for their own services.

Vulut Bilişim Teknolojileri Ltd. Şti. Turkey

Server and database hosting. All account and content data is stored on these servers.

Cloudflare, Inc. USA and global network

Content delivery network, attack protection and security checks in front of the website. Web traffic (IP address and request details) passes through Cloudflare. Policy

Brevo (Sendinblue SAS) France, European Union

Sending transactional e-mails: e-mail verification, password reset, account deletion codes, alert and pattern notifications and notification digests. Policy

Creem Outside Turkey

Sale of and payment for paid plans, invoicing and tax. Creem collects your payment details directly from you. Policy

Google USA and global

Sign in with Google; delivery of push notifications in the Android app and in browsers such as Chrome (Firebase Cloud Messaging). Policy

Apple USA and global

Sign in with Apple; delivery of push notifications in the iOS app (Apple Push Notification service). Policy

Browser push services Depends on your browser

When you allow browser notifications, they are delivered through the service run by your browser maker (Google, Mozilla, Apple or Microsoft). Only the encrypted notification and the device address go to that service.

Amazon Web Services USA

Storing and serving profile images uploaded in the previous version of the Service.

We also give information to authorised public bodies and courts where the law requires it and only to the extent requested. If the Company merges, is transferred or is split, data may pass to the successor provided the protections in this policy continue.

Content you post in the community and your public profile are, by design, visible to other users and visitors.

Some of the providers above are located outside Turkey and the European Union or process data on servers abroad. Under Article 9 of KVKK, transfers abroad rely first on an adequacy decision and, where there is none, on appropriate safeguards such as the standard contracts published by the Turkish Personal Data Protection Board; standard contracts are notified to the Board within five business days of signature. In occasional cases without these, we rely on the exceptions in Article 9(6) of KVKK.

Transfers subject to the GDPR rely on European Commission adequacy decisions (such as the EU-US Data Privacy Framework) or on standard contractual clauses. You can ask for a copy of the safeguard used by writing to info@priceonn.com.

We keep data for as long as needed for the purpose it was collected for and for any period required by law. After that, data is deleted, destroyed or anonymised. Details are in the Data Retention and Deletion Policy.

Account, profile, preferences, watchlist, alerts, charts

While your account is open. Deleted immediately when you delete your account.

Community posts and likes

Until you delete them or your account. Moderation records about content removed for breaking the rules are kept for 2 years for appeals and possible legal claims.

Notification inbox and delivery records

90 days.

Web session

Until the browser closes or after 12 hours of inactivity; up to 30 days if you choose "remember me". Mobile app sessions last up to 60 days from last use.

E-mail verification and password reset links

Verification links for 24 hours and password reset links for 1 hour; deleted when they expire.

Rate limit and failed sign-in counters

Until the counter window ends (minutes to hours).

Payment event records

400 days. Invoices and accounting records are kept by Creem as seller for the periods its own laws require.

Server access logs

1 year, as required by Turkish Law No. 5651 and its regulation.

Correspondence

2 years after the request is closed.

Account deletion record

To prove the deletion took place, kept as an irreversible keyed hash that does not contain your identity, e-mail or name, for the general limitation period of 10 years.

Contact form messages and support correspondence

2 years, kept as a record of our reply in case of a dispute, then deleted automatically. If you delete your account, messages linked to it are deleted immediately.

• All connections are encrypted with TLS. Passwords are stored as bcrypt hashes, and only hashes of session, refresh and verification tokens are kept.
• Session cookies are protected with the HttpOnly, Secure and SameSite attributes, and forms are protected with CSRF tokens.
• In the mobile apps, session tokens are kept in the iOS Keychain and the Android Keystore.
• The database can be reached only from the server itself, with accounts set up on the principle of least privilege. Secret keys are kept apart from the application code and the web root.
• Rate limits and increasing delays apply to sign-in, account deletion and code verification steps.
• If a data breach such as unauthorised access to personal data happens, we notify the people affected and the Personal Data Protection Board as soon as possible and within 72 hours at the latest.

No system is completely secure. If you find a security issue, please report it to info@priceonn.com.

Under Article 11 of KVKK you have the right to learn whether your data is processed; to request information if it is; to learn the purpose of processing and whether data is used in line with it; to know the third parties it is transferred to; to have incomplete or wrong data corrected; to have data deleted or destroyed under the conditions in the law and to have these actions reported to third parties it was transferred to; to object to an outcome against you that results solely from analysis by automated systems; and to claim compensation if you suffer loss because of unlawful processing.

Where the GDPR applies, you also have the right to access, rectify and erase your data, to restrict processing, to data portability, to object to processing based on legitimate interest and to withdraw consent at any time. You can complain to the data protection authority where you live.

• You can see, correct and delete most of your account information yourself on your account and profile pages.
• You can permanently delete your account and the data linked to it on the web from your account page or at priceonn.com/account/delete, and in the mobile app from the Account section.
• For other requests write to info@priceonn.com, or for applications from Turkey to info@priceonn.com following the procedure in the KVKK and GDPR Notice. To verify your identity we may ask you to write from the e-mail address registered to your account or to give extra details.
• We answer requests free of charge within 30 days at the latest. If the action involves an extra cost, the fee in the tariff set by the Board may be charged.

• Sign-in closes immediately; all your web sessions and mobile device sessions end, and your device notification records are deleted.
• Your watchlist, alerts, saved charts, templates, layouts, settings, notification settings, notification inbox and delivery records, profile and profile image, follows, blocks, room follows, likes, Google and Apple links, password records and plan entitlements are deleted.
• Your community posts are removed. Replies written by others to your posts remain without the post they replied to.
• Your identity is anonymised in reports you made.
• Your basic account record from the previous version of the Service is permanently deleted within 30 days.
• Records we must keep by law (such as server access logs and payment event records) are kept only until the end of the relevant period and only for that purpose.
• A paid subscription is not cancelled automatically when you delete your account; cancel it first in the Creem customer portal.

• Permissions: the app asks only for internet access, network state, permission to send notifications and, optionally, biometric lock. It does not ask for location, camera, microphone or contacts. When you choose a profile image, only the image you pick is accessed.
• Notification permission is given through the operating system's permission prompt and can be turned off in device settings at any time. In-app notification settings cannot override the system permission.
• Stored on the device: session tokens in secure storage; a cache of your watchlist, latest prices and chart data in the app's own storage, which is removed when you delete the app.
• The app does not use an advertising identifier and contains no third-party analytics or advertising software, and our data disclosures on the App Store and Google Play match this policy.

We may update this policy when the Service or the law changes. We announce important changes by e-mail and in the Service before they take effect. The current text is published on this page with its effective date.

For privacy questions and GDPR requests:

info@priceonn.com

For applications under KVKK:

info@priceonn.com