Pally Privacy Policy
Last updated: 19 June 2026
This Privacy Policy explains how your personal data is collected, used, shared and protected when you use the Pally ("Application", "Pally", "we") mobile application. Pally is an application developed and operated by Zeynep Altuntaş.
- Data controller: Zeynep Altuntaş
- Contact: support@getpally.app
By using the Application, you accept the practices described in this policy.
1. Data We Collect
Account information. Your email address and password when you register (your password is stored in encrypted form by our authentication provider; we do not see your plaintext password). Optionally, your display name and profile image.
Content you create in the Application. The groups you set up, the expenses you add, payments/settlements, and the member names you add to a group. This data is kept in order to manage your account and the information you share with your group members.
Receipt images (AI scanning feature). When you use the receipt scanning feature, the receipt image you upload or capture is transmitted to and processed by the Claude API service of our service provider Anthropic, solely for the purpose of automatically extracting expense information (amount, date, merchant, etc.). Images are not stored by us once they have been processed; only the extracted expense information is saved to your account.
Purchase information. When you take out a Premium subscription or make a one-time purchase, the purchase transaction takes place through Apple, and your subscription status is processed via our subscription management provider RevenueCat. We do not see or store your payment/card information. This information is processed solely by Apple.
Notification data. If you have enabled notifications, the notification identifier (push token) belonging to your device is processed so that we can send you notifications.
Technical records. Our infrastructure providers may keep standard access records (e.g. IP address, timestamp) for the security and operation of the service.
Other than the above, we do not use any analytics, crash reporting or advertising/tracking tools.
2. The Purposes for Which We Use Data
- To create your account and authenticate you,
- To record groups, expenses and settlements and display them to group members,
- To provide the receipt scanning feature,
- To manage subscriptions and purchases,
- To send you notifications (if you have enabled them),
- To ensure the security of the service and to fix errors,
- To fulfil our legal obligations.
3. Third Party Service Providers (Sub-processors)
We do not sell your data. Your data is processed only with the trusted providers below, solely in order to provide the service, and under their own privacy policies:
| Provider | Purpose |
|---|---|
| Supabase | Hosting, database and authentication (servers in the EU / Ireland) |
| Anthropic (Claude API) | Extracting expense information from receipt images |
| RevenueCat | Management of subscription and purchase status |
| Apple | Payment processing and push notifications (APNs) |
4. Where Data Is Stored
Your account and application data is stored on servers hosted in the European Union (Ireland) region.
5. Data Sharing
We do not sell your personal data to third parties and we do not share it for marketing purposes. Your data is shared only with the sub-processors listed above in order to provide the service, and in cases where we are legally obliged to do so (valid requests from official authorities).
Note: the expenses, member names and settlements you add to a group can be seen by the other members of that group. This is a core function of the Application.
6. Retention and Deletion
We retain your data for as long as your account is active. You can delete your account from within the Application. When you delete your account, your personal data is deleted; for the integrity of past records in shared groups, your memberships are anonymised (your name appears as "Eski üye") and are rendered incapable of being associated with you.
7. Your Rights (KVKK & GDPR)
Under Personal Data Protection Law No. 6698 (KVKK) and (if you are in the European Union) the GDPR, you have the following rights:
- To learn which of your data is being processed and to access it,
- To request that incorrect data be corrected,
- To request that your data be deleted,
- To object to processing or to restrict processing,
- To receive your data in a portable format.
To exercise these rights, you can contact us at the contact address above. We respond to your request as soon as possible and within the periods prescribed by the relevant legislation.
8. Children's Privacy
Pally is not directed at children under the age of 13 (in the European Union, under the age of 16 depending on your country), and we do not knowingly collect data from persons under this age. If we become aware that such data has been collected, we delete it.
9. Security
We apply industry standard measures to protect your data (encrypted communication, access controls, row level authorisation). However, no method of transmission over the internet or of electronic storage is 100% secure; we cannot guarantee absolute security.
10. Changes to This Policy
We may update this policy from time to time. For significant changes we will change the "Last updated" date and, where necessary, inform you within the Application. Your continued use of the Application after updates means that you accept the current policy.
11. Contact
For any questions about this policy or your personal data:
Zeynep Altuntaş, support@getpally.app