Privacy Policy

Last updated: 11 November 2026

This policy covers the Kalemo mobile app and the kalemoapp.com website.

Who is responsible

Cüneyt, Karşıyaka, İzmir, Türkiye. You can reach us at [email protected].

What we process

• Receipts: the photos and PDFs you upload, and the store name, date, amounts, tax, payment method, items and notes read from them or entered by you, and the return and warranty dates you set on a receipt.
• Income: the amount, currency, category (such as salary or rental income), date and note of income you enter, and whether it repeats every month.
• Shared home: if you create or join a home, its name and currency, the names shown for its members and child profiles, invite codes, and which of your records belong to the home. Everyone in the home sees the home’s records and who paid; the home’s owner and admins can also correct or delete them. Your personal records stay visible only to you.
• Savings, budgets and repeating expenses: the goals, deposits, monthly limits and repeating expenses (such as rent or subscriptions) you enter.
• Category corrections: when you change an item’s category, the item name, the store and the category you chose, so that the next receipt is sorted the same way.
• Notifications: if you allow them, a token for your device, used to tell the rest of your home when a receipt is added.
• Account: a random identifier while you use the app as a guest, and your email address if you create an account. If you sign in with Apple, we receive the identifier Apple gives this app for you and the email address you chose to share, which can be a private relay address.
• Preferences: language and main currency.
• Usage counter: how many receipts you scanned this month, to apply the free quota.
• Technical logs: IP addresses and request logs kept by our infrastructure providers for security.
• Waiting list: your email address and language, if you join the list on the website.

Reminders for return and warranty dates are scheduled on your own phone and are not sent through our servers. The app lock uses your phone’s Face ID, fingerprint or passcode; we never see them. The app has no advertising trackers and no analytics tools. Location data is removed from a photo before it leaves your phone. The AI is told not to extract card numbers or cashier names, although such details may still be visible on the photo itself.

Pharmacy and similar receipts

A pharmacy receipt can reveal information about your health. We do not analyze such receipts separately. You can delete a line, or the whole receipt, at any time.

Why we process it, and on what legal basis

• Providing the service (reading and storing receipts, showing reports): performance of a contract (GDPR Art. 6(1)(b)).
• Preventing abuse and keeping the service secure: legitimate interests (GDPR Art. 6(1)(f)).
• Waiting list email: your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time.

Where it is stored, and who it is shared with

Your data is not sold, and is not shared for advertising. We use only these providers, to run the service:

• Supabase (database, file storage, sign-in): servers in the European Union. Data is encrypted in transit and at rest.
• Anthropic (reading receipts with AI, USA): the receipt photo is sent only to be read, and is not used to train models. Under its own safety rules the provider may keep it for a short time.
• Frankfurter (exchange rates, from European Central Bank data): only a currency and a date are requested, and no receipt data is sent.
• Resend (sending sign-in codes by email, servers in the European Union): only your email address and the code.
• Expo (delivering notifications, USA): your device’s notification token and the notification text (the home’s name, the member’s name, the store and the amount), which it hands to Apple or Google for delivery.
• Cloudflare (website and email forwarding).
• Apple and Google (app distribution, subscription payments, delivering notifications, and Sign in with Apple). Your card details never reach us.

Transfers outside the EU and Türkiye rely on Standard Contractual Clauses and on the transfer rules of Turkish data protection law.

How long we keep it

Your receipts and account are kept until you delete them. Deleted data also leaves our backups within 7 days at the latest. A guest account opened more than 30 days ago, with nothing saved in it and not part of a home, is deleted automatically. Your email on the waiting list is deleted after the launch announcement, or whenever you ask.

Your rights

You can access your data, and ask for it to be corrected, deleted or moved, or object to its processing.

• Download my data: in the app, Settings > Download my data.
• Delete my account: in the app, Settings > Delete my account, or on the account deletion page.
• Anything else: [email protected].

If you are not satisfied with our answer, you can complain to the data protection authority of your country.

Children

Kalemo is not designed for people under 16, and we do not knowingly collect data from them.

Security

Connections are encrypted, photos sit in a private space and open only through short-lived links made for you, and every record is locked to its owner at database level. No system is flawless, however. In the event of a breach, we will notify as the law requires.

Changes

We may update this policy. We will announce important changes in the app.