Version 1.0 — 8 August 2026 · app version 0.2.155 · translation of the Turkish original
You use FinaX to see your cash flow. The app stores the financial records you type into it on a server that belongs to your account, gives them to nobody, does not track you, and lets you delete everything whenever you want. The long version is below. Every sentence in this text was derived from the app's source code; if the code changes one day, this page changes too.
FinaX is built and published by one person: Mustafa Evleksiz. In the language of data-protection law, that person is the data controller. Any privacy question goes straight to the e-mail address above; there is no support team in between. The data controller is Mustafa Evleksiz, acting as a natural person; FinaX is not published under a registered company. Contact runs through the e-mail address above.
FinaX is a budgeting ledger. You enter your accounts, income and expenses, recurring payments and instalment plans by hand; the app computes your cash flow for the days ahead from them. That has one important privacy consequence: FinaX has no connection to any bank. The app does not link to your bank account, does not pull statements, and uses no open-banking service. A credit card in FinaX is only a name, a limit and a statement day.
When you sign in to your account, what you enter is written to the database in your Supabase project. By Apple's definition this is "collected data", because it leaves your device for somewhere the developer can reach — even though only you can read the rows. Your language choice does not leave the device. It is stored locally, because the sign-in screen, the lock screen and the widget are all drawn before your account is read — waiting for the server would mean showing those screens in the wrong language and then changing it. What is never collected. No card number, IBAN, CVV, bank password or any payment instrument is ever asked for, stored or transmitted. Nor is location, contacts, health data, photos, browsing history, advertising data or a device identifier.
These stay on your phone, never reach the server, and never reach me:
From your device, FinaX connects to two addresses only: It connects nowhere else. There is no ad network, attribution SDK, analytics SDK or crash-reporting service inside the app. What the rate function sends. fx-refresh sends the rate provider (openexchangerates.org) only currency codes — for example TRY,USD,EUR — plus its own server key. Your identity, your e-mail, your amounts and your balances do not go to the provider; the provider does not even see your IP address, because the request is made by the server and not by your phone. All the provider sees is that someone asked for the rates of these currencies.
This is not a slogan, it is the state of the code: On the App Store privacy label the answer to the "Tracking" question is No, and in the app's privacy manifest the list of tracking domains is deliberately empty.
Nobody. I do not sell your data, do not hand it to anyone, and do not use it for advertising. There are three places whose infrastructure the app needs to work; these are not parties I "share" data with, they are services that carry or host it: And one forced case: if a valid legal demand arrives (a court order, say), I may have to give up as much as the law requires. If that happens and the law does not forbid it, I will tell you.
No system is flawless; I am not writing "your data is absolutely safe", because nobody can write that honestly. What I can write is which protections exist in the code today.
Your data stays until you delete it. Nothing expires on its own; FinaX exists to remember your history. You control the ways of deleting it: There is no single "reset everything" button in the released app; that console exists only in a development build. The way to delete everything at once is to delete the account.
Export. From Settings → My data you can take everything as CSV (tabular) or JSON (a full backup). The file is created on your device and handed to the share sheet; what you do with it is up to you. You can restore a backup from the same screen. Account deletion. On the Settings → Delete account screen you type SİL to confirm and it is done. This deletes the auth.users record on the server; the profile, the preferences and every financial row you own go with it down the database cascade. It is deletion, not deactivation, and it is irreversible. I recommend taking a backup first. Two things are not deleted, and both deserve to be said plainly: Also, deleted rows may remain for a short while in Supabase's routine database backups; those backups are overwritten on rotation.
Under the data-protection law where you live (KVKK in Turkey, GDPR in Europe) you have the right to access your data, correct it, delete it, restrict its processing and receive it in a portable format. In FinaX most of that already sits behind a button: access and portability → My data (CSV/JSON), correction → editing the record itself, deletion → Delete account. If something is missing, write to mustafa@mustafaevleksiz.com; I will reply within a reasonable time, at most 30 days. If you have a complaint, you can take it to the data protection authority in your country (in Turkey, the Personal Data Protection Authority — KVKK).
FinaX is not a children's app, is not marketed to children, and does not knowingly collect data from anyone under 13. If I learn that such an account exists, I delete it.
As the app changes, so does this text. Every version carries its date at the top; if something important changes it is also stated inside the app. Older versions remain in this repository's history.
For anything about privacy: mustafa@mustafaevleksiz.com
This text is governed by the laws of the Republic of Türkiye; disputes fall to the courts and enforcement offices of Istanbul. Any rights that the consumer legislation of your own country grants you remain reserved.