Kambiyo: Live FX & Gold · Effective date: October 5, 2026 · Last updated: October 5, 2026
For the purposes of Turkey's Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR), the data controller is Emir KIZILIRMAK (md9.net). Contact: destek@md9.net
The app has no accounts or sign-up. It asks for notification permission (for price alerts and the morning summary) and, on iOS, tracking permission (App Tracking Transparency, for personalized ads). Both are optional; the app keeps working if you decline.
None of this is sent to our servers or to third parties. If device backup is turned on, it may be included in your operating system's own backup (iCloud or Google). Settings › Delete my data or deleting the app removes it from your device.
The app fetches rates and chart data from our own server, the Kambiyo API, which runs under the md9.net domain on Cloudflare's infrastructure. The server obtains rates from third-party public data providers.
With every request, your device's IP address is processed by Cloudflare to deliver the content to you and to keep the service secure (preventing abuse and attacks). We do not keep IP addresses in our own logs; they are not retained beyond Cloudflare's standard processing.
If you set a price alert or turn on the morning summary, the following is stored on our server:
This is used only to send you a notification when a condition is met and for the weekday morning summary; it is not linked to your name or contact details. An alert's conditions are deleted when you delete the alert. The device record and all alerts are deleted when you turn notifications off or use Delete my data. Records with no activity for 12 months are deleted automatically.
| Service | Data processed | Purpose | Retention | Can it be turned off? |
|---|---|---|---|---|
| Firebase Analytics | App usage events (screens opened, features used), app instance ID, device model and OS version, approximate location derived from the IP address (country/city) | Understanding how the app is used and improving it | 14 months | Yes: Settings › Usage statistics |
| Firebase Crashlytics | Crash diagnostics (stack trace, device model, OS and app version) | Finding and fixing bugs | 90 days | Yes: same switch |
| Firebase Performance Monitoring | Technical performance measurements (e.g. app start time), device model and OS version | Monitoring app speed | Google's standard retention | Yes: same switch |
| Firebase Remote Config | Firebase installation ID | Changing app settings without waiting for an update | Google's standard retention | No; required for the app to work |
| Firebase Cloud Messaging | Notification (push) token; if the morning summary is on, a subscription to a language-specific notification topic | Delivering price alert and morning summary notifications | Google's standard retention | Yes: notification permission and the notification switches in Settings |
The free version shows banner, native, interstitial, app-open and rewarded ads through Google AdMob. To serve and measure ads and to prevent fraud, Google processes:
In the European Economic Area, the United Kingdom and Switzerland, Google's consent form (User Messaging Platform) is shown. If you do not give consent or permission, the app keeps working fully and non-personalized ads are shown; these are chosen based on general information such as context and approximate location, not on your interests.
You can change your choices at any time in Settings › Ad privacy choices and, on iOS, also in Settings › Privacy & Security › Tracking. On Android, you can reset or delete your advertising ID in the Ads section of your device settings (on most devices Settings › Privacy › Ads or Settings › Google › Ads). No ads are shown with Kambiyo Pro or during an Ad-free Break (Reklamsız Mola).
Kambiyo Pro is purchased through the App Store or Google Play, and Apple or Google processes the payment; we never see your card or payment details. To unlock and restore Pro, RevenueCat processes an anonymous app user ID and your purchase/subscription status (which plan is active, purchase and renewal information).
Deleting the app removes only the data on your device. To delete the server record right away, use Delete my data first; otherwise the record is deleted automatically after 12 months without activity.
| Processing | KVKK art. 5 | GDPR art. 6 |
|---|---|---|
| Usage statistics (Firebase Analytics, Performance Monitoring) and personalized ads | Explicit consent (art. 5/1) | Consent (art. 6(1)(a)) |
| Delivering rates and chart data; price alerts and the morning summary; verifying and restoring Kambiyo Pro purchases | Establishment or performance of a contract (art. 5/2-c) | Performance of a contract (art. 6(1)(b)) |
| Service security (Cloudflare), crash reports (Crashlytics), app settings (Remote Config) and non-personalized ads | Legitimate interest (art. 5/2-f) | Legitimate interests (art. 6(1)(f)) |
You can withdraw your consent at any time using the switches and ad choices above; withdrawal does not affect the lawfulness of earlier processing.
Google (Firebase and AdMob), Cloudflare and RevenueCat may process data on servers outside Turkey, including in the United States. These transfers take place within the framework of KVKK art. 9 and Chapter V of the GDPR; these providers apply safeguards such as standard contractual clauses for international transfers.
| Data | Period |
|---|---|
| Data on your device (holdings, favorites, settings, cache) | Until you delete it, use Delete my data or uninstall the app |
| Device record and alert conditions on our server | Until you delete the alert, turn notifications off or use Delete my data; deleted automatically after 12 months without activity |
| IP address in rate requests | Not kept in our own logs; Cloudflare's standard processing periods |
| Firebase Analytics events | 14 months |
| Crashlytics crash reports | 90 days |
| Advertising data | According to Google's retention policies |
| Purchase records (RevenueCat) | As long as needed to verify and restore Pro and as required by legal obligations |
Under KVKK art. 11 you have the right to learn whether your personal data is processed and, if so, to request information about it; to learn the purpose of processing and whether data is used in line with that purpose; to know the third parties in Turkey or abroad to whom data is transferred; to request correction of incomplete or inaccurate data; to request deletion or destruction under KVKK art. 7 and notification of these actions to the third parties to whom data was transferred; to object to a result against you arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.
If you are in the EU, EEA, United Kingdom or Switzerland, you also have the rights of access, rectification, erasure, restriction of processing, data portability, objection and not to be subject to decisions based solely on automated processing under GDPR articles 15–22, and you may lodge a complaint with the data protection authority in your country.
Email your request to destek@md9.net. Requests are answered free of charge within 30 days at the latest. Because the app has no accounts, we cannot identify you by name; the quickest way to delete your server record is Settings › Delete my data. If you are not satisfied with our answer, you may complain to Turkey's Personal Data Protection Board (KVKK Kurulu).
Kambiyo is not directed to children under 13 and does not knowingly collect personal data from children under 13. If you believe we hold such data, email destek@md9.net and we will delete it. Parents can limit app downloads and in-app purchases with Screen Time on iOS and Google Family Link on Android.
When this policy changes, the date above is updated; significant changes are announced in the app.