Last updated: 12/10/2026
Developer: Fatih Acı
Contact: fatihaci79@gmail.com
This Privacy Policy describes how maShop ("the App") handles information when you use our mobile application.
Google Sign-In (Optional)
If you choose to sign in with Google, we receive your name and email address from Google solely for authentication purposes.
Apple Sign-In (Optional)
If you choose to sign in with Apple, we receive your name and email address from Apple solely for authentication purposes. If you select Apple's "Hide My Email" option, your real email address is replaced by an anonymous relay address (xxx@privaterelay.appleid.com); messages we send are forwarded to your real address through Apple's servers.
Data You Enter in the App
Your transaction records (product names, prices, dates, supplier/customer names) are stored primarily on your device and, by the nature of the service (preventing data loss on device change, multi-user / multi-device support, backup), are by default synchronised with our own server in Turkey (Muğla) over an encrypted connection. If you use the account alone on a single device, you can turn server backup off in Settings; while backup is off these records stay only on your device, cannot be recovered if the device is lost or damaged, and the existing copy on our server is permanently deleted after 30 days. This data is not transferred abroad, is not shared with third parties, and is permanently deleted from the server when your account is deleted (see Section 7).
Technical Data (Firebase)
Firebase is used for authentication (login/session), in-app notifications (FCM push) and limited usage analytics. Analytics is OFF by default and runs only if you enable it in Settings; while the preference is off, the analytics infrastructure is never started at app launch and no event is sent at all, including session start and screen views. If you enable it, events such as session start, screen views and feature interactions are processed together with an app-instance identifier, in order to measure which parts of the app are used and improve the service. You may switch it off again at any time. No interest profile is built from this data and it is not used for ad personalization. Crash reporting is not collected; no crash reports, app logs or screenshots are taken from your device.
Push Notification Content
Push notifications are delivered through Google (Firebase Cloud Messaging) and, on iOS, Apple (APNs). A notification consists only of plain text, the notification type and a record/account identifier; person names, amounts and currencies are not sent in a notification.
Device and Server Records
To manage your connected devices, apply your plan's device limit, secure your account, calculate the inactivity period and monitor whether the app version you use is compatible with the service, your device information (device name, model, platform, operating system and app version) and your first and last sign-in times are kept on our server. Our server's request and error records (logs, including the version and platform information sent by the app) are kept for 30 days for security and to fix errors, and the access records at the server entry point (including the IP address) for at most 15 days. When you tap "Got it" on an in-app announcement, which announcement you read and when are recorded as evidence that the notice reached you. If the server does not accept a record during synchronisation, a content-free technical trace (table name, record number, rejection reason — not the record's content or values) is kept for 90 days after that record was last rejected, so the error can be found and fixed (recording of this trace begins 30 days after the change is announced in the app). These records are kept on our own server in Turkey and are not shared with third parties. Details: KVKK Personal Data Notice, Sections 1 and 5.
Feedback and Support Requests
Feedback and support requests you send from within the app (category, text, optional rating, app version and platform) are kept on our server so we can review and answer them. Requests marked "completed" are automatically deleted 1 year after they were created; open requests are kept while your account remains open; all of them are deleted immediately when your account is deleted.
Payment Information
Subscription payments are collected directly by Google Play or the App Store (the relevant store acts as the merchant of record). We do not receive, process, or store your payment card or bank account information; this payment transfer is not performed by maShop.
Subscription Verification (RevenueCat)
We use RevenueCat, Inc. (USA) to verify your subscription status and determine your plan entitlements (seat count, feature access). Only a user identifier derived from your in-app account and the subscription/purchase status received from the store are transmitted to this service. Your name, email address, payment card details and the business data you enter in the app are not transmitted.
Advertising (Google AdMob)
On the free (Free) plan, optional, opt-in rewarded video ads may be shown to unlock access to certain features. Ads are non-personalized: no interest profile is built and no behavioral targeting is performed. Advertising is provided by Google AdMob, which may process your device advertising identifier (Android: Advertising ID / iOS: IDFA) and the approximate region derived from your IP address, for ad delivery, frequency capping and fraud prevention. This does not mean your device's GPS location is accessed (see Section 2). No continuous or automatic banner ads are shown; an ad plays only when you choose to watch it. If you are in the EEA or the UK, Google's consent tool asks for your choice before the ad system starts; you can change your choice or withdraw your consent at any time under Settings → Ad privacy choices. If you decline, Google may serve limited ads that do not use your device's local identifiers. In other regions, to withdraw your consent, simply do not choose the ad the next time.
| Service | Purpose | Privacy Policy |
|---|---|---|
| Google Firebase | Authentication, notifications (FCM push) | policies.google.com/privacy |
| Google Sign-In | Authentication | policies.google.com/privacy |
| Apple Sign-In | Authentication (real email or Apple private relay) | apple.com/legal/privacy |
| Google Play / App Store | Payment & subscription management | Store privacy policies |
| Apple (APNs) | Push notification delivery on iOS (token and plain notification content) | apple.com/legal/privacy |
| Google AdMob | Non-personalized rewarded ad delivery, frequency capping, fraud prevention | policies.google.com/technologies/ads |
| RevenueCat, Inc. | Subscription verification and plan entitlements | revenuecat.com/privacy |
| Google Firebase Analytics | Limited usage analytics — opt-in, OFF by default (service improvement) | policies.google.com/privacy |
We do not sell or share your personal data with third parties for commercial purposes. The advertising provider (AdMob) processes only limited technical data to serve non-personalized ads; your personal data is not sold for advertising purposes.
Potential risks of cross-border transfer (KVKK Art. 9/6-a): Several of the providers above are located abroad (USA / EU). In the country to which your data is transferred there may not be a level of data protection equivalent to KVKK, and it may become more difficult for you to exercise your rights as a data subject. Non-mandatory transfers (e.g. advertising) rely solely on your explicit consent, which is asked separately each time; an ad request is made only when you choose Watch an ad. To withdraw your consent, simply do not choose the ad the next time; withdrawal takes effect for the future. Transfers that are mandatory for the service to function, such as login and notifications, are necessary for you to use the app.
maShop may make use of anonymised and aggregated data in order to improve the service and to produce sector benchmarking / recommendation features. Anonymisation removes the user name, email address, business name, customer/supplier/personnel names and account identifiers; the data is used only in groups containing a sufficient number of accounts, and aggregation is never carried out at a level that would allow an individual account to be distinguished. The daily totals kept to operate the service (numbers of accounts and active users, plan and platform distribution, activation rate and similar) also fall under this section; they contain no account or personal identifier, and values based on fewer than 5 accounts are not kept separately.
Anonymised data loses its character as personal data within the meaning of Law No. 6698 and therefore falls outside the scope of the Law (Art. 3/1-b, Art. 7/3).
Your raw transaction data (sales, purchases, expenses, customer, supplier and personnel records) is processed only to provide the service to you (storage, synchronisation, backup); it is not used for any other purpose, including model training, without anonymisation, and is not transferred to third parties. Record contents are not viewed in support or security reviews; only content-free technical traces are used (details: KVKK Personal Data Notice, Section 2.1).
The synchronised copy and backups of your transaction data are kept on maShop's own server (Turkey, Muğla); no third-party cloud provider or sub-processor is used for hosting.
The table in Section 4 is the current list of the sub-processors (service providers) used by maShop. Where a new sub-processor is added to the list, this policy is updated without undue delay and the change is announced by in-app notification; where the change expands the scope of processing, your explicit consent is obtained again.
Your data is stored on your device within the operating system's protected app sandbox. All data transfer with our server is encrypted with HTTPS (TLS). The server's firewall rejects incoming connections by default; administrative access is open only to the developer and only with key-based authentication; the server applies per-user and per-IP request limits; and the database is backed up hourly and daily to separate storage units. Communications with Google services use HTTPS encryption. Details: KVKK Personal Data Notice, Section 7.
The App is not directed at persons under 18. We do not knowingly collect personal information from persons under 18.
Uninstalling the App deletes the data stored locally on your device; to also delete the synchronised copy on our server, simply submit an account deletion request from within the App. If you want only the transaction-data copy on our server deleted, without deleting your account, you can turn server backup off; the copy is permanently deleted after 30 days. In addition, if no active user of the account signs in for 365 days (opening the app while connected to the internet counts as signing in), the account and all its data are permanently deleted: a push notification is sent to the account's active users before deletion, and no deletion takes place until at least 30 days have passed since the warning; accounts with an active paid subscription are exempt from this rule while the subscription continues. Details: KVKK Personal Data Notice, Section 5.
Account Deletion: The in-app "Delete My Account" action permanently deletes your account after a 30-day grace period. For users signed in with Apple, this also invokes Apple's auth/revoke endpoint, causing the app to be removed automatically from "Apps Using Apple ID" in your Apple ID settings.
For deletion of Google Sign-In data or other requests, contact us at fatihaci79@gmail.com.
We may update this Privacy Policy from time to time. We will notify you of significant changes through an in-app notification. The "Last updated" date at the top will reflect the latest revision.
If you have questions about this Privacy Policy:
Email: fatihaci79@gmail.com
All financial calculations displayed in maShop (profit/loss, cost estimates, totals, etc.) are approximate and for informational purposes only. They do not constitute financial, accounting, tax, or legal advice. Users should not rely on in-app calculations for official financial reporting or tax filings.