TRGet the appGet it

Ceres

Privacy Policy

What data we process when you use the Ceres app and appceres.com, why we use it, who we share it with, how long we keep it and your rights.

Draft — this text will be published after legal review; it is not binding yet.

Last updated: 3 October 2026

  1. 01Who we are

    The Ceres mobile app and appceres.com are provided by Ceres Finansal Teknolojiler A.Ş. (“Ceres”, “we”). Address: [Company address] · E-mail: info@appceres.com. For users in Türkiye, the details required by the KVKK are in the KVKK Privacy Notice.

  2. 02Principles

    • No ads, no data sales: your data is never used for advertising, profiling or third-party marketing, and it is never sold.
    • No tracking: the app has no advertising identifier (IDFA / AAID), no ad SDK and no third-party analytics.
    • No bank connection: Ceres doesn’t connect to your bank and doesn’t move money or make payments. Your records are only what you enter, scan or import.
    • Only what’s needed: data is processed only as far as the app needs it to work.

  3. 03Data we collect

    • Account: name, e-mail, optional phone number and profile picture. Your password is stored only as an encrypted hash. With Sign in with Apple or Google, the name and e-mail those services share.
    • Preferences: language, country, currency, time zone, payday, income and savings goal, notification settings.
    • Financial records: income and spending (amount, date, merchant, category, note), budgets, goals, recurring payments, installments, investments, debts and money owed to you.
    • Cards: card name, bank, program, last 4 digits only, statement and due dates, limit, balance. We never ask for or store the full card number, CVV, IBAN or online banking passwords.
    • Receipts and attachments: receipt photos and what’s read from them (store, date, items, VAT, total, last 4 digits of the card); images you attach to transactions.
    • Statements: a card statement PDF you import is deleted right after it’s read. Excel and CSV files are read on your device only and never uploaded.
    • Ceres AI: the questions you ask in Ask Ceres and the answers.
    • Family: household name, members and roles, the e-mail address of the person you invite, shared budget and goals.
    • Subscription: your plan, its status, expiry date and store transaction IDs. Payment card details are handled by Apple or Google and never reach Ceres.
    • Device and security: push token, device name and model, platform, app version, session and two-step verification records; app error reports (with e-mail addresses, amounts, IBANs and phone numbers masked).
    • Support: messages and feedback you send us.
    • Website: the e-mail address you enter in the “Notify me” form, your language, device type and the date of your consent. The site uses no advertising or analytics cookies; it keeps only your chosen language in a cookie and your theme in your browser.

    What we don’t collect: location, contacts, health data, audio, your calendar events (Ceres only adds reminders to your calendar, it doesn’t read it) or advertising identifiers.

  4. 04What stays on your device

    Face ID and Touch ID checks are done by the operating system; biometric data never reaches Ceres. Your app PIN and session keys are kept in the device’s secure storage (Keychain / Keystore). A copy of your records is cached on the device so the app works offline.

  5. 05How we use data

    • Calculating your period, budget, forecast and report card; showing charts and summaries
    • Sending the notifications you turn on: payment reminders, budget alerts, period close, new offers that match your cards
    • Showing bank and brand offers that match your cards (offers are collected from public pages; your data isn’t used for that)
    • Valuing your assets at daily rates (rates come from the Central Bank of the Republic of Türkiye and open sources; none of your data is sent)
    • Providing the Premium AI features
    • Account security, finding and fixing errors, preventing abuse
    • Answering support requests and meeting legal obligations

  6. 06AI processing

    Receipt scanning, statement import, Ask Ceres and Ceres notes run on Anthropic PBC’s Claude model, and a request is sent only when you use one of these features. For Ask Ceres, only the summary needed to answer travels with your question: totals, the category split, relevant transactions, card summaries and, if you’re in a household, household totals and members’ first names. E-mail, phone and password are never sent. Receipt scanning sends the receipt photo; statement import sends the statement’s content. Anthropic processes this data on our behalf as a service provider; under its commercial API terms, data sent through the API isn’t used to train models.

    AI answers can contain mistakes and are not financial, tax or investment advice.

  7. 07Who we share data with

    • Supabase: database, authentication, file storage and server functions (European Union, Ireland)
    • Anthropic: AI features (USA)
    • RevenueCat: subscription status (USA)
    • Apple and Google: app stores and payments, Sign in with Apple / Google, push notification delivery
    • Expo: push notification delivery (USA)
    • Sentry: masked app error reports
    • [E-mail delivery provider]: verification and password reset e-mails

    If you use the family feature, everyone in your household sees the household’s spending, income and goals. We may disclose data to authorities when legally required, only as far as the law requires. Your data is never sold.

  8. 08International transfers

    Some of our service providers are outside Türkiye. These transfers rely on the safeguards in Article 9 of the KVKK and related rules (standard contracts); the KVKK Privacy Notice has the details.

  9. 09How long we keep data

    • Account and financial records: as long as your account is open
    • Receipt images and attachments: until you delete them or your account is deleted
    • Statement PDFs: deleted as soon as they’re read
    • Ask Ceres questions and answers: until your account is deleted
    • Push token: when you sign out, the device becomes invalid or your account is deleted
    • Pending family invites: 5 days
    • Feedback: may be kept with the link to your account removed
    • Waitlist e-mail: until the launch announcement or until you withdraw consent

    When you delete your account, your account, records and files are permanently deleted at the end of a 30-day grace period. Retention required by law is not affected.

  10. 10Deleting your account and downloading your data

    • In the app: Profile › Security & privacy › Delete account permanently. Sign back in within 30 days to undo it.
    • If you can’t open the app: write to info@appceres.com from the e-mail address on your account.
    • To download your data: Profile › Import / export (JSON or CSV).
    • Deleting your account doesn’t cancel an App Store or Google Play subscription; cancel it in the store’s subscription settings.
    Account deletion page

  11. 11Security

    All connections are encrypted with TLS. Access rules in the database let each user reach only their own data and their household’s. The app offers an app lock (Face ID / PIN), two-step verification and signing out other sessions. No system is perfectly secure; if a breach happens, we’ll inform you and the relevant authority as the law requires.

  12. 12Your rights

    Under the KVKK and the GDPR you can access your data, ask for it to be corrected or deleted, object to processing and take your data with you. Write to info@appceres.com from the e-mail address on your account; we answer free of charge within 30 days at the latest.

  13. 13Children

    Ceres isn’t designed for anyone under 18 and doesn’t knowingly collect data from them; if we find out we have, we delete it.

  14. 14Changes

    We may update this policy. We announce significant changes in the app or by e-mail; the current version is always on this page.

  15. 15Contact

    Ceres Finansal Teknolojiler A.Ş. · [Company address] · info@appceres.com

Back to home