Privacy Policy

Data controller

Stoktamı is developed and operated by Alp Buğra Toker, who is the data controller. You can send questions and requests to destek@stoktami.com.

Google user data (Sign in with Google)

• Data accessed: if you sign in with Google, we request only basic profile information (the openid, email and profile scopes): your Google account ID, name, email address and whether it is verified, and your profile photo URL. We do not access Gmail, Drive, contacts, calendar or any other Google data.
• Data usage: we use this information only to create your account, sign you in and show your name in your profile.
• Data sharing: we do not sell Google user data or share it with anyone; it is stored only on our servers hosted by Amazon Web Services (AWS) in Frankfurt, Germany. We may disclose it to authorities if legally required (e.g. a court order).
• Data protection: all connections are encrypted with HTTPS, our database is not reachable from the internet, and only authorized people can access our servers.
• Data retention and deletion: we keep it for as long as your account exists. When you delete your account in the app (Profile → Delete account) or by writing to destek@stoktami.com, the data received from Google is permanently deleted. You can revoke Stoktamı’s access at any time under third-party connections in your Google Account (myaccount.google.com/connections).
• Limited Use: we do not use Google user data for advertising, do not sell it, do not send it to AI providers, and do not use it to develop, improve or train AI or machine learning models. Stoktamı’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Sign in with Apple

If you sign in with Apple, we receive your Apple ID identifier, your email address (or, if you choose, Apple’s private relay address) and, on first sign-in only, your name. It is used for the same purposes as Google data and is stored and deleted in the same way. You can revoke access on iPhone under "Sign in with Apple" in your Apple Account settings.

Data we process

• Account: your name, email address and profile photo URL (as provided when you sign in with Apple, Google or email), the identifier of your sign-in method, and your language and notification preferences.
• Session: your device name, platform (iOS/Android), app version, client/user agent, the last IP address of the session, and when the session was created and last used.
• The product links you add, the options you select (size, color…) and your notification rules.
• Notifications: records of notifications we send you and your device push token, so that we can send them.
• Email sign-in: only a hash of the code we email you (the code itself is not stored).
• The IP address requests come from, to prevent abuse (rate limiting; also the last IP in the session record).
• Waitlist (stoktami.com): the email address you enter.

We do not collect passwords, payment details, location, contacts, photos or any other content on your device. The app shows no ads, and we do not track you across other apps or websites.

Why we process it

• To provide the service: checking your products and notifying you when they are back in stock or their price drops (KVKK art. 5/2-c, performance of a contract).
• To keep your account and sessions secure and prevent abuse (art. 5/2-f, legitimate interest).
• Waitlist: to let you know when the app launches (art. 5/1, explicit consent: you provide your address yourself and can withdraw at any time).

Who we share it with

• All data is hosted on Amazon Web Services (AWS) servers in Frankfurt, Germany.
• Expo (push service, USA) and, through it, the Apple and Google push services, to deliver notifications.
• Apple and Google, to verify your identity at sign-in (only if you sign in with Apple or Google).
• Our email provider SendGrid (Twilio Inc., USA) receives your email address and the code, to send you the sign-in code.
• We check product pages from our own servers; we do not send your name or email to stores.
• Product images in the app load directly from the store’s servers; the store can see your device’s IP address and app information when they do.
• To resolve a short link you share (e.g. ty.gl, bit.ly) to the product link, we send requests to link shortening and link tracking services (e.g. Adjust); these services see the link.
• If you add a link from a store we cannot read yet, the link (without your identity) is sent to our AI provider (Anthropic or OpenRouter) to recognize the store.

We do not sell your data or share it with anyone for advertising. We may disclose it to authorities if legally required (e.g. a court order).

Our servers are in Germany; Expo, SendGrid and the AI provider are in the USA, and Apple and Google are also outside Turkey. Your data is therefore transferred abroad (KVKK art. 9). Each provider receives only the data it needs for its task.

How long we keep it

• Your account, tracked products and preferences are kept for as long as your account exists.
• Notifications are kept for 90 days, product price history for 90 days.
• Session records (device information, last IP) and the push token are kept while the session lasts: they are deleted when you sign out or after the session goes unused for 30 days.
• Hashes of sign-in codes are deleted within 24 hours.
• A waitlist address is kept until we let you know the app has launched, or until you ask us to delete it.
• When you delete your account, your account, tracked products, notifications, sessions and push tokens are permanently deleted. A link you added may remain, no longer tied to your account, in a review record opened for a store we cannot read.

How we protect it

• All connections between the app, the website and our servers are encrypted with HTTPS.
• Your session token is stored in encrypted storage on your device (iOS Keychain, Android Keystore).
• We do not use passwords; only hashes of sign-in codes are stored.
• Our database is not reachable from the internet; only authorized people can access our servers.

Cookies

stoktami.com does not use advertising, analytics or tracking cookies. The app contains no third-party analytics or advertising tools.

Deleting your account

In the app, go to Profile → Delete account (Profil → Hesabı sil) to permanently delete your account and data at any time.

If you cannot access the app, you can also request deletion by writing to destek@stoktami.com from your account’s email address.

Your rights

Under KVKK art. 11 you have the right to learn whether your data is processed, request information, ask for it to be corrected or deleted, object, and claim compensation for damages. Send your request to destek@stoktami.com.

Changes

We may change this policy; when we do, the date at the top of this page changes.