Last updated: October 15, 2026. The Ritvelo app is developed and published by Aigialos. This policy explains what information we process and why, as the data controller under Turkish Personal Data Protection Law No. 6698 (KVKK). It applies to all users, including users in the United States. You can send questions to hello@aigialoslabs.com.
Information we process
Account: your email address, or, if you sign in with Google or Apple, the email and name those services share; if you start as a guest, only an anonymous account ID. Payments: the name, plan, amount, currency, payment day, category, and notes of the subscriptions and bills you add. Statements: the CSV, XLSX, or PDF statements you upload and the date, description, amount, and category details extracted from them. Receipts: PDF, JPG, or PNG receipt files you attach to a transaction, their file names, and the service name on the receipt. Preferences: your profile, currency, and notification settings. Your device’s push token, if you allow notifications. Your purchase status, if you buy Plus. We never ask for your full card number, CVV, PIN, or bank password, and we do not connect to your bank.
Information that stays on your device
When you add a payment from a photo of a bill or a screenshot, the image is read on your device; the image itself is not sent to our servers, and only the amount and date you confirm are saved. Files you attach to a transaction as receipts are different: they are not read automatically, they are uploaded to your account and stored as described below. Whether app lock is turned on is stored only on your device; app lock uses your device’s own Face ID, fingerprint, or other authentication, and we have no access to your biometric data. Home screen widgets show only app data that is on your device.
How we use information
We use your information only to run the app: to detect recurring payments; to show monthly and yearly totals, charts, and the calendar; to notify you about price changes and upcoming payments; to verify your Plus membership; and to fix errors. We do not show ads, we do not use ad networks or product analytics, and we do not sell your information.
Shared lists
If you create a shared list and invite someone, or join a list, the payments and amounts in that list, who paid, and your display name are shared with the list’s other members. Your email address is not shown to other members.
Service providers and international transfers
Your account and data are stored on Supabase infrastructure. Notifications are delivered through the Expo Push service. Verification code and password reset emails are sent through Resend, so your email address is passed to Resend for this purpose. Plus purchases are processed by Google Play or the App Store; membership status is verified with RevenueCat, and we never see your payment details. App errors are sent to Sentry; user IDs, emails, amounts, descriptions, and request contents are removed from these reports. If you sign in with Google or Apple, those services’ own privacy terms apply. These providers’ servers are located outside Turkey; your data is transferred only to provide these services and in accordance with the KVKK rules on transfers abroad.
Retention
Raw statement files you upload are kept in a private storage area and are automatically deleted within 24 hours after processing. Receipt files you attach to a transaction are kept in a private area of your account until you remove the receipt or the transaction, delete your financial data, or close your account. Your payment and transaction records are kept until you delete them or close your account. When you delete your account, all associated data is permanently removed, and, except for records we are legally required to keep, it is also cleared from backups within a reasonable period.
Your data choices and account deletion
From the Profile screen, you can export your data as a JSON file, delete statement files one by one, remove receipts attached to transactions, remove all of your financial data, or permanently delete your account and all of its data with “Delete my account.” If you cannot access the app, you can request deletion by writing to hello@aigialoslabs.com from the email linked to your account. You can also write to the same address to exercise your rights under Article 11 of the KVKK (such as the rights to information, correction, deletion, and objection); we respond to requests within 30 days.
Security and children
In our database, each user can access only their own data and the lists they are a member of; connections are encrypted. Ritvelo is not designed for children under 13, and we do not knowingly collect data from children under that age.
Changes
When we update this policy, we change its date and announce significant changes in the app.