Privacy Policy
1. Controller
Hikmet Erdem Özermis
Römerstraße 147
52134 Herzogenrath
Germany
Email: hikmeterdemo@icloud.com
2. Data we process
Depending on how the app is used, the following categories of data may be processed:
- Account data: email address, internal user ID, authentication information and, where applicable, a name or email address provided by Apple or Google.
- Financial data: income, expenses, categories, budgets, savings goals, subscriptions, notes, amounts and dates entered by the user.
- Preference data: language, currency, notification preferences, onboarding selections and other app settings.
- Technical data: device and operating-system information, app version, timestamps and technical logs where required for operation, security or troubleshooting.
- Push data: push token, notification preferences and technical delivery information when notifications are enabled.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the app, user account, synchronisation and recovery | Art. 6(1)(b) GDPR |
| Storing voluntary preferences and enabling optional notifications | Art. 6(1)(a) or Art. 6(1)(b) GDPR |
| IT security, prevention of misuse and troubleshooting | Art. 6(1)(f) GDPR |
| Compliance with legal obligations | Art. 6(1)(c) GDPR |
4. Local storage and guest mode
Certain information may be stored locally on the device. When guest mode is used, financial data may remain exclusively on the device unless cloud synchronisation is enabled or an account is created. Local data may be lost when the app is deleted or the device is reset.
5. Account and sign-in
Depending on the available app version, Fynexa may offer email/password authentication, Sign in with Apple or Google Sign-In. When an external provider is used, Fynexa receives the identity information required to complete authentication. Processing by the provider is also governed by that provider's privacy policy.
6. Cloud synchronisation through Supabase
Fynexa uses services provided by Supabase, Inc. for user accounts, authentication, database functions and cloud synchronisation. Account information and financial information entered by the user may therefore be processed within the infrastructure configured for the Fynexa project. Supabase acts as a processor. Where data is transferred internationally, the safeguards required under applicable data-protection law are used.
7. Push notifications
At the user's request, Fynexa may send reminders, for example for recurring payments or a daily finance check-in. Notifications are enabled only after system permission is granted and can be disabled at any time in the app or device settings. Expo Push Services, Apple Push Notification Service (APNs) and/or Firebase Cloud Messaging (FCM) may be used for technical delivery.
8. Recipients and service providers
Data is disclosed only where required to provide the app, comply with law or act on the user's consent. Possible recipients include:
- Supabase, Inc. – hosting, database, authentication and synchronisation
- Apple Inc. – app distribution, Apple sign-in and push delivery
- Google LLC – Google sign-in and, where applicable, push delivery
- Expo / 650 Industries, Inc. – technical push delivery and app infrastructure where used
Fynexa does not sell personal data and does not use financial data for personalised advertising.
9. International transfers
Some service providers may process data outside the European Union or European Economic Area. Such transfers take place only on the basis of an adequacy decision, appropriate safeguards such as the EU Standard Contractual Clauses, or another lawful transfer mechanism.
10. Retention
Data is retained only for as long as necessary for the stated purposes. Account information and synchronised financial data are generally retained until the user account is deleted. Statutory retention obligations remain unaffected. Local data remains on the device until it is deleted by the user, the app or the operating system.
11. Account and data deletion
Users may request deletion of their account and associated cloud data through an in-app deletion function or by emailing hikmeterdemo@icloud.com. Identity verification may be required to prevent unauthorised deletion.
12. Data subject rights
Subject to the applicable legal requirements, users have the right to:
- access their personal data,
- correct inaccurate data,
- request erasure or restriction of processing,
- receive data in a portable format,
- withdraw consent with future effect,
- object to processing based on legitimate interests.
Users also have the right to lodge a complaint with a competent data-protection authority. In Germany, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia may be competent.
13. Security
Appropriate technical and organisational measures are used to protect data against loss, misuse and unauthorised access. No system can guarantee absolute security. Users should appropriately protect their device, credentials and Apple/Google accounts.
14. Children
Fynexa is not specifically directed at children. Where parental consent is required under applicable law, the app may be used only with the required consent.
15. Changes to this Privacy Policy
This Privacy Policy may be updated when features, service providers or legal requirements change. The current version will be published on this page.
16. Contact
Questions about privacy or requests to exercise data-protection rights may be sent to hikmeterdemo@icloud.com.