This page explains which personal data we process when you use the Planstant mobile app, why, who we share it with and how long we keep it. The Turkish version is our notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK); if the two differ, the Turkish version prevails. Last updated: 24 October 2026.
16X9 FİLM YAPIM BİLİŞİM SANAYİ VE TİCARET ANONİM ŞİRKETİ
Maslak Mah. AOS 55. Sk. 42 Maslak B Blok No: 4 İç Kapı No: 542, Sarıyer / İstanbul
Maslak Vergi Dairesi · VKN 0012062477 · MERSİS 0001206247700001
Email: support@planstant.com
| Data | Purpose | Legal basis (KVKK Art. 5/2) |
|---|---|---|
| Your email address | Creating your account, sending sign-in codes, essential account notices | (c) Formation and performance of the contract |
| Content you enter in planners (budgets, expenses, tasks, habits, lists, notes, calendar entries) | Syncing between your devices, backup, PDF export on request | (c) Performance of the contract |
| Subscription status (Premium or not, end date, purchase source) | Unlocking Premium features | (c) Performance of the contract |
| IP address, device and app information (user agent), session record, hash of the sign-in code, one-way hash of your email address | Account security, keeping you signed in, preventing abuse such as mass code requests | (f) Our legitimate interest, provided it does not harm your fundamental rights |
| Server access logs (IP address, time, requested path) | Monitoring the service, detecting attacks, responding to legal claims | (f) Legitimate interest; (e) establishing, exercising or defending a right |
| Support emails you send us | Solving your issue and answering your request | (c) Performance of the contract; (ç) legal obligation (for KVKK requests) |
We do not ask for your name, phone number, location or contacts. If you add a photo to a list item, a calendar event or your journal, it is stored only on your phone: it is not sent to our server, not synced between your devices and never reaches us. The camera and photo library open only when you choose to add a photo, with your phone's permission; extra information such as location is removed from the saved photo. When you delete your account, these photos are deleted from your phone too. Payment details never reach us; purchases are made through the App Store or Google Play. Please do not enter special categories of data (such as health or religious beliefs) in planners; if you do, they are stored only in your account as your content and are not used for any other purpose.
Electronically and automatically: your email and planner content when you type them in the app; IP address, device information and access logs when the app connects to our server; subscription status from App Store or Google Play purchase notifications. Planner data is stored on your phone first and synced to the server when you are online.
We do not sell your data or share it for advertising. We share only what is needed with these service providers:
| Recipient | Purpose and data | Country |
|---|---|---|
| Hetzner Online GmbH (hosting) | App server and database; all data above is stored on this server | Finland (Helsinki, European Union) |
| Apple Inc. and Google LLC | App distribution, purchases and payment. For purchases they are separate controllers under their own privacy policies. | USA and other countries |
| Authorized public authorities | Only when legally required and only to the extent requested | Türkiye |
Our server is in the European Union, in Finland, so your data is stored outside Türkiye. Sign-in code emails are sent from this same server; we do not use a separate email provider. If we start working with a new service provider, we will update this policy beforehand.
| Data | Retention |
|---|---|
| Account, email, planner content, subscription status | Until you delete your account; deleted from the live system immediately. |
| Database backups | 14 days; a deleted account leaves the backups within 14 days. |
| Sign-in code | Valid for 5 minutes; stored only as a one-way hash and deleted within 1 hour after it expires. |
| Session record (IP address, device information) | While the session is active; an unused session ends after 7 days and is deleted within 1 hour. Signing out deletes it immediately. |
| Abuse-prevention records (IP address, email hash) | 24 hours |
| Sent email records (recipient address, time, delivery result) | 30 days |
| Server access logs | 30 days (rotated daily; older logs are deleted) |
| Support emails and privacy requests | Up to 2 years after the request is closed (to prove we answered it). |
Expired records are removed by an automatic cleanup that runs on the server every hour.
The app has no ads, advertising ID, analytics or tracking tools. It uses only a session key that is strictly necessary to keep you signed in; there are no tracking or advertising cookies. This website uses no cookies and loads nothing from third parties (no external fonts or scripts). Reminders are created as local notifications on your phone; their content is not sent to our server.
Under KVKK Article 11 you can ask us to: tell you whether your data is processed and give you information about it; tell you the purpose and whether it is used accordingly; name the third parties it is transferred to in Türkiye or abroad; correct incomplete or inaccurate data, delete or destroy it under KVKK Article 7, and notify those changes to recipients; object to a result against you arising solely from automated analysis; and compensate damage caused by unlawful processing.
Send your request, following the Turkish Communiqué on the Procedures and Principles for Applications to the Data Controller, in one of these ways: from the email address registered in the app to support@planstant.com with the subject "Privacy request"; in writing with a wet signature to the address above; or by registered electronic mail (KEP), secure electronic signature or mobile signature.
Please include your full name, your signature for written requests, your Turkish ID number (or nationality and passport number if you are not a Turkish citizen), your address, a contact email or phone number, and what you are asking for. We may ask for extra information to verify your identity.
We answer within 30 days free of charge; if the request involves an additional cost, the fee set by the Board may be charged. If your request is refused, the answer is insufficient, or we do not answer in time, you can complain to the Turkish Personal Data Protection Board within 30 days of learning our answer and in any case within 60 days of your request (KVKK Article 14). If you live in the EU or UK you may also contact your local data protection authority.
In the app, tap the round Profil (Profile) button at the top right of the Today screen → Hesabı sil (Delete account) to delete your account and all server data immediately. If you cannot open the app, follow the steps on the account deletion page.
Planstant is for people aged 13 and over. If we learn that an account belongs to someone under 13, we delete it.
We update this policy before we start using a new service provider, a new type of data or a new purpose. We also tell you about important changes by email. The current version is always at this address.