Privacy Policy

1 Scope and data controller

This policy explains how your personal data is processed when you use the yuksekportfoy.com website and the Yüksek Portföy application at app.yuksekportfoy.com (together, the "service").

The data controller under Turkish Personal Data Protection Law No. 6698 (KVKK) is Doğukan Barış Yüksek, Yenimahalle / Ankara, Türkiye. Contact: [email protected].

2 Data we collect

Account information

• Email address, first name and last name.
• Gender. This field is optional; you can choose "prefer not to say".
• Password. Your password is never stored in plain text; only a salted hash is kept.

Sign in with Google

If you choose to sign in with Google, we receive only your email address, first name, last name and Google account ID from Google (requested scopes: openid, email, profile). We do not access your contacts, calendar, Drive files or any other Google data. Your Google password never reaches us.

Data you enter in the app

• The portfolios you create and the transactions you add to them.
• Your watchlist.
• Your home (dashboard) layout.

Technical data

• IP address and browser/device type on sign-in attempts.
• Device information and IP address in session refresh records.
• When an unexpected error occurs in the interface: the page path where it happened, browser information and screen size.

3 How we use your data

• To create, verify and protect your account.
• To calculate and show your portfolio figures (return, profit/loss, allocation and so on).
• To keep the service secure: preventing brute-force attempts and bot traffic.
• To detect and fix errors.
• To send essential account emails (verification code, password reset, notifications).

We do not use your data for advertising, we do not profile you, and we do not sell your data.

This processing is carried out to perform the service relationship with you, on the basis of our legitimate interest in keeping the service secure, and to meet our legal obligations.

4 Use of Google user data

Data we receive through Sign in with Google is used only to verify your identity, create your account and recognise you when you sign in again.

• It is not used for advertising, marketing or profiling.
• It is not shared with or sold to third parties, other than the service providers listed below.
• You can remove the link to your Google account by closing your account or by writing to us; you can also revoke the app's access at any time from your Google account's security settings.

5 Who we share data with

We work with the following service providers (data processors) to run the service. Each one processes only the data needed for the stated purpose.

• Brevo: sending verification and notification emails (email address, name).
• Cloudflare: traffic routing and Turnstile bot protection (IP address, browser signals); storage for encrypted backups.
• Google: authentication, only if you choose Sign in with Google.

No user data is sent to market data providers.

These providers' infrastructure may be located outside Türkiye; in that case data may be processed abroad, limited to the purposes above. Data may be shared with competent authorities where the law requires it.

6 Retention and deletion

• Our servers are located in Türkiye. Backups are stored encrypted.
• When you close your account you can reopen it for 30 days. After that, your portfolios, watchlist, sessions, sign-in history and social sign-in links are deleted, and your account record is anonymised.
• Invoice records are kept for the period required by law.
• Interface error reports are deleted after 30 days.
• Registrations with an unverified email are deleted after 48 hours.

7 Security

Passwords are stored as salted hashes, backups are encrypted, connections are encrypted (HTTPS) and repeated failed sign-in attempts are limited. Even so, no method on the internet can guarantee complete security; we recommend that you never share your password and that you choose one you do not use elsewhere.

8 Cookies and local storage

• Website (yuksekportfoy.com): no analytics or advertising tools are used and no tracking cookies are set. Only your theme and language preference is kept in your browser's local storage. Fonts are loaded from Google Fonts; your browser connects to Google's servers to fetch them.
• Application (app.yuksekportfoy.com): the session key needed to keep you signed in, and preferences such as theme, language and text size, are kept in your browser's local storage. No advertising or tracking cookies are used.
• Cloudflare may set strictly necessary security cookies so that bot protection can work.

9 Your rights

Under Article 11 of KVKK and, where applicable, the EU General Data Protection Regulation (GDPR), you have the right to:

• Learn whether your data is processed and access the data we hold about you.
• Ask for incomplete or inaccurate data to be corrected.
• Ask for your data to be deleted.
• Learn the purpose of processing and the parties your data is transferred to.
• Object to processing and claim compensation if you suffer damage.

You can close your account yourself, and correct details such as your name, from Settings in the app. For any other request write to [email protected]; we reply within 30 days at the latest. If you are not satisfied with our reply, you can lodge a complaint with the Turkish Personal Data Protection Board.

10 Changes to this policy

We may update this text as the service changes. The current version is always published on this page and the date at the top changes. We announce changes that significantly affect how your data is used separately, in the app or by email.

11 Contact

For anything related to privacy: [email protected]