Privacy Policy – Exrate

1. Who we are and what this policy covers

This Privacy Policy explains how the Exrate application (published in the app stores under localized names such as "Currency Converter: Offline", hereinafter "the App"), published by AssetBox, processes information when you use it on iOS or Android. Data controller: Emre Balli (AssetBox). By using the App you acknowledge the practices described in this policy. If you do not agree with them, please do not use the App.

2. Summary

• The App does not require an account, and we do not ask for your name, email address, phone number, or any financial account information.
• Your currency selections, converter lists, portfolio entries, and settings are stored only on your device.
• We use a limited number of third-party services for analytics, crash reporting, advertising, purchases, and push notifications, as described below.
• We do not sell your personal information.

3. Information stored on your device

The App stores the following information locally on your device: your selected base and target currencies, converter and multi-converter lists, portfolio holdings and quantities you enter, display preferences (such as the number of decimal places and language), your Premium status, and the most recently downloaded exchange rates so that the App can work offline.

This information is not transmitted to us. It remains on your device until you delete it or uninstall the App. Depending on your operating system settings, it may be included in your device's own backups (such as iCloud or Google backups), which are governed by Apple's or Google's terms and to which we have no access. We do not offer a cloud backup or synchronization service, and we cannot recover data that is lost because of uninstallation, device loss, a device reset, or a malfunction.

4. Information processed through third-party services

4.1 Analytics and crash reports

We use Google Firebase Analytics to understand, in aggregate, how the App is used, for example which screens are opened, which currencies are selected, and which search terms are entered in the in-app currency and calendar search. We use Firebase Crashlytics to collect crash reports and technical diagnostics (such as device model, operating system version, and app version) in order to fix errors and improve stability. Firebase may assign an app instance identifier for these purposes. We do not use this information to identify you personally.

4.2 Advertising

The free version of the App displays advertisements served by Google AdMob, including banner, native, and optional rewarded ads. AdMob may collect device identifiers (such as the Apple Identifier for Advertisers, where you have permitted tracking, or the Android advertising ID), IP address, approximate location derived from the IP address, and information about your interaction with ads, in order to deliver and measure ads, limit how often an ad is shown, prevent fraud and, where you have consented, show personalized ads.

4.3 Purchases and subscriptions

Purchases of Premium are processed by Apple or Google. We use RevenueCat to validate purchase receipts and to manage your Premium entitlement. RevenueCat assigns a random, anonymous App User ID and processes purchase-related information such as product, price, currency, purchase date, trial status, and renewal status. We never receive or store your payment card details.

4.4 Push notifications

If you allow notifications, the App obtains a push notification token from Apple or Google (through Expo's notification service) and sends it to our notification server together with the anonymous RevenueCat App User ID, a device identifier generated by your operating system for apps from the same developer (the identifier for vendor on iOS or the Android ID on Android), your device platform, and the country or region setting of your device. We use this information only to send you notifications about exchange rates and the App and to understand the distribution of notification recipients by country. You can turn notifications off at any time in your device settings.

4.5 Exchange rate and market data providers

To show up-to-date information, the App connects directly to third-party data sources, including Truncgil Finans (currency, gold, and precious metal prices), Frankfurter (European Central Bank reference rates and rate history), CoinGecko (cryptocurrency prices and logos), Forex Factory / Fair Economy (economic calendar), REST Countries (currency names), and GitHub (flag images). These requests do not contain personal information that we add; however, as with any internet connection, the providers necessarily receive your IP address and standard technical request information, which they process under their own policies.

4.6 Support requests

If you contact us by email, including through the feedback option in the App, we receive your email address, the content of your message, and any information you choose to include. To help us resolve purchase issues, the feedback email prepared by the App contains your anonymous RevenueCat App User ID, which you may remove before sending. We use this information only to respond to you and keep it only as long as necessary for that purpose and for our legitimate record-keeping.

5. How we use information

• To provide the App's features, including currency conversion, rate history, portfolio tracking, and the economic calendar.
• To provide, restore, and verify Premium purchases and rewarded Premium access.
• To send push notifications you have allowed.
• To display advertising in the free version of the App.
• To analyze usage in aggregate, diagnose errors, and improve the App's stability and quality.
• To respond to your requests and to comply with legal obligations and enforce our Terms of Service.

6. Legal bases for processing

Where the GDPR, the Turkish Personal Data Protection Law No. 6698 (KVKK), or similar laws apply, we rely on the following legal bases: the performance of a contract (providing the App and Premium); our legitimate interests in operating, securing, analyzing, and improving the App and in funding a free version through advertising, where these interests are not overridden by your rights; your consent where required (for example for personalized advertising, tracking on iOS, and push notifications); and compliance with legal obligations.

7. Advertising choices and consent

Where required by applicable law, for example in the European Economic Area, the United Kingdom, and Switzerland, the App asks for your consent through Google's consent management platform before personalized ads are shown. If you do not consent, non-personalized or limited ads may be shown instead. Where available, you can review or change your choice at any time through "Privacy settings" on the App's information screen. On iOS, the App asks for your permission before accessing the advertising identifier for tracking; you can change this in Settings > Privacy & Security > Tracking. On Android, you can reset or delete your advertising ID in your device settings. Purchasing Premium removes ads, and Premium users receive no ad requests.

8. Sharing and sale of information

We do not sell your personal information and we do not share it with third parties for their own independent purposes, except as described in this policy. Information is processed by the service providers named above on our behalf or under their own terms, and may be disclosed if required by law, to protect our rights or the safety of users, or in connection with a merger, acquisition, or transfer of the App. Where advertising through AdMob is considered "sharing" for cross-context behavioral advertising under California law, you may opt out by declining personalized ads, by limiting ad tracking in your device settings, or by purchasing Premium.

9. Third-party services and their policies

The processing performed by third-party providers is governed by their own privacy policies, which we encourage you to review. We are not responsible for the content, privacy, or security practices of third parties:

• Google (Firebase Analytics, Firebase Crashlytics, AdMob): policies.google.com/privacy
• RevenueCat: revenuecat.com/privacy
• Expo (push notification delivery): expo.dev/privacy
• Apple App Store and Google Play: the terms and privacy policies applicable to your store account and purchases
• Data providers listed in section 4.5: their respective privacy policies

10. Data retention

Data stored on your device remains there until you delete it or uninstall the App. Notification registration data is kept while it is needed to send notifications and is removed or disregarded when the token becomes invalid or upon a verified deletion request. Data held by third-party providers is retained according to their own retention settings and policies; for example, Firebase Analytics data is retained for the period configured in our analytics settings. Support emails are kept only as long as reasonably necessary.

11. Data security

We apply reasonable technical and organizational measures appropriate to the limited nature of the data we process, and communications with our servers and service providers are encrypted in transit. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your device secure, including by using a screen lock.

12. International data transfers

The third-party providers listed above, and our own servers, may process data in countries other than your own, including the United States and countries in the European Union. Where required, such transfers rely on appropriate safeguards, such as standard contractual clauses or other mechanisms implemented by those providers. Where the KVKK applies, by using the App you acknowledge that data may be transferred abroad for the purposes described in this policy, within the limits permitted by law.

13. Children

The App is not directed to children under 13 years of age (or the higher minimum age required in your jurisdiction), and we do not knowingly collect personal data from them. If you believe that a child has provided personal data through the App, please contact us and we will take appropriate steps to delete it.

14. Your rights

Depending on your jurisdiction, for example under the GDPR, the KVKK (including the rights listed in Article 11), or the CCPA/CPRA in California, you may have the right to request access to, rectification, erasure, or restriction of your personal data, to object to processing, to data portability, to withdraw consent at any time without affecting prior processing, and not to be discriminated against for exercising these rights.

Because the App does not use accounts, we may be unable to link most data to you. To help us locate data relating to you, please include your anonymous RevenueCat App User ID (shown in the feedback email the App prepares) in your request. You can delete local data at any time by uninstalling the App, stop push notifications by disabling them in your device settings, and manage advertising choices as described in section 7.

To exercise your rights, contact us at exrate@asset-box.com. We may need to verify your request and will respond within the period required by applicable law. You also have the right to lodge a complaint with your local data protection authority; in Türkiye, this is the Personal Data Protection Authority (KVKK).

15. About the financial information in the App

Exchange rates, precious metal prices, cryptocurrency prices, rate history, portfolio values, and economic calendar entries shown in the App are obtained from third-party sources, are provided for general information only, and may be delayed, incomplete, or inaccurate. They do not constitute financial, investment, tax, or legal advice. Please see our Terms of Service for the full disclaimer.

16. Changes to this policy

We may update this Privacy Policy from time to time, for example when we add features or service providers or when the law changes. When we do, we will update the effective date at the top of this page and, for material changes, provide reasonable notice where required by law. Your continued use of the App after a change takes effect indicates your acknowledgment of the updated policy. The current version is always available at https://asset-box.com/privacy/exrate.

17. Contact

For privacy questions or requests, contact us by email at exrate@asset-box.com. Data controller: Emre Balli (AssetBox), https://asset-box.com.