Privacy Policy

1. Data controller

Polatlı Ajans is the data controller for the personal data processed through CryptoAnaliz.

For any privacy question or request you can contact us at [email protected].

2. Data we collect

• Account data: e-mail address, name and profile photo link (if provided by your Google account), Firebase user ID, the sign-in method, e-mail verification status, preferred language, account type (Free or Pro), credit balance, account creation and last sign-in dates.
• Password: if you sign up with e-mail and password, your password is handled by Google Firebase Authentication. It is not sent to or stored on our servers.
• Notification data: the push notification token of your device (Firebase Cloud Messaging) and the platform (Android), your notification preferences (which categories you turned on or off) and a queue record of each notification sent to you (category, title, text, delivery status and time). See section 11.
• Content you create in the app: your watchlist, price alerts (coin, target price, direction, status, trigger price and time), AI analysis history (coin, timeframe, indicator values used, the generated text, credit cost and date) and records of the signal notifications sent to you and whether you read them.
• Credits and purchases: credit transactions (amount, type, balance, date), Google Play purchase records (product ID, order ID, purchase token and the verification response returned by Google, such as purchase time, status, expiry date and region code) and your subscription status and dates. We never receive your card or other payment details; payments are processed by Google Play.
• Technical data: when you use the app or the website, your IP address, device or browser type and request times are processed by our hosting and content delivery providers and in server logs for security and troubleshooting. Server errors are reported to an error-monitoring service that is configured not to send personal data by default.
• Data stored only on your device: your sign-in session token (in the device's secure storage) and app preferences such as language.
• Advertising data (only when ads are shown, i.e. to Free users and signed-out visitors): the Google Mobile Ads SDK built into the app, operated by Google AdMob, processes data on your device and sends it to Google to serve and measure ads and to prevent fraud. This can include your Android advertising ID (if you have not disabled or reset it), IP address, device and app information (such as model, operating system and app version), an approximate location derived from the IP address, and ad interaction and diagnostic data. This data is collected and used by Google under its own privacy policy, is separate from your CryptoAnaliz account data and is not linked by us to your account. See section 10.
• Rewarded ads: when you watch an optional rewarded ad, we store a record of the reward (a transaction ID issued by AdMob, your member ID, the credit amount and the date) to verify it on our server, grant the credits once and enforce the daily limit.

We do not collect your location, contacts, photos or files, or microphone or camera data ourselves. CryptoAnaliz does not connect to any exchange account and never asks for exchange API keys.

3. Why we use your data

• To create and manage your account and let you sign in.
• To provide charts, signals, the radar and AI analyses, and to keep your analysis history.
• To send the push notifications you allow: announcements and credit notifications to signed-in members, and watchlist signals and price alerts to Pro members (see section 11).
• To manage credits, verify Google Play purchases and provide the Pro subscription.
• To prevent abuse, for example repeatedly claiming the free credit or redeeming the same purchase twice.
• To show ads to Free users and signed-out visitors through Google AdMob, and to grant and verify the credits from optional rewarded ads.
• To keep the service secure, fix errors and answer your support requests.
• To comply with legal obligations such as accounting and tax rules.

We do not use your CryptoAnaliz account data (such as your e-mail address, watchlist or analysis history) for advertising or marketing profiling and we do not hand it to advertisers. Ads are served by Google as described in section 10.

4. Legal bases (KVKK and GDPR)

We process personal data under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where applicable, the EU General Data Protection Regulation (GDPR):

• Performance of a contract (KVKK art. 5(2)(c), GDPR art. 6(1)(b)): account, analyses, notifications, credits and purchases.
• Legal obligation (KVKK art. 5(2)(ç), GDPR art. 6(1)(c)): accounting and records required by law.
• Legitimate interests (KVKK art. 5(2)(f), GDPR art. 6(1)(f)): security, error tracking and abuse prevention, including the hashes kept after account deletion described below.
• Consent: push notifications are only shown if you allow them in Android; you can withdraw this permission at any time in your device settings. Advertising: where the law requires consent (for example in the European Economic Area and the United Kingdom, and as a precaution in Türkiye), the app shows a consent form (Google User Messaging Platform) before any ad is requested; you can change your choice later in the app where the option is offered, and without consent only non-personalised ads or no ads are shown. Where the law requires it for transfers abroad, we rely on the safeguards provided by law or on your explicit consent.

5. Service providers and transfers

We share data only with the providers needed to run the service, and only for the purposes below:

• Google Firebase Authentication (Google): sign-in with Google or with e-mail and password; processes your e-mail address, password, name, profile photo and user ID.
• Google Firebase Cloud Messaging (Google): delivery of push notifications; processes your device token and the notification content.
• Google Play Billing (Google): payment for credit packages and the Pro subscription. We send the purchase token to Google to verify the purchase.
• OpenAI: writes the AI analysis texts. For a quick analysis we send only the coin symbol, the timeframe, the RSI value, the lower Bollinger band, the last closing price and the response language. For a deep analysis we additionally send the headlines of public news articles about the coin (from CoinDesk, Cointelegraph and Decrypt) and the number of related public posts found on X. Your name, e-mail address, account ID, IP address or device data are never sent to OpenAI.
• Binance: price and chart data come from Binance's public market data APIs. Our servers and the app fetch this data directly; when the app connects to Binance, Binance can see your IP address and standard connection information, as with any website. No account information is shared with Binance and the app does not place trades.
• X (Twitter) API and news feeds: our servers search them using only the coin symbol; no user data is sent.
• Cloudflare: content delivery, DNS and protection of our website and API; processes IP addresses and request data.
• Our server hosting provider: stores the database and runs the service.
• Sentry: monitoring of server-side errors.
• Google AdMob (Google): serves and measures the ads shown to Free users and signed-out visitors and delivers rewarded ads. Google processes the advertising data described in section 2 as an independent party under Google's Privacy Policy (https://policies.google.com/privacy). We tell AdMob which ad unit to show and, for rewarded ads, your member ID so that AdMob can confirm the reward to our server; we do not send your e-mail address, name, watchlist or analysis content to AdMob.

Some of these providers process data outside Türkiye (for example in the United States or the European Union). Such transfers are made in line with KVKK article 9 and the GDPR, using the safeguards provided by law.

We do not sell your account data and we do not share it with third parties for their own marketing. The only exception is the advertising data that Google collects directly through the ad SDK, described in sections 2 and 10. We may disclose data to authorities when required by law.

6. How long we keep data

• Account data and app content are kept while your account exists. When you delete your account, they are deleted from our database immediately and the deletion of your Firebase sign-in account is requested at the same time.
• After deletion we keep only two irreversible, one-way hashes, described below. They do not contain your e-mail address or purchase token and cannot be turned back into them.
• E-mail hash: a one-way hash of the e-mail address of the deleted account, together with the dates of the first and last free credit, is kept so that the free credit cannot be claimed again with the same e-mail address. It is kept for as long as we offer free credits.
• Purchase token hash: a one-way hash of each purchase token, together with the store, product ID, purchase type and the date it was first seen, is kept to prevent the same purchase from being credited twice and for accounting records. It is not linked to any member and is kept for as long as these purposes and statutory retention periods require.
• Google keeps its own records of your Google Play orders under Google's policies.
• Rewarded ad records (transaction ID, amount, date) are deleted together with your account.
• Device notification tokens, notification preferences and notification queue records are deleted together with your account. Queue records of notifications that have been processed are also deleted automatically after about 30 days.
• Advertising data collected by Google AdMob is kept by Google under its own policies; we cannot delete it and deleting your CryptoAnaliz account does not delete it. You can manage it in your Google account and Android ad settings (see section 10).
• Server logs and backups may contain data for a limited period and are deleted in their normal rotation.

7. Your rights

Under KVKK article 11 and, where applicable, the GDPR, you have the right to:

• learn whether your personal data is processed and request information about it;
• access your data and, where applicable, receive it in a portable format;
• request correction of inaccurate data and deletion of your data;
• object to or request restriction of processing;
• withdraw your consent at any time;
• learn the third parties to whom data is transferred;
• lodge a complaint with the Turkish Personal Data Protection Authority (KVKK) or, in the EU, with your local supervisory authority.

To use these rights, write to [email protected], preferably from the e-mail address registered to your account. We may ask you to confirm that you own the account. We answer within 30 days at the latest.

8. Deleting your account

You can delete your account at any time in the app: Profile → Delete account. If you cannot use the app, send a deletion request to [email protected]. Step-by-step instructions: https://www.cryptoanaliz.net/delete-account

9. Children

CryptoAnaliz is intended only for adults aged 18 or over. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us at [email protected] and we will delete it.

10. Ads, cookies and tracking

Free users and signed-out visitors see ads served by Google AdMob: banner ads on some screens, native ads in lists, an occasional full-screen ad after you close an analysis result, and optional rewarded ads. Pro members see no ads and the advertising SDK is not loaded for them.

To serve and measure ads, Google may use your Android advertising ID and similar device data, store or read identifiers on your device and use cookies or similar technologies inside ad content. This is done by Google, not by us, and is separate from your CryptoAnaliz account. Google's Privacy Policy: https://policies.google.com/privacy. How Google uses data from apps that use its services: https://policies.google.com/technologies/partner-sites

Your ad choices: on Android go to Settings → Google → Ads (the exact path depends on your device) to delete or reset your advertising ID and to turn off ad personalisation. Where consent is required, CryptoAnaliz shows a consent form (Google User Messaging Platform) on first use and, where offered, lets you review your choice later; if you do not consent, only non-personalised ads or no ads are shown. Ads are not directed at children; CryptoAnaliz is for adults only.

Rewarded ads are optional: if you watch one to the end, you can receive 3 credits, up to 3 times per day (the amounts may change and are shown in the app). The reward is verified on our server through Google and is granted once per ad; it is available only to signed-in Free accounts with a verified e-mail address. Using automation, emulators, repeated accounts or any other method to obtain rewards unfairly is prohibited and may lead to credits being removed.

Apart from the ad SDK described above, CryptoAnaliz contains no analytics or tracking SDKs.

These legal pages set no cookies. Our content delivery provider Cloudflare may set strictly necessary security cookies to protect the site from attacks.

11. Push notifications

CryptoAnaliz can send push notifications to signed-in members in four categories:

• Announcements: information about the service, such as new features, maintenance or credit information, sent by us to all members or to groups of members (for example by account type or language). Announcements are informational; we do not use them for third-party advertising.
• Credits: a notification when credits are added to your account (welcome credit, monthly free credit, credit package purchase, Pro subscription credit).
• Signals (Pro): trading signals for the coins on your watchlist.
• Alerts (Pro): your price alerts.

You can turn each category on or off in the app under Settings → Notifications, and you can turn off all CryptoAnaliz notifications in your phone's notification settings. Signals and alerts are only sent to Pro members.

To deliver notifications we store your device notification token (Firebase Cloud Messaging) and, for each notification, a queue record with its category, title, text, delivery status and time. Tokens that are no longer valid are deleted. Tokens, preferences and queue records are deleted when you delete your account; queue records of processed notifications are also deleted automatically after about 30 days.

12. Security

Communication between the app and our servers is encrypted with HTTPS (TLS). Your sign-in session token is kept in your device's secure storage, passwords are managed by Firebase Authentication, and the identifiers kept after account deletion are stored only as one-way hashes. Access to the administration panel is restricted to authorised staff.

No method of transmission or storage is completely secure, but we work to protect your data with appropriate technical and organisational measures.

13. Changes to this policy

We may update this policy. The current version is always published on this page with its last updated date. If we make significant changes, we will inform you through reasonable means such as an in-app notice or e-mail.

14. Contact

Polatlı Ajans, CryptoAnaliz — [email protected] — https://www.cryptoanaliz.net