Account data: when you sign in with Apple or Google, we receive your email address, display name, and a provider user identifier to create and secure your account.

Business data you enter: your products (name, code, barcode, category, unit, purchase/sale price, VAT rate, stock levels, low-stock thresholds), product photos, categories, stock movements, and sale totals. Sales are stored as totals only — StokCepte does not store customer identities or line-item buyer details.

Camera and photos: barcode scanning and product photos use your device camera and photo library. Barcodes are read on your device; product photos you choose to add are stored with your account.

Subscription data: purchases and subscription status are processed by RevenueCat together with the Apple App Store or Google Play. We receive your subscription and entitlement status, not your card or bank details.

Usage analytics: we use PostHog (hosted in the EU) to collect pseudonymous product-usage events — for example a screen view, a completed sale with its total, a stock adjustment, or a low-stock alert — identified by a random account ID together with basic properties such as plan, language, and currency. We do not record session replays, and analytics events do not include customer or line-item detail.

Diagnostics: to keep the app stable we may collect crash and error reports, along with the device model, operating system version, and app version.

Notifications: StokCepte can show low-stock and account-related alerts as local notifications generated on your device. They are scheduled on-device — StokCepte does not use a third-party push service and does not collect a push token. You can turn notifications off in your device settings at any time.

To provide the service: store and sync your inventory, run quick sales and stock adjustments, generate basic reports, and show low-stock alerts (in the app and as local notifications on your device).

To manage subscriptions and entitlements, to keep the app secure and prevent abuse, to diagnose and fix problems, and to understand aggregate usage so we can improve the product. We do not sell your data or use it for third-party advertising.

We process your data to perform our contract with you (providing the app you signed up for); on the basis of our legitimate interests in keeping the app secure, diagnosing issues, and improving it; to comply with legal obligations that may apply to us; and, where required, with your explicit consent (for example camera access and notifications, which you control in your device settings).

We share data only with the processors that operate the service on our behalf: Supabase (secure database, authentication, file storage for your product and company-logo photos, and serverless functions that validate photo uploads and carry out account deletion), PostHog EU (product analytics), RevenueCat together with the Apple App Store and Google Play (subscription management and in-app payments), Apple and Google (sign-in), and Google Fonts (the app may load fonts from Google's servers, which involves your device's IP address). Barcode scanning runs entirely on your device. Each provider processes data under its own terms and only as needed to run the service, and we do not sell your data.

Your inventory data and analytics are hosted in the European Union. Some providers (for example Apple and Google for sign-in and payments) may process limited data outside Türkiye and the EEA under their own safeguards and standard contractual protections. Where transferring your personal data abroad requires it, we rely on the appropriate legal safeguards under KVKK and GDPR.

StokCepte is a mobile app and does not use advertising or tracking cookies. It stores data locally on your device (such as your session and preferences) so the app works and remembers your settings.

We keep your data while your account is active. You can delete your data or your account at any time by contacting us; we will delete it, and remove it from routine backups within a reasonable period, unless we are legally required to keep certain records for a limited time.

Data is encrypted in transit, access is protected by authentication and row-level security so only your account can reach your data, and only the providers listed above can access it to run the service. No system is perfectly secure, but we take reasonable technical and organizational measures to protect your data.

Under KVKK and GDPR you can request access to your data, correction, deletion, restriction of or objection to processing, and a portable copy, and you can withdraw consent where processing is based on it. To exercise any of these rights, email support@loaglabs.com; we respond within the legally required time.

If you believe your data is not handled lawfully, you also have the right to lodge a complaint with the Turkish Personal Data Protection Authority (KVKK — Kişisel Verileri Koruma Kurumu), in the EEA with your local data protection supervisory authority, and in the United Kingdom with the Information Commissioner's Office (ICO).

California (CCPA/CPRA): we do not sell your personal information and do not share it for cross-context behavioural advertising, and we have not done so in the preceding 12 months. California residents have the right to know, access, correct, and delete their personal information, and the right not to be discriminated against for exercising these rights. You can exercise them via the contact below; an authorised agent may act for you where the law allows.

Brazil (LGPD): if you are in Brazil, you have the rights set out in the Lei Geral de Proteção de Dados, including confirmation of processing, access, correction, anonymisation or deletion, portability, and information about sharing, and you may lodge a complaint with the national authority (ANPD).

Other jurisdictions: if the privacy law of your country (for example Japan's APPI or South Korea's PIPA) grants you similar rights, we will honour requests in accordance with the law that applies to you. Contact us and tell us where you are located.

StokCepte is a business tool intended for adults and is not directed to children. We do not knowingly collect personal data from anyone under 16 (or the higher age your local law sets for consent). If we learn that we have collected such data, we will delete it; if you believe a child has provided us data, contact us.

We may update this policy as the app evolves. We will change the date at the top and, for significant changes, notify you in the app.

Data controller: loaglabs. For any privacy question or request, contact us at support@loaglabs.com.