Privacy Policy

1. In short

• We don’t show ads, we don’t sell your data and we don’t track you across other companies’ apps or websites.
• The app contains no analytics, advertising or crash-reporting SDKs, and we don’t access your advertising ID.
• We never collect real money, bank, card or national ID details (except the identity details the law requires for a KVKK data request).
• We don’t access your location, contacts, photos, camera or microphone.
• You can delete your account in the app at any time; your account data is deleted immediately (and from any backups within 30 days).

2. Who is responsible

The data controller is [Name of the data controller] ([Postal address]). You can reach us at destek@bostreak.com.

3. Data we process

• Account details: your display name, email address, a hash of your password (your password is never stored in plain text), the date your email was verified, your chosen avatar (one of the Bo mascot’s expressions), your language and time zone, and when your account was created. Guest accounts have no email or password.
• Google or Apple sign-in: the user ID that provider gives us, your email address and whether it is verified. If you choose to hide your email with Sign in with Apple, we receive Apple’s relay address.
• Account security: hashes of your session keys and of the verification, sign-in and password reset codes we email you, their expiry times and attempt counts.
• Learning data: lessons and exams you complete, whether your answers were correct, questions you got wrong, XP, streak and streak freezes, your daily goal, quest rewards, badges, your league group and results, Horn activity, your friend code, your friend list, and nudges and congratulations you send and receive.
• Virtual portfolio: your virtual balance and the virtual capital you have earned, virtual holdings, trades, pending orders and the notes you write in your trade journal (your reason, an optional emotion tag and the related lesson).
• Intro survey: your experience, the markets you’re interested in, your goal, your area of interest, your age range, how much time you want to spend each day and how you heard about BoStreak.
• Support messages: your email address and what you write if you email us.
• Request details: if you make a KVKK data request, the name, Turkish ID or passport number, address, contact details and signature required by the Communiqué on Applications.
• Usage measurement: the days you open the app, the screens you open and how far you get in the intro questions, recorded with a random identifier generated for your device and linked to your account once you create one. It contains no name, email, amounts or text you write.
• Technical data: technical details of requests to our server. Our app keeps your IP address only in server memory for up to 15 minutes to prevent abuse such as repeated failed sign-in attempts and never writes it to our database; our hosting provider’s infrastructure logs may keep it briefly.

Stored only on your device: your sound, haptics, notification and reminder-time preferences, your display-currency choice, a draft of the intro survey and your session key (in secure storage). Your chosen currency is sent with requests so amounts can be calculated in it, but it is not saved to your account.

The emotion tag in the trade journal is optional, kept only so you can see your own trading habits, and never shown to anyone else.

A display name and (except for guest accounts) an email address are required to create an account; without them you can’t sign up. Survey answers, avatar and trade notes are optional.

4. How we collect it

• Directly from you: sign-up, the survey, your trade journal and support emails.
• Automatically as you use the app: lesson, trade and game records, usage measurement (you can turn it off), and technical request data.
• From Google or Apple: only if you sign in with them.

5. Why we use it and our legal bases

• To create your account, save your progress and virtual portfolio, and provide lessons, leagues, quests and other features — performance of our contract with you (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• To set your daily goal and starting plan from your survey answers — performance of contract.
• To send verification, sign-in and password reset codes and manage sessions — performance of contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)); to prevent cheating and abuse and keep the Service secure — our legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).
• To improve the Service by measuring which parts are used and whether people come back — our legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)). Measurement runs only on our own server, with no third-party analytics tool; you can turn it off under Profile > Settings > Usage measurement.
• To answer support requests — performance of contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)); to answer data subject requests — legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)).
• To comply with lawful requests from authorities and protect our rights in disputes — legal obligation and the establishment, exercise or defence of legal claims (KVKK Art. 5/2-ç, e).

We don’t use your data for advertising, profiling or to give you investment recommendations. We make no automated decisions that have legal or similarly significant effects on you; league rankings and quests only concern the game inside the app.

We don’t rely on your consent for any current processing. If we ever start processing based on consent (for example, promotional emails), we will ask first and you can withdraw your consent at any time.

6. Who we share it with

• Our server and database hosting provider, which runs the Service’s infrastructure.
• Resend, which receives your email address and the email content when we send verification, sign-in and password reset emails (servers in the EU, Ireland).
• Cloudflare, which hosts our website and domain and forwards emails sent to our support address.
• Google, whose email service (Gmail) stores support emails, and which verifies your identity if you sign in with Google.
• Apple, which verifies your identity if you sign in with Apple.
• Other users: in leagues, your display name, avatar, league points, weekly XP and portfolio score (a score based on your return relative to the index) are visible. People you add as friends also see your total XP, streak, longest streak, badge tiers, shared streak and weekly portfolio return percentage; friendship is mutual and can be removed at any time. Your portfolio value, trades, trade journal and email are never shown to others.
• Public authorities: only where the law requires it and only to the extent requested.

Our hosting and email delivery providers process your data only on our behalf, on our instructions and to provide the Service.

Our server gets market prices from Binance, Bybit and Kraken; none of your personal data is sent to them. Coin and company logos are loaded by your device directly from Brandfetch; like any web request, this lets Brandfetch see your IP address and basic technical information about your device, but no account information is sent to it.

Share cards are only shared when you choose to, through the app you pick; they never show portfolio values or profit and loss.

If we ever transfer the Service to a company, your data will be transferred with the protections described in this policy; we will tell you in advance, and you can delete your account before the transfer if you wish.

7. International transfers

Our service providers’ servers may be located outside Türkiye (for example, in the European Union and the United States). We make these transfers under KVKK Art. 9 on the basis of standard contracts signed with the recipient and notified to the Turkish Personal Data Protection Authority (or an adequacy decision, where one has been announced). For users in the EU, the safeguards provided by the GDPR (adequacy decisions or EU Standard Contractual Clauses) apply. You can request a copy of these safeguards at ${MAIL}.

8. How long we keep it

• Account, learning and virtual portfolio data: for as long as your account exists.
• Guest accounts (no email, password or Google/Apple sign-in): deleted automatically with all their data after 24 months without use. A guest who deletes the app can never reach that account again, so we don’t keep it indefinitely.
• When you delete your account: all account data is deleted immediately and permanently, and automatically removed from any security backups within 30 days.
• Verification, sign-in and password reset codes: valid for 15 minutes; only their hashes are stored.
• Session keys: valid until you log out; they expire after 365 days without use and are revoked when you log out or change your password.
• IP address: in our app’s server memory only, for up to 15 minutes; briefly in the hosting infrastructure’s logs.
• Usage measurement records: 400 days (about 13 months), then deleted automatically.
• Support messages and data subject requests: up to 2 years after the request is closed (as evidence in case of disputes), then deleted.

If the law requires us to keep something longer, we keep it only for that period and purpose.

9. Security

Passwords are hashed with a strong algorithm (scrypt); session keys and verification codes are stored only as hashes; the connection between the app and our server is encrypted; your session key is kept in your device’s secure storage; and access to data is limited to what is needed to run the Service.

No system is perfectly secure. If a breach affects your data, we will notify the Turkish Personal Data Protection Authority and, where required, you, within the time limits set by law.

10. Your rights

Under KVKK Art. 11 you have the right to:

• Find out whether your personal data is processed and, if so, request information about it,
• Find out the purpose of processing and whether it is used for that purpose,
• Know the third parties in Türkiye or abroad to whom your data is transferred,
• Have incomplete or incorrect data corrected,
• Have your data deleted or destroyed under the conditions in KVKK Art. 7,
• Ask that corrections, deletions or destructions be notified to third parties who received your data,
• Object to an outcome against you that results solely from automated analysis of your data,
• Claim compensation if you suffer damage because of unlawful processing.

If you live in the European Union, under the GDPR you also have the right to receive a copy of your data in a portable format, to restrict processing and to object to processing based on legitimate interests, and you can lodge a complaint with your local data protection authority.

Send your request from the email address registered to your account to destek@bostreak.com, or use one of the methods in the Data Subject Request Form. We will reply free of charge within 30 days. If your request is rejected, you find our answer inadequate or we don’t answer in time, you can complain to the Turkish Personal Data Protection Board within 30 days of learning our answer and in any case within 60 days of your application.

11. Deleting your account

You can delete your account in the app at any time: Profile > Settings > Privacy > Account & data > Delete my account. For password accounts, you’ll be asked for your password to confirm. Deletion is immediate and cannot be undone; all your account data — including lesson progress, virtual portfolio, trade journal, Horns and league history — is deleted. If you can’t open the app, follow the steps at bostreak.com/hesap-silme (in Turkish) or email us from your account’s email address.

12. Children

BoStreak isn’t designed for children under 13, and we don’t knowingly collect data from children under 13. Users aged 13 to 17 should use the app with a parent’s or guardian’s knowledge and consent. In the EU, users under the age set for parental consent (usually 16) need their parent’s consent. If we learn that we have collected data from a child under 13, we will delete the account and its data. Parents can send requests about their child’s data to destek@bostreak.com.

13. Notifications

Streak and league reminders are local notifications scheduled on your device; no push token is sent to our server for them. You can turn them off in the app’s settings or your device settings.

14. Website and cookies

bostreak.com uses no cookies, analytics or advertising tools, collects no forms and loads no third-party fonts or scripts. Cloudflare, which hosts the site, may briefly keep technical logs such as IP addresses for security and to operate the service.

15. Changes

We may update this policy. We will announce significant changes in the app before they take effect. The date at the top shows the latest version.