In short
The subscriptions, bills and spending records you enter in SupBor are stored only under your account, and only you can access them. The app contains no advertising, analytics, crash reporting or tracking tools. We never sell your data or use it for advertising. You can delete your account and all cloud data from within the app at any time.
This policy covers the SupBor Android app (the “App”) and the supbor.com website (the “Site”). The service is provided by, and the data controller is, BorteStudios (Istanbul, Türkiye; “we”). You can reach us about anything at support@supbor.com.
Data processed in the App
Account information
An account is needed so your records can sync between devices. Sign-in is handled by Google’s Firebase Authentication:
- Email and password sign-in: your email address, email verification status and the user ID created by Firebase. We never see your password; Firebase stores it securely (hashed).
- Google sign-in: basic profile information shared by Google, such as your email address, name and profile photo link, together with your user ID.
Records you enter
Information you add to the App is stored under your account in Google’s Cloud Firestore database:
- Payment plans: type (subscription/bill), name, amount, currency, category, first due date, repeat cycle, reminder days and archive status; for subscriptions also trial end, pause, cancellation date, notes and price history.
- Payment and spending records: name, amount, currency, category, date, note and a link to the related payment plan.
This data is kept in Firestore’s Europe (eur3) region. Our security rules allow only the account owner with a verified email address to access each record.
SupBor never connects to any bank, card or payment account and never makes payments on your behalf. You enter amounts and dates yourself. We recommend not writing card numbers, IBANs or passwords in note fields.
Data that stays on your device
The following is never sent to our servers and is stored only on your phone:
- Language, theme, reminder time, privacy view and app lock preferences,
- Recently used categories and your last backup and sync dates,
- The summary shown by the home screen widget (cleared when you sign out),
- Firestore’s temporary on-device cache used for offline access.
App lock uses Android’s device authentication (fingerprint, face unlock, PIN). We never access your biometric data; authentication is handled entirely by Android.
Notifications are created by a scheduled task running on your device. We do not use a server or notification tokens to send them.
Encrypted backups
A .sbor backup exported from Settings is encrypted on your device with a password you choose and saved to a location you choose. The backup file never reaches us; we do not know your password and cannot recover it. Android’s automatic cloud backup is turned off for SupBor.
Permissions
- Internet: to sign in and sync your records.
- Notifications: to show due-date reminders. If you decline, upcoming payments are still shown inside the App.
Why we process data
| Purpose | Data |
|---|---|
| Creating your account and providing secure sign-in | Account information |
| Storing your records and syncing them between devices | Records you enter |
| Showing due-date reminders | Records (processed on your device) |
| Answering support requests | Your email and its contents |
| Keeping the service secure and preventing abuse | Account information, technical connection data |
We do not use your data for advertising, profiling or sale, and we do not sell it to third parties.
Service providers and international transfers
We use the following providers to run the service. They process data only on our behalf and only to provide the service:
| Provider | Service | Data |
|---|---|---|
| Google (Firebase Authentication) | Accounts and sign-in | Account information |
| Google (Cloud Firestore) | Storing and syncing records | Records you enter |
| Vercel | Hosting supbor.com | IP address and technical connection data |
Because these providers’ servers are located outside Türkiye, your data is transferred internationally. Transfers take place in line with Article 9 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and the relevant provisions of the GDPR. See the KVKK Information Notice for details.
Unless required by law, we do not share your data with anyone else.
Retention
- Account information and records: kept while your account is open. When you delete your account, your cloud records and account are permanently deleted.
- On-device data: deleted when you uninstall the App or clear its data.
- Support correspondence: kept for up to 1 year after the request is resolved.
Deleting your account and data
In the App, go to Settings › Security › Delete account and data to permanently delete your account and all cloud records. If you cannot access the App, follow the steps on the Account and Data Deletion page.
Website
supbor.com is a static informational site:
- It does not use cookies and has no analytics, advertising or tracking tools.
- Your light/dark theme choice is stored only in your browser’s local storage and is never sent to us.
- Fonts and images are served from our own domain; no third-party resources are loaded.
- Our hosting provider Vercel briefly processes technical connection data such as your IP address to deliver and secure the Site.
Security
Data is encrypted in transit (HTTPS/TLS). Firestore security rules restrict every record to its owner, and the amount of a recorded payment cannot be changed afterwards. No system is perfect; if a breach occurs, we will inform you and the competent authorities within the legal time limits.
Children
SupBor is not directed at children under 13, and we do not knowingly collect data from children of that age. If you become aware of such a case, contact us and we will delete the account.
Your rights
Under KVKK and, where applicable, the GDPR, you have the right to access your data, request correction or deletion, object to processing and receive your data in a portable format. You can export a copy of your data at any time with the encrypted backup in the App. Send requests to support@supbor.com; we reply within 30 days. You also have the right to lodge a complaint with the Turkish Personal Data Protection Authority or your local data protection authority.
Changes
We may update this policy. We will announce significant changes in the App or on this page. The date at the top of the page shows the latest update.
Contact
BorteStudios · Istanbul, Türkiye · support@supbor.com