Security

1. On-device storage

Kartopu has no server and doesn’t ask you to open an account. Your assets, income and expenses, debts and receivables, goals, plans and settings are kept only on your phone, in the app’s own storage. Other apps cannot access it, and neither can we.

The app works offline. When online, it only downloads current exchange rates and gold/silver prices from public sources; these requests contain no information about you.

2. App lock

You can lock Kartopu in Settings → Security → “App lock”.

• The lock uses your device’s own lock: fingerprint, face recognition or screen passcode. The operating system does the check; Kartopu only receives “success / failure”.
• Kartopu stores no passwords or biometric data. On your device it only keeps whether the lock is on and after how long it locks again.
• With the lock on, the app locks on launch and after staying in the background longer than the time you choose. In the background, its content is hidden in the app switcher.
• With the lock off, anyone with access to your device can see your data. We recommend using your phone’s screen lock.

3. Backups and changing phones

• Android: Automatic backup and device-to-device transfer are off; your data is not copied to your Google account backup.
• iPhone: App settings (including your preferences and the install ID) may be included in the device’s own iCloud or computer backup.
• When you change phones, your data moves only through the app’s own export. Where you keep the exported file is up to you; it contains your financial data, so keep it somewhere you trust.

4. Karto and on-device processing

Karto understands what you write with a rule-based Turkish parser that runs only on your device. No cloud AI is used; what you tell Karto is never sent anywhere and no internet is needed. Financial calculations follow deterministic, testable rules. Karto never changes a record without your approval.

5. The limited data that is sent

Only if you allow it are pseudonymous usage statistics and crash reports sent to providers in the EU (PostHog, Sentry). Long numbers, amounts and email addresses in error messages are removed on the device before sending; no screenshots are taken. Details: Privacy policy.

6. Reporting a vulnerability

If you think you’ve found a security vulnerability in Kartopu, please report it to destek@kartopu.app with “Security” in the subject line. Include:

• what the vulnerability is and how to reproduce it,
• the app version and your device/operating system.

Please don’t disclose it publicly until it is fixed, and don’t try to access other people’s data. We will confirm we received your report and keep you informed about the fix.

7. Versions and updates

Security fixes ship with app updates. We recommend keeping the app up to date from the store.