Privacy policy

Scope

This policy applies to the insider app for iOS, the obscura.technology website and related services. The data controller is Kaan Ozcagiran, who offers the service under the Obscura Technology brand.

Data we collect

We collect only the data required to operate the service:

• Account: username, email address and password hash.
• Invitation: the single-use invitation code you use.
• Portfolio and goals: asset, quantity, average cost, total cost and goals that you record.
• Content: locked theses, group messages, content reports and profile information.
• Membership: Apple subscription status and transaction tokens.
• Technical: session, device association, security and error records; IP address for abuse prevention.

Device and account association

To reduce multiple-account abuse, the app stores a random credential in device-only Keychain storage. The server links a keyed hash of that credential to your account; only one account can be linked to the device at a time. Signing out does not unlink it. To use another account, sign in to the current account and release the device with your password under Profile → Settings and privacy → Switch account. This removes sessions and private cache from this device while preserving your account, server content and linked Apple subscription. The subscription does not transfer to the other account. Account deletion also removes the association. This credential is not used for advertising or cross-app tracking.

Website preferences

The website carries your language selection in its URL; English pages use /en. The preference may also be stored locally in your browser. This site does not use cookies for advertising or cross-app tracking.

Market data providers

Refreshing crypto quotes, opening charts and loading coin logos that are not bundled with the app may send requests directly to CoinGecko; the provider can see your IP address and requested asset. The new release is prepared to retrieve supported stock and ETF quotes, chart history and daily session data for thesis verification from Twelve Data through the insider app server. These requests include market query parameters such as symbol, exchange, date and chart interval; your insider app session, email address, invite code and portfolio are not sent to the provider. Requests to Twelve Data originate from our server, not directly from your device. Bundled stock and BIST logos make no network requests. Data coverage and timestamps are shown in the app; unavailable data is never replaced with an invented price.

How we use data

We use data to verify accounts, process invitations, run the thesis and reputation loop, apply moderation, manage subscription access, respond to support requests and keep the service secure.

Collection methods and legal grounds

We receive data electronically from registration and sign-in forms, your actions in the app, Apple subscription verification responses, support correspondence and service security logs. We process account, invitation, portfolio, thesis, message and membership records to form or perform the service contract; device association, IP and security records for our legitimate interest in preventing abuse, provided your fundamental rights are not harmed; and records that must be retained to meet applicable legal obligations. Sharing portfolio allocation with other members is your choice.

Sharing

We do not sell or rent your personal data to third parties. Data is shared only:

• With service providers such as Google Cloud for hosting and backups and Google Workspace for email delivery.
• With Apple for subscription and App Store transactions.
• With market data providers only for the quote, chart and logo requests described above.
• When required by a valid court order or regulatory obligation.

Services outside Türkiye

The insider app server and its backups are hosted in Google Cloud’s Germany (Frankfurt) region. Verification emails are processed through Google Workspace, and that processing may take place outside Türkiye. Apple subscription verification, direct crypto requests from the app to CoinGecko and server-side market queries to Twelve Data may result in the data described above being processed by providers outside Türkiye. The categories sent are described in the sharing and market data sections.

Retention and deletion

We keep data only as long as necessary for the service. Application logs are configured for 30 days and hourly server backups for 35 days. Google Cloud applies a further 7-day soft-delete recovery period after a backup is deleted; deleted account data may remain in older backups during this period. You can delete your account from Profile → Settings and privacy → Delete my account. This removes your account, sessions, private portfolio, goals and messages. Personal text and identity are removed from shared theses while other participants’ numerical outcomes remain without your identity. To prevent old backups from bringing data back, a keyed hash of the account ID and deletion time are kept in a separate record; it contains no email, password or personal content. Deletions are automatically reapplied before the server opens access to an older backup. Deleting your account does not automatically cancel an Apple subscription; turn off renewal through Apple separately. Screenshots taken by others cannot be recalled.

Retention of market evidence

When the market provider contract ends, raw prices and daily session records, including copies, must be removed within 30 days. Source/session metadata, derived thesis outcomes and reputation may be retained within the permitted scope. Removed raw evidence is clearly marked; missing prices are not recreated. This differs from deleting your account; account-deletion rights are described above.

Visibility and moderation

Your portfolio quantities and costs are not shown to other members; percentage allocation is visible only if you turn on sharing. Platform moderators and authorized inspectors may join private groups for moderation and review content reports. Staff access and administrative decisions are logged.

Security

Passwords are stored as one-way hashes. We use encryption in transit, access controls and abnormal activity monitoring. No system is completely risk-free; contact us if you notice a security issue.

Your rights

Under Turkish data protection law, you may ask whether we process your data, learn the purpose and recipients of processing, request correction or deletion when the legal conditions apply, ask that these changes be notified to recipients, object to an adverse result based solely on automated analysis, and seek compensation for unlawful processing. Contact us from the email address registered to your account at the address below. We may ask for information to verify your identity and respond to applications within 30 days.

Contact

For privacy questions and requests, use our support mailbox: