BunCo Privacy Policy
Last updated: 2026-08-16 Effective: [RELEASE DATE — fill in] Applies to: Global users (GDPR for EU + KVKK for Turkey + others)
IMPORTANT: This document is a template and should be reviewed by legal counsel before publication. It should reflect BunCo's actual data processing practices.
2026-08-16 revision: A previous version of this policy stated that "BunCo does not operate a backend server" and that "your data never leaves your device." That is no longer accurate. With the release of the optional account + sync feature (multi-device use and group sharing), BunCo now operates its own server. The sections below have been rewritten to describe what actually happens.
1. Data Controller
- App Name: BunCo
- Data Controller: [Company / Individual Name]
- Contact: privacy@berkayboran.com — [physical address if applicable]
2. What We Collect
BunCo is an offline-first app: it works fully without an account, and in that mode your data stays on your device only — nothing is sent to our servers.
Creating an account is optional. You only create one if you want to use your groups on more than one device or share a group with a friend. Once you sign in and sync, the data listed in §2.2 is sent to our server.
2.1 Data Stored on Your Device
| Data Type | Storage Location | Purpose | Retention |
|---|---|---|---|
| Groups, members, expenses, settlement plans | Device SQLite database (unencrypted, app sandbox) | Core app function (bill splitting) | Until you delete or uninstall |
| IBAN, payment details | Device Keychain/Keystore (encrypted via expo-secure-store) |
IBAN sharing (FAST message generation) | Until you delete or uninstall |
| Theme preference, language, settings | MMKV (device key-value store) | User experience | Until you delete or uninstall |
2.2 Data Sent to Our Servers
If you have not created an account: none. Sync only runs after you sign in.
If you have created an account, our server (bunco.berkayboran.com) stores:
| Data Type | Purpose | Retention |
|---|---|---|
| Email address, password hash (argon2id — never the password itself), display name | Authentication | Until the account is deleted |
| Group name, base currency | Multi-device use and sharing | Until the account or group is deleted |
| Member display names, owner/active status | Resolving group membership | Until the account or group is deleted |
| Expense title, date, amount, currency, split details, category, note, comments | Core app function | Until the account or group is deleted |
| SHA-256 hash of an invite link (never the link itself) | Validating single-use invites | Until the invite is used or expires |
| Session (refresh) tokens | Keeping you signed in | Until the session ends (30 days) |
| Server access logs (IP, request path; passwords and tokens are redacted) | Security and debugging | [LOG RETENTION — fill in] |
Data that is NEVER sent to our servers:
- IBANs and payment details. These live only in your device's encrypted
Keychain/Keystore (
expo-secure-store); the sync protocol has no field for them. As a consequence, even if you share a group, your IBAN does not reach the other person through sync. - Device preferences such as theme and language.
Important — scope of sharing: When you sign in and sync, all groups on that device are uploaded to your account (not only the ones you share). A group is visible only to people you invite; nobody else — including us, outside ordinary system administration — browses your groups. If you prefer that your data never leaves the device, do not create an account; the app is fully functional without one.
Hosting: The server runs on our own rented server (VPS); the database is backed up daily with GPG AES-256 encryption. Server location: [SERVER LOCATION — fill in; if outside the EU, the GDPR transfer basis must also be stated].
2.3 Third-Party Services
| Service | Purpose | Data Type | Legal Basis |
|---|---|---|---|
| Sentry (sentry.io) | Crash reporting | Anonymous device ID + error stack trace (IBAN/email/phone are masked) | GDPR 6(1)(f) — legitimate interest |
| Google Play / App Store | App distribution + crash analytics | Anonymous device ID, app version | Platform rules |
| Expo (expo.dev) | OTA updates (if applicable) | Anonymous device ID | GDPR 6(1)(f) |
In crash reports:
- IBANs, emails, phone numbers are automatically masked (
[IBAN],[EMAIL],[PHONE]) - Fields named "password", "token", "secret" are redacted (
[REDACTED]) - Source:
src/shared/services/sentry.ts(auditable)
3. Legal Basis (GDPR Article 6)
- Performance of a contract (you using the app) — GDPR 6(1)(b)
- Legal obligations — GDPR 6(1)(c)
- Legitimate interest (crash reporting, performance improvement) — GDPR 6(1)(f)
4. Data Retention
- On your device: Until you delete (uninstalling clears app sandbox)
- Sentry crash reports: 90 days (Sentry default retention)
- On our servers: Nothing if you have no account. If you do, until you delete your account (see §5). Deleted groups/expenses are retained for a period as tombstones so other devices learn about the deletion.
5. Your Rights (GDPR Articles 15-22 + KVKK Article 11)
- Right to be informed: What data we process
- Right of access (data portability): Export your data — in-app "Export Data" (CSV)
- Right to rectification: Fix incorrect data — directly in-app
- Right to erasure (right to be forgotten): Delete all data — in-app "Delete Account"
- Right to restrict processing: Request processing be stopped
- Right to object: Object to automated decisions
Account Deletion
Method 1 — Deleting in the app (recommended, immediate):
- Settings → Delete Account
- If you are signed in, enter your password and type "DELETE" to confirm
- Deletion happens immediately and cannot be undone
This removes:
- From the server (if you are signed in): your account, email address, password hash, display name, all session records, group membership links and any invites you created
- From your device: all SQLite data (groups, members, expenses, settlements, budgets, comments), Keychain/Keystore contents (including IBAN and payment details), MMKV preferences and scheduled notifications
What happens to shared groups: Groups where you are the only linked account are deleted from the server entirely. Groups you share with others are not deleted — the expense history inside them also determines other members' balances, so it is their data too. If you own such a group, ownership passes to the earliest-joined remaining member. Your display name within the group and past expense records stay so that other members' settlements remain correct; your account identity (email, password, name) is deleted.
Method 2 — Requesting deletion on the web (if you cannot use the app):
- Follow the instructions at https://bunco.berkayboran.com/account-deletion. Use this route if you have uninstalled the app or forgotten your password; requests are completed within 30 days.
Method 3 — Uninstalling the app:
- Uninstalling clears device data only; it does not delete your server account (Method 1 or Method 2 is required).
Method 4 — Sentry crash data deletion:
- Email privacy@berkayboran.com with "Delete my Sentry data"; deleted within 30 days
Response Time
GDPR Article 12: We respond within 30 days. Email privacy@berkayboran.com.
6. Children's Data
BunCo is not intended for users under 13. We do not knowingly collect children's data. If we discover a child's data, we delete it immediately.
7. Data Security
- IBAN and sensitive fields are encrypted via
expo-secure-store(iOS Keychain / Android Keystore) and are never sent to our server - App offers biometric lock (Face ID / fingerprint) for sensitive screens (user opt-in)
- Sentry data is masked via PII filter
- All communication with our server uses HTTPS/TLS (HSTS enabled)
- Passwords are hashed on the server with argon2id; plaintext passwords are never stored
- Authorization headers and password fields are redacted from server access logs
- Database backups are encrypted with GPG AES-256
- Code is not open-source but available for security audit upon request — privacy@berkayboran.com
8. International Data Transfers
- Sentry data: Goes to Sentry's servers (EU or US per data residency choice)
- Google Play crash data: Goes to Google's servers
- BunCo server: If you have an account, the data in §2.2 goes to our own server. Server location: [SERVER LOCATION — fill in]; if outside the EU/Turkey, the transfer basis under GDPR Chapter V and KVKK Article 9 must be stated here.
9. Policy Updates
If this policy changes:
- In-app notification (Settings → Privacy Policy "New" badge)
- "Last updated" date is refreshed
- Material changes (new data type, new 3rd party) → re-consent required
10. Contact
- Data Controller: privacy@berkayboran.com
- GDPR Requests (EU): privacy@berkayboran.com
- KVKK Requests (Turkey): privacy@berkayboran.com
- Complaints: EU local data protection authority; Turkey: kvkk.gov.tr/Sikayet
This document is part of the MIT-licensed BunCo project. Individual users / companies deploying BunCo can use this template but must adapt it to their own legal entity.