Privacy Policy

Effective date: 20 October 2026 · Version 1.0

This policy explains how your personal data is processed when you use the RealReturn website and app (realreturn.app). In short:

• We do not sell your portfolio data or share it for advertising.
• If you use RealReturn without an account, your portfolio data stays on your own device.
• If you create an account, your data is stored on servers in the European Union (Ireland) so it can sync across your devices.
• You can download your data and fully delete your account at any time.
• We use a cookieless analytics tool, and you can opt out.

1. Who is responsible for your data

Tuğçe Çıkmazkara (individual), Türkiye
Email: contact@realreturn.app
If you wish to make a written request by post, email us and we will send you our postal address.

EU and UK representative (GDPR and UK GDPR Art. 27): We are in the process of appointing a representative. Their details will be published here once the appointment is complete. In the meantime, please send any request to contact@realreturn.app.

2. What data we process

Category	Examples	When
Account data	Email address, password (only a hashed version is stored; we cannot see your password), account creation and last sign-in time, access level, the date you accepted the Terms and your confirmation that you are 18+	If you create an account
Portfolio data	Positions you add (asset, quantity, purchase price and date), portfolios, cash accounts, transfers, broker names, debts, alerts	When you enter them
Your notes	Notes and investment theses you write on positions (Journal)	If you write them
Your settings	Country, base currency, language, theme, tax rate preference, watchlist	When you use the app; stored on your device only
Technical data	IP address, browser and device information, request time	When you visit, in server and security logs
Usage statistics	Pages visited, referring site, country, device type; not linked to your identity, no cookies	When you visit (you can opt out)

What we don't collect: We don't ask for ID numbers, bank account or card details. We don't connect to your brokerage accounts. We don't request location, camera or microphone access.

CSV files: If you import your transaction history from a CSV file, the file is read in your browser; the file itself is never sent to our servers.

About notes: Please do not include sensitive personal details, such as health or family matters, in Journal fields.

3. Why we process your data and on what legal basis

Purpose	Legal basis (GDPR / UK GDPR)
Creating your account, signing you in, syncing your portfolio across devices, calculating returns, running your alerts	Performance of a contract (Art. 6(1)(b))
Keeping the service secure, preventing abuse and excessive requests, fixing errors	Legitimate interests (Art. 6(1)(f))
Improving the service with anonymous usage statistics	Legitimate interests (Art. 6(1)(f)); you can opt out at any time
Essential account messages (email verification, password reset, inactive account notice)	Performance of a contract (Art. 6(1)(b))
Complying with legal obligations, responding to rights requests, handling legal claims	Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f))

We don't send marketing emails. If we ever want to, we will ask for your separate consent first.

No automated decisions: Our calculations inform you; no automated decision producing legal or similarly significant effects is made about you.

4. Where your data is stored

• Without an account: Your portfolio data and settings stay only in your browser's local storage. They are not sent to us.
• With an account: Your portfolio data is stored on your device and on Supabase infrastructure in the European Union (Ireland, eu-west-1). Data is encrypted in transit (HTTPS) and at rest.
• Data you added without an account is moved to your account only if you confirm it when you sign in.

5. Who we share your data with

We do not sell your data and do not share it for advertising.

5.1 Service providers

Provider	Purpose	Data	Location
Supabase Inc.	Database and authentication	Account and portfolio data	Hosted in EU (Ireland); US-based company
Resend Inc.	Transactional account emails (verification, password reset)	Email address	Hosted in EU (Ireland); US-based company
Cloudflare Inc.	Price-data proxy, security	IP address (kept for at most 2 minutes), asset symbols	Global; US-based company
Render Services Inc.	Website hosting	Technical data (server access logs)	US-based
Umami Software Inc.	Cookieless, anonymous usage statistics	Page, referrer, country, device type	US-based; not linked to your identity

5.2 Direct price services

Some live prices and inflation data are fetched by your browser directly from: CoinGecko (crypto), Frankfurter (currencies), gold-api.com (metals), the World Bank and Eurostat (European Commission, ec.europa.eu) (inflation). These services see your IP address and the asset symbol or country code requested; your account or portfolio is not sent to them.

5.3 Other disclosures

We may disclose data to competent authorities when legally required, and to our legal advisers when necessary to protect our rights.

6. International transfers

Some of our providers are US-based companies and may access data from the United States.

• For EU/UK users: Transfers are protected by the provider's EU-US Data Privacy Framework certification or the European Commission's Standard Contractual Clauses.
• For users in Türkiye: We are in the process of signing the standard contracts published by the Turkish Personal Data Protection Board under Article 9 of the KVKK and notifying them to the Board. This section will be updated once the process is complete.

7. How long we keep data

Data	Period
Account and portfolio data	While your account is open. Deleted immediately when you delete your account.
Inactive accounts	If you don't sign in for 2 years, we email you; if you don't sign in within 30 days of that notice, your account and data are deleted.
Backups	Deleted data is permanently removed from backups within at most 30 days.
IP address for abuse prevention	At most 2 minutes

8. Your rights

• Access: Know what data we process and get a copy.
• Portability: In the app: Profile → "Download all my data" (JSON and CSV).
• Rectification: Correct inaccurate data directly in the app.
• Erasure: In the app: Profile → "Delete my account and all my data", effective immediately.
• Objection: Opt out of analytics in Profile → Settings.
• Complaint: Lodge a complaint with your local data protection authority (see below).

For any other request, write to contact@realreturn.app. We respond free of charge within 30 days.

European Union / EEA / Switzerland

You can complain to the data protection authority in your country.

United Kingdom

Information Commissioner's Office (ico.org.uk).

Türkiye

See our KVKK Information Notice. Complaints: Personal Data Protection Board (kvkk.gov.tr).

United States

We do not sell your personal information and do not share it for targeted advertising. If your state's law gives you additional rights, contact us at contact@realreturn.app.

Brazil (LGPD) / Canada / Other countries

Contact us at contact@realreturn.app to exercise any rights under your local law.

9. Security

We protect your data with HTTPS encryption in transit, encryption at rest, database rules that let each user access only their own records, hashed passwords, rate limiting, security headers, and two-factor authentication on administrator accounts. If a data breach occurs, we will notify the relevant authority and, where required, you, within the legal deadlines (e.g. 72 hours).

10. Cookies and local storage

• We don't use advertising or tracking cookies.
• Our analytics tool (Umami) does not use cookies and does not store an identifier on your device.
• The app uses your browser's local storage to keep you signed in, remember your settings, and show your portfolio offline. These are strictly necessary.

11. Age limit

RealReturn is for people aged 18 and over. If we learn that we hold data of someone under 18, we will delete it.

12. Not investment advice

RealReturn is an informational analysis tool and does not provide investment advice. See our Terms of Use.

13. Changes

We may update this policy. We will notify you in the app or by email about significant changes. The effective date is always shown at the top.

14. Contact

Tuğçe Çıkmazkara · contact@realreturn.app