Sepetliyo Privacy Policy
Last updated: 19 October 2026
This policy explains what data Sepetliyo collects, why, and what we do with it. The Turkish version applies under Turkish law (KVKK); see also the KVKK Disclosure Notice (Turkish only).
Who we are
Sepetliyo is built and published by Ali Rıza Yüksektepe, an individual developer, who is responsible for your data ("we"). The same name appears as the seller on the App Store and Google Play. There is no company or trade registry entry.
Contact: support@odexi.app. If you need a postal address, ask for it at that email.
What we collect
| Data | When | Why |
|---|---|---|
| Email address | When you sign in with an email code, Apple or Google (with Apple's "hide my email", the relay address Apple gives us) | To create your account and let you sign in |
| Display name | If you type one, or if Apple shares your name at sign-in | So household members recognise each other |
| User ID | Generated randomly when you sign up | To tie data to your account and match your subscription |
| Household, lists and items | When you create a household or add lists and items | To run the shared list |
| Purchase records | When you enter a price and a store | Price history, alerts and the spending summary |
| Household city and district | When you pick a city while creating a household or in Home settings, and optionally type a district | To show prices by city and match price alerts by city |
| Push token | If you allow notifications | To notify you when someone adds an item or a price alert fires |
| Subscription status | If you subscribe to Sepetliyo Aile | To unlock the plan for everyone in the household |
| Barcode number | When you scan a barcode | To find the product |
We don't ask for location permission and we never read your device's location. The city is chosen from a list and the district is text you type; only those two names are stored. Everyone in the household can see the household's city.
If you use receipt scanning, the receipt photo is read on your phone (on-device text recognition) and isn't sent to our servers. Only the items and prices you confirm are sent.
We show no ads and do no advertising tracking. The app currently has no analytics or crash-reporting tool. If we add one, we'll update this page and tell you first.
What other household members see
People in the same household see the lists, items, purchase records and each other's display names. A member with the child role can see the list and add and check off items, but can't manage the household.
Community prices
When at least 3 different people in the same city have entered a price for a product, that week's median price is shown to other users. No identity, household or name is shared with it. If you don't want your prices counted, turn off Home > Price sharing. It is on by default.
Who we share data with
We don't sell your data. These service providers process data on our behalf:
- Supabase (EU, Frankfurt region): database, sign-in and sync.
- RevenueCat (USA): subscription management. It receives your user ID and the store receipt.
- Expo Push Service (USA): delivers notifications. It receives the push token and the notification text; the notification reaches your device through Apple's and Google's push services.
- Apple and Google: sign-in verification only; payments and subscriptions run through your app store.
- Open Food Facts: if a scanned product isn't in our catalogue, the barcode number is sent to this open database. The request leaves your device, so they can see your IP address.
How long we keep it
As long as your account is open. When you delete it, your account, display name, push tokens and memberships are deleted. The items and purchase records you added stay in the household, but are no longer linked to you. Deleted data is removed from our active systems right away and from Supabase's managed backups within 30 days.
Deleting your account
In the app, tap Home > Delete account. If you can't open the app, follow the steps on the delete account page. Deleting your account doesn't cancel your store subscription; cancel it separately in your Apple ID or Google Play settings.
Children
The child role is a household-member label set by the household owner. We don't offer a separate service for children. People under 18 may use the app only with the knowledge and permission of the adult household owner (a parent or guardian). Children under 13 can't create an account on their own. Ads and analytics are off for child accounts. If you believe a child's data was collected without permission, write to support@odexi.app and we'll delete it.
Your rights
You can ask us to access, correct or delete your data, or object to its processing, by writing to support@odexi.app or using the in-app options. If you are in Turkey, your rights are listed in the KVKK Disclosure Notice. If you are in the EU or UK, you also have the rights granted by GDPR, including the right to lodge a complaint with your data protection authority.
Security
Data travels over HTTPS. Every table is protected by row-level access rules, so you can't read another household's data. No system is perfectly secure; if there is a breach we'll notify you and the authorities as the law requires.
Changes
If we change this policy we'll announce it in the app and update the date above.