Privacy policy

Draft, not yet in effect. This text has not been reviewed by a lawyer. Remove this notice when it is published.

Last updated: [DATE]

This policy describes what the North Star mobile app (“the app”) and this website do with personal data. It covers the app for iPhone and Android, the service behind it and asknorthstar.app.

1. Who is responsible

The data controller is [LEGAL NAME], [POSTAL ADDRESS], Türkiye. For anything about your data, write to support@asknorthstar.app.

2. In short

You can use the app without an account. We then store no question or answer text.
With an account we store your email address and your conversations, so that you can read them again, until you delete them.
The text of every question is sent to an AI provider to produce the answer. Your email address is not sent with it.
There is no advertising and no analytics or tracking software in the app. Crash reports contain no questions, answers or email addresses.
You can delete your account in the app at any time.

3. What we collect

From everyone who uses the app

An app installation record. The first time the app contacts our service it is given a random token. The app keeps the token in the phone’s secure storage and sends it with each request; we store only a hash of it. With it we store the platform (iOS or Android), the app version, the time the installation was registered and last seen, the IP address it was registered from, and how many questions it has used without an account.
Your questions, while they are answered. A question (up to 1,000 characters) is sent to our servers together with the app’s language. If you are not signed in, the question and the answer are not stored on our servers; in the app they stay in memory only and are gone when you start a new chat or close the app.
A usage record per question. The time, how long the answer took, the AI models used, token counts, cost, whether it succeeded and any error code, linked to your installation and, if you are signed in, to your account. It contains no question or answer text.
Technical data of each request. Your IP address, which our servers need to answer and use to limit abuse; a random identifier per request (shown as the “Support ID” when something fails); and server log lines with the time, the address requested and the result. Server logs do not contain the text of questions or answers.

If you create an account

Your email address, the date the account was created and your last sign-in. There are no passwords: you sign in with a 6-digit code we email to you.
Your conversations: the questions you ask, the answers, the list of source videos of each answer, a title taken from your first question, and times.
Your language preference, if you choose English or Turkish in Settings.
How many questions you asked on each day, for the daily limit.
Sign-in sessions. The app holds a sign-in token in the phone’s secure storage; our servers hold the matching session. Your account is linked to the installation you signed in on.

Crash diagnostics

When the app crashes or hits an unexpected error, it sends a report to Sentry: the error and where in the code it happened; the phone model, operating system version, free memory and storage, battery level, screen orientation, language, time zone and whether the phone was online; the app version and build; the last technical events before the error (such as “request failed with status 500”, with its Support ID); and a count of app starts that ended normally or in a crash. A report may carry a random installation identifier created by Sentry.

Reports never contain your questions, answers, conversation titles, email address, account identifier, sign-in or installation tokens, screenshots or screen recordings. Email addresses and tokens are removed from error messages before they are sent. Sentry’s servers see the IP address of the connection.

App updates

When the app starts, it asks Expo’s update service whether a newer version of the app’s code is available, and downloads it if so. Expo receives the request with your IP address and technical details of the app (platform, the version it runs and its update channel). No account data or chat content is sent.

What stays on your phone

Sign-in and installation tokens (in the phone’s secure storage), your language choice, the number of questions you have left, and a cached copy of the app’s settings. On an iPhone, the secure storage can survive removing the app.

This website

This website uses no analytics, and we set no cookies on it. It is hosted on DigitalOcean and delivered to your browser through DigitalOcean’s content delivery network, which is run by Cloudflare. Like any web host, they receive your IP address and browser details when you open a page. Pages are served from a server of that network near you, which can be in a country other than Germany.

What we do not collect

The app does not ask for your name, phone number, location, contacts, photos, camera or microphone, and contains no advertising or tracking software. We do not sell personal data or use it for advertising.

4. Why we use it, and on what legal basis

To answer your questions and keep your conversations: Questions, answers, conversations, language. Basis: performing our contract with you (the service you asked for).
To let you sign in: Email address, sign-in codes and sessions. Basis: performing our contract with you.
To apply question limits and prevent abuse: Installation record, IP address, usage counters. Basis: our legitimate interest in keeping a free service usable and affordable.
To keep track of what the service costs: Usage records. Basis: our legitimate interest in running the service.
To find and fix faults, and to keep the service secure: Server logs, Support IDs, crash diagnostics. Basis: our legitimate interest in a working and secure app.
To deliver app updates: Update requests. Basis: performing our contract with you.
To answer your requests and meet legal duties: Your emails to us. Basis: legal obligation and our legitimate interest.

Under Turkish law these correspond to Article 5(2)(c), (ç) and (f) of Law No. 6698 (KVKK); under the GDPR, to Article 6(1)(b), (c) and (f). We do not use your data to make decisions about you by automated means, and we do not use your questions for advertising.

5. Who processes your data

We use the companies below to run the service. Each receives only what it needs for its task.

DigitalOcean, LLC (USA) – hosting: Runs our servers and the database, in its Frankfurt, Germany data centre. Everything we store is stored here: accounts, conversations, installation and usage records, backups and server logs.
DeepInfra, Inc. (USA) – AI provider: Receives the text of each question, twice: once to turn it into a search vector, and once, together with excerpts of the public video transcripts and the app’s language, to write the answer. It does not receive your email address, account or installation identifier.
Qdrant Solutions GmbH (Germany) – vector database (Qdrant Cloud): Holds the transcripts of the public videos. To find the relevant passages it receives the search vector calculated from your question, not the question’s text, and no account data.
Mailtrap (Railsware Products Studio LLC, USA) – email delivery: Sends the sign-in and verification emails. Receives your email address and the content of those emails, including the code.
Sentry (Functional Software, Inc., USA) – crash diagnostics: Receives the crash reports described above.
Expo (650 Industries, Inc., USA) – app updates: Receives the update requests described above.
Cloudflare, Inc. (USA) – delivery of this website: DigitalOcean also hosts this website and uses Cloudflare’s content delivery network to deliver its pages. Cloudflare is not involved in the app.

Apple and Google distribute the app through their stores under their own privacy policies. Source videos open in YouTube or your browser, outside the app. We may disclose data when the law requires it.

6. Transfers abroad

Our servers are in Germany, and several of the companies above are based in the United States. Your data is therefore processed outside Türkiye and, for some providers, outside the European Economic Area. [TRANSFER MECHANISM: to be completed after legal review – KVKK Article 9 and GDPR Chapter V.]

7. How long we keep it

Account (email address, language preference): Until you delete the account.
Conversations: Until you delete the conversation or the account.
Questions asked without an account: Not stored.
Sign-in codes: A code stops working after 3 minutes (sign-in) or 15 minutes (new account).
Sign-in sessions: Until you sign out or delete the account, or 90 days after the app last used the session. Expired sessions are removed daily.
Counters for limiting requests: At most one day, in temporary memory.
Installation records, usage records, daily question counts: [RETENTION PERIOD: none is set today; these are kept indefinitely.] Daily question counts are deleted with the account. Usage records are detached from the account when it is deleted.
Database backups: 7 days.
Server logs: [RETENTION PERIOD: no fixed period today.] Logs are not archived; they are lost when the server process that wrote them is replaced, which happens at every release.
Crash reports (Sentry), email delivery logs (Mailtrap), website access logs (DigitalOcean): [RETENTION PERIODS: to be confirmed from the provider settings.]

8. Deleting your data

You can delete a single conversation in the app’s History, and your whole account under Settings › Account › Delete account. Deleting the account takes effect at once. Delete your account explains what is deleted, what is kept, and how to ask by email if you no longer have the app.

9. Your rights

Under Turkish law (KVKK, Article 11) you have the right to learn whether your personal data is processed; to request information about it; to learn the purpose of the processing and whether the data is used accordingly; to know the third parties, in Türkiye or abroad, to whom it is transferred; to have incomplete or inaccurate data corrected; to have data erased or destroyed under the conditions of Article 7; to have those corrections and erasures notified to third parties who received the data; to object to a result against you that arises from analysis solely by automated systems; and to claim compensation for damage caused by unlawful processing.

If the GDPR applies to you you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable form, and to complain to the data protection authority of your country.

To use any of these rights, write to support@asknorthstar.app from the email address of your account. We answer within 30 days at the latest, free of charge. If you are not satisfied with the answer, you can complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, kvkk.gov.tr).

10. Security

Connections between the app and our servers are encrypted (HTTPS). The database is reachable only from our servers’ private network. Installation tokens are stored as hashes, and there are no passwords to steal. On the phone, tokens are kept in the system’s secure storage. No system is perfectly secure; if you think your account has been misused, write to us.

11. Children

The app is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has created an account, write to us and we will delete it.

12. AI-generated answers; not investment advice

Answers are generated by an AI model as summaries of what public finance videos on YouTube have said. They can be incomplete, out of date or wrong, and they reflect the videos, not our opinion. Nothing in the app is investment advice or a recommendation to buy or sell anything. Check the source videos and other sources before you decide.

Please do not put sensitive personal information in your questions.

13. Changes to this policy

When this policy changes, we publish the new version on this page and change the date at the top. If a change materially affects how your data is used, we will also announce it in the app or by email before it takes effect.

14. Contact

[LEGAL NAME] · support@asknorthstar.app