Privacy Policy
This policy covers useanomaly.com, the anomalY web app and the anomalY apps for iPhone and iPad. anomalY is the data controller. You can reach us at hello@useanomaly.com. A notice under Turkish data protection law is on the KVKK page.
What we keep
When you sign in with Apple or Google, we receive and store these items:
- your email address (Apple can give us a private relay address instead of your real one),
- your name, as the provider gives it,
- the address of your profile picture, if the provider gives one,
- your account number at the provider, so we recognise you next time.
We also keep a session record for each device where you are signed in. For Apple accounts we keep Apple's refresh token, encrypted, so we can remove the link to anomalY when you delete your account. To limit abuse of sign-in, we keep a hashed key made from your IP address for up to 24 hours. We do not store your IP address or your browser details with a session.
What we do not keep
We do not ask for your portfolio, your bank or broker details, or your identity number. We do not use analytics or advertising trackers. Your lists and price alarms stay on your device and are not sent to us. If we add a way to sync them to your account, we will update this policy before it starts.
Why we keep it
We use your data to sign you in, to show who is signed in, to give you a copy of your data when you ask, and to protect the service from abuse. We do not sell your data and we do not use it for advertising.
The legal grounds are the performance of our agreement with you (your account), our legitimate interest in keeping the service secure, and legal obligations that apply to us.
Who processes it for us
- Cloudflare hosts the website, the app and the database, and delivers every request.
- Google confirms your identity when you sign in with Google.
- Apple confirms your identity when you sign in with Apple.
These companies process data in other countries, including the United States, under their own data processing terms. To deliver each page, Cloudflare processes your IP address and the details of the request; we do not store them.
How long we keep it
We keep your account until you delete it. A session ends after 7 days without use. The hashed sign-in key is removed after 24 hours. When you delete your account, we remove your profile and sessions at once. Database backups keep a copy for up to 30 days, then it is gone.
Your rights
You can find out whether we process your data, see it, get a copy, have it corrected or deleted, object to processing, and ask who received it. In the account menu, choose Download my data or Delete account, or write to hello@useanomaly.com. We answer within 30 days.
You can also complain to the Personal Data Protection Authority of Türkiye (kvkk.gov.tr) or, if you live in the European Economic Area, to your local data protection authority.
Sign in with Apple and a hidden email
If you hide your email, Apple gives us a private relay address that ends in privaterelay.appleid.com. We store that address. Mail sent to it reaches you only if you allow it in your Apple ID settings. When you delete your account, we also remove the link to anomalY at Apple.
Children
The service is for people aged 18 and over. If we learn that an account belongs to someone younger, we delete it.
Browser storage
The app keeps your sign-in token and your settings in your browser's local storage. The storage page lists what it keeps.
Changes to this policy
We update this policy when what we keep or how we use it changes. The date at the top shows the current version.
Contact
Questions about this policy or your data: hello@useanomaly.com.