ApplycasTR
SubNook

SubNook — Privacy Policy

Last updated: 7 October 2026

This policy explains how SubNook handles your data. It is the same as the privacy declarations in the stores (App Privacy on the App Store, Data safety on Google Play).

Data we collect

SubNook collects the following data as a developer:

  • Purchase information
    Purpose: App functionality · Linked to your identity · Not used for tracking
  • Identifiers
    Purpose: App functionality · Linked to your identity · Not used for tracking
  • Identifiers
    Purpose: App functionality · Not linked to your identity · Not used for tracking
  • Diagnostics (crashes, performance)
    Purpose: App functionality, Analytics · Not linked to your identity · Not used for tracking

Your documents

Your documents never go to our servers.

Data stored on your device

SubNook has no accounts. The subscriptions you add, their amounts, currencies, dates, notes, your reminder settings and widget data are stored on your device. We have no access to them.

Screenshots you import and bill e-mails or PDFs you send from the share menu are read on your device; they are not sent to us or anywhere else.

The JSON export file is created on your device and goes only where you save or share it.

If your device's own backup is on (iCloud Backup on iPhone, automatic backup to your Google account on Android), the app's data is included in that system backup like any other app's; it stays in your Apple or Google account and never reaches us.

Cloud backup (SubNook Pro)

With Pro, if you turn on cloud backup, your data is backed up to your own account. On iPhone, to the private iCloud database of your Apple Account; Apple's privacy policy applies. On Android, to the hidden app data folder of your Google Drive; the app asks for the drive.appdata permission, which only lets it see the files it creates there, not your other Drive files. Google's privacy policy applies.

These backups never reach us. You can turn backup off in Settings and delete the cloud copy with “Delete cloud backup”; the data on your device is not deleted. There is no sync between iOS and Android; use JSON export and import to switch.

What we don't do

We never ask for access to your bank account, cards or passwords. No ads, advertising SDKs, usage analytics (such as Firebase Analytics) or tracking, and no advertising identifiers. We don't sell or share your data.

Permissions

Notification permission is asked for reminders and price-rise notifications. Screenshots are picked with the system photo picker; the app only sees the image you choose. On Android, the Google Drive permission is asked only when you turn on cloud backup.

Deleting your data

You can delete subscriptions one by one in the app or all at once with Settings → “Delete all data”, or uninstall the app to delete everything on your device. Delete your cloud backup in Settings → Cloud backup → “Delete cloud backup”. To ask RevenueCat to delete the purchase data linked to your anonymous ID, write to the address below.

Children

SubNook is not directed at children under 13.

Third-party services

SubNook uses the following third-party services:

  • Firebase Remote Config ve Firebase Hosting (Google)
    To download the service catalog (service names, plans, prices, logos) and fallback exchange rates. The request contains none of your subscription data; Firebase uses an app installation identifier for this.
  • Firebase Crashlytics (Google)
    Sends a crash report (stack trace, device model, OS version, an installation identifier) when the app crashes, and an error record with the affected catalog service IDs if the downloaded catalog can't be read. Your subscription data is not included. Firebase Analytics is not used.
  • Frankfurter
    To download daily exchange rates from European Central Bank data; it's a public service and the request contains no personal data. Rates are cached on the device.
  • RevenueCat
    To verify and restore purchases. RevenueCat receives your purchase history, an anonymous user ID created by RevenueCat and basic technical information such as app version, operating system and store country. It is not used for advertising or tracking.
  • Google Drive ve Google Play hizmetleri (Google)
    Used in the Android app only, with Pro and if you turn on cloud backup. You grant the drive.appdata permission with your Google account; a JSON backup of your subscriptions is written to and read from the hidden app data folder of your Drive. The backup never reaches us. On iPhone, the backup goes to Apple's iCloud.
  • Google ML Kit
    Used in the Android app only, to read the text in a screenshot. Text recognition runs on the device and the image is not sent; device/app identifiers and performance and diagnostic metrics are sent to Google. On iOS, text is read with Apple's on-device tools.

Changes

If we change this policy, we will update the date and publish the new text on this page.

Contact

If you have questions about this policy, write to support@applycas.com.

KVKK Notice

Under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”), we inform you about how your personal data is processed. This section is for people located in Türkiye.

Data controller. Oktay Tanrıkulu (Applycas). Address: Bağlar Mah., 46. Sokak No: 22, Flat 8, Bağcılar/Istanbul, Türkiye. Contact: support@applycas.com.

Personal data processed. When you email us: your email address, your name (if you give it), the content of your message and any information you attach. When you visit the website: technical data such as your IP address and browser information in the hosting infrastructure’s server logs. We do not process special categories of personal data.

Purpose of processing. Answering your support requests and messages, fixing problems in the apps, keeping the site running securely and meeting legal obligations.

Legal basis. KVKK Art. 5/2(f) (the controller’s legitimate interests, provided they do not harm your fundamental rights and freedoms) and Art. 5/2(ç) (the controller’s compliance with a legal obligation).

Method of collection. By email, and automatically through the website’s hosting infrastructure.

Transfers. To the extent necessary to provide the service, your personal data is processed by our hosting and email forwarding provider Cloudflare, Inc. (USA) and Google LLC (USA), which hosts our mailbox, and to that extent is transferred abroad. A data processing agreement under KVKK Art. 12 is in place with Cloudflare. Google’s Gmail service is used under Google’s standard terms of service and privacy policy for account holders. As the Personal Data Protection Board has issued no adequacy decision for these countries, the transfer is made under paragraph six of KVKK Art. 9, on an incidental basis and only to the extent strictly necessary for the technical performance of the operation you initiated — delivering the email you sent us and our reply to you, serving the page you asked to view. Your data is not transferred to any other third party and is not sold.

Retention. Correspondence is kept for no more than twenty-four months after your request is resolved, and, where a legal dispute is possible, for the applicable limitation period. It is then deleted or anonymised. Server logs are kept for a short period under the hosting provider’s own retention policy.

Automated decision-making. No profile is built about you and no decision against you is produced by automated analysis.

Your rights. Under Article 11 of the KVKK, you may apply to the data controller to:

  • Learn whether your personal data is processed,
  • Request information if it has been processed,
  • Learn the purpose of processing and whether it is used accordingly,
  • Know the third parties to whom it is transferred, in Türkiye or abroad,
  • Request correction if it is incomplete or inaccurate,
  • Request deletion or destruction under the conditions set out in the law,
  • Request that corrections, deletions and destruction be notified to third parties to whom the data was transferred,
  • Object to a result against you that arises from analysis of the data by automated systems,
  • Request compensation for damage arising from unlawful processing.

How to apply. Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may apply: in writing with a wet signature to the address above; by email to support@applycas.com using a secure electronic signature or mobile signature; or by a message sent to support@applycas.com from an email address you have previously notified to us and which is registered in our system. Your application should state your name and surname, your signature (for written applications), your Turkish ID number (for foreign nationals, your nationality and passport number), your address for service, your email address and phone number if any, and the subject of your request.

Time limit and cost. Your application is concluded free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. If the request requires an additional cost, the fee set out in the Board’s tariff may be charged.

Complaints. If your application is rejected, our reply is insufficient, or we do not reply within thirty days, you may complain to the Personal Data Protection Board within thirty days of learning of our reply and in any event within sixty days of the date of your application.

GDPR Notice

This section explains your rights under the General Data Protection Regulation (GDPR) and the UK GDPR if you are located in the European Economic Area (EEA) or the United Kingdom.

Controller. Oktay Tanrıkulu (Applycas), Bağlar Mah., 46. Sokak No: 22, Flat 8, Bağcılar/Istanbul, Türkiye. Contact: support@applycas.com. Given the scope of our processing, we are not required to appoint a Data Protection Officer.

EU representative. We have no establishment in the EEA. Because the processing described here is occasional, limited in scope and involves no special categories of data, we have not appointed a representative, relying on the exemption in Article 27(2)(a) GDPR. We will reassess this if our processing changes.

Data, purposes and legal bases.

  • Email correspondence (your email address, your name, the content of your message and any attachments) — to answer your support request. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in responding to requests addressed to us; where the request concerns performance of an app contract, Art. 6(1)(b).
  • Server logs (IP address, browser information) — to serve the page you asked for and keep the infrastructure secure. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in keeping the site running and secure.
  • Legal obligations — Legal basis: Art. 6(1)(c) GDPR.

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms; the data processed is minimal and is never used for marketing.

Recipients. Cloudflare, Inc. (hosting and email forwarding) and Google LLC (the Gmail service that hosts our mailbox). Cloudflare acts as our processor under Art. 28 GDPR and process data only on our instructions. Google’s Gmail service is used under Google’s standard terms of service and privacy policy for account holders. There are no other recipients; your data is not sold and not shared for advertising.

International transfers. These providers (including Google) process data in the United States. Transfers rely on the European Commission’s Standard Contractual Clauses included in Cloudflare’s data processing agreement and, where the provider is certified, on the EU–US Data Privacy Framework. You can request a copy of the safeguards in place by writing to support@applycas.com.

Retention. Correspondence is kept for no more than twenty-four months after your request is resolved, and, where a legal dispute is possible, for the applicable limitation period. Server logs are kept for a short period under the hosting provider’s own retention policy.

Your rights. Under Arts. 15–22 GDPR you have the right to access your data, to have it rectified, to have it erased, to restrict its processing, to receive it in a portable format, and to object at any time to processing based on legitimate interests. Our processing is not based on consent, so there is no consent to withdraw.

Automated decision-making. We carry out no decision-making based solely on automated processing, and no profiling, within the meaning of Art. 22 GDPR.

Do you have to provide data? You need to provide nothing to browse the site. The information you share when emailing us is used only so that we can reply; without it we may not be able to answer your request.

Right to complain. You may lodge a complaint with the data protection authority of your EEA member state. In the United Kingdom the competent authority is the Information Commissioner’s Office (ico.org.uk). If you contact us first, we will do our best to resolve the matter.