Privacy Policy

Last updated: October 2026

Boha Reminder is made by Boha Software. This policy explains what the app collects, why it collects it, who else touches it, and what you can do about it. It's written to be read, not filed away.

1. Who we are

• Company: Boha Software
• Address: Aksoy Mah. 1748 Sk. No: 35/1, Ulaş Apt. D:10, Karşıyaka / İzmir, Turkey
• Service: Boha Reminder: the iOS app, the Android app and the web interface at boha.pro
• Contact: reminder@boha.pro

We're the data controller for everything described below.

2. The short version

• We collect what the app needs to work: your account, the records you create, and the documents you choose to upload.
• There are no ads, no advertising identifiers and no profiling. The website counts page views with a cookieless tool that can't identify you; the apps send nothing but crash reports, which carry no name, e-mail address or account id.
• We don't track your location, and we never see your card details.
• We don't sell your data and we don't share it for marketing.
• You can delete your account from inside the app, and your data goes with it.

3. What we collect, and why

Account details

Your name, e-mail address and password (the password is stored only as a hash, so we can't read it), plus the language your account is set to and the date you joined. We need these to create your account, sign you in, and write to you about the service. If you sign in with Google or Apple, we also store the stable user id that provider gives us so we can recognise you next time.

Optional profile details

Your phone number, address, city and district, a profile photo, and a Turkish ID number (T.C. Kimlik No). Every one of these is optional and empty unless you fill it in. We don't require them, we don't verify them against anything, and we don't share them; they're there for your own records. You can clear any of them at any time.

The records you create

Your vehicles, properties, tasks and notes, with everything you enter on them: names, license plates, model years, mileage, utility subscriber numbers, expiry dates, amounts you've spent, service history and free-text notes. This is the content of the service; without it there's nothing to remind you about. If you keep track of a relative's affairs and enter their details, please make sure you're entitled to share them.

Documents and photos you upload

You can attach a document or a photo to a record: an insurance policy, an inspection report, a receipt, a picture of the car. Files are stored privately for your account, outside the public web root, and can be opened only by your signed-in account or through signed links that expire after five minutes. The app asks for camera or photo library access at the moment you attach something, and nothing leaves your device unless you pick it.

Connected mailboxes

On the web app you can connect your own mailbox to read your mail, reply to it and turn a message into a task. It's optional (nothing here applies unless you connect one) and it isn't part of the mobile apps. We store the server address, port, encryption method and user name, and your password encrypted: it is never shown back to you, never returned by our API, never written to a log and never visible in our admin panel. We index folder names and message headers only (sender, recipients, subject, date, size, read and flag state, and the name, type and size of attachments) for the last 12 months and at most 3,000 messages. Message bodies and attachments are not stored. A body is fetched from your own server when you open it and held in a temporary cache for 45 minutes, then dropped; an attachment is passed through at the moment you download it. Mail you send goes out through your own SMTP server, under your own identity, and is never kept on ours.

Your mail provider (Google, Yandex, Microsoft, your company's own server) remains a separate data controller for the mailbox itself, under its own privacy policy; we connect to it on your behalf with the credentials you give us, and we recommend an app password where your provider offers one. What you do in the app happens in your real mailbox: marking a message read, flagging it or deleting it does the same thing there. None of your mail is shared with anyone, used for advertising or profiling, or used to train any model.

The weather card on the web

The Overview page of the web app shows a 7-day forecast for a province. If your profile has a city, the card uses it. If it doesn't, your browser may ask whether boha.pro can use your location; if you allow it, your location is used only inside your browser to pick the nearest province. It is never sent to us or to the weather provider, and we don't store it. If you don't allow it, the card shows Istanbul. You can turn the card off at any time with the Weather switch in Settings.

The forecast is loaded from weatherwidget.io. It receives only the province the card shows, plus what any website you open receives: your IP address and basic browser information. It gets no name, e-mail address or account details, and it sets no cookies. The card's font and script library are loaded from Google's servers, which see the same technical information.

Device and notification data

When you sign in on a phone or tablet, we store a push notification token for that device together with its platform, device type, brand, model, operating system version and app version. That's what lets us send a reminder to the right device and show you the "My Devices" list. Signing a device out removes its token and stops its notifications.

Security and technical data

We record the IP address and the browser or device description behind security-relevant events (password changes and resets, linking or unlinking a Google or Apple account) and behind changes to your profile details. We also store the date you were last active and the IP address of that visit. This is what lets you, and us, answer "was that me?" after the fact.

Crash reports

If the iOS or Android app crashes or runs into an error, it sends a crash report through Firebase Crashlytics so we can find and fix the problem. A report holds the technical detail of the error (the message and the line of code where it happened), the device model, operating system version and app version, device state such as free memory and disk space, and a random identifier for that installation of the app. We don't add your name, e-mail address, account id or the content of your records. Reports are kept for 90 days and then deleted.

Subscription data

If you buy a paid plan we store which store it came from, which product it was, the purchase token the store issued, its status and its renewal dates. We never receive your card number, and no payment details ever reach our servers; see section 6.

Messages you send us

Feedback and contact-form messages are kept with your account so we can answer them and see what needs fixing.

4. What we don't collect

• No location in the apps. The iOS and Android apps never ask for or read your location, in the foreground or the background. On the web, the weather card may ask your browser for it and keeps it inside your browser; see section 3.
• No advertising. There's no ad SDK, no advertising identifier (IDFA or AAID), no ad network, no retargeting and no profiling.
• No tracking, and no analytics in the apps. The iOS and Android apps contain no analytics SDK of any kind; the only diagnostic they send is the crash report described in section 3. The website uses Cloudflare Web Analytics, which counts page views without cookies and without any identifier that could follow you between visits or across sites; see section 6. Nothing anywhere builds a profile of you.
• No contacts, calendar, microphone or health data. Camera and photo library access is used only for the file you're attaching, at the moment you attach it.
• No card or bank details. Payments happen entirely inside Google Play and the App Store.
• No selling or brokering. We don't sell personal data and we don't pass it to data brokers.

5. Our legal basis for using your data

We process personal data under Turkey's Personal Data Protection Law no. 6698 (KVKK) and, for users in the EEA and the UK, the GDPR. Depending on the data, our basis is one of these:

• Performing our contract with you: your account, your records, your reminders, your subscription.
• Our legitimate interests: keeping accounts secure, preventing abuse and fraud, and keeping the service running.
• A legal obligation: where the law requires us to keep something or to answer a competent authority.
• Your consent: for camera, photo library and notification permissions, which you can withdraw at any time in your device settings.

6. Third parties we rely on

We keep this list short on purpose. Each of these providers processes data on our instructions, only for the purpose named:

• Google: Firebase Cloud Messaging. Delivers push notifications. It receives the device token and the notification itself, which is why our notifications say only that something is due, never the details.
• Google: Firebase App Check. Confirms that a request really comes from a genuine copy of our app rather than a script.
• Google: Firebase Crashlytics. Receives the crash reports described in section 3 so we can see what went wrong. It gets no name, e-mail address or account id.
• Google Sign-In and Sign in with Apple. Used only if you choose to sign in that way. We receive a stable user id, your e-mail address and your display name. We get no other access to those accounts.
• Google Play Billing and the Apple App Store. Handle every purchase, renewal and refund. They tell us a subscription is valid; they never send us payment details.
• Cloudflare. Sits in front of boha.pro as our content delivery network and firewall, and does three things for us. It runs the Turnstile check on the web sign-in, sign-up and password-reset pages, which sees your IP address and basic browser signals to tell a person from a bot. It detects automated traffic on the other pages the same way. And it runs Cloudflare Web Analytics, which tells us how many people opened a page and how fast it loaded. That last one sets no cookie and stores nothing on your device; it can't recognise you on a second visit or on any other site, and it produces counts, not profiles. None of this is advertising, and none of it is shared with anyone else.
• weatherwidget.io. Shows the forecast in the weather card on the web app. Like any website, it sees your IP address and basic browser information, and it learns the province the card shows; nothing else. See section 3.

7. Where your data is kept

Your account, your records and your uploaded files are stored on servers we operate ourselves, in Turkey. No other third party has access to those servers, and our e-mail is sent from them too. Some of the providers above operate globally, so sending a push notification, verifying a sign-in or confirming a purchase may involve processing outside Turkey and outside the EEA. Those transfers are limited to what the feature needs, and are made under the safeguards the applicable law requires.

8. How long we keep it

• Your account and your records: for as long as your account is open.
• A vehicle or property you delete: hidden from your lists immediately and erased for good 90 days later, so a mistake can be undone.
• A task or a note you delete: erased immediately.
• Uploaded documents: until you remove them, or until you delete the record they belong to.
• Security events: kept for the life of the account, because a security history is only useful if it goes back far enough.
• A mailbox you connect: its settings and message index stay until you disconnect it or delete your account, and go the moment you do. Bodies only ever live in a 45-minute cache; files attached to a mail you haven't sent yet are cleared after 24 hours.
• If your plan stops covering mail: the message index is deleted at once, and the connection settings wait 30 days in case you upgrade before they go too.
• Crash reports: 90 days in Firebase Crashlytics, then deleted.
• After you delete your account: everything above is erased, your uploaded files included. We keep one audit row holding the e-mail address, the IP address the request came from, the date and the reason. It is the record that the deletion happened; we keep it for 10 years and erase it after that.
• Long-unused free accounts: if an account on the Free plan isn't used for 90 days (no sign-in, and neither the app nor the web app is opened with a signed-in session), we e-mail you and the account becomes inactive. To sign in with your password again, first reset it with Forgot Password, or sign in with Google or Apple if you've linked one; either step reactivates the account. A second e-mail warns you seven days before deletion. If the account still isn't used, it's permanently deleted with all its records and uploaded files on day 120 at the earliest, and never sooner than 30 days after the first e-mail. Accounts on a paid plan are never deleted this way. These deletions leave the same audit row for 10 years; instead of a request IP address it records the date the account was last used and the dates of both e-mails.

9. How we protect it

• Passwords are stored as hashes, never in a readable form.
• All traffic between your device and our servers is encrypted with TLS.
• Uploaded documents sit outside the public web root and are reachable only by your signed-in account or through signed links that expire after five minutes.
• Every signed-in device has its own token, and signing that device out revokes it.
• Sign-in, sign-up and password-reset are protected against automated attacks.
• Access to production data is limited to the people who need it to run the service.

No system is perfectly secure, but if a breach ever affects your personal data we'll tell you and the competent authority as the law requires.

10. Your rights

Under KVKK article 11 and, where it applies, the GDPR, you can ask us whether we hold data about you, ask for a copy, have it corrected or deleted, object to how we use it, and complain to a regulator. In practice:

• See and correct it: most of it is already in the app, under My Profile.
• Delete it: My Profile, then Delete My Account. You confirm with a one-time code we e-mail you (older versions of the mobile app ask for your password instead), and the deletion is immediate and permanent.
• Get a copy: write to reminder@boha.pro and we'll send you your data in a machine-readable file.
• Ask us anything else: reminder@boha.pro. We answer within 30 days.

11. Children

Boha Reminder isn't designed for or directed at children, and we don't knowingly collect personal data from anyone under 13. If you're under 18, use the app with a parent's or guardian's knowledge. If you believe a child has given us personal data, write to reminder@boha.pro and we'll remove it.

12. Changes to this policy

We'll update the date at the top whenever this policy changes. If a change materially affects how we use your data, we'll tell you in the app or by e-mail before it takes effect. Continuing to use Boha Reminder after that means you accept the updated policy.

13. Contact

Questions, requests or complaints about this policy: reminder@boha.pro