Privacy Policy

Last updated: October 2026

Boha Reminder is made by Boha Software. This policy explains what the app collects, why it collects it, who else touches it, and what you can do about it. It's written to be read, not filed away.

1. Who we are

• Company: Boha Software
• Address: Aksoy Mah. 1748 Sk. No: 35/1, Ulaş Apt. D:10, Karşıyaka / İzmir, Turkey
• Service: Boha Reminder: the iOS app, the Android app and the web interface at boha.pro
• Contact: reminder@boha.pro

We're the data controller for everything described below.

2. The short version

• We collect what the app needs to work: your account, the records you create, and the documents you choose to upload.
• There are no ads, no advertising identifiers and no profiling. The website counts page views with a cookieless tool that can't identify you; the apps send nothing but crash reports, which carry no name, e-mail address or account id.
• We don't track your location, and we never see your card details.
• We don't sell your data and we don't share it for marketing.
• You can delete your account from inside the app, and your data goes with it.

3. What we collect, and why

Account details

Your name, e-mail address and password (the password is stored only as a hash, so we can't read it), plus the language your account is set to and the date you joined. We need these to create your account, sign you in, and write to you about the service. If you sign in with Google or Apple, we also store the stable user id that provider gives us so we can recognise you next time.

Optional profile details

Your phone number, address, city and district, a profile photo, and a Turkish ID number (T.C. Kimlik No). Every one of these is optional and empty unless you fill it in. We don't require them, we don't verify them against anything, and we don't share them; they're there for your own records. You can clear any of them at any time.

The records you create

Your vehicles, properties, tasks and notes, with everything you enter on them: names, license plates, model years, mileage, utility subscriber numbers, expiry dates, amounts you've spent, service history and free-text notes. This is the content of the service; without it there's nothing to remind you about. If you keep track of a relative's affairs and enter their details, please make sure you're entitled to share them.

Documents and photos you upload

You can attach a document or a photo to a record: an insurance policy, an inspection report, a receipt, a picture of the car. Files are stored privately for your account, outside the public web root, and can be opened only by your signed-in account or through signed links that expire after five minutes. The app asks for camera or photo library access at the moment you attach something, and nothing leaves your device unless you pick it.

Connected mailboxes

On the web app you can connect your own mailbox to read your mail, reply to it and turn a message into a task. It's optional (nothing here applies unless you connect one) and it isn't part of the mobile apps. We store the server address, port, encryption method and user name, and your password encrypted: it is never shown back to you, never returned by our API, never written to a log and never visible in our admin panel. We index folder names and message headers only (sender, recipients, subject, date, size, read and flag state, and the name, type and size of attachments) for the last 12 months and at most 3,000 messages. Message bodies and attachments are not stored. A body is fetched from your own server when you open it and held in a temporary cache for 45 minutes, then dropped; an attachment is passed through at the moment you download it. Mail you send goes out through your own SMTP server, under your own identity, and is never kept on ours.

Your mail provider (Google, Yandex, Microsoft, your company's own server) remains a separate data controller for the mailbox itself, under its own privacy policy; we connect to it on your behalf with the credentials you give us, and we recommend an app password where your provider offers one. What you do in the app happens in your real mailbox: marking a message read, flagging it or deleting it does the same thing there. None of your mail is shared with anyone, used for advertising or profiling, or used to train any model.

The weather card on the web

The Overview page of the web app shows a 7-day forecast for a province. If your profile has a city, the card uses it. If it doesn't, your browser may ask whether boha.pro can use your location; if you allow it, your location is used only inside your browser to pick the nearest province. It is never sent to us or to the weather provider, and we don't store it. If you don't allow it, the card shows Istanbul. You can turn the card off at any time with the Weather switch in Settings.

The forecast is loaded from weatherwidget.io. It receives only the province the card shows, plus what any website you open receives: your IP address and basic browser information. It gets no name, e-mail address or account details, and it sets no cookies. The card's font and script library are loaded from Google's servers, which see the same technical information.

Device and notification data

When you sign in on a phone or tablet, we store a push notification token for that device together with its platform, device type, brand, model, operating system version and app version. That's what lets us send a reminder to the right device and show you the "My Devices" list. Signing a device out removes its token and stops its notifications.

Security and technical data

We record the IP address and the browser or device description behind security-relevant events (password changes and resets, linking or unlinking a Google or Apple account) and behind changes to your profile details. We also store the date you were last active and the IP address of that visit. This is what lets you, and us, answer "was that me?" after the fact.

Crash reports

If the iOS or Android app crashes or runs into an error, it sends a crash report through Firebase Crashlytics so we can find and fix the problem. A report holds the technical detail of the error (the message and the line of code where it happened), the device model, operating system version and app version, device state such as free memory and disk space, and a random identifier for that installation of the app. We don't add your name, e-mail address, account id or the content of your records. Reports are kept for 90 days and then deleted.

Subscription data

If you buy a paid plan we store which store it came from, which product it was, the purchase token the store issued, its status and its renewal dates. We never receive your card number, and no payment details ever reach our servers; see section 6.

Messages you send us

Feedback and contact-form messages are kept with your account so we can answer them and see what needs fixing.

4. What we don't collect

• No location in the apps. The iOS and Android apps never ask for or read your location, in the foreground or the background. On the web, the weather card may ask your browser for it and keeps it inside your browser; see section 3.
• No advertising. There's no ad SDK, no advertising identifier (IDFA or AAID), no ad network, no retargeting and no profiling.
• No tracking, and no analytics in the apps. The iOS and Android apps contain no analytics SDK of any kind; the only diagnostic they send is the crash report described in section 3. The website uses Cloudflare Web Analytics, which counts page views without cookies and without any identifier that could follow you between visits or across sites; see section 6. Nothing anywhere builds a profile of you.
• No contacts, calendar, microphone or health data. Camera and photo library access is used only for the file you're attaching, at the moment you attach it.
• No card or bank details. Payments happen entirely inside Google Play and the App Store.
• No selling or brokering. We don't sell personal data and we don't pass it to data brokers.

5. Our legal basis for using your data

We process personal data under Turkey's Personal Data Protection Law no. 6698 (KVKK) and, for users in the EEA and the UK, the GDPR. Depending on the data, our basis is one of these:

• Performing our contract with you: your account, your records, your reminders, your subscription.
• Our legitimate interests: keeping accounts secure, preventing abuse and fraud, and keeping the service running.
• A legal obligation: where the law requires us to keep something or to answer a competent authority.
• Your consent: for camera, photo library and notification permissions, which you can withdraw at any time in your device settings.

6. Third parties we rely on

We keep this list short on purpose. Each of these providers processes data on our instructions, only for the purpose named:

• Google: Firebase Cloud Messaging. Delivers push notifications. It receives the device token and the notification itself, which is why our notifications say only that something is due, never the details.
• Google: Firebase App Check. Confirms that a request really comes from a genuine copy of our app rather than a script.
• Google: Firebase Crashlytics. Receives the crash reports described in section 3 so we can see what went wrong. It gets no name, e-mail address or account id.
• Google Sign-In and Sign in with Apple. Used only if you choose to sign in that way. We receive a stable user id, your e-mail address and your display name. We get no other access to those accounts.
• Google Play Billing and the Apple App Store. Handle every purchase, renewal and refund. They tell us a subscription is valid; they never send us payment details.
• Cloudflare. Sits in front of boha.pro as our content delivery network and firewall, and does three things for us. It runs the Turnstile check on the web sign-in, sign-up and password-reset pages, which sees your IP address and basic browser signals to tell a person from a bot. It detects automated traffic on the other pages the same way. And it runs Cloudflare Web Analytics, which tells us how many people opened a page and how fast it loaded. That last one sets no cookie and stores nothing on your device; it can't recognise you on a second visit or on any other site, and it produces counts, not profiles. None of this is advertising, and none of it is shared with anyone else.
• weatherwidget.io. Shows the forecast in the weather card on the web app. Like any website, it sees your IP address and basic browser information, and it learns the province the card shows; nothing else. See section 3.

7. Where your data is kept

Your account, your records and your uploaded files are stored on servers we operate ourselves, in Turkey. No other third party has access to those servers, and our e-mail is sent from them too. Some of the providers above operate globally, so sending a push notification, verifying a sign-in or confirming a purchase may involve processing outside Turkey and outside the EEA. Those transfers are limited to what the feature needs, and are made under the safeguards the applicable law requires.

8. How long we keep it

• Your account and your records: for as long as your account is open.
• A vehicle or property you delete: hidden from your lists immediately and erased for good 90 days later, so a mistake can be undone.
• A task or a note you delete: erased immediately.
• Uploaded documents: until you remove them, or until you delete the record they belong to.
• Security events: kept for the life of the account, because a security history is only useful if it goes back far enough.
• A mailbox you connect: its settings and message index stay until you disconnect it or delete your account, and go the moment you do. Bodies only ever live in a 45-minute cache; files attached to a mail you haven't sent yet are cleared after 24 hours.
• If your plan stops covering mail: the message index is deleted at once, and the connection settings wait 30 days in case you upgrade before they go too.
• Crash reports: 90 days in Firebase Crashlytics, then deleted.
• After you delete your account: everything above is erased, your uploaded files included. We keep one audit row holding the e-mail address, the IP address the request came from, the date and the reason. It is the record that the deletion happened; we keep it for 10 years and erase it after that.
• Long-unused free accounts: if an account on the Free plan isn't used for 90 days (no sign-in, and neither the app nor the web app is opened with a signed-in session), we e-mail you and the account becomes inactive. To sign in with your password again, first reset it with Forgot Password, or sign in with Google or Apple if you've linked one; either step reactivates the account. A second e-mail warns you seven days before deletion. If the account still isn't used, it's permanently deleted with all its records and uploaded files on day 120 at the earliest, and never sooner than 30 days after the first e-mail. Accounts on a paid plan are never deleted this way. These deletions leave the same audit row for 10 years; instead of a request IP address it records the date the account was last used and the dates of both e-mails.

9. How we protect it

• Passwords are stored as hashes, never in a readable form.
• All traffic between your device and our servers is encrypted with TLS.
• Uploaded documents sit outside the public web root and are reachable only by your signed-in account or through signed links that expire after five minutes.
• Every signed-in device has its own token, and signing that device out revokes it.
• Sign-in, sign-up and password-reset are protected against automated attacks.
• Access to production data is limited to the people who need it to run the service.

No system is perfectly secure, but if a breach ever affects your personal data we'll tell you and the competent authority as the law requires.

10. Your rights

Under KVKK article 11 and, where it applies, the GDPR, you can ask us whether we hold data about you, ask for a copy, have it corrected or deleted, object to how we use it, and complain to a regulator. In practice:

• See and correct it: most of it is already in the app, under My Profile.
• Delete it: My Profile, then Delete My Account. You confirm with a one-time code we e-mail you (older versions of the mobile app ask for your password instead), and the deletion is immediate and permanent.
• Get a copy: write to reminder@boha.pro and we'll send you your data in a machine-readable file.
• Ask us anything else: reminder@boha.pro. We answer within 30 days.

11. Children

Boha Reminder isn't designed for or directed at children, and we don't knowingly collect personal data from anyone under 13. If you're under 18, use the app with a parent's or guardian's knowledge. If you believe a child has given us personal data, write to reminder@boha.pro and we'll remove it.

12. Changes to this policy

We'll update the date at the top whenever this policy changes. If a change materially affects how we use your data, we'll tell you in the app or by e-mail before it takes effect. Continuing to use Boha Reminder after that means you accept the updated policy.

13. Contact

Questions, requests or complaints about this policy: reminder@boha.pro

Terms of Use

Last updated: October 2026

These terms are the agreement between you and Boha Software (Karşıyaka / İzmir, Turkey) for the use of Boha Reminder. By creating an account or using the app you accept them. If you don't accept them, please don't use the service.

1. What Boha Reminder is

Boha Reminder is a personal organizer for the paperwork that comes with owning a home, a car or a boat in Turkey. You enter your own dates (insurance renewals, inspections, taxes, utility subscriptions, tasks and notes) and the app reminds you before they fall due, by push notification and e-mail. It's available as an iOS app, an Android app and a web interface at boha.pro.

2. What Boha Reminder is not

It's a convenience, not an authority. Boha Reminder reminds you of the dates you enter. It doesn't check them against any official register, it isn't connected to any government agency, insurer, municipality or bank, and it doesn't file, pay or renew anything on your behalf.

Keeping track of your official deadlines remains your responsibility. A reminder can fail to reach you for reasons neither of us controls: the date you typed may be wrong, your phone may silence the notification, an e-mail may land in spam, a device may be offline, or the service may be down. We're not liable for a missed deadline, a fine, a penalty or a lapsed policy. Treat the app as a helpful second pair of eyes, never as your only record.

It isn't a mail provider. If you connect your own mailbox, mail is sent through your provider's server under your own identity. Delivery, delays, spam filtering and any limit your provider applies are outside our control, and your provider's own terms keep applying to the mailbox.

Nothing in the app is legal, tax, insurance or financial advice.

3. Your account

• You need an account to use the app. Keep the details you give us accurate and up to date.
• Keep your password to yourself. Everything done through your account is your responsibility, so tell us at reminder@boha.pro straight away if you think someone else has got in.
• One account is for one person. Don't share it, and don't use anyone else's.
• There's no minimum age, but if you're under 18 you should use the app with a parent's or guardian's knowledge.

4. Plans, subscriptions and payment

• Boha Reminder has a free plan and paid plans with higher limits. What each plan includes is shown in the app.
• Every paid plan is bought and paid for through Google Play or the Apple App Store. We don't sell subscriptions ourselves and we never see or handle your payment details.
• Subscriptions renew automatically unless you turn renewal off. The price, the currency and the billing period are the ones the store shows you at the moment of purchase.
• To manage a subscription, change it or switch off automatic renewal, use your account settings in the store you bought it from. Cancelling stops the next renewal; you keep your plan until the end of the period you've already paid for.
• We may change plan contents and prices. We'll announce a change in the app first, and it takes effect for you from your next renewal.

5. Cancellation and refunds

Refunds are handled by the store you bought from, under that store's own rules, and the decision is the store's. We don't run a separate refund process alongside them. If a subscription ends, lapses or is refunded, your account returns to the free plan; your existing records aren't deleted.

If you're a consumer in a country whose law gives you a statutory right of withdrawal, that right applies through the store where you made the purchase.

6. Your content

Everything you put into Boha Reminder (records, documents, photos, notes) stays yours. You give us only the permission we need to run the service: to store your content, back it up and show it back to you on your devices. We don't use it for anything else, we don't use it to train anything, and we don't share it. You're responsible for having the right to upload what you upload.

7. Acceptable use

Use Boha Reminder lawfully and for your own affairs. In particular, don't:

• upload content that's unlawful, or someone else's documents without their consent;
• try to break into, overload, disrupt, scrape or reverse-engineer the service;
• use the service to store or distribute malware;
• resell the service or pass off access to it as your own product.
• connect a mailbox you don't own and aren't authorised to use;
• send bulk, unsolicited or marketing mail through a connected mailbox; sending is capped at 50 messages an hour, and your provider's rules apply on top of ours.

8. Intellectual property

The service itself (its software, design, text, logos and graphics) belongs to Boha Software. You may use it as our customer; you may not copy, adapt or redistribute it without our written permission.

9. Availability and changes

We work to keep Boha Reminder available and correct, but we provide it "as is" and can't guarantee it will always be uninterrupted, timely or error-free. Maintenance, outages, network problems and changes at the app stores can all interrupt it. We may add, change or withdraw features, and we'll give reasonable notice where a change materially affects how you use the service.

10. Limitation of liability

To the extent the law allows, we're not liable for indirect or consequential loss, for lost profits or lost business, or for missed deadlines, fines, penalties or lapsed cover of the kind described in section 2. Our total liability arising out of the service is limited to the amount you paid for it in the twelve months before the claim.

Nothing in these terms limits liability that can't be limited by law, including liability for death or personal injury, for fraud, or for our own gross negligence or wilful misconduct. If you're a consumer, your mandatory statutory rights aren't affected.

11. Suspension and termination

You can stop using Boha Reminder at any time, and you can delete your account from inside the app.

We may suspend or close an account that breaches these terms, that's being used unlawfully, or where the law requires it. Where we can, we'll tell you why first and give you the chance to put it right. If an account on the Free plan isn't used for 90 days we e-mail you and make it inactive; if it still isn't used after the warning e-mails, it's permanently deleted with all its records on day 120 at the earliest, and never sooner than 30 days after the first e-mail (the Privacy Policy has the details). Accounts on a paid plan are never deleted this way. When an account is closed, any unused part of a paid period is dealt with under the store's refund rules.

12. Changes to these terms

We may update these terms as the service develops or the law changes. We'll update the date at the top and, for a material change, tell you in the app or by e-mail before it takes effect. If you keep using Boha Reminder afterwards, the updated terms apply.

13. Governing law

These terms are governed by the law of the Republic of Turkey, and the courts and enforcement offices of İzmir, Turkey have jurisdiction. If you're a consumer, this doesn't take away the protection of the mandatory consumer law of the country you live in, or your right to bring a claim before your local consumer arbitration committee or court.

14. Contact

reminder@boha.pro

Cookie Policy

Last updated: October 2026

This policy explains what Boha Reminder stores in your browser, and why. The short answer: a few small things that keep you signed in and remember how you like the app, plus the security check on the sign-in pages. Nothing for advertising, and nothing that follows you anywhere.

1. What this covers

Cookies and similar storage only apply to the web interface at boha.pro. The iOS and Android apps don't use cookies; they keep your sign-in token and your settings in the app's own private storage on the device, which only Boha Reminder can read and which is removed when you uninstall the app.

A cookie is a small file a site saves through your browser. Browsers also offer two similar stores, local storage and session storage. They aren't technically cookies, but they do the same job, so we list everything we use here rather than hiding behind the word.

2. What we store

This is the complete list. There is nothing else.

The one cookie we set

• boha_theme: remembers whether you chose the light or the dark theme, so the page doesn't flash the wrong one while it loads. It holds a single word, light or dark. It lasts a year, it's sent only to boha.pro and its subdomains, and it contains nothing that identifies you.

What we keep in your browser's local storage

• auth_token: the token that keeps you signed in. Without it you'd have to sign in again on every page.
• user: your name, e-mail and plan, so the page can draw itself before the server answers. It's a copy of what you already gave us.
• dil: whether you chose Turkish or English on this device.
• hava_durumu: whether you keep the weather card on the Overview page switched on or off.
• doviz_kurlari: whether you keep the exchange rates card on the Overview page switched on or off.
• ekran_koruyucu: whether the screen saver, which dims the screen after five minutes without activity, is on or off.
• yanmenu_dar: whether you collapsed the side menu.

What we keep for the length of the tab

• senkron_damga: a counter that tells the page whether one of your other devices has changed something, so the list you're looking at can refresh itself.
• surum: the app version shown at the foot of the page, so it isn't asked of the server on every page.
• hitap_ertelendi: that you chose "Later" on the "How should we address you?" window, so it doesn't open again in the same tab.
• paket_yenileme: the moment the page reloaded itself once after a new version of the app went live, so it doesn't reload over and over.

Everything in this group is cleared when you close the tab.

All of these are either strictly necessary for the service to work or a preference you set yourself. None of them is used to profile you, and none of them is shared with anyone.

3. Cloudflare Turnstile

The sign-in, sign-up and password-reset pages run Cloudflare Turnstile, a check that tells a person from an automated script. It protects your account from someone guessing passwords at scale, and it protects the service from abuse. It's strictly necessary: if you block it, you won't be able to sign in.

It's provided by Cloudflare, which may place its own strictly necessary security storage while the check runs. Cloudflare explains what it does with that at cloudflare.com/privacypolicy.

4. Cloudflare Web Analytics

We'd like to know how many people open a page and how quickly it loads, so we use Cloudflare Web Analytics on the website. It's the one measurement tool we run, and it works differently from the usual ones:

• It sets no cookie and writes nothing to your browser's storage. Nothing of it survives after you close the page.
• It gives you no identifier: no visitor ID, no fingerprint. It can't tell whether you've been here before, and it can't recognise you on any other website.
• What it reports is a count: how many times a page was opened, roughly where in the world from, and how long it took to load. Not a profile, and not a person.
• Cloudflare runs it for us, on our instructions. The measurements aren't sold, shared or used for advertising.

Cloudflare also checks the other pages for automated traffic the same way it checks the sign-in pages, as part of protecting the service.

The mobile apps don't do any of this. There is no analytics of any kind in the iOS and Android apps.

5. The weather card

The forecast in the weather card on the web app's Overview page is loaded from weatherwidget.io. It sets no cookie and writes nothing to your browser's storage. Whether the card is on or off is kept in hava_durumu above. Section 3 of our Privacy Policy explains what the card receives.

6. What we don't use

We want to be specific, because "we value your privacy" is easy to write and hard to check:

• No Google Analytics, and no analytics at all in the apps. There is no Google Analytics and no Firebase Analytics anywhere, and the iOS and Android apps measure nothing. The website counts page views with Cloudflare Web Analytics, described above, cookieless, and unable to tell one visit from another.
• No advertising. No ad networks, no advertising identifiers, no retargeting pixels, no social media trackers.
• No profiling and no selling. We don't build a profile of you and we don't sell or rent anything to anyone.

Because none of the storage listed above is used for advertising or measurement, there's no consent banner to click through; there's nothing to consent to beyond what the service needs to run.

7. Managing it yourself

Every browser lets you see and delete cookies and site storage, usually under Settings → Privacy. You can clear ours at any time.

Two things worth knowing before you do: clearing the storage for boha.pro signs you out, because that's where the sign-in token lives, and blocking Cloudflare means the sign-in page can't finish its security check. Your data itself isn't affected; it lives on our servers, not in your browser, and it's all still there when you sign back in.

8. Changes and questions

If we ever add something to this list, we'll update this page and the date at the top before it goes live. For the fuller picture of what we collect and why, see our Privacy Policy. Anything else, write to reminder@boha.pro and a person will answer.