TREN
Let's talk
← Home

Privacy Policy of CripRem

Last updated: 25 October 2026

CripRem helps you record the crypto trades you make on exchanges, follow your portfolio's profit and loss, and get price and profit/loss alerts. This policy explains which personal data we process when you use the CripRem apps for iOS and Android (the "Service"), why we process it, who we share it with, and what rights you have.

At a glance

  • We never touch your exchange account. We don't ask for exchange API keys or passwords, and we can't see or move your funds. Your portfolio is built only from the trades you enter yourself.
  • We only process what the Service needs: your sign-in details, the trades and alerts you create, and the technical data needed to deliver notifications and manage subscriptions.
  • No ads, no tracking. We don't sell your personal data, show ads, use advertising identifiers or track you across other companies' apps and websites.
  • A small set of service providers: Google, Apple and Adapty, plus Hetzner, which hosts our servers, Amazon Web Services, which sends our emails, and Cloudflare, which runs our domain.
  • You stay in control: delete trades, alerts and notifications at any time, and delete your whole account right from the app (section 10).

1. Who we are

The Service is provided by FEİNSOFT BİLİŞİM HİZMETLERİ SANAYİ TİCARET LİMİTED ŞİRKETİ ("Feinsoft", "we", "us"), Yıldıztepe Mahallesi, Tomurcuk Sokak No: 7/3, Altındağ, Ankara, Türkiye. We are the data controller for the personal data described in this policy. You can reach us at support@criprem.com.

2. Data we collect

2.1 Account data

CripRem doesn't use passwords. You sign in with Google or Apple, and we receive the following from them:

  • Sign in with Google: your Google account ID, email address, name and profile photo. We store a resized copy of the profile photo on our servers.
  • Sign in with Apple: your Apple user ID; your email address, which is a private relay address if you choose "Hide My Email"; whether that address is verified or private; your name, if you choose to share it (Apple provides it only the first time you sign in); and a token Apple issues to keep your sign-in valid.

We also assign you an internal user ID and keep records of your sign-in sessions, such as when a session was created and last used.

2.2 Portfolio data you enter

The trades you record: exchange (for example Binance, KuCoin or Bitget), trading pair, buy or sell, quantity, price, fee and fee asset, and the date and time of the trade. From these we calculate your holdings, average cost and profit/loss. We don't verify this information with any exchange; it is only what you enter.

2.3 Alerts and notification history

The alert rules you create (asset, alert type, threshold values and their currency, comparison window, repeat settings, the channels you choose — push notification, email or in-app — and whether the rule is active), and the history of alerts that have been triggered (title, message, triggered and threshold values, currency, channel, time, and whether you have read it).

2.4 Settings

Your preferred currency (USD, EUR or TRY) and app language. We keep your language on our servers so that push notifications and emails reach you in your language.

2.5 Device and push notification data

If you allow notifications, we store your device's push token (issued by Firebase Cloud Messaging), your platform (iOS or Android) and a device identifier (Android ID on Android, the app-specific identifierForVendor on iOS), so that notifications reach the right device and old tokens of the same device can be retired. We don't use these identifiers for advertising or tracking.

2.6 Subscription data

If you subscribe, we keep your plan (free, monthly or yearly), the product ID, subscription status, expiry and renewal information, grace-period status, store information (App Store or Google Play; live or test environment), your Adapty profile ID, and when this information was last verified. Payments are processed by Apple or Google; we never receive your card or payment details.

2.7 Technical and log data

Our servers keep logs of requests to the Service (time, the function called, duration, errors and your user ID) to keep the Service secure and to fix problems. These logs are deleted automatically after 90 days. Like any internet service, our hosting infrastructure processes your IP address to deliver responses.

Crash reports: If the app crashes or hits an unexpected error, Firebase Crashlytics (Google), which is built into the app, sends us an error report. It contains the technical details of the error (stack trace), your device model, operating system and app version, information about the device's state at the time (such as free memory and screen orientation), the time of the error and a random installation ID that Crashlytics creates for this installation. We don't add your user ID, email address or portfolio data to these reports, we don't link them to your account, and we use them only to find and fix errors.

If you have agreed to share diagnostics with Apple or Google, they may give us aggregated crash reports and usage statistics that don't identify you.

2.8 Data that stays on your device

Some data is stored only on your device and isn't sent to us: interface preferences (language, theme, sort order), the biometric lock setting, cached subscription status, whether the subscription reminder has been shown, and the coin and price threshold you pick before signing in (used to create your first alert once you sign in). Your sign-in tokens are kept in your device's secure storage (iOS Keychain / Android Keystore).

Biometrics: if you turn on Face ID, Touch ID or fingerprint lock, verification is performed entirely by your device's operating system. We never receive or store your biometric data; the app only learns whether verification succeeded.

2.9 What we don't collect

  • Exchange API keys, exchange passwords, wallet private keys or recovery phrases
  • Payment card or bank details
  • Location from your device's GPS or location services (we don't request location permission), contacts, your photo library, camera, microphone or files
  • Advertising identifiers (IDFA / Google Advertising ID): collection is turned off in our subscription SDK, and the Android advertising-ID permission is removed from the app
  • Data from third-party advertising or analytics SDKs: the app doesn't include any. The only usage events we receive are the subscription events Adapty records (section 4). The only diagnostics tool in the app is the crash reporting described in section 2.7 (Firebase Crashlytics).

3. How we use your data and our legal bases

Purpose Data used Legal basis
Create and maintain your account; sign you in and keep you signed in Account data, session records Performance of our contract with you
Record your trades and calculate your portfolio and profit/loss in your chosen currency Portfolio data, settings Performance of our contract with you
Check your alerts and send push, email and in-app notifications in your language Alert rules, device and push data, email address, language Performance of our contract with you
Offer subscriptions, verify purchases, apply plan limits and measure how the subscription screen performs Subscription data, user ID, Adapty purchase and screen-view events, the part of the app the subscription screen was opened from Performance of our contract with you; our legitimate interest in understanding subscription performance
Keep the Service secure, prevent abuse, and find and fix errors and crashes Log data, IP address, session records, crash reports Our legitimate interest in a secure and reliable Service
Answer your questions and handle requests about your data Your email address and the content of your message Performance of our contract with you; legal obligation
Comply with the law and establish, exercise or defend legal claims Data relevant to the specific matter Legal obligation; our legitimate interests

Under the EU/UK GDPR these bases correspond to Art. 6(1)(b) (contract), 6(1)(c) (legal obligation) and 6(1)(f) (legitimate interests); under Turkish Law No. 6698 on the Protection of Personal Data (KVKK), to Art. 5(2)(c), (ç), (e) and (f). Where we rely on legitimate interests, you can object (section 9).

We don't use your data for advertising, we don't sell it, and we don't make decisions based solely on automated processing that have legal or similarly significant effects on you. Alerts fire automatically, but only according to rules you set yourself.

4. Who we share your data with

We share personal data only with the following recipients, and only as much as each of them needs:

  • Hetzner Online GmbH: hosts our servers, database and backups on our behalf in data centres in Germany.
  • Google: Google Sign-In; Firebase Cloud Messaging, which delivers push notifications (on iOS together with Apple Push Notification service); Firebase Crashlytics, which collects crash reports; and Google Play, which processes purchases on Android.
  • Apple: Sign in with Apple, Apple Push Notification service and App Store purchases. If you use "Hide My Email", the emails we send you are delivered through Apple's private relay service.
  • Adapty (adapty.io): manages subscriptions. Adapty receives your internal user ID, the subscription and transaction information provided by the App Store or Google Play, basic device and app information (such as device model, operating system and app version, language and a device identifier) and your IP address. It also records when the subscription screen is shown, which part of the app it was last opened from (for example the alert form or settings), and purchase events. Advertising-identifier collection is turned off.
  • Amazon Web Services (Amazon SES): sends the alert emails you turn on, with the alert details, to your account's email address. Emails are sent from AWS's Sweden (Stockholm) region.
  • Cloudflare: provides DNS for our domain (criprem.com) and forwards the emails you send to support@criprem.com to us.
  • Public authorities, courts and professional advisers: when required by law, or when needed to establish, exercise or defend legal claims.
  • A successor business: if we are involved in a merger, acquisition or sale of assets, your data may be transferred as part of that transaction, subject to this policy.

The content of push notifications (for example "BTC crossed above $70,000") passes through Google's and Apple's delivery services.

Crypto exchanges: to show prices, our servers fetch public market data (prices and trading pairs) from Binance, KuCoin and Bitget. These requests come from our servers and contain no information about you; exchanges never learn who you are or what you hold.

We don't sell your personal data or share it with anyone for advertising.

5. International transfers

Some of our service providers process data outside the country you live in: our servers and backups are hosted in Germany (Hetzner), our emails are sent from Sweden (Amazon Web Services), and Google, Apple, Adapty and Cloudflare may process data in other countries, including the United States and countries of the European Union. When we transfer personal data out of Türkiye, the European Economic Area or the United Kingdom, we do so on a lawful basis and with the appropriate safeguards required by the applicable law, such as standard contractual clauses, in line with Article 9 of KVKK and Chapter V of the GDPR.

6. How long we keep your data

  • Account, portfolio, alert, notification-history and settings data: as long as your account exists. When you delete a trade, alert rule or notification in the app, it is removed from our database straight away.
  • After you delete your account: when you delete it in the app, your account data is deleted straight away; requests sent by email are completed within 30 days. Anything the law requires us to keep longer is excepted. Copies in backups are erased as the backups are overwritten.
  • Push tokens: deactivated when you sign out or when the token stops working; deleted together with your account.
  • Subscription records: as long as your account exists. Apple and Google keep their own purchase records under their own policies.
  • Server logs: deleted automatically after 90 days.
  • Crash reports: deleted automatically from Firebase Crashlytics after 90 days.
  • Support emails: as long as needed to handle your request and any follow-up.

When a retention period ends, the data is deleted, destroyed or anonymised.

7. How we protect your data

  • Traffic between the app and our servers is encrypted in transit (HTTPS/TLS).
  • Sign-in tokens on your device are kept in the platform's secure storage, and access to our servers and database is limited to authorised personnel.
  • Because we never ask for your exchange credentials, even a breach of our systems could not be used to access your exchange accounts or funds.
  • You can protect the app on your device with a biometric lock.

No method of transmission or storage is completely secure. If a breach affects your personal data, we will notify you and the relevant authorities as required by law.

8. Your choices

  • Push notifications are optional. You can allow or turn them off at any time in your device settings; your alerts keep working and stay visible in the app.
  • Email alerts are off by default and are sent only for alert rules where you turn email on.
  • Biometric lock can be turned on or off in Profile › Privacy & Security.
  • Currency and language can be changed at any time in the Profile tab.
  • Your records (trades, alert rules and notifications) can be edited or deleted at any time.
  • Your account can be deleted at any time in Profile › Privacy & Security › Delete My Account (section 10).
  • Subscriptions are managed and cancelled in your App Store or Google Play account settings. Deleting the app or your account doesn't cancel a subscription.

9. Your rights

Depending on where you live, you may have the right to:

  • access the personal data we hold about you and get a copy of it;
  • have inaccurate data corrected;
  • have your data deleted;
  • restrict or object to certain processing, including processing based on our legitimate interests;
  • receive the data you gave us in a structured, commonly used, machine-readable format (data portability);
  • withdraw your consent at any time, where processing is based on consent;
  • lodge a complaint with a data protection authority.

Users in Türkiye: under Article 11 of KVKK you also have the right to learn whether your data is processed and for what purpose, to know the third parties in Türkiye or abroad to which it is transferred, to ask that corrections or deletions be notified to those third parties, to object to a result against you that arises solely from automated analysis, and to claim compensation for damage caused by unlawful processing. The Turkish version of this policy is our information notice under Article 10 of KVKK. You can complain to the Personal Data Protection Board (kvkk.gov.tr).

Users in the EEA and the UK: you can complain to the data protection authority where you live or work.

How to exercise your rights: email support@criprem.com from the email address linked to your CripRem account, or write to us at the postal address in section 13. We may ask for information to verify your identity. We respond within 30 days, free of charge.

10. Deleting your account

You can delete individual trades, alert rules and notifications in the app at any time. You can delete your CripRem account and all data associated with it in two ways:

  • In the app: Profile › Privacy & Security › Delete My Account. As soon as you confirm, your account and the data listed below are deleted and you are signed out. This can't be undone.
  • By email (for example if you've already removed the app): email support@criprem.com with the subject "Delete my account", from the email address linked to your CripRem account. If you used Apple's "Hide My Email", include that relay address; you'll find it under Sign in with Apple in your Apple Account settings. We confirm your request and delete your account within 30 days.

What we delete: your account and profile (name, email address, profile photo), your trades, alert rules, notification history, settings, push tokens and subscription record. If you signed in with Apple, we also revoke CripRem's Sign in with Apple authorisation, and we ask Adapty to delete your subscription profile.

What we keep: server logs until they expire (at most 90 days), crash reports that aren't linked to your account (at most 90 days), backups until they are overwritten, and any data the law requires us to keep.

Deleting your account doesn't cancel an active subscription; cancel it first in your App Store or Google Play account settings.

11. Children

CripRem is not directed to children under 13, and we don't knowingly collect personal data from children under 13. If you believe a child under 13 has given us personal data, contact us and we will delete it. If the law in your country sets a higher minimum age for using online services and you are under that age, use the app only with the consent of your parent or guardian.

12. Changes to this policy

We may update this policy when the Service or the law changes. We'll publish the new version on this page with a new "Last updated" date, and if the changes are significant we'll let you know in a reasonable way (for example in the app or by email) before they take effect.

13. Contact us

  • Data controller: FEİNSOFT BİLİŞİM HİZMETLERİ SANAYİ TİCARET LİMİTED ŞİRKETİ
  • Address: Yıldıztepe Mahallesi, Tomurcuk Sokak No: 7/3, Altındağ, Ankara, Türkiye
  • Email: support@criprem.com

This policy is published in English and Turkish. If the two versions differ, the Turkish version prevails for users in Türkiye.