1. Controller and scope
Morve Teknoloji Yazılım Danışmanlık Hiz. Tic. Ltd. Şti. is the controller for Autelio personal data. This policy covers the mobile app, accounts, cloud backups, purchase verification, public pages, and API.
2. Local-only by default
Without an account or cloud backup, vehicles, odometer entries, fuel, expenses, categories, preferences, and notes remain in the local app database. Core features work without signing in.
Operating-system automatic app-data backup remains disabled. Removing the app or clearing app data may remove local records.
3. Optional account data
If you create an account, we process a normalized email address, an internal user ID, verification status, and security timestamps. We store a password hash, never the plain password. Authentication tokens are hashed server-side and held in operating-system-backed secure storage on the device.
4. Encrypted cloud backup
When you choose cloud backup, the necessary preferences, vehicles, odometer records, fuel, expenses, categories, maintenance, and reminder data are sent over HTTPS and stored in private encrypted server storage. Backups are snapshots, not live remote vehicle CRUD or continuous sync.
Cloud backup is optional, automatic backup is off by default, and the newest five snapshots are retained. Account deletion removes associated cloud backups.
5. Premium and purchase verification
For Lifetime Premium, we may process the store, product ID, an encrypted purchase token or Apple-signed transaction, transaction hash and identifiers, purchase or revocation state, verification timestamps, and entitlement status. Google Play or Apple App Store handles payment; Autelio does not receive card numbers or bank details.
On Apple platforms, the App Store transaction may include an app account token that matches your internal Autelio user ID so the purchase can be verified, restored, and kept separate from Google Play purchases. Lifetime Premium is a one-time non-consumable product, not a subscription.
6. Advertising and privacy choices
The free version may use Google AdMob to show banner ads on selected main screens. Lifetime Premium users receive no ads, and Autelio does not request or preload ads while Premium or entitlement status is unresolved.
The Google Mobile Ads SDK may process technical data such as IP-derived approximate location, app interactions, diagnostics, performance data, device or other identifiers, and advertising data for ad delivery, measurement, analytics, and fraud prevention. Autelio does not send vehicle records, notes, account email, backup content, or purchase tokens as ad-request parameters.
Where applicable, Google User Messaging Platform requests and records privacy choices before Autelio requests ads. Autelio’s initial iOS release requests non-personalized ads, does not request App Tracking Transparency access, and cannot access IDFA; SKAdNetwork may provide privacy-preserving attribution. If Google requires a privacy-options entry point, it is available in Settings → Data and privacy → Ad privacy options.
7. Logs, support, purposes, and sharing
Web/API access and security logs may include IP address, timestamp, user-agent, request path, and response status. We do not derive precise location from IP, run analytics or crash-reporting SDKs, or sell personal data.
We process data to provide requested account, backup, purchase-verification, advertising, security, legal, and support functions. Infrastructure, email, Google advertising, and store verification providers process only what is needed for those functions, or data may be disclosed where law requires.
8. Retention, deletion, and rights
Account data and backups are kept while the account is active, subject to snapshot limits and legal/security needs. You may delete the cloud account in Settings or at https://autelio.api.morve.com.tr/delete-account (Turkish: https://autelio.api.morve.com.tr/hesap-sil). Local device records remain unless you delete them separately. Apple, Google Play, and Google advertising data may remain under their respective provider policies.
Send applicable access, correction, deletion, restriction, objection, recipient-information, or KVKK Article 11 requests to destek@morve.com.tr. We may reasonably verify identity before responding.
9. Security, children, and changes
We use HTTPS, password hashing, hashed mobile tokens, private encrypted backup storage, access controls, ownership checks, rate limits, and secret-safe logging. No system can guarantee absolute security.
Autelio is not directed to children. Material policy changes are posted here with a new effective date.