SolstyPrivacy Policy
Last updated: October 18, 2026
At a glance: Solsty can be used without an account. In that case, none of your app data reaches us; everything stays on your device. If you create an account, your data is stored on our server so it can sync between devices. We do not show ads, run third-party analytics or tracking code, or sell your data.
1. Data controller
Solsty is a personal project operated by Bilal Arıkan. For privacy questions and requests, contact: hesap@solsty.net.
2. Using Solsty without an account
Without an account, your agenda content stays in local device storage: native preferences on supported mobile devices, or browser storage on the web. This data is never sent to our servers.
This means that clearing browser data or uninstalling the app removes this data, and we cannot recover it because we do not have a copy. We recommend using the backup download feature in Settings.
3. Data processed when you create an account
| Data | Reason | Legal basis |
|---|---|---|
| Email address | Identifying your account, verifying sign-in and resetting your password | Performance of a contract |
| Password (hashed) | Verifying sign-in. Your password is hashed with argon2id ; the plain-text password is never stored and cannot be known to us | Performance of a contract |
| Supported synchronized content, including tasks, journal entries, notes, body measurements, skincare records, expenses and savings goals | Syncing and backing up data between your devices | Performance of a contract |
| Session records (device label, creation and last-used times) | Keeping you signed in and allowing you to sign out | Performance of a contract |
| Server access logs (IP address, request time, URL and browser information) | Security, preventing abuse and diagnosing failures | Legitimate interests |
What we do not collect: location, contacts, camera or microphone access, advertising identifiers or cross-app advertising profiles. Solsty does not use advertising networks or third-party analytics trackers.
Mobile storage, synchronization and service activity
Android and iOS use the device's native preferences storage when available; the web app uses browser storage. These stores are not an end-to-end encrypted vault. Optional account synchronization sends supported records to the service, including tasks, journal entries, routine notes, body measurements, skincare records, expenses and savings goals. Sleep records, bingo progress, goal-day marks and future letters currently remain on the device in the mobile client. Export a local backup to preserve these records.
To operate synchronization, we process your account identifier, an app-generated installation identifier, session and device labels, and synchronization times. The service also records account-linked daily synchronization and feature activity for usage reports, security events and IP addresses for abuse prevention, and aggregate request counts, response status and durations for diagnostics. These records are not used for advertising or cross-app tracking.
Social sign-in
When an enabled Google, Apple or Facebook sign-in option is selected, that provider authenticates you and shares a provider account identifier and available email information with Solsty. We store the identifier, email address and email verification status to identify your account. Solsty does not receive your provider password or request your contacts, messages or photo library. Names and profile pictures returned during authentication are not stored by this sign-in integration.
Your chosen provider processes the sign-in request under its own privacy policy. Provider access tokens are used only for the sign-in exchange and are not retained as account credentials. See our account and data deletion instructions.
4. Cookies
Solsty does not use tracking cookies, so it does not display a cookie consent window. Only technically necessary information, including session keys and app data, is kept in browser storage to maintain your session.
The landing site also stores your chosen language and animation preference only in your browser.
5. Third parties that process data
The providers we use to run the service are listed below. We do not share data with anyone else, sell your data or allow it to be used for advertising.
| Provider | Used for | Data accessed | Location |
|---|---|---|---|
| Hostim | Server hosting | Database and server logs | European Union |
| Squarespace | Domain name and DNS | Domain queries only; no access to app data | USA |
| Cloudflare R2 | Backup storage | Only encrypted backup files; it cannot read their contents | EU |
| Resend | Sending email (verification and password reset) | Your email address and the message itself | USA |
Transfers to US-based providers take place under standard contractual clauses. We update this list when we add or remove a provider.
6. Security
- All traffic is encrypted with TLS ; unencrypted connections are not accepted.
- Passwords are hashed with argon2id and are never stored in plain text.
- The database is not accessible from the internet; only the application server can access it.
- Each user's data is also isolated at the database level; even an application error cannot access another user's rows.
- Backups are encrypted before leaving the server; the backup provider cannot read their contents.
- Administrative server access is available only through a private network using a key; password sign-in is disabled.
No system is completely secure. If you notice a vulnerability, report it to hesap@solsty.net and we will respond as quickly as possible.
7. Retention periods
- Account data: for as long as your account remains open.
- When an account is deleted: data is removed from the server immediately. Backup copies are fully removed during backup rotation within 6 months at the latest.
- Server access logs: up to 30 days.
- Data on your device: until you delete it; this is outside our control.
8. Exercising your rights
Under the KVKK and GDPR, you have rights to access, correct, delete, object to processing and port your data. Most of these rights can be exercised directly in the app:
- Access and portability: Settings → Data Management → Download Backup. You receive all your data in a readable file.
- Deletion: Settings → Account → Delete account. Your account and data are removed from the server.
- Correction: you can edit all your content inside the app.
If you cannot complete a request through the app, contact hesap@solsty.net and we will respond within 30 days. If you are not satisfied with the outcome, you may complain to Turkey's Personal Data Protection Authority (KVKK) or the data protection authority in your country.
9. Children
Solsty is not intended for children under 13, and we do not knowingly collect data from anyone under 13. If we discover such an account, we delete the account and its data.
10. Changes
If this policy changes, the date above will be updated. For changes that materially affect how data is processed, we notify account holders by email.