Privacy

Two analytics tools measure how the site is used. They are not equivalent, and only one of them asks you first.

• Google Analytics 4 — loads only if you accept. It sets cookies in your browser and sends your visit (pages viewed, approximate location from your IP address, device and browser, referring site) to Google, which acts as an independent controller of that data under its own terms. If you decline, or never answer, the Google tag is never requested at all — nothing is set and nothing is sent.
• Cloudflare Web Analytics — always on. It is cookieless by design: it stores no identifier in your browser and does not build a profile across visits. It reports page counts, referrers and load performance in aggregate. Because it cannot single you out, it is not gated behind the choice below.

If you decline analytics, this site sets no cookies at all. Accepting sets Google’s (_ga and related), which is what the choice is about.

Your answer itself is remembered in your browser’s local storage under a single key, carthago:analytics-consent. It never leaves your device, contains no identifier, and exists only so you are not asked on every page. Clearing your browser storage forgets it, and the question comes back.

One further cookie exists but is not for visitors: an administrative session cookie on /admin, set only after a password login by the site’s operator.

The site runs on Cloudflare Workers, and the data behind it in Cloudflare D1 and R2. Serving a page necessarily involves Cloudflare processing your IP address and request headers, as any web host does, including for security and abuse prevention. The public read-only API under /api/v1 uses no cookies and requires no key.

The Carthago app for Android and iOS is a read-only reader over the same data. It collects nothing — and unlike the website, that is not a claim with an analytics caveat attached: the app ships no analytics SDK of any kind, no Google Analytics, no Cloudflare beacon, no crash reporter, no advertising identifier.

• No account, and nothing to sign into. The app never asks for a name, an email or a password.
• One permission: internet access. That is the entire list. No location, no contacts, no files, no camera, no notifications — and nothing that lets it draw over other apps.
• A local cache, on your device only. Screens you have opened are stored on the phone so the app opens instantly and still shows something without a connection. It holds published banking figures, never anything about you, it is never uploaded anywhere, and uninstalling the app deletes it.
• Requests reach our own server only. The app talks to carthago.appand nowhere else. Those requests are logged the same way this website’s are, described under “Hosting and logs” below. Tapping a news headline opens that publisher’s page in your browser, at which point their privacy policy applies, not ours.

If you use the Telegram question-and-answer bot, that is a separate surface with its own handling, and more is retained there than on the website:

• Your question text is stored, together with the database query the model generated from it and whether that query succeeded. This exists to catch a specific failure — a model that quietly answers over the wrong subset of banks — which is not diagnosable after the fact without the question.
• Those stored questions carry a short, non-reversible hash of your Telegram chat id, not the id itself: enough to group repeated failures from one conversation, not enough to identify who asked.
• A separate daily counter used for rate-limiting does hold your Telegram chat id in full, with a per-day message count and nothing else.
• Your question is sent to a third-party model provider (currently Groq and Cerebras) to be turned into a database query. Do not put anything confidential in it.

Telegram itself is not operated by this site; your use of it is governed by Telegram’s own privacy policy.

No advertising, no ad networks, no third-party trackers beyond the two analytics tools named above, no fingerprinting, no session recording, no heatmaps, no data sold or shared with data brokers. Fonts are served from this site, not from Google Fonts, so loading a page makes no request to Google unless you accepted analytics.

Depending on where you live — under the GDPR in the EU/UK, or under KVKK (Law No. 6698) in Türkiye — you may have the right to ask what personal data is held about you, to have it corrected or deleted, and to object to its processing.

In practice the website holds nothing that identifies you: decline analytics and there is no identifier to request. For the Telegram bot, a request naming your chat id will have the stored questions and counter for that id deleted.

Write to incesalim10@gmail.com. This is a solo, non-commercial project, so expect a human reply rather than a ticketing system.

This page carries the date it was last changed. Because the site is open source, the change history of both the code described here and this page itself is public and checkable.

This notice describes what the software does. It is not legal advice.