Privacy policy
Last updated: 12 October 2026 · Version 1.0
1. In short
- Your documents stay on your phone, encrypted. Tamga Wallet does not keep a copy of them.
- You decide which document to show, to whom, with which fields; the screen tells you before anything is shared and asks for your approval.
- If you choose to verify your identity, this happens at Tamga Network's identity service. Images of your ID document and face never reach Tamga Wallet; that service is covered by Tamga Network's own privacy notice (§4).
- The app has no ads, no tracking and no analytics. Crash reports go only with your permission to our own server; there is no third-party analytics or crash library. Our servers do not log your IP address.
2. Controller and scope
BROS İNŞAAT SANAYİ VE DIŞ TİCARET LİMİTED ŞİRKETİ (operator of Tamga Wallet) · Tax office / tax ID (VKN): Beyoğlu / 1870632151 · Address: Harbiye Mah. Bostan Sk. No: 15 İç Kapı No: 5, Şişli / İstanbul, Türkiye
Privacy requests: privacy@tamgawallet.com · General: hello@tamgawallet.com · Security: security@tamgawallet.com
This policy covers only the services run by the operator of Tamga Wallet: the Tamga Wallet mobile app; the wallet provider service (provider.tamgawallet.com: wallet-unit registration, device attestation, wallet-unit and key attestations, closing the wallet if your phone is lost); the tamgawallet.com website; and support e-mail.
Tamga Network services are not covered by this policy. The identity service (id.tamga.network), trusted lists (trust.tamga.network), the schema catalogue (schemas.tamga.network), status lists (status.tamga.network) and the hosted verifier Tamga Verify (verify.tamga.network) are run by Tamga Network, an independent organisation. Tamga Network is the controller for processing in those services, and Tamga Network's own privacy notice applies. Tamga Wallet only connects to them; §4 says what the wallet sends.
For documents issued by institutions, the institution is the controller. For example, your university issues your student card. Tamga Wallet only receives the document on your phone and presents it with your approval; you exercise your rights about those documents against the institution. Tamga Wallet opens the institution's registered contact channel for this (see §9).
3. What we process, why, on what legal basis
| Service | Data | Purpose | Legal basis (Turkish KVKK) | Where, how long |
|---|---|---|---|---|
| Tamga Wallet (device) | Your documents, document keys, presentation history, PIN hash, language | Store and present your documents | Stays on your device; not sent to us | On your phone, encrypted with AES-256-GCM. The key exists only on this device (a copy in a phone backup cannot be read). Until you delete it or reset the wallet. |
Wallet provider (provider.tamgawallet.com) | Wallet-unit key fingerprint, app version, registration time, revocation status and, if revoked, the reason; the result of the device attestation check (Apple App Attest / Android key attestation) — only the level: keys in the phone's secure chip or in a software keystore; the wallet's latest security state (app version, operating system version, Android patch month, integrity result — §7); optionally a one-way fingerprint of your revocation code | Prove to institutions that the wallet is a genuine, secure Tamga Wallet; let you close the wallet if the phone is lost | Art. 5/2-c (performance of contract) · Art. 5/2-f (legitimate interest: preventing fake wallets) | Tamga Wallet's wallet provider server. Contains no personal data and no device identifier; the code itself is never stored. Until the wallet is revoked; the revocation stays on the wallet provider's status list. Only the latest security state is kept (overwritten); daily counts without any wallet ID for 12 months. |
| Error reports (optional) | Error type, cleaned message and code lines, screen name, app and operating system version, phone model, language, time rounded to the hour. No document contents, identity, addresses, keys, PIN, revocation code, wallet or device ID | Finding and fixing bugs in the app | Art. 5/1 (explicit consent: a report is sent only when you allow it; you can change this in Settings at any time) | Tamga Wallet's wallet provider server; 90 days (counts without any wallet ID for 12 months). No third-party service. |
Website (tamgawallet.com) | No cookies, no sign-in. Your theme choice (light / dark) is kept only in your browser and never reaches us | Show the website | Art. 5/2-f | In your browser, until you clear it |
| Support e-mail | Your e-mail address, what you write and any files you attach | Answer your question or request | Art. 5/2-c · Art. 5/2-f | Google Workspace; 2 years |
| Server access log | Time, host, request line, status code, size, duration — no IP address | Security and troubleshooting | Art. 5/2-f | Tamga Wallet server (wallet provider and website), 14 days |
Automatic renewal: some institutional documents renew themselves while the app is open, when their copies run low, without you noticing. The institution re-reads the information from its own source. You can turn this off under Settings → “Renew copies automatically”. Identity and contact credentials never renew automatically.
Presentation history: which document you showed, to whom, with which fields is kept only on your phone. You can export it as a password-protected file (Settings → “Move to a new phone”). We never see this file.
4. Tamga Network services the wallet connects to
The services below are run by Tamga Network, which is their controller. This data does not reach the operator of Tamga Wallet. For retention periods, Tamga Network's processors and your rights in those services, see Tamga Network's own privacy notice. Here we only list what the wallet sends when you start an action.
| Tamga Network service | When | What goes from the wallet or from you |
|---|---|---|
Identity service (id.tamga.network) — identity verification | When you choose to get an identity credential | The wallet opens the verification page. Images of your ID document and face go from that page directly to Tamga Network (and its identity verification provider). To receive the credential, the wallet sends its wallet-unit attestation and the public key of the credential key; the issued credential is written to your phone. |
| Identity service — driving licence information (optional) | When you choose to get driving licence information | Images of your driving licence card go from the verification page directly to Tamga Network; for matching, the wallet sends the given name, family name and date of birth from your identity credential. It is not an official driving licence. |
| Identity service — contact credentials | When you choose to get an e-mail or phone credential | The e-mail address or phone number you enter and the one-time code you receive |
| Identity service — deletion and revocation | When you choose “Reset wallet and delete my data”, or when your wallet is closed | A request to delete your records at the identity service (your credentials are revoked); a closed wallet's revocation is seen through the wallet provider's status list |
Tamga Verify (verify.tamga.network) | When you present to an organisation that uses Tamga Verify | Only the document fields you approve, on behalf of the organisation that asked |
Trusted lists, schemas, status lists (trust., schemas., status.tamga.network) | When checking institutions and documents | The wallet downloads public lists; no information about you is sent |
5. What we don't do
- We keep no copy of your documents, your ID number or your face.
- We do not sell your data, use it for advertising or build profiles.
- The app contains no analytics, advertising identifier, tracking, server-sent (push) notification or third-party crash-reporting library; crash reports go only with your permission, to our own server. Notifications are created only on your phone (local notifications): no data goes to a server and the lock screen shows no document or institution name; you can turn them off in Settings → Notifications.
- No IP address, document content, ID number, email address, phone number or code is written to our server logs.
- We never show your documents to anyone without your approval.
6. Recipients and processors
| Recipient | Role | Which data | Location |
|---|---|---|---|
| Hetzner Online GmbH (server hosting) | Processor | Data processed by the wallet provider and the website (§3) | Germany (EU) |
| Google Workspace (Google Ireland Ltd.; email) | Processor | Support and privacy e-mails | Google's data centres (EU and outside the EU) |
| Apple / Google | Independent controllers | During device attestation your phone's operating system talks to their servers | Their own policies |
| Tamga Network | Independent controller | The data in §4, in actions you start | Its own privacy notice |
| The institution that issued, or the organisation you present to | Independent controller | Only the fields you approve | Their policy |
International transfers (KVKK Art. 9): Our server is in Germany (Hetzner Online GmbH) and email runs through Google Workspace, so some data is transferred outside Türkiye. The transfer relies on standard contracts with these processors under KVKK Art. 9; the standard contracts are notified to the Turkish Personal Data Protection Authority within five business days of signing.
7. Security
- On the device: documents are encrypted; keys are in the phone's key store, only on this device. Every presentation asks for the phone's own lock (face, fingerprint or phone passcode). Wrong PIN attempts are limited with increasing waiting times.
- Device attestation and key level: the phone's operating system attests to the wallet provider, with a signed statement, that the wallet key was created in the phone's secure chip. If verified, your documents are presented at “secure hardware” level; otherwise (no attestation or not verifiable) the wallet provider issues no wallet attestation to that phone and the wallet cannot receive documents from institutions (only phones with secure hardware are supported).
- On the network: all connections use HTTPS; presentations are additionally end-to-end encrypted. Institutions and verifiers are checked against signed trusted lists.
- On the server: logs without IP addresses; operator endpoints closed to the outside.
- Known limits: the service is pre-pilot and the wallet provider server is still being set up; temporary limits are stated openly on this page and in the app. Details: Security.
Security monitoring and error reports
The European Union's wallet rules require the wallet provider to monitor the security of installed wallets. We do this without opening a new monitoring channel: when the wallet renews its attestation (wallet unit attestation) — when the app opens, at most once a day — it sends the signals below in a request signed with the wallet key. In the app, Settings → Privacy → “What is monitored?” shows the same list with this phone's values.
| What | Why | How often | How long it is kept | Can it be turned off |
|---|---|---|---|---|
| App version and build number | Stop outdated, unsafe versions and ask for an update | When the wallet attestation is renewed, at most once a day | Only the latest value per wallet; counts for 12 months | No — part of the service; without it no wallet attestation is issued |
| Operating system (major and minor version only, e.g. “Android 15”) | Warn about old systems | Same | Same | No |
| Android security patch month (e.g. “2026-09”) | Warn about phones that are not updated | Same (not on iPhone) | Same | No |
| Integrity result (Android: Play Integrity · iPhone: App Attest assertion) | See that the app is the official one and the phone's system was not modified; if the result is critical, getting and renewing documents stops and, after review by a person, the wallet may be closed | Same | Only the result class (good · none · critical); the token itself is not kept | No |
| Error report (table above) | Fix bugs | Only after an unexpected close and only with your permission | 90 days; counts for 12 months | Yes: Settings → Privacy → Error reports — Always ask (default) · Send without asking · Never send |
- Legal basis: security signals Art. 5/2-c (performance of contract) and Art. 5/2-f (legitimate interest: security of wallets); error reports Art. 5/1 (explicit consent).
- Never collected: device IDs (advertising ID, IDFV, Android ID), IP address, location, usage behaviour, screens you open, document types, how often you show documents, Bluetooth or NFC support.
- Error report preview: after an unexpected close, the app asks you on the next start; “View report” shows the full text that would be sent. The report is cleaned on the phone before sending (addresses, long numbers, e-mail addresses, tokens and file paths become “[silindi]”) and cleaned again on the server. A report is not linked to your wallet.
- iPhone limit: Apple does not report whether a phone is jailbroken; App Attest only proves that the app and its key are genuine.
- If your wallet is closed for a security reason: you can see the reason, the date and what to do with your revocation code on the My wallet status page (provider.tamgawallet.com/check); closures that affect several wallets are announced on the Security advisories page before or at the same time. The app also shows the reason when it opens.
8. Children
Tamga Wallet has no age limit. The European Union's digital identity wallet regulation (eIDAS 2.0) sets no age limit for the wallet, and Tamga Wallet follows the same approach. Using the wallet requires identity verification, which needs a valid identity document.
9. Your rights and how to use them
Under KVKK Art. 11 you have the right to learn whether your data is processed, request information, rectification and erasure, learn the third parties it was transferred to, object, and claim compensation.
- In the app: in your history or a document's details, “Ask them to delete my data” — to the issuer or the organisation you presented to, via its registered channel; “Report to the data protection authority”; Settings → “Reset wallet and delete my data” — deletes everything on the phone and your wallet record at the wallet provider, and sends Tamga Network's identity service a request to delete your records there (your credentials are revoked). Details: Delete my data.
- Lost your phone? Close the wallet at provider.tamgawallet.com/lost with the revocation code shown once during setup. The page asks for no name, phone or email. Institutions stop issuing to the closed wallet, credentials issued by Tamga Network's identity service are revoked within 24 hours, and if the phone ever connects again it deletes its documents.
- By email: privacy@tamgawallet.com — we may ask for additional information to verify it is you. We answer within 30 days.
- For records in Tamga Network services (identity service, Tamga Verify) you exercise your rights against Tamga Network, through the channels in its own privacy notice.
- Complaints: Turkish Personal Data Protection Authority — www.kvkk.gov.tr
Because the wallet provider keeps no name, phone number, e-mail address or ID number, for deletion from the app we recognise your wallet by the wallet key on your phone; for email requests we tell you in our reply what we need to find your record.
10. Changes
We announce material changes in the app and on this page before they take effect. Earlier versions are available on request.