Goblin
Every kuruş, accounted for.
Savings in Turkey end up scattered: dollars at one bank, gold at another, a time deposit rolling over somewhere else, subscriptions billed in euros. Goblin brings all of it into lira at the live rates of İş Bankası, TEB and the Central Bank, and keeps watch over what is about to renew.
- What it is
- Personal finance for life in lira
- Status
- Live, in private use
- Started
- December 2025
The problem
Each bank app shows only its own slice, at its own rates. Global budgeting apps don't know Turkish banks, gram gold or the withholding tax on a deposit, and they don't bring everything back to lira.
Nobody could answer a simple question: what is everything worth right now, in lira, and what is about to charge me this week?
How it works
Holdings are valued at the bank's own live rate, not a mid-market average, so the numbers match what your bank actually quotes.
Deposit accounts compute themselves: interest, withholding tax, net return, daily accrual, and automatic rollover with compounding at maturity. Weekend maturities move to Monday.
Subscriptions in 22 currencies get correct renewal dates, and the next 1, 7 and 30 days are converted to lira.
Pick the day a subscription started.
A subscription that started onJanuary renews on
- 28Feb 2026
- 31Mar 2026
- 30Apr 2026
- 31May 2026
- 30Jun 2026
Header of a .goblin export
0000000047424C4E01018F2AC3119E704BD205E8|GBLN···*···pK···|000000106A33B1F07C1D44920EA85BC6E329770D|j3··|·D···[··)w·|00000020D4613BE09C5218AF067ECD452F91B863…|·a;··R···~·E/··c|
The real header layout, byte for byte. Salt and IV are random in every file.
Under the hood
A file format of its own. A .goblin export starts with the bytes GBLN, a version and flags, then a salt, an IV and AES-256-GCM ciphertext. With a passphrase, the key comes from PBKDF2 at 600,000 iterations; tampering or a wrong passphrase is caught by the GCM tag.
Three banks, no single point of failure. Pluggable clients read İş Bankası's JSON service, TEB's daily endpoints and the Central Bank's XML. Reactor fans them out in parallel, each behind its own circuit breaker, retry and timeout.
Dates done properly. Renewals stay pinned to the day a subscription started, falling back to the last day of shorter months, leap years included, covered by 17 unit tests. If the scheduler was down, the interest engine catches up on every missed cycle.
Identity checked once. Only the gateway validates tokens. It strips any user id a client tries to send and injects the verified one, so the services behind it carry no security framework of their own.
Where it stands
The web app is live at goblin.berkinpolat.net and works as a PWA. A native iOS shell exists but hasn't been submitted to the App Store.
The core was built between December 2025 and March 2026 and has run untouched since. Crypto holdings and wider bank coverage are the obvious next steps.
Pace. Commits per week since December 2025. The quiet weeks are real too.
Goblin40 commits
Built with: Next.js 16, React 19, Java 21, Spring Boot, Spring Cloud Gateway, Resilience4j, PostgreSQL, Auth0, SwiftUI, Dokploy