Privacy Policy

1. Data Controller

The controller of your personal data under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") is the individual developer of the Appreciety app ("we"). For users in the European Economic Area, the United Kingdom and elsewhere, the controller is the same. For questions and requests about your data, write to us at support@appreciety.com.

2. Data We Process

Account details: first name, last name, username and e-mail address. Your password is stored only as an irreversible hash and is never kept in plain text. If you sign in with Google or Apple, we receive that account's identifier and the basic details you share (name, e-mail); Apple's "Hide My Email" may give us a random relay address. We also keep your account type (user/admin), your e-mail verification status and your preferred app language.

Profile details: your profile photo and photo gallery (up to 5 photos), your bio, optional Instagram/X links, a free-text location, and the city and country you live in (for the "Local" badge).

Content you create: places and photos you add, ratings and reviews, routes (days, times, notes), lists, favourites, your "been there" marks and the travel passport built from them, your follow and block relationships, groups you join, route invitations, reports and support messages you send, and your badges. Text and links you paste into the import feature are processed only to find places.

Security data: if two-step verification is on, the 6-digit code e-mailed to you (stored hashed, valid for 10 minutes), password-reset and e-mail verification links and session refresh tokens (stored hashed), and signed invitation links.

Device and technical data: a device token and platform (iOS/Android) to send notifications; the app language; crash reports; anonymous usage statistics showing which features are used (for example "route shared"; they carry no content or identity); server logs (IP address, request time, error records) and rate limiting to prevent abuse. You can turn anonymous usage and crash data off at any time under Settings → Legal. For admin actions, the admin's IP address is kept in the audit log.

Location: We use your device location only if you allow it: to centre the map on you, to sort nearby places and search results by distance, and to find the spot when you add a place. Your location is sent to our server to answer the request and is not stored permanently on your profile or elsewhere; only the last location is cached on your device. We do not track location in the background.

What we do not collect: advertising identifiers, your contacts, the microphone, images taken with the camera (photos are only picked from your gallery) and background location. The App has no private messaging between users.

3. Purposes and Legal Bases

We process your data to create and manage your account, to provide the place, route, list and travel passport features, to show community content, to send notifications and e-mails, to protect your account with two-step verification, to detect and remove inappropriate content, to prevent abuse, and to find bugs and improve the App. Legal bases (KVKK Art. 5 and 6): establishing and performing our Terms of Service, your explicit consent (for location, notifications and anonymous usage data), our legal obligations, and our legitimate interests (security, preventing abuse, debugging). For users in the European Economic Area and the United Kingdom, the same purposes rest on performance of a contract, legitimate interests, consent and legal obligation under the GDPR.

4. Automated Image Review

Photos you upload to the App (profile, place, route) are scanned automatically with Google Cloud Vision before they are published; images found to be obscene or violent are rejected automatically. This is an automated system that works without human involvement; if you wish to object to a result, you can contact us.

5. Recipients of Data and Transfers Abroad

We use these service providers to host and process your data: - Supabase: database and photo storage; servers in Europe (Ireland). - Vercel: application server; processing in Europe (Dublin), while the network that relays requests may be worldwide. - Google: maps and place search (Maps/Places), Google sign-in, image review (Cloud Vision), and Firebase (anonymous usage statistics, crash reports, push notifications). Google servers may be outside Türkiye and Europe, including the United States. - Apple: Sign in with Apple and iOS push notifications (APNs). - Resend: sending verification, password-reset and verification-code e-mails (Europe region, Ireland). - Cloudflare: domain management and forwarding of e-mails sent to support@appreciety.com.

Transfers of your data abroad fall under KVKK Art. 9 and the GDPR's transfer rules; with our providers we rely on the safeguards the law requires (for example standard contractual clauses, explicit consent). We do not sell or rent your personal data to any third party other than these providers.

6. Information Shared with Other Users

- Your username, name, main profile photo, bio, the places you add, your reviews and ratings, and routes you make public can be seen by other users. - For the other photos in your gallery you can choose "everyone" or "followers only". Your main profile photo is always public. - You can choose who sees the places you have visited and saved (your travel passport, your map, the follow feed): "everyone", "followers only" or "only me". - If you keep a route "private", only you and the collaborators you add can see it. Someone with an invitation link can see the route's title and city before joining; you can revoke links at any time. Your friend invitation code is your username. - Users you block cannot interact with you.

7. Data Security

Passwords, verification codes and session tokens are stored hashed; all communication is encrypted with HTTPS; you can turn on two-step verification; sign-in attempts and other sensitive actions are protected by rate limiting; and banned or deactivated accounts are locked out of the system immediately. Even so, no transmission over the internet can be guaranteed to be 100% secure.

8. Retention and Account Deletion

We keep your data while your account is active. You can delete your account at any time under Settings → Delete Account; the account is closed immediately, all your sessions are ended, and your personal data (photos, follow and block relationships, favourites, lists, private routes, notification and security tokens, support messages) is deleted at the moment of deletion; the name, e-mail and profile details on the account record are anonymised so they no longer identify you. If a technical problem occurs, the process is retried automatically within 24 hours at the latest. Deleted data may remain in system backups for up to 30 more days. Your public reviews, public routes and places you added remain under the name "Deleted user", with no link to your name, e-mail or photo. Records kept for security (for example admin audit logs) are kept for the legally required periods.

9. Children's Privacy

The App is not designed for children under 13 and we do not knowingly collect data from them. If the digital age of consent in your country is higher (between 13 and 16 in Europe, depending on the country), you must use the App with the permission of your parent or legal guardian. If we learn that a user is under 13, we delete the account and its data.

10. Cookies and Tracking

The App does not use cookies. The web pages opened from links in e-mails and on appreciety.com (password reset, e-mail verification, share and invitation pages, support and legal texts) contain no tracking scripts, external fonts or advertising cookies. We do not track you for advertising and we do not collect advertising identifiers.

11. Exercising Your Rights

Under KVKK Art. 11 you have the right to learn whether your personal data is processed, to request information, to learn the purpose and whether it is used accordingly, to know the parties it is transferred to, to request correction of incomplete or wrong data, to request deletion or destruction, to request that these actions be notified to the parties it was transferred to, to object to a result against you that comes only from automated analysis, and to claim compensation for damage. Users in the European Economic Area, the United Kingdom, Japan, South Korea and similar places can also use the rights their local law grants (access, rectification, erasure, restriction, objection and data portability) in the same way, and you keep the right to complain to your data protection authority.

Inside the App you can do the following yourself: edit or delete your profile details and photos, change privacy preferences, revoke invitation links, block users, turn two-step verification on or off, turn off anonymous usage and crash data, turn off location and notification permissions in your device settings, and delete your account. If you would like a copy of your data, just write to support@appreciety.com.

12. How to Apply

To exercise your rights, write to support@appreciety.com with your request and information that helps us verify your identity. We will respond to your request within 30 days at the latest.

13. Changes to This Policy

We may update this policy from time to time. For important changes we will notify you in the App; the current version is always published in the App and at appreciety.com/legal/privacy-policy.

14. Contact

For privacy questions: support@appreciety.com.