Privacy Policy — Muğla Travel Guide

TürkçeEnglish

Effective date: 11 May 2026

Last updated: 16 August 2026

This document describes what data the Muğla Travel Guide mobile application ("App") collects, how it is processed, and the rights of users. Prepared to comply with GDPR (EU 2016/679), the Turkish KVKK (Personal Data Protection Law No. 6698), Apple App Store and Google Play policies.

1. Data Controller

Kalynda Teknoloji Havacılık ve Turizm Ltd. Şti. (Kalynda Technology Aviation & Tourism Ltd.)

  • Address: Söğütlüyurt Mah. İstiklal Cad. No:57, 48770 Dalaman / Muğla, Türkiye
  • Contact: privacy@kalyndagroup.com

2. What Data We Collect

2.1 Anonymous device fingerprint (always)

Technical information necessary for the App's core functionality. Does not identify any individual person:

  • Device UID (UUID v4 generated by the app) — content personalization, push targeting
  • Platform (android/ios) — version compatibility
  • OS version — debugging
  • Device model — performance optimization
  • App version — outdated install detection
  • Language preference — localized content
  • Country code (from IP, raw IP NOT stored) — localization
  • First / last seen timestamps — DAU/MAU statistics
  • Push subscription state — notification targeting

Note: The Device UID regenerates if you uninstall and reinstall the App. We never collect persistent identifiers like IMEI, Android ID, IDFA or MAC address.

2.2 Location data (only with user consent)

  • Foreground location — single-shot GPS sample taken while the App is open, for nearby POI recommendations.
  • Location history — retained only if Settings > "Save my location history" is enabled.
  • During active navigation, location continues while the App is in the background. Once you start turn-by-turn guidance, the route keeps updating even if you lock the screen or switch apps — otherwise the directions would freeze. iOS shows its blue location indicator at the top of the screen while this happens; Android shows a persistent notification. Tracking stops the moment you end navigation.
  • Outside navigation your location is not tracked in the background. The App never requests "Always" location authorisation; it operates solely on "While Using the App". On Android the ACCESS_BACKGROUND_LOCATION permission is NOT in the manifest (since v0.1.0+35).
  • Retention: maximum 90 days, then auto-deleted.
  • Opt-out wipes all existing history immediately.

2.3 Push notification token (only if granted)

The Firebase Cloud Messaging (FCM) token — required to send notifications. Device-specific, contains no user identity.

2.4 Interaction data (anonymous, default on, opt-out)

In-app behavioral signals — which screen was visited, time spent, POI/event taps, favorites, language change, push tap, etc. Sent to our own backend Kalynda Analytics. Each event is associated with a UUID v4 device identifier; it does NOT identify the person. Users can disable this via Profile > "Send anonymous usage statistics"; queued events are deleted on opt-out.

2.5 Data we do NOT collect

  • Phone number, email (unless you explicitly enter it)
  • Contact list, calendar, SMS, call logs
  • Photo gallery (unless you share)
  • Microphone / audio
  • IMEI, Android ID, IDFA, MAC address
  • Browser history, list of other apps
  • Persistent advertising identifier mapping

3. Purposes of Processing

Under GDPR Article 6 (legitimate interest + explicit consent) and KVKK Article 5:

  • Provide core App functionality (nearby POI, language, map) — legitimate interest
  • Anonymous usage statistics — legitimate interest
  • Location history and heatmap — explicit consent (Settings opt-in)
  • Push notifications — explicit consent (system permission)
  • Debugging / crash reports — legitimate interest

4. Third-Party Recipients

  • Supabase (EU / US) — database hosting, DPA in place
  • Firebase Cloud Messaging (Google, US) — push delivery
  • Cloudflare (EU / US) — backend hosting and API request logs
  • Sentry (EU) — crash reports

We do not sell data. No personal data is shared with ad networks.

5. International Data Transfers

Supabase, Firebase and Cloudflare servers may be partially in the US. Under GDPR Chapter V and KVKK Article 9, you grant explicit consent for this transfer by using the App.

6. Retention Periods

  • Device fingerprint: active use + 1 year inactive
  • Location pings: 90 days (automatic deletion)
  • Push tokens: until invalid (FCM tombstoning)
  • Crash reports: 90 days
  • "Delete my data" → immediate cascade delete

7. Your Rights (GDPR Art. 15-22 + KVKK Art. 11)

Via Settings > "Delete my data" or privacy@kalyndagroup.com:

  • Right to be informed
  • Right of access (request a copy)
  • Right to rectification
  • Right to erasure ("right to be forgotten")
  • Right to object
  • Right to data portability
  • Right to lodge a complaint (KVK Kurulu / EU Supervisory Authority)

8. Children's Data

The App is not intended for children under 13. If a parent discovers their child's data has been processed, email privacy@kalyndagroup.com — it will be deleted immediately.

9. Security Measures

  • HTTPS-only (TLS 1.2+)
  • Supabase RLS on every table
  • Service-role key server-side only
  • 2FA TOTP required for the admin panel
  • Failed-login lockout (5 failures → 10 min)
  • Rate limiting on every endpoint
  • CSRF protection, push hardening, audit log

10. Changes to This Policy

If changes occur, the "Effective date" is updated and you will be notified on the App's next launch. Material changes request fresh explicit consent.

11. Contact

Data Controller: Kalynda Teknoloji Havacılık ve Turizm Ltd. Şti.

Email: privacy@kalyndagroup.com

Turkish Data Protection Authority: www.kvkk.gov.tr

Delete my data →