TravelerApp

1. Introduction

TravelerApp (the "App") is operated by Ege Özçelik, an independent developer based in Türkiye, under the brand Reconchille Studios. For the purposes of this Policy, Ege Özçelik is the data controller responsible for your personal data.

This Privacy Policy describes how we collect, use, disclose, and safeguard personal data when you download, install, access, or use TravelerApp and any related services (collectively, the "Services"). It also explains the rights available to you under applicable data protection laws, including:

• The General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK GDPR for users in the European Economic Area and the United Kingdom;
• The California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), for California residents;
• Other applicable data protection and privacy laws.

If you are located in the Republic of Türkiye, the dedicated KVKK (Law No. 6698) version of this notice applies to you; please switch to the Türkiye (KVKK) region using the selector above.

By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Services.

2. Information We Collect

We collect information that you provide directly, information generated through your use of the Services, and information received from third parties.

2.1 Information you provide

• Account information: email address (required); first and last name (optional); date of birth (optional); avatar photo (optional, stored in Supabase Storage).
• Personalization information: traveler type, interest categories, and excitement preferences you select during onboarding.
• User-generated content: travel plans, routes and journeys, landmark posts and notes, comments, votes, favorites, saved places (MyMap), packing lists (Backpacker), safety alerts (Ranger), and events you create or participate in.
• Event contact details: if you create an event, you may optionally attach a phone number, Instagram handle, or Telegram handle to that event. This contact information is event-scoped — it is attached only to the events you create and shown publicly on those events; it is not part of your profile and is not collected as profile data.
• AI interactions: free-text prompts and trip descriptions you send to our AI travel features, together with relevant context (such as your coordinates and personalization preferences) needed to produce the response.
• Support correspondence: messages, screenshots, or attachments you send us through support channels.

2.2 Information collected automatically

• Precise location data: while you are actively using the App and have granted permission, we access your device's precise location to show nearby landmarks, events and safety alerts, to record journeys, and to deliver AI-based suggestions. Location access is foreground-only (When-In-Use); we do not track your location while the App is in the background, and we do not request "Always" location.
• Route / journey data: when you have an active journey, the App samples GPS while the App is in the foreground and stores breadcrumb points consisting only of latitude, longitude, timestamp, and accuracy. We do not collect altitude or speed.
• Device motion / sensor data: the Sunwise compass reads device-motion sensor data to orient the sun compass. This is processed entirely on your device and is never sent to a server.
• Device and technical data: device model, iOS version, app version, language, locale, approximate region, and crash diagnostics.
• Subscription data: purchase receipts, subscription status, renewal dates, trial eligibility, and transaction identifiers received from Apple and RevenueCat.
• Log data: authentication events, API request logs, client IP address (used as a rate-limit key), and error traces retained for security, fraud prevention, and debugging.

2.3 Information from third parties

• Sign in with Apple: if you register using Apple ID, Apple returns an identity token that is exchanged for a session; if you choose to share them, we receive your email address and name.
• Google Sign-In: if you register with Google, a Google token is exchanged for a session and we may receive your email address, name, and profile picture, as permitted by Google and authorized by you.
• RevenueCat: we receive subscription entitlements, purchase history, and transaction identifiers linked to your account.

2.4 Authentication

We authenticate you using an email one-time code (magic code), Sign in with Apple, or Google Sign-In. We do not use passwords for account access; no password is collected or stored by the App.

3. How We Use Your Information

We use the information described above for the following purposes:

• To create and maintain your account and authenticate you;
• To deliver the Services, including landmarks, routes and journeys, maps, AI suggestions, weather, and community content;
• To process subscriptions and payments via Apple and RevenueCat and to manage trials, renewals, and refunds;
• To enable community features, displaying journeys, landmark posts, events, comments, and profiles to other users in accordance with your sharing choices;
• To generate AI responses by forwarding your prompts, coordinates, and personalization preferences to Google Gemini, and place queries and coordinates to Google Places;
• To send transactional communications such as account verification emails, security alerts, and service updates;
• To prevent fraud, abuse, and security incidents, enforce our Terms of Service, and protect our users and the public;
• To improve and secure the Services, including diagnosing crashes and monitoring performance on an aggregated and anonymized basis where feasible;
• To comply with legal obligations and respond to lawful requests from regulatory authorities or courts.

We do not use your personal data for targeted or behavioral advertising, and we do not sell or share your personal data with third parties for cross-context behavioral advertising. The App contains no analytics, advertising, or tracking SDKs.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area or the United Kingdom, we rely on the following legal bases under Article 6 of the GDPR:

• Performance of a contract (Art. 6(1)(b)): to operate your account, provide the Services you subscribed to, and process payments.
• Compliance with a legal obligation (Art. 6(1)(c)): to comply with tax, consumer protection, and data protection laws.
• Legitimate interests (Art. 6(1)(f)): to secure the Services, prevent abuse, and improve functionality. We balance these interests against your rights and freedoms and apply safeguards where appropriate.
• Consent (Art. 6(1)(a)): for optional features such as precise location access, camera and photo-library access, and AI features that transmit your prompts and coordinates to our processors. You may withdraw consent at any time (for example, by revoking the permission in iOS Settings) without affecting the lawfulness of processing carried out before the withdrawal.

We do not engage in automated decision-making that produces legal or similarly significant effects on you. Any personalization is preference-based, optional, and changeable by you at any time. Any processing of special-category data is carried out on the basis of your explicit consent or another applicable lawful basis under Article 9 GDPR.

5. Third-Party Services

TravelerApp integrates with the following third-party processors. Each processes your data under its own privacy policy and, where applicable, under data processing agreements with us.

For California residents, Google (Gemini and Places) and RevenueCat act as service providers / contractors under written contract that limits their use of the personal information to the documented purposes of providing the Services. They are not permitted to retain, use, or disclose the information for any other purpose, including their own commercial purposes.

External privacy policies:

• Supabase: supabase.com/privacy
• Apple: apple.com/legal/privacy/
• Google: policies.google.com/privacy
• RevenueCat: revenuecat.com/privacy/

TravelerApp does not use advertising SDKs, cross-app tracking, or device fingerprinting.

6. Data Sharing and Disclosure

We share your personal data only in the following circumstances:

• With other users, when you post content in community features. Your display name, avatar, and shared content (including landmarks, events, and journeys you publish) become visible to other users of the Services. Community photos are stored in publicly accessible storage buckets and are reachable by URL. Do not post information you do not want to be seen publicly.
• With service providers identified in Section 5, acting as data processors / service providers under contract and bound by confidentiality and security obligations.
• For legal reasons, where disclosure is required by a subpoena, court order, or other legally binding request, or where we believe in good faith that disclosure is necessary to investigate fraud, enforce our Terms, or protect the rights, property, or safety of Reconchille Studios, our users, or the public.
• In business transfers, such as a merger, acquisition, financing, reorganization, or sale of assets, subject to the acquiring party honoring this Privacy Policy or providing equivalent protections.

We have not sold, and have not shared (for cross-context behavioral advertising), any personal information in the preceding twelve (12) months, within the meaning of Cal. Civ. Code §1798.130(a)(5)(C)–(D). We do not sell your personal data for monetary or other valuable consideration.

7. International Data Transfers

We store account data, user-generated content, and storage objects on Supabase servers in Frankfurt, Germany (EU) (AWS eu-central-1). AI prompts and place queries are routed through Google services, which process data in the United States. Subscription data is processed by RevenueCat in the United States.

Where personal data is transferred outside the European Economic Area or the United Kingdom, we rely on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Agreement (IDTA), and supplementary technical and organizational measures such as encryption in transit and at rest.

8. Data Retention

We retain personal data only for as long as necessary to deliver the Services, fulfill the purposes set out in this Privacy Policy, and meet our legal obligations.

• Active accounts: retained for the lifetime of the account.
• Journeys, saved places, and other content: retained until you delete them or delete your account.
• Ranger safety alerts: auto-expire on a per-type basis, ranging from approximately 8 hours to 365 days depending on the alert category.
• After account deletion: data is removed from production systems and purged from encrypted backups within thirty (30) days.
• Anonymized data: may be retained indefinitely because it can no longer be linked to you.
• Legal holds: where we are required by law to retain data longer (for example, for tax or consumer protection purposes), we retain it only for the period required by that law.

You may delete your account at any time directly in the App via Profile > Settings > Delete Account. Deletion triggers cascading removal of your user-generated content, your uploaded files, and your authentication record, subject to the backup retention window above. As an alternative, you may email us at info@reconchillestudios.com to request deletion.

9. Your Privacy Rights

9.1 GDPR and UK GDPR (EEA and United Kingdom)

Under the GDPR and UK GDPR, you have the following rights with respect to your personal data:

• Right of access — to obtain confirmation and a copy of your personal data;
• Right to rectification — to correct inaccurate or incomplete data;
• Right to erasure ("right to be forgotten");
• Right to restriction of processing;
• Right to data portability — to receive your data in a structured, commonly used, machine-readable format;
• Right to object to processing based on legitimate interests;
• Right to withdraw consent at any time, where processing is based on consent;
• Right to lodge a complaint with your local Data Protection Authority or, in the UK, the Information Commissioner's Office.

To exercise these rights, contact us at info@reconchillestudios.com. We will respond within one month, extendable by two additional months for complex or numerous requests.

9.2 CCPA / CPRA (California Residents)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, disclose, and (if any) sell or share — including the right to request the specific categories and the specific pieces of personal information we have collected;
• Delete your personal information, subject to statutory exceptions;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information — we do not sell or share personal information as defined by the CCPA, so no "Do Not Sell or Share My Personal Information" link is required;
• Limit the use and disclosure of Sensitive Personal Information (see Section 9.3);
• Non-discrimination — we will not discriminate against you for exercising any of these rights, and we do not offer financial incentives in exchange for your personal information.

We will acknowledge a verifiable consumer request within ten (10) business days and respond within forty-five (45) days, extendable by an additional 45 days where reasonably necessary, with notice to you. We will verify your identity before processing your request. You may designate an authorized agent to make a request on your behalf, subject to verification.

9.3 Sensitive Personal Information (CCPA)

Under the CCPA, precise geolocation is treated as Sensitive Personal Information (SPI). We collect and use precise geolocation only for purposes necessary to provide the Services you request — such as showing nearby content, recording journeys, and powering location-based AI features — which fall within the excepted purposes set out in Cal. Civ. Code §1798.121(d) and the implementing regulations. We do not use or disclose precise geolocation to infer characteristics about you, and we do not use SPI for any purpose that would entitle you to limit its use beyond what is described here.

9.4 Notice at Collection (California)

The categories of personal information we collect, and the business or commercial purposes for collecting them, are as follows:

We retain each category only for the periods described in Section 8, and we disclose these categories to the service providers listed in Section 5 for the purposes stated.

10. Children's Privacy

TravelerApp is not directed to children, and you must be at least 13, or the minimum age of digital consent in your country (16 in the EEA, unless a member state has set a lower age between 13 and 16), to use the Services. Age is self-declared; we do not operate an enforced age-gate. We do not knowingly collect personal data from children below the applicable minimum age. If we become aware that we have inadvertently collected such data, we will delete it promptly. Parents and legal guardians who believe their child has provided us with personal data may contact us at info@reconchillestudios.com.

11. Security

We authenticate accounts using email one-time codes, Sign in with Apple, and Google Sign-In; we do not use or store passwords. We implement industry-standard technical and organizational safeguards to protect your personal data, including:

• Encryption in transit via TLS 1.2 or higher for all API traffic;
• Encryption at rest for data stored in Supabase;
• Row-Level Security (RLS) policies at the database layer to enforce per-user access;
• Server-side service-role credentials kept off the client and rotated periodically;
• Least-privilege access controls for engineers and administrators;
• Regular encrypted backups with defined retention windows;
• Logging and monitoring of authentication and administrative events.

No system can guarantee absolute security. If we become aware of a security breach affecting your personal data, we will notify you and the relevant supervisory authorities in accordance with applicable law.

12. Location Data

The Services request precise location access to deliver core functionality, including nearby landmarks, events and safety alerts, journey recording, weather, and AI-based recommendations. Location access is foreground-only (When-In-Use); the App does not collect location data while running in the background and does not request "Always" location. Journey recording samples GPS only while the App is in the foreground and stores only latitude, longitude, timestamp, and accuracy.

Photo metadata. Community photos (for events and landmarks) are stored in publicly accessible storage buckets reachable by URL. We do not guarantee that EXIF metadata (which can include the location and time a photo was taken) is stripped before upload. Please be mindful of metadata in any photo you choose to share publicly.

You may revoke location permission at any time via iOS Settings > Privacy & Security > Location Services > TravelerApp. Without location access, some features may be limited or unavailable.

13. Cookies and Similar Technologies

The iOS App does not use cookies or cross-app tracking technologies. Our website, if any, may use strictly necessary cookies required for site operation. We do not use advertising cookies or third-party analytics that rely on cross-site tracking.

14. Apple App Store Disclosures

Consistent with Apple's App Store privacy nutrition labels, we disclose the following data categories that may be linked to your identity:

• Contact info: email; optionally name;
• User content: photos, user-generated content, support messages;
• Identifiers: Apple ID, Google ID, internal user ID;
• Purchases: subscription entitlements and purchase history;
• Location: precise, while using the App;
• Diagnostics: crash data, performance data.

We do not use any data for tracking, as defined by Apple's App Tracking Transparency framework (the App declares no tracking and does not request the IDFA). We do not link data to third-party data for advertising or measurement purposes, and we do not share data with data brokers. The App sends no remote push notifications.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you in advance through an in-app notice or by email sent to the address associated with your account. The "Effective Date" at the top of this page indicates when this Policy was last revised.

Continued use of the Services after the effective date of the revised Policy constitutes your acceptance of the changes. Where required by law, we will obtain your affirmative consent before material changes take effect.

16. Contact and Data Controller

The data controller responsible for your personal data is:

For privacy-related inquiries, requests to exercise your rights, or complaints, please write to us at the email address above. Where required by applicable law, you may also lodge a complaint with your competent supervisory authority.