Rotamigo
Privacy Policy
This policy explains how the Rotamigo mobile app and rotamigo.app process personal data. Users in Türkiye can find the statutory notice in the KVKK Notice.
1. Controller
Orhan Taşkıran (bireysel geliştirici). Contact by email only: [email protected].
2. Data we collect
- Account: email address, username, display name, 18+ confirmation, account status. With Sign in with Apple or Google, the provider identifier; with Apple, a refresh token kept only on our servers so we can revoke Apple access when you delete your account. Your second-factor record if two-step verification is on.
- Profile and what you share: bio, social links, travel style preferences, profile photo, posts, comments, stories, trips (city, dates, optional hotel), plans, routes, reviews, reference badges and trip memories.
- Messages: text, photos and voice messages in direct, group and plan chats, reactions and read status.
- Location: a one-time latitude/longitude only when you choose Location in a chat. We never track your location in the background. If you turn on showing your trip on the Explore Map (off by default), only the province is shown.
- Camera, photos and microphone: only when you take or pick a photo or record a voice message, and only for that content.
- Social activity: follows, blocks, likes, mentions, close friends list, story views and notifications.
- Device: push token, a random installation ID and platform, to deliver notifications.
- Safety and moderation: reports, up to 1,000 characters of content evidence, moderation decisions and short-lived rate-limit counters.
- Crash reports: stack traces, device model and OS version. Email, username, IP address and message content are not attached.
We do not access your contacts, SMS, call logs, health or financial data. We do not track you for advertising and we do not sell personal data.
3. Why we process data
- To create your account, keep you signed in and show your profile;
- to provide travel matching, feed, plans, routes and messaging;
- to send notifications if you allow them;
- to keep the community safe: preventing abuse, reviewing reports, rate limiting;
- to find and fix bugs;
- to fulfil export and deletion requests.
4. Service providers and transfers
| Provider | Purpose | Data shared |
|---|---|---|
| Supabase | Database, authentication, server functions | Account and app data (EU — Frankfurt) |
| Cloudflare (R2) | Photo and media storage/delivery | Images and voice messages you upload |
| Google Firebase Cloud Messaging | Notification delivery | Push token and generic notification text; no message content |
| Google Gemini API | Rotamigo AI travel assistant | Your questions and plan preferences (city, dates, style); not your account ID. Chats are not stored on our servers, only usage counts |
| OpenAI Moderation API | Automatic detection of harmful content | Text of posts, comments, routes and AI assistant messages; not your account ID |
| Sentry | Crash and error reports | Technical stack traces and device info (EU — Frankfurt) |
| Google Maps SDK | Map display | IP, device info, the map area being viewed |
| Photon (komoot), OpenStreetMap Nominatim, device geocoder | Place search | Search text or the point picked on the map; never your own location |
| Apple, Google | Sign in with Apple / Google | Identity data exchanged with the provider at sign-in |
| Resend | Verification and password reset emails | Your email address and email type |
Some providers are outside Türkiye; transfers rely on contractual safeguards as required by KVKK Art. 9.
5. Who can see what
Your username, display name and profile photo are visible to other users even with a private profile. With a private profile, your posts, stories and trip details are visible only to followers you approve. People you block cannot see your profile or content.
6. Retention
- Your account and content are kept until you delete your account; you can delete individual items any time.
- Photos you view are cached on your device for up to 7 days, and your latest feed and chat list for offline viewing; they are deleted when you sign out.
- Stories are visible for 24 hours; stories you add to highlights stay until you remove them.
- Rate-limit counters are deleted after 48 hours and unfinished media uploads after about 24 hours.
- When you delete your account, your profile is closed and anonymised immediately; media and your sign-in account are then permanently deleted (usually within an hour).
- Report and moderation records may be kept for a limited period (up to 2 years for closed cases) for community safety and legal claims.
7. Your rights
You can access, correct, delete and object to processing of your data. In the app, use Settings → Account → Export my data for a copy and Delete my account to delete your account. For other requests write to [email protected]. See Delete account.
8. Age limit
Rotamigo is for people aged 18 and over. We close accounts we learn belong to minors.
9. Security
Data is encrypted in transit with HTTPS; we use row-level access rules, short-lived tokens for private media and optional two-step verification.
10. Changes
We announce material changes on this page with an effective date and, where needed, in the app.