YeGezGet the app
Legal

Privacy Policy

Last updated: 21 September 2026

This policy explains how YeGez handles data. It is prepared under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”) art. 10. The Turkish version is the governing text; this English version is provided for convenience and, if the two differ, the Turkish text prevails.

Data controller: Mustafa Emir (individual app developer) Contact: m.emirofficial@gmail.com

In short

  • No account. No sign‑up, name, email or phone number. We keep no account record identifying you on our servers.
  • Purchases go through the store. Subscriptions are processed by the App Store or Google Play; we never see your payment or card details.
  • The free tier shows ads. Ads are served by Google AdMob; personalised ads only with your consent. Subscribers see no ads at all.
  • Usage measurement. We collect statistics tied to device and app‑level identifiers — never your name or email — to improve the app and measure our marketing.
  • Text you write. Feedback, venue suggestions and routes you share are stored on our server. Please don’t put personal data in those fields.

1. What we process, why, and how

a) Data kept only on your device. Your onboarding preferences (e.g. halal‑first ordering), the name and avatar you choose, the dishes, venues and cities you save, the routes you build, the trip dates you enter, your preview allowances, your language preference and your subscription status live in the app’s own storage (AsyncStorage) on your device. There is no server account for any of it; deleting the app deletes this data. Profile → Reset clears it all at once.

b) Usage measurement (Google Analytics 4 / Firebase). Screens viewed, time on screen, session and interaction events (e.g. seeing a paywall, choosing a plan, completing a purchase, generating a route) and the city being browsed at the time. Measurement runs through one of two layers:

Neither layer contains your name, email address or real‑world identity — but device and app‑level identifiers may still count as personal data. The data goes to Google and is subject to Google’s policies.

c) Ads (Google AdMob). Users without a subscription see banner and interstitial ads in the app, and — only if you choose to watch them — rewarded ads on locked content. To serve ads, Google’s ad SDK processes device information, IP address and ad interaction data:

d) Marketing measurement (Meta). To measure whether our promotion campaigns on Meta (Facebook/Instagram) work, we use Meta’s measurement SDK. This SDK shows no ads in the app; it only reports events such as install, app open and completed purchase (with amount and currency) to Meta, and processes device and app information. Linking to your advertising identifier is enabled only if you allow it in the ATT prompt; if you decline, measurement continues in aggregate and anonymously through Apple’s SKAdNetwork. Meta’s processing is governed by its own policies.

Unlike ad serving, this measurement also runs for subscribers: because it shows no ads and only measures which promotion led to an install or a purchase, a subscription does not switch this layer off. If you want to stop the link to your advertising identifier, withdraw the ATT / Tracking permission.

e) Location. For “nearby venues” and walking distances, your device location is used if you allow it in the permission dialog. Location is processed on your device; it is never sent to or stored on our servers, and never shared with third parties. You can turn the permission off at any time in your device settings; the feature still works without it (distances are simply not shown).

f) Notifications. If you save trip dates for a city, we offer to remind you before your trip and on the morning of it. The notification permission is requested at that point. Reminders are scheduled on your device; neither the notification content nor your trip dates are sent to our servers. Deleting the dates cancels the reminders, and you can revoke the permission at any time in your device settings.

g) Purchases. Subscriptions are sold through the App Store and Google Play and managed with RevenueCat. We never see payment or card details — Apple and Google process those. So that a subscription can be recognised across devices, RevenueCat processes an anonymous user ID generated by the app plus transaction and device information.

h) Venue data and Google reviews (third‑party content). Venue ratings, review counts, opening hours, photos and recent reviews come from Google Places and are cached on our server (Supabase). Reviews are shown unmodified, with the author’s publicly visible Google name, profile photo and profile link, and with attribution to Google. This content is never kept longer than 30 days; if it is not refreshed, it stops being shown. If you don’t want your own review to appear in the app, email m.emirofficial@gmail.com and we will remove it — you can also delete it through Google.

i) City requests. When you tap “request” for a city, we record only which city was requested, anonymously. No email address, device identifier or other personal data is kept.

j) Venue suggestions. When you suggest a venue from the app, we store only the fields you fill in (venue name, optional note and link, and the city in context). Please do not enter personal data in these fields; if you do so by accident, email us and we will delete it.

k) Feedback and messages you send us. In the in‑app feedback and “Contact us” flows, the free text you write, whether the message was positive or negative, the app version, the platform (iOS/Android), your interface language and the city you were viewing are stored on our server (Supabase). Messages are anonymous: we do not record who sent them, which is why we cannot reply to an in‑app message — use the email route if you want a reply. Please do not write names, phone numbers or addresses here. If you do so by accident, email us and we will delete it.

l) Routes you share. When you choose “share as a link”, a publicly accessible snapshot of that route is stored on our server and published on a web page anyone with the link can open. The published content is only the city, the stop rows, estimated walking/day statistics and the app version — your name, device identifier and any other personal data are not part of that record. You initiate the sharing; if you give the link to nobody the page is in practice unreachable, and it is excluded from search engines. To have a shared route removed, email us the link.

m) Images are AI‑generated. The dish, city and landmark images in the app and on this site are AI‑generated illustrative images. They are not photographs of a particular restaurant, plate or moment. Venue cards may additionally show real venue photos sourced from Google Places; those are presented with attribution.

n) App updates. The app can receive bug fixes through in‑app updates (Expo Application Services / EAS Update); during this, the version and basic device information (platform, app version) is sent to EAS servers.

o) Camera and menu scanning. The camera is used when you open the “Scan” screen, and only there; permission is requested the first time and the rest of the app works exactly the same if you decline. The camera frame is written to your device’s own temporary storage, text recognition runs on the phone (Apple Vision on iOS, Google ML Kit’s bundled model on Android), and the frame is deleted as soon as it has been processed. The image is never uploaded to any server, never sent to us or to a third party, and never stored. The text read from the menu is not sent either. Only the fact that a scan happened (counts such as how many lines were recognised and how many matches were found) enters the usage measurement in (b); the menu text or image does not.

ö) On‑device translation model. If you choose to read the menu in your own language, translation also runs on the phone. The translation engine depends on the operating system: Apple Translation on iOS (iOS 18 and later) and Google ML Kit on Android. In both cases the language pack is downloaded once — from Apple on iOS, from Google on Android; the download only starts after you approve it, and the request made to that provider at that moment includes your IP address. The translated text is not sent to the provider; once the model is downloaded, translation works offline.

p) Offline pack. If you choose to download a city’s pack, dish, city and landmark images and pronunciation audio files are downloaded from our content server (Supabase) and written into your device’s app folder, so they work abroad without internet. These files never leave your device; deleting the app deletes them too.

2. Legal bases (KVKK art. 5 / GDPR art. 6)

3. Transfers, including transfers abroad (KVKK art. 9)

For the processing described above, data is transferred to the relevant service providers. Their servers may be located outside Türkiye:

Transfers abroad for consent‑based processing (personalised ads, marketing measurement, location, notifications) take place under that same consent. Other transfers are limited, under KVKK art. 9, to the minimum data required to perform the service and are carried out under the relevant providers’ standard contractual clauses or undertakings. Each provider is subject to its own privacy policy.

4. Retention

5. Your rights (KVKK art. 11 and GDPR)

Under KVKK art. 11 you have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether it is used accordingly; to know the third parties to whom it is transferred at home or abroad; to request correction if it is incomplete or incorrect; to request erasure or destruction; to request that these actions be notified to third parties to whom the data was transferred; to object to a result reached solely by automated analysis that is to your detriment; and to claim compensation if you suffer damage. If you are in the EU, your GDPR rights of access, rectification, erasure, restriction, portability and objection apply.

How to apply: email m.emirofficial@gmail.com (in line with the Turkish Communiqué on the Procedures and Principles of Application to the Data Controller). Applications are answered free of charge within 30 days at the latest. If your application is refused, you may complain to the Turkish Personal Data Protection Board.

Practical notes: in‑app measurement is not tied to an account identifying you, so when handling a request we can only match a record to you using information you provide (e.g. a share link, or the date and content of your message). The surest way to stop measurement entirely is to delete the app. You can turn off ad personalisation from iOS Settings → Privacy & Security → Tracking or Android Settings → Google → Ads.

6. Children

YeGez is not directed at children and does not knowingly collect data from them. Our ad configuration is not flagged as child‑directed.

7. Security

Data is encrypted in transit (HTTPS). Because we hold no personal account data on our server, there is no dataset that would reveal your identity in the event of a breach; third‑party providers are subject to their own security certifications.

8. Website

Our website uses no cookies and runs no analytics; your visit is not measured. Fonts are served from the site itself. City and dish images are loaded from our content store (Supabase Storage); during that request your browser’s IP address and browser information reach the relevant hosting provider. Hosting providers may, by the nature of the service, process IP addresses in access logs for a short period.

9. Changes

We may update this policy; we will notify you in the app for significant changes. The current version is always published at the address behind the Profile → Privacy link in the app.

10. Contact

Data controller: Mustafa Emir · m.emirofficial@gmail.com