This policy explains which personal data the Vizigo mobile app processes and why, who it is shared with, and how you can exercise your rights. It is based on Turkey's Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR).
1. Data controller
Muhammed Samet Temiz · vizigotravel@gmail.com
2. What data we process
Account details: email address and password (the password is stored only by our authentication provider, encrypted; we cannot see it). If you sign in with Google, the email address and account ID that Google shares with us.
Profile: your optional display name, app language, preferred map app and currency.
Passport details: only which country issued your passport and its type (e.g. ordinary, special). A passport number, photo or any other document detail is NEVER requested or stored.
Your trip plans: chosen country, cities, dates, number of travellers and plan content; in group plans, the members and who invited them.
Ratings: the 1–5 star ratings you give to places (no written reviews are collected).
Usage counters: counters such as the monthly plan limit of the free plan.
Location: only when you tap "Turn on location" and allow it; used to calculate distances to nearby places and directions. No location history is stored.
Group live location (optional): if you turn on location sharing in a group trip yourself, your latest position (latitude, longitude, accuracy, time of update) is shared only with the members of that trip; while it is on, it is updated also when the app is in the background and the screen is off, and a permanent notification shows this. When you turn it off, your location is deleted immediately; when the trip or the pass ends, sharing stops automatically and the location is deleted. No location history is kept. A one-time emergency location you send with "Share my location (emergency)" is visible only to the members of your group and is deleted after 7 days. A phone number you optionally share for "Call" is visible only to the members of that trip.
Data kept on your device: offline packages, the latest exchange rates and your preferences are stored only on your phone.
Feedback (optional): if you send feedback from within the app, we store your message, the category you chose (bug, suggestion, other), if you wish a screenshot of the current screen, and technical information (app version, device model, operating system, language, name of the screen). Feedback is not linked to your account; no location, passport or account details are added. You can turn the screenshot off before sending; the screenshot shows whatever is on the screen at that moment.
Anonymous usage measurement and crash reports (optional, off by default): only if you allow it, we receive which screens and features are used (e.g. visa map, plan creation, Where am I?, group plan), the number of plans created and app crashes (error type and technical trace). This data is stored with a random identifier created on your device and is not linked to your account; no location, passport, email or content you type into the app is sent. You can turn your permission off in Profile at any time; when you do, sending stops and the random identifier is deleted from your device.
Notifications (optional): only if you turn them on in Profile → Notifications and grant your phone's notification permission, a notification address (token) belonging to your device is stored together with your account and notifications are sent only for the types you choose (SOS, group live location, group invitation, entry form reminder, visa / entry rule change). When you turn notifications off or delete your account, this address is deleted.
Voice commands (optional): if you tap the microphone in the search box, your phone's microphone permission is requested on first use and what you say is converted to text on your device by your phone's own speech recognition service, only while it is listening. The audio and the recognised text are not sent to us and are not stored; the text is only used to open the matching screen.
3. Why we process it (purpose and legal basis)
To create your account and provide the service — performance of a contract (KVKK Art. 5/2-c, GDPR Art. 6/1-b).
To show visa information for your passport and prepare plans — performance of a contract.
Distances and directions based on your location — your explicit consent (KVKK Art. 5/1, GDPR Art. 6/1-a); you can withdraw permission at any time in your phone settings.
Security, preventing misuse and legal obligations — legitimate interest and legal obligation.
4. Who we share it with
We do not sell your data or share it for advertising. To provide the service, it is shared only with these service providers, and only as much as needed:
Supabase: database, authentication and file storage.
Google: only if you sign in with Google, for authentication.
Routing provider (OSRM): when you ask for directions, the start and destination coordinates are passed on through our server.
Wikimedia Commons: place photos are loaded by your phone directly from this source; your IP address reaches Wikimedia when this happens.
Open-Meteo: for weather forecasts, only the coordinates of your destination are sent; no information about you is sent.
Google Firebase Cloud Messaging: only if you turn on notifications, the notification address (token) and the notification text, to deliver notifications to your phone.
Google Firebase Crashlytics: only if you allow anonymous usage statistics and crash reports, crash reports from the Android app are sent to this Google service. A report contains the error type and technical trace, the app version, device model and operating system, and a random installation identifier created by Firebase; your account, e-mail, location and passport information are not sent. If you turn the permission off, collection stops and unsent reports are deleted from your device.
The servers of these providers may be located abroad. In that case your data is transferred in line with the transfer rules of KVKK Art. 9 and the GDPR.
5. How long we keep it
Your account and plan data are kept as long as your account is open. When you delete your account, the data is permanently deleted immediately and removed from technical backups within 14 days at the latest. Records we are legally required to keep are kept for the required period.
Feedback, anonymous usage measurement and crash reports are kept for at most 12 months and then deleted automatically.
6. Deleting your account
You can permanently delete your account and your data under Profile → Delete my account. Other people's group plans are not broken: a shared plan you own passes to another member and your name is removed from the plan. If you use the app without signing in, you can delete the data on your phone under Profile → Clear data on this device.
7. Your rights
Under KVKK Art. 11 and GDPR Art. 15–22 you have the right to access your data, have it corrected or deleted, restrict processing, object, and receive your data in a portable format. Send your request to vizigotravel@gmail.com; we reply within 30 days at the latest. You can lodge a complaint with Turkey's Personal Data Protection Board or the supervisory authority of the EU country where you live.
8. Children
The app is not intended for children under 16 and we do not knowingly collect data from them.
9. Security
Data is sent over encrypted connections; in the database each user can access only their own data.
10. Changes
If we update this policy, we will announce the change in the app. Effective date: November 5, 2026.