Privacy Policy
Last updated: 15 October 2026
Data controller: gezgez · Contact: info@gezgez.org
- We show no ads, use no analytics or tracking tools, and do not sell your data. We share it only with the service providers described below, so they can perform the specified task.
- An account is required to use the app. Your plans, travel memory and journal are backed up to your account and are visible only to you.
- The photos, videos, audio recordings and text you add to your journal are not used for anything else and are never sent to any AI service. Location data is removed from photos and videos.
- Location is off by default. If you turn it on, no continuous location history is kept; only the moment you reach a stop in your plan is recorded.
- You can permanently delete your account in the app or through the account deletion page.
Contents
- What stays on your phone
- What is sent to the server when planning
- Your account
- Location
- Journal: photos, videos, audio and text
- Notifications
- Abuse protection
- Server logs
- Other services
- Collection methods and legal bases
- Where data is stored
- Retention periods
- Your rights
- Children
- Changes
1. What stays on your phone
An account is required to use gezgez. The following are stored in the app's database on your phone:
- The plans you create (city, dates, stops, times, route and the accommodation point you chose); also synced to your account (see 3)
- Travel memory: the stops you have visited (see Location); also synced to your account
- Journal pages: photo, video, audio recording and text; the photo you choose for an album cover (see 5); also synced to your account
- My meals: the cards of the dishes you mark with "I ordered this" on a menu, including the photo, video, voice note, text and restaurant name you add to a card (see 5); also synced to your account
- Your menu scans: the translated list of the menus you scan, the city, the date and the restaurant name you enter; also synced to your account. The menu photo is not stored.
- The dietary needs (vegetarian, allergens and so on) and religious practice you choose in the menu scanner and when setting up a trip; these stay only on the phone. When a trip plan is synced to your account, these choices are removed from it.
- Your settings (language, visit verification mode); these stay only on the phone
Your session key is kept in the phone's secure key store. The random device number generated by older versions of the app is no longer used; it is deleted from the phone the first time the updated app opens.
When you sign out, your plans, travel memory, journal and the records belonging to your account are deleted from the phone; they stay in your account and come back when you sign in again. Language and visit verification mode stay on the phone as device settings. Uninstalling the app deletes all of this from the phone.
2. What is sent to the server when planning
The plan is computed by our server, not by your phone. For this, the following is sent to the server:
- City, dates and number of days
- The transport types you chose, your trip pace, your interests and whether you want food suggestions
- If you confirmed an accommodation point, its coordinates and name
- The app's language
While the plan is being prepared, the job is held in the server's memory and is deleted at most one hour after it finishes. The job belongs to the account that started it; no other account can see its status or result. The finished plan is saved to your phone and synced to your account (see 3).
Other features of the app also send requests to the server:
- City and address search: the text you type or the point you tap on the map.
- "Use my location" (accommodation question): your current location, sent once to find places to stay near you.
- Food nearby, live departures, place information: the coordinates and names of the stops in your plan.
- Menu scanner: the menu photo you take or choose, the dietary needs you selected and the city of your open trip. An allergy or religious-practice choice can reveal special-category health or belief data. Before the first transfer, the app separately explains that the data goes to Google Gemini and asks for your explicit agreement; if you do not agree, it does not open the photo picker or upload a photo. The consent setting is visible on the menu screen and can be withdrawn at any time. The server does not store the photo or your dietary needs. Immediately before each transfer, it records only your account, the version of the consent text shown, the time you agreed on the device and the time the server observed it as consent evidence; the photo, city and dietary needs are not part of that evidence record. The translated list is saved on your phone as a "menu scan" and synced to your account (Profile, Your menu scans); it stays until you delete it. Everything visible in the photo (people at the table, a receipt) is part of this request.
Every request to the server carries your session key; your name and email are not part of the requests, the server recognises you by the session key.
3. Your account
Sign-in data
| sign-in method | what is stored |
|---|---|
| Google or Apple | The user number the provider assigns you, your email address and your name. Your password never reaches us: Google or Apple performs the sign-in and we only receive a signed identity token. When signing in with Apple you can choose to hide your email. |
| Email and password | Your email address and a one-way transformed form of your password. The password itself is never written anywhere. Emails are sent to this address to verify it and to send password reset links. |
One account is attached to an email address. If you sign in with the same address both with Google and with email and password, both lead to the same account. Older versions of the app may have created separate accounts for the same address; when you sign in in a way that proves the address (with Google, or with a verified email and password), the trips and visits in those accounts are gathered into your account.
Sessions
A session record is kept for each sign-in: your phone's operating system and version (e.g. "android 15"), and the time it was created and last used. Only a one-way hash of the session key is stored, not the key itself.
Synced data
The trips and visit records on your phone are backed up to your account and synced to your other devices. Trips created on a phone with older versions of the app, which could be used without an account, are attached to the first account that signs in on that phone:
- Trips: the full plan (city, dates, stops, including the accommodation point), except the religious practice and dietary needs you chose when setting up the trip
- Visits: place name, its coordinates, date, verification method, the accuracy of the location reading and your distance to the stop
- Journal: the text of your pages, the trip and day they belong to, the photo, video and audio files, and album cover photos (see 5)
- My meals: the dish's name on the menu, its translation, description, city and date; the text, restaurant name, photo, video and audio files you add to the card (under the same rules as journal files, see 5)
- Menu scans: the translated list, city, date and restaurant name. The menu photo is not stored on the server.
Purchases and trip passes
Trip Packages, the Extra City and GezGez Pro are bought through Google Play or the App Store. The store takes the payment; your card and payment details never reach us.
- Proof of purchase: after a purchase the app sends the store's proof of purchase to our server, which verifies it by asking Google Play or by checking Apple's signature. Stored: the product, the store transaction number, the purchase time and, if any, the refund time; for a subscription, the end of the period.
- Account tag: to confirm a purchase belongs to your account, the store receives your account tag: on Google Play a one-way hash of your user number, on the App Store your user number. Your name and email are not sent.
- Trip passes: which pass you planned which cities and dates with, when the pass was activated, remaining date changes and the number of menu scans you used.
- Free first trip: so the free first trip can be given only once, when it is used we store one-way hashes (SHA-256) of your sign-in provider's user number and your verified email address. These hashes remain after you delete your account; they do not reveal who you are and only stop a re-created account with the same identity from getting the free trip again.
- Store notifications: Google Play and the App Store notify our server about refunds and subscription renewals; these notifications only update the related purchase record.
4. Location
Location permission is requested only when you use a feature that needs it. Where the app uses location:
| feature | when it is read | where it goes |
|---|---|---|
| Visit verification (Profile → App), off by default | In While the app is open mode, only while the app is on screen. In In the background too mode, the phone checks whether you enter the area around the stops in your plan even when the app is closed; the operating system asks for separate permission for this mode. | Stays on the phone. A visit record is written only when you reach a stop. This record is synced to your account. |
| Journey screen (how far to the next stop) | Only while that screen is open | Stays on the phone and is not saved. |
| "Use my location" (accommodation question) | Once, when you press the button | Sent to the server (see 2). |
No continuous location history is kept. If location permission is not granted or visit verification is off, your location is not read.
5. Journal and My meals: photos, videos, audio and text
In the Journal tab you can create pages for each day of your trip. A page holds at most one photo, a video of up to 30 seconds, an audio recording of up to 3 minutes, and text. You can also put your own photo on an album cover instead of the city photo. The meal cards in the My meals tab hold one photo, one video, one voice note and text in the same way; when you add a card to a journal page the file is not copied, the page and the card show the same file. Only you add these; the app never takes photos or videos or records audio on its own. The rules below apply to the files of journal pages and meal cards alike.
- Permissions: camera access is requested only when you tap "Take a photo" or "Record a video", microphone access only when you tap "Record audio". When you choose from your gallery, only the photo or video you pick is read; the rest of your gallery is not accessed.
- Photos: resized on the phone so the long edge is 1600 pixels, and saved again. This removes the location and device information inside the photo (EXIF); the server also removes this information from any photo it receives. Album cover photos go through the same steps.
- Videos: at most 30 seconds and 100 MB. They are not re-encoded on the phone; a small preview photo is made from the first frame (and handled like a photo). The server removes the location information inside every video it receives, without touching the picture or sound. The copy on your phone is not changed.
- Where it is kept: on your phone and in your account on our server (see 11). The files can only be reached with your own session; no other account can see them.
- What it is used for: only to show it to you and to sync it between your devices. It is not reviewed, analysed, sent to AI services or shared with anyone.
- Deleting: when you delete a page or a meal card, its photo, video and audio recording are deleted from the server right away; if another page or card uses the same file, the file stays with it. When you change an album cover or go back to the city photo, the old cover photo is deleted. Deleting a trip also deletes its journal pages and album cover.
- Limit: each account has 1 GB of space in total for journal and meal card files; a 30-second video can take up tens of MB.
6. Notifications
Notifications such as "Your plan is ready" are scheduled on your phone itself. The device address needed to send remote notifications is not collected and is not sent anywhere.
7. Abuse protection
To limit requests arriving too fast from the same place, the source IP address is kept in application-server memory: for one minute for general requests, and for at most one hour for plans and account sign-up attempts. This memory record is not written to the persistent application database or application log. Because requests reach the server through Cloudflare, Cloudflare separately processes the IP address for its security and network services; this transfer is described below. Sign-up attempts are limited because the sign-up screen says whether an account already exists for an address; the limit slows down checking this for many addresses at once.
8. Server logs
To find errors, the application server writes the path of incoming requests to a technical log. These paths can include information from the request (e.g. a city name, or the coordinates of an accommodation point or a stop). The end-user IP address is not intentionally written to the application log; the reverse proxy's internal network address may appear. The application log is deleted when the server software is updated and restarted. Cloudflare security/network logs are separate from this application log and are governed by the Cloudflare account settings and contract.
9. Other services
Services the app connects to directly
To show content, the app connects directly from your phone to these services; they see your IP address:
| service | what for |
|---|---|
| Wikipedia, Wikimedia Commons, Wikivoyage | City and place photos, descriptions, city search |
| Google Maps (Google Maps Platform) | Map display. To deliver the map images to your phone, Google sees your IP address and the map area being displayed. This use is subject to the Google Maps/Google Earth Additional Terms of Service and the Google Privacy Policy |
| Expo (expo.dev) | Downloading app updates |
| Google / Apple | Only if you sign in this way |
| Google Play / App Store | Purchase and payment; only if you buy a package or subscription (see Purchases) |
When you tap a link in the app (Google Maps for directions, the city's public transport app or website, Viator for ticket and tour cards), that app or site opens; from there on, that service's own privacy policy applies.
Services the server uses
Requests from the app travel through the Cloudflare network and an encrypted Cloudflare Tunnel to our server in Türkiye. Cloudflare processes your IP address, request time and technical connection data for security, abuse prevention and delivery.
The server gathers city data (places, opening hours, weather, public transport, place descriptions) from open data sources and service providers: OpenStreetMap, Wikipedia and Wikidata, MET Norway and Visual Crossing (weather), Google Gemini (place descriptions and classification), Perplexity and Tavily (guide search), Viator (tickets and tours). These requests contain only city and place information; your identity, IP address and location are not sent.
There are three exceptions, and in none of them is your identity sent:
- The address/hotel search text you enter and coordinates you send by tapping the map or choosing "Use my location" are passed through our server to Geoapify to find an address. Geoapify sees the server IP address; it does not receive your account or your phone's IP address. Normal lookup results may be cached to avoid repeating the external request; an emergency-address lookup is not cached.
- If you chose car travel, your accommodation point and the stops are passed to the OSRM routing service to compute driving routes.
- The menu photo you take on the Menu tab, the names of the dietary needs you selected and the city are passed to Google Gemini for translation and marking. Allergies and dietary choices can reveal information about your health or beliefs. Selecting a need and using the feature are optional; before the first transfer, the app explains the transfer and asks for separate, explicit agreement to this processing. Consent can be withdrawn from the menu screen.
Proofs of purchase are sent from our server to the Google Play Developer API for verification (App Store proofs are verified on the server with Apple's signature; no extra request goes to Apple).
Account emails (verification, password reset) are sent through Resend, from its European Union region (Ireland). Resend sees only the recipient address and the content of the email; link and open tracking are turned off.
10. Collection methods and legal bases
Data is obtained electronically and partly by automated means from information you enter or upload in the app, device permissions you enable, Google/Apple sign-in providers, and technical records created when you use the app. The activities, purposes and legal bases are:
| activity | purpose | legal basis |
|---|---|---|
| Account, session, plan, sync, journal and saved menu-scan result | Provide the app service you requested and operate your account and device sync | Turkish KVKK Art. 5(2)(c), necessity for forming or performing a contract; GDPR Art. 6(1)(b), performance of a contract |
| Optional location, camera, microphone and gallery access | Provide only the location, journal or scanning feature you initiate | Performance of the service you request, plus the operating-system permission. You can withdraw device permission at any time. |
| IP-based limits, session security and technical records | Protect accounts and the service from abuse, attacks and errors | KVKK Art. 5(2)(f) and GDPR Art. 6(1)(f), the controller's legitimate interests, with impact on your rights minimised |
| Email verification, password reset and requests | Account security, communication with you and handling legal requests | Performance of a contract; where applicable, a legal obligation (KVKK Art. 5(2)(ç), GDPR Art. 6(1)(c)) |
| Purchase verification, trip passes and menu-scan counts | Provide and record the passes you bought or were given | Performance of a contract: KVKK Art. 5(2)(c), GDPR Art. 6(1)(b) |
| Keeping free-first-trip hashes after account deletion | Prevent the free pass from being claimed again and again with re-created accounts | Legitimate interests: KVKK Art. 5(2)(f), GDPR Art. 6(1)(f); only a one-way hash is kept |
| Sending menu restrictions that may reveal allergy/health or belief data to Gemini together with the photo and city | Translate the menu and mark the restrictions you requested | Separate, specific and withdrawable explicit consent under KVKK Art. 6 and GDPR Art. 9(2)(a). If you do not consent, this processing does not occur and you can continue using other features. |
Withdrawing consent does not affect the lawfulness of earlier processing; it stops this data being sent on later menu scans. A record may still be processed when strictly required by law or to establish, exercise or defend a legal claim. gezgez does not make decisions based solely on automated processing that produce legal or similarly significant effects for you.
11. Storage and international transfers
The application server, database and journal files run on our own server located in a home in Türkiye. Nightly backups are encrypted with GnuPG before leaving that server and uploaded to Cloudflare R2 object storage. The private decryption key is not held on the server or in R2. Cloudflare cannot read the encrypted backup contents, but it still processes technical data such as the account, object name/size and connection. The contractual R2 storage location and the applicable international-transfer mechanism must be recorded before production release.
Cloudflare, Google, Apple, Resend, Expo, Gemini, Geoapify and OSRM may process data outside Türkiye or the country where you are located, creating an international transfer. Each transfer is limited to the purpose and data stated above. Before production release, the controller records for each provider and country whether the transfer relies on an adequacy decision, an appropriate safeguard such as a standard contractual clause, or a statutory exceptional-transfer condition. A production feature is not enabled until its record and required agreement are complete.
12. Retention periods
| data | period |
|---|---|
| Account, trips and visits | Until you delete your account |
| Journal pages, photo, video and audio files | Until you delete them or your account; a deleted file leaves the backups within 30 days |
| My meals cards and their files | Until you remove them or delete your account; a deleted file leaves the backups within 30 days |
| Menu scans (translated list) | Until you delete them or your account |
| Menu explicit-consent evidence (text version and two timestamps) | Until you delete your account; the photo, city and dietary needs are not stored in this record |
| Menu photo | Not stored; on the phone it is kept in memory only while the app is open |
| Purchase records and trip passes | Until you delete your account |
| Free-first-trip hashes | For as long as the free first trip is offered; they remain even if you delete your account |
| Sessions | Expire after 60 days without use |
| Plan job | Deleted from memory at most 1 hour after it finishes |
| IP address | In memory only, at most 1 hour |
| Server logs | Until the server software is restarted |
| Database and journal file backups | 30 days |
13. Your rights
- Deleting your account: Profile → Account → "Delete account", or use the web account-deletion page. Your account, sign-in records, sessions, trips, visits and journal (including photo, video and audio files) are permanently deleted from the active system and removed from backups within 30 days at the latest. This cannot be undone. Purchase records and trip passes are deleted too; free-first-trip hashes remain. If your subscription is still active in the store, cancel it from your Google Play or App Store account.
- Signing out everywhere: Profile → Account → "Sign out on all devices".
- Deleting the data on your phone: signing out or uninstalling the app is enough; the copy in your account stays.
- Camera and microphone: you can withdraw these permissions at any time in your phone's settings; the rest of the journal keeps working.
- Turning location off: Profile → App → "Visit verification", or the location permission in your phone's settings.
- Other requests: write to info@gezgez.org to learn whether your data is processed and obtain information or a copy; correct inaccurate data; request deletion or restriction where the conditions apply; learn the recipients; exercise portability; object to legitimate-interest processing or direct marketing; withdraw consent; or object to a solely automated result that adversely affects you.
- Complaint: after the applicable controller-request process, you may complain to the Turkish Personal Data Protection Board; where GDPR applies, you may complain to the competent authority where you live, work or where the alleged infringement occurred.
14. Children
gezgez is not directed at children under 13 and does not knowingly collect data from them.
15. Changes
If this policy changes, the date above is updated. If the types of data collected expand, this is also announced inside the app.