Gallivanter Privacy Policy

Last updated and effective: 28 October 2026 · Version 1.2 · Turkish original: gizlilik-politikasi.md (the Turkish text prevails in Türkiye)

This policy explains how personal data is processed when you use the Gallivanter mobile app (the "App", the "Service"). It is the information notice required by Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and, for users in the European Union/European Economic Area (EU/EEA), also contains the information required by Article 13 of the General Data Protection Regulation ("GDPR").

1. Controller and contact

The controller can be reached for all requests about this policy at the email address above. No postal address is published. Notices and requests are handled by email at support@gallivanter.net; a postal address is available on request where the law requires it, and is given to the competent authorities and to Apple and Google as the store accounts require.

2. What we process, why, and on what legal basis

The App shows no ads, uses no advertising ID, no advertising or third-party tracking SDKs and no cookies. Your personal data is collected by automated means (through the App and our servers) for the purposes and on the legal bases listed below.

Providing data. The email address or Google/Apple sign-in, a username, and the age and terms confirmation are needed to enter into the contract; without them we cannot provide an account. Everything else (location, notifications, photos, crash reports, usage statistics, profile details) is optional. Your data comes from you, from your device and, if you use that sign-in method, from Google or Apple; we do not buy data from other sources and do not combine it with data from elsewhere. Where we rely on legitimate interests, we weigh them against your rights and you may object (Section 8).

What we do not use: advertising ID, advertising and third-party tracking SDKs, cookies, contacts, calendar, camera, microphone, background location, and sending your precise location to our server. The App does not track you across other companies' apps or websites and does not combine your data with other data for advertising.

2.1 Push notifications

If you allow notifications, the App registers your device's Expo push token with our server (with the platform, an opaque device installation ID and the device language; at most 10 devices per user, the oldest is dropped). Notifications are delivered through the Expo push service and, on Android, Google Firebase Cloud Messaging (FCM) and, on iOS, the Apple Push Notification service (APNs). To receive notifications on Android, your device registers with FCM and obtains a registration token; during this registration Google processes the token and a Firebase identifier of the app installation. No Firebase analytics, advertising or other module is used in the App. These services carry the notification title and text, the page the App should open and the badge count; a chat notification contains the first 120 characters of the message. A push is sent only under the same rules as the in-app notification (your preferences and blocks) and, for chat, only while the App is not open. Notifications cover follows, follow requests, accepted requests and chat messages.

To turn them off, switch off Gallivanter notifications in your operating system settings or turn off individual preferences in Settings > Notifications. Signing out deletes that device's token from our server; deleting your account deletes all your tokens; a token is also deleted when the push service reports that the device is no longer registered.

2.2 Crash reports and usage statistics

• Crash reports (processor: Sentry). On by default. When the App crashes or an error occurs, the error type and stack trace, app version, device model, operating system version, device context such as network status, and the time of the error are sent to Sentry. Only your account's user ID (UUID) is attached; email address, name, session token, request headers and query parameters are removed before the report leaves the device, and message and photo content is not included. You can switch this off at any time in Settings > Privacy and security > Send crash reports; after that no new reports are sent.
• Usage statistics (processor: PostHog). Off by default and only active if you consent in the App. If you consent, predefined in-app events such as screens opened and features used, the app version, device type, a random analytics ID and, if you are signed in, your account's user ID (UUID) are sent. Your messages, search terms, location, email address and name are never sent, and location lookup from the IP address is disabled. You can withdraw consent at any time in Settings > Privacy and security > Usage statistics; after that no new data is sent. Withdrawing consent does not affect the lawfulness of earlier processing.
• Both providers are used in their EU data region and are configured not to store IP addresses.

2.3 Sign in with Google and Apple

Instead of an email and password you can sign in with your Google account (Android and iOS) or your Apple ID (iOS only). Sign-in runs through our authentication service, Supabase Auth, in a browser session using OAuth (PKCE); your Google or Apple password never reaches the App or us. The App contains no separate Google or Apple sign-in SDK.

• Information received: from Google only the openid, email and profile scopes are requested: account ID, email address and whether it is verified, and the name and profile photo link of your Google account. From Apple we receive the account ID and email address; if you choose to hide your email, Apple's relay address is sent, and a name only if you choose to share it. This information is kept in your sign-in record in the authentication service.
• Your Gallivanter profile: your Google or Apple name and photo are not copied to your Gallivanter profile and are not shown to other users; you choose your username, display name and profile photo yourself. On first sign-in you are asked, as with email sign-up, to confirm that you are 16 or older and to accept the Terms of Service.
• Role of Google and Apple: Google and Apple process the data of your accounts with them and the sign-in itself as independent controllers under their own privacy policies. They learn that you signed in to Gallivanter; your activity in the App is not shared with them.
• Removing the link: you can remove Gallivanter's access in the third-party connections of your Google Account security settings or, on iOS, in Settings > [your name] > Sign in with Apple. This does not delete your Gallivanter account; for account deletion see Section 9.

2.4 Community events

You can add your own event to the App (a community event). The title, description, category, start and end time, venue (the venue name, address and city you enter and, if you choose, a map position taken from your device location), cover photo and optional ticket link you add are stored, and the event is shown with your profile as the organizer (username, display name, profile photo) in the App's public event lists and search, next to other events. Users who block each other do not see each other's events; events of suspended accounts are not shown. You can also share an event with friends only: a friends-only event is visible, and can be joined or commented on, only by people you follow who also follow you (and by you and the moderators), and does not appear in public lists, search or share pages.

• The cover photo is processed like other photos (location and device metadata are removed).
• A ticket link can only be an https link to an allowed ticket sales site. A user who taps it leaves the App and goes to that site; the site's own terms and privacy policy apply, and we send no user data to these sites.
• To prevent abuse a daily limit applies and a second event with the same name at the same venue on the same day cannot be added; for this the server counts the events you added in the last 24 hours (including deleted ones).
• Community events are subject to the Community Guidelines and can be reported. An event reported by 3 different people is hidden without waiting for review; moderators can remove events that break the rules.

3. Who can see what

• Public accounts' profiles and comments are visible to other users of the App. Private accounts' profiles are visible only to approved followers.
• Photos live in a publicly readable storage bucket. Their URLs contain unguessable random IDs but are not secret: anyone who has a URL can open the photo, including photos of private accounts, until it is deleted and purged (Section 7).
• Event RSVPs follow block and private-account rules; a private account's RSVP is visible only to that user and approved followers.
• Community events you add are shown with your profile as the organizer in the public event lists, even if your account is private (Section 2.4). A hidden event is visible only to you and the moderators.
• Open and approval groups have a public web page (gallivanter.net/g/...) that anyone can open without an account: it shows the group's name, description, category, city, university, the number of members (a count only, never names) and up to five upcoming public events. Secret groups and hidden or deleted groups have no page; approval groups' pages are not indexed by search engines.
• Messages are visible only to members of the conversation. That includes photos sent in a chat, reactions, replies, edits and the read markers ("seen"): they are visible to the chat's members only. The photo files are stored with an unguessable random name, are not shown anywhere else and are deleted when the message is deleted or the sender's account is deleted. When you join or leave a group the group chat shows a short system line ("joined" / "left"); a removal or ban is shown as "left". Typing indicators are relayed live and never stored. For a group's chat room that means the group's current members.
• Your answers to the onboarding questions (purposes, interests, when you are available) and your university name also stay only on your device; they never reach our servers, so nobody can see them.
• Users who block each other cannot see each other's content or search results.
• Reports and the related content are reviewed only by the controller and moderators authorized by the controller.

4. Location

Location permission is "while using the app"; no background location is collected. If you decline, the App keeps working (only distance and nearby ordering are missing). The coordinate on your device is rounded to about 1 km before it is sent to our server. The server does not store your location against your account; your last location is kept only on your device. GPS data in uploaded photos is removed on our server. Your location is not shared with other users.

5. User content

You are responsible for the comments, messages, community events, groups and photos you submit. By submitting content you grant us the limited license needed to run the Service (Terms of Service, Section 4). Content that violates the Community Guidelines may be removed. Your content is not used for advertising, not sold, and not used to train artificial intelligence models or given to third parties for that purpose. User content is not sent to the translation service either. The App does not generate text about your content with artificial intelligence.

6. Recipients, processors and third parties

We do not sell personal data. Your data is transferred only to the service providers below, to the extent needed to run the Service. Processors process data only on our behalf and on our instructions, under their data processing agreements.

Changes to recipients. This table is the list of our recipients and processors. If we add or replace a processor that handles personal data, we update this table before the change takes effect where possible, and announce material changes as described in Section 13. If the Service is ever sold or transferred to a successor, your data may pass to it only on the condition that it keeps to this policy; we tell you in the App beforehand and you can delete your account. We never sell personal data.

6.1 International transfers

Your account and content data is held in the EU (Supabase: Ireland; Railway: EU). These providers, as well as Expo, Sentry and PostHog, are US-based companies and may access data remotely from the US for maintenance and support. Push tokens and notification content may be processed in the US by Expo, Firebase Cloud Messaging and the Apple Push Notification service. Because translation runs on our own server in the EU, no data is transferred to another provider or outside the EU for translation. When you sign in with Google or Apple, the sign-in takes place on that company's own infrastructure under its own policies. The controller is established in Türkiye and accesses the data from Türkiye.

• Under KVKK: transfers rely, under KVKK Art. 9, on the standard contract mechanism announced by the Personal Data Protection Board; where the provider's data processing agreement does not offer it and the other Art. 9 mechanisms are not available, occasional transfers rely on your explicit consent. You may withdraw explicit consent at any time; features that require the transfer (for example push notifications) may then be unavailable.
• Under the GDPR: transfers outside the EU/EEA to countries without a European Commission adequacy decision rely on the provider's data processing agreement incorporating the European Commission's Standard Contractual Clauses (SCCs) and, where the provider is certified, on the EU-US Data Privacy Framework. You can request a copy of these safeguards at the contact email.

7. Retention

We keep your data for as long as the purpose requires (taking into account its nature and sensitivity, the risk of harm from misuse, whether the purpose can be reached another way, and legal requirements); afterwards it is deleted or anonymized. Account data is kept for as long as your account exists. The cleanup job for deleted data runs on the server every hour.

Where a statutory provision, a request from a competent authority or a pending legal dispute requires longer retention, the data concerned is kept only for that purpose and only as long as necessary.

8. Your rights

Under the GDPR (users in the EU/EEA) you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), to object to processing based on legitimate interests, including profiling (Art. 21), and to withdraw consent at any time where processing is based on consent (Art. 7(3); this does not affect the lawfulness of earlier processing).

Under KVKK Art. 11 you have the right to: learn whether your personal data is processed; request information if it is; learn the purpose of processing and whether data is used for that purpose; know the third parties in Türkiye or abroad to whom it is transferred; request rectification if it is incomplete or inaccurate; request erasure or destruction under KVKK Art. 7; request that rectification and erasure be notified to the third parties to whom the data was transferred; object to a result against you arising exclusively from automated analysis; and claim compensation for damage caused by unlawful processing.

How to exercise them:

• Write to support@gallivanter.net, preferably from the email address registered to your account. We may ask for additional information to verify your identity. We answer free of charge within 30 days at the latest; if a request involves an additional cost, a fee under the tariff set by the Turkish Personal Data Protection Board may be charged.
• A copy of your data (portability): if you want a copy of your data, write to support@gallivanter.net. The copy covers your profile, groups, events, RSVPs, comments, your own messages, follows, blocks and settings: we send the data of your account in a structured, machine-readable format (JSON) together with your photo files within 30 days at the latest, by email or via a secure download link.
• Account deletion: immediately in the App (Section 9).
• In-app tools: profile editing, private account, deleting comments, community events and groups, blocked users, notification preferences, switching off crash reports, withdrawing usage-statistics consent.
• Right to complain: if you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Board (www.kvkk.gov.tr). If you are in the EU/EEA, you can complain to the data protection supervisory authority of your habitual residence, place of work or place of the alleged infringement. If you are in the United Kingdom, you can complain to the Information Commissioner's Office (ico.org.uk); in Switzerland, to the Federal Data Protection and Information Commissioner; in Canada, Australia and New Zealand, to the privacy commissioner of your country or province; in the United States, to your state attorney general or the Federal Trade Commission.

8.1 Automated decisions and profiling

We do not make decisions that have legal or similarly significant effects on you solely by automated means, and we do not profile you for advertising or build interest profiles. The only automated steps are: a community event or group reported by 3 different people is hidden until a person has reviewed it (the owner can ask for review, Terms of Service Section 5); rate limits and daily limits that prevent abuse; and rules that apply automatically according to your age band (Section 10). You may object to a result against you arising exclusively from automated analysis (KVKK Art. 11) and ask for human review (GDPR Art. 22) at the contact email.

8.2 Users in the United States and other countries

We do not sell personal data, do not share it for targeted advertising, and use it only for the purposes in Section 2. Under the privacy laws of the United Kingdom, Canada, Australia, New Zealand, Switzerland and of US states such as California, you may ask to know what we hold about you and where it comes from (Section 2 lists the categories, purposes and Section 6 the recipients), to access, correct and delete it, to get a copy and to withdraw consent, and we do not treat you worse for using these rights. Use the same contact email; we answer within 30 days. If we refuse a request you may appeal by replying to our answer, and then contact the authority named above.

9. Deleting your account

In the App: Settings > My account > Delete my account (asks for confirmation; irreversible). If you cannot access the App, email support@gallivanter.net from your account's email address with the subject "Account deletion request"; we complete the request within 30 days. Step-by-step description: account-deletion.md.

On deletion:

• Your sign-in account (email address and password hash, or the sign-in information received from Google or Apple), profile, follow relationships, likes, comments, the community events you added, event RSVPs, likes and comments, notifications and preferences, blocks, conversation memberships and your devices' push tokens are deleted immediately.
• Groups you own pass to the longest-standing admin or, if there is none, the longest-standing member; a group with no other members is deleted. Your memberships in other groups are deleted immediately.
• All files you uploaded are deleted from storage through the cleanup queue: usually within a few hours, at the latest within 7 days.
• Messages you wrote are part of the other participants' conversation history and are therefore not deleted; they remain with the sender detached from your account (shown as "Deleted user") for as long as the conversation exists. Conversations left with no members are deleted with their messages. If your messages contain information that identifies you, you can ask for their deletion at support@gallivanter.net.
• Report records: your identity is removed immediately from reports you filed. Reports about you, moderation decisions and sanction records are kept for the periods in Section 7 and no longer link to a profile.
• Copies in backups are deleted automatically when the backup period ends (Section 7).
• Crash reports and usage statistics are deleted at the end of the provider retention periods (Section 7); you can ask by email for earlier deletion.
• If you signed in with Google or Apple, deleting your account does not by itself remove the app connection in your Google or Apple account; you can remove it separately as described in Section 2.3.

10. Children

The Service is not directed at people under 16; you must be at least 16 years old to use it. When you create your profile you are asked to confirm that you are 16 or older and to accept the Terms of Service. Age is self-declared; we do not verify age with identity documents. We do not knowingly collect personal data from anyone under 16, including children under 13 who are protected by US children's privacy law (COPPA); if we learn that we hold such data, we delete it.

If you believe an account belongs to someone under 16, report it in the App with Report from the menu on their profile, or write to support@gallivanter.net. Parents and guardians can also write to that address to ask for their child's account to be deleted. Accounts found to belong to someone under 16 are deleted together with their data as described in Section 9.

Users aged 16-17. When you create your profile you choose an age band (16-17 or 18+). Only the band is stored, never a date of birth; it is visible only to you and to our moderators, and only support can change it. 16-17 accounts are private; an adult cannot send messages to a 16-17 account until that account accepts a message request; they can decline or block at any time; they are not shown to adults in suggestions, nearby lists, member or attendee lists unless there is a follow relationship; an adult can find them only by searching for their name or username, and that search shows just a name, username and picture; and they can create friends-only events, or events inside their own approval or secret group that only that group's members can see, but not public events. Accounts aged 16-17 can create groups, but only groups that need approval to join or are secret (invite only); they cannot create or switch to a public (open to everyone) group.

11. Security

All communication between the App and our servers is encrypted with TLS (https). Database tables use row-level security and only our server can access the database. Session tokens are kept in secure device storage; passwords are kept as hashes by the authentication service. Location and device metadata are removed from uploaded photos. Messages are not end-to-end encrypted: they are stored on the server, and the controller may access them only where moderation, security or a legal obligation requires it. No system is perfectly secure. Access to the database and the moderation tools is limited to the controller and moderators the controller authorizes (Section 3). In the event of a data breach we notify the Turkish Personal Data Protection Board under KVKK and, where required, the competent supervisory authority under the GDPR within 72 hours, and where the breach is likely to put you at high risk (and under US state breach laws where they apply) we inform affected users as soon as reasonably possible, telling them what happened, what data is affected, what we are doing and whom to contact.

12. Cookies and tracking

The App uses no cookies and no advertising trackers. On your device it keeps a session token in secure storage and your preferences and caches in local storage (Section 2, last row); the only third-party software modules in the App that collect data are the crash-reporting module (Sentry) and, only with your consent, the usage-statistics module (PostHog), described in Section 2.2, plus the push registration described in Section 2.1. Because the App does not track you across other companies' apps or websites, it does not act on browser "Do Not Track" or similar signals; there is nothing to opt out of other than the switches in Settings > Privacy and security. and we do not track you across other companies' apps or websites. Usage statistics run only with your consent. The web pages that publish this policy use no cookies, scripts or analytics; the legal links in the App open these pages in the browser. The sign-in pages opened when you sign in with Google or Apple belong to those companies and are subject to their own cookie policies.

13. Changes

We may update this policy. We announce material changes in the App before they take effect; if a change introduces new processing based on consent, we ask for your consent separately. The current version is always available at https://gallivanter-production.up.railway.app/legal/privacy and in the App under Settings.

14. Changes in this version (1.2, 28 October 2026)

• Said that accounts aged 16-17 can create their own approval or secret groups and create events inside that group that only its members can see (Section 10).
• Said that an adult can find a 16-17 account only by searching for its name or username, and that the search shows just a name, username and picture (Section 10).
• These changes affect who can see the data of these accounts, so you are asked to accept again together with the Terms of Service.
• Said that the answers to the onboarding questions (purposes, interests, when you are available) and your university name are kept only on your device and never sent to the server (Sections 2 and 3).
• Removed the optional birth date and gender from the Account screen: the App no longer asks for them, and what an earlier version kept on your device is deleted (Sections 2 and 3).

Earlier version (1.1, 12 October 2026)

• Said that the optional birth date and gender in the Account screen are kept only on your device and never sent to us (Sections 2 and 3), described the data download and the Account screen deletion path (Sections 8 and 9), and added the chat room of each community group (Sections 2 and 3).
• Described the optional university name, the organization application and the anonymous source counter (Section 2); the other onboarding answers (purposes, interests, city) stay on your device.
• Added sign-in with Google (Android and iOS) and Apple (iOS) and the role of these services (Sections 2.3 and 6).
• Added community events, their visibility and retention (Sections 2.4, 3 and 7).
• Described the data Firebase Cloud Messaging processes for Android notifications, and links to ticket sites (Sections 2.1 and 6).
• Added the data protection officer and UK representative statements (Section 1), whether providing data is required and where data comes from (Section 2), the change of processors and business transfer rules (Section 6), complaint authorities, automated decisions and profiling, and a section for users in the United States and other countries (Section 8), COPPA (Section 10), breach notification content (Section 11) and on-device storage and tracking-signal disclosure (Section 12).
• Stated that translation runs on our own server and that no text is generated with artificial intelligence (Sections 5 and 6).