Privacy Policy

01Introduction & Data Controller

Welcome to Odyssey Journal ("we," "our," "us," or the "App"). We respect your privacy and are committed to protecting your personal data in full compliance with the Turkish Law on the Protection of Personal Data (KVKK - Law No. 6698), the General Data Protection Regulation (GDPR - EU 2016/679), and the California Consumer Privacy Act (CCPA).

This Privacy Policy explains how we collect, use, store, process, and protect your information when you use our mobile application and related web services at odysseyjournal.app.

• Data Controller: Arif Gültaş
• Data Protection & Privacy Contact: privacy@odysseyjournal.app
• General Support: support@odysseyjournal.app
• Official Website: odysseyjournal.app

This Privacy Policy is here to inform you; it is not a contract, and you are not asked to accept it. Where we rely on your consent, we ask for it separately in the App (see Section 4), and you can withdraw it at any time.

02Information We Collect

We collect personal data by electronic means through the App and the website: partly directly from you, when you enter it, and partly automatically while you use them (Section 2B).

A. Information You Voluntarily Provide

• Account Credentials & Profile: Email address, password (securely hashed and salted via Supabase Auth), username, full name, profile bio, avatar image, an optional website link, your preferred app language, and your notification preferences.
• Home Location (optional): If you accept the prompt shown after you first sign in, the coordinates, city and country of your home are saved to your account, where only you can read them. They are used only to calculate the distance on your boarding pass. Other users never see them; they see only that distance figure, which for them is worked out from an approximate (rounded) version of your home location. You can skip the prompt.
• User-Generated Content (UGC): Travel posts, stories, photographs and their captions, categories, the weather recorded with a post, comments, bookmarks, collections, reactions (likes), travel dates, and optional locations. Posts are public: every signed-in user of the App can see them, together with their location. Collections can be marked private.
• Social Activity: The accounts you follow and that follow you, the users you block, the reports you file (with the reason, any text you add and the account the report concerns), and your search history, which is stored in your account so your recent searches can be shown to you.
• Direct Communications: In-app private messages ("Letters") between travelers, message requests and their approvals, and support communications sent to our email addresses.

B. Automatically Collected Technical Data

• Device Information: Operating system and version, app version, and the push notification token of your device (only if you allow notifications). Crash reports also carry the device model, which Sentry records automatically.
• Diagnostic & Crash Data: Crash logs, stack traces, and performance measurements from a sample of sessions, collected through Sentry. Email addresses are masked before a report leaves your device; reports are linked to your account ID (a random identifier), not to your name.
• Network & Session Data: Your IP address, which every server the App contacts necessarily receives, and the time of your requests. Our infrastructure provider Supabase keeps them in its service logs for up to seven (7) days.
• Activity Log (Law No. 5651): When you create, edit or delete a post, a comment, a message, a collection that others can see, or your username, name, bio or avatar, we record your account ID, your IP address, the time, the type of action (created, edited or deleted), which item it concerned, and the app version and operating system sent with the request (user agent). The content itself is not stored in this log. Section 8 explains how long it is kept.

C. Location Information

• Precise Location (GPS): Read only while the App is open and only when you use a feature that needs it: tagging a post with your current location, setting your home location, or showing your own position on the map. We never track your location in the background or continuously. You may revoke location permissions at any time through your device settings and search for a place by name instead.
• Photo Metadata: Photos are re-encoded as JPEG before upload, which removes their embedded metadata, including any GPS position stored by the camera.

03Infrastructure & Supabase Data Architecture

Odyssey Journal uses Supabase (supabase.com) as its core cloud backend, database, authentication engine, and media storage provider.

Supabase Security & Storage Specifications:

• Server Region: Our primary production database and media storage are hosted on Supabase infrastructure (AWS EU region - Frankfurt, Germany).
• Encryption in Transit: All communications between the mobile application, web clients, and Supabase servers are encrypted using TLS 1.3 / HTTPS.
• Encryption at Rest: All database tables, user records, and uploaded media files are encrypted at rest using industry-standard AES-256 encryption.
• Row Level Security (RLS): Strict granular database policies enforce access isolation. Users can only read, insert, update, or delete data permitted by verified cryptographic authentication tokens (JWT).
• Session Storage: Your sign-in session is stored on your device in the App's private storage (AsyncStorage), which the operating system keeps separate from other apps. It is removed when you sign out or delete your account.
• Automated Backups: The database is backed up automatically once a day on our Supabase Pro plan, and each backup is kept for seven (7) days.

04How We Use Your Information & Legal Basis

We process personal data under the lawful bases defined in KVKK Article 5 & 6 and GDPR Article 6:

Where we rely on your consent, you can withdraw it at any time: the AI content check in the App's settings, location and notification permissions in your device settings, or by writing to privacy@odysseyjournal.app. Withdrawing consent does not affect processing carried out before it.

05Third-Party Sub-Processors

We partner only with reputable third-party service providers that maintain strict data security and privacy standards:

1. Supabase, Inc.: Cloud database, user authentication, object storage for photos. (Servers: AWS Frankfurt, Germany - EU).
2. Sentry (Functional Software, Inc.): Error monitoring and crash diagnostics, hosted in Sentry's EU region (Frankfurt, Germany). Email addresses are masked on the device; reports carry your account ID, device and app details, and the technical context of the error.
3. Google LLC (Google Maps Platform): Map tiles in the Android app; loading them transmits the visible map area and your IP address. Where the interactive map is not available, the profile shows a static Google map image instead, and that request carries the coordinates of your posts.
4. Google LLC (Google Workspace): Enterprise email hosting for customer support and privacy inquiries.
5. Expo / 650 Industries, Inc.: Application framework and push notification gateway (Expo Push Service). When a notification is due, our server sends Expo your device's push token, the notification text (including the display name of the person who liked, commented or followed) and the related item IDs. Expo delivers it through Firebase Cloud Messaging (Google LLC) on Android and the Apple Push Notification service (Apple Inc.) on iPhone.
6. Open-Meteo (Zurich, Switzerland): The current weather at the place of an entry, recorded when you create it. The App sends only the coordinates of that entry; no account identifier, name or e-mail is attached.
7. Wikimedia Foundation, Inc. (Wikidata): City and country names in the App's twelve languages. The App sends only the name of the place being looked up; the names returned are stored in a shared table so they do not have to be looked up again.
8. OpenAI, L.L.C.: Automated content moderation. With your permission, the text and photos of your posts and the text of your comments are sent to OpenAI's Moderation API to check them against our Community Guidelines. Text and photos are checked before the post is published; flagged content is not posted. If the check is temporarily unavailable, content may be published without it and remains subject to reports and review. OpenAI does not use data sent through its API to train its models and keeps it for up to 30 days for abuse monitoring. You give or withdraw this permission in the App under Settings > Legal & Community > AI content check; without it you can still browse, but not post or comment. If you think content was flagged by mistake, write to support@odysseyjournal.app and a person will review it.
9. Unsplash, Inc.: Stock photographs used as fallback imagery in the App, for example on the Explore screen and for collections without a cover. Loading them transmits your IP address.
10. Apple Inc.: On iPhone, maps are drawn with Apple Maps, and the place name for a location is looked up with the phone's built-in geocoding service; both receive the coordinates concerned and your IP address. The "Apple Maps" button on a post's map hands its coordinates to the Maps app.

We do NOT sell, rent, or trade your personal data to data brokers, advertisers, or any commercial third parties.

06User-Generated Content & Third-Party Privacy

07International Data Transfers

Your data is processed by our sub-processors in the European Union (Frankfurt, Germany: Supabase, Sentry), in the United States (Google, Expo, OpenAI, Apple, Wikimedia, Unsplash), and in Switzerland (Open-Meteo), only for the purposes and only with the data described in Section 5.

• Under KVKK (Article 9): The Personal Data Protection Board has not yet issued an adequacy decision for any country, so these transfers require the appropriate safeguards set out in Article 9, namely standard contracts with the recipients that are notified to the Personal Data Protection Authority. Using the App does not mean that you consent to transfers abroad, and we do not make the service conditional on such consent. You can ask privacy@odysseyjournal.app which safeguard applies to a given recipient.
• Under GDPR (Chapter V): Transfers to sub-processors outside the EEA are governed by European Commission Standard Contractual Clauses (SCCs) and adequacy decisions.

08Data Retention & Deletion

• Active Accounts: We retain your personal data and travel journal entries for as long as your account remains active.
• Account Deletion: You can permanently delete your account and all associated posts, photos, comments, and messages directly in the App at: Settings > Account > Delete Account.
• Deletion Timeline: When you delete your account, your profile, posts, comments, likes, collections, follows, blocks, reports, search history, push tokens and the messages you sent and received are erased from our database at once, and the App then deletes your photos from storage. Copies remain in the daily backups for up to seven (7) days, until those backups expire. Records we are legally required to keep are retained only for the applicable statute of limitations. What is erased and the few records that are kept are listed at odysseyjournal.app/delete-account.
• Activity Log: As the provider hosting the content users publish, Turkish Law No. 5651 requires us to keep the activity log described in Section 2B for at least one year. We keep each record for one (1) year from the action it records and then delete it automatically, even if you have deleted your account in the meantime. The log cannot be seen in the App; only we can access it, and we disclose it only to authorities legally entitled to request it.
• Deleting a Conversation: Deleting a conversation in Letters hides it from your own inbox only. The messages remain visible to the other traveler until one of you deletes their account.

09Rights Under Turkish Law (KVKK Article 11)

Under Article 11 of Law No. 6698 of the Republic of Türkiye on the Protection of Personal Data ("KVKK"), you have the following rights as a data subject:

1. to learn whether your personal data is being processed;
2. to request information about the processing, if your data has been processed;
3. to learn the purpose of the processing and whether your data is used in accordance with that purpose;
4. to know the third parties within Türkiye or abroad to whom your personal data has been transferred;
5. to request that incomplete or inaccurate personal data be corrected;
6. to request the erasure or destruction of your personal data under the conditions set out in Article 7 of the KVKK;
7. to request that any correction, erasure or destruction be notified to the third parties to whom your data was transferred;
8. to object to an outcome to your detriment that arises from the analysis of your data exclusively by automated means;
9. to claim compensation for damage suffered as a result of unlawful processing of your personal data.

How to Submit a Request: As set out in the Communiqué on the Procedures and Principles of Application to the Data Controller, you can apply in writing, by registered electronic mail (KEP), with a secure electronic or mobile signature, or by email to privacy@odysseyjournal.app from the email address registered to your account. Please include your name and surname, your T.R. identity number (or, if you are not a Turkish citizen, your nationality and passport or identity card number), your address, how we can contact you, and what you are requesting. We conclude requests free of charge as soon as possible and within thirty (30) days at the latest; only where the reply involves an additional cost may the fee set by the Board be charged. If your request is refused, you find our reply insufficient, or we do not reply in time, you may lodge a complaint with the Personal Data Protection Board within thirty (30) days of learning of our reply, and in any case within sixty (60) days of your application (KVKK Article 14).

10Rights Under GDPR (EEA & UK Users)

If you are a resident of the European Economic Area (EEA) or United Kingdom, you have the following rights under GDPR:

• Right of Access (Article 15)
• Right to Rectification (Article 16)
• Right to Erasure / Right to be Forgotten (Article 17)
• Right to Restriction of Processing (Article 18)
• Right to Data Portability (Article 20)
• Right to Object (Article 21)
• Right to Withdraw Consent at any time, without affecting processing carried out before (Article 7(3))
• Right Not to Be Subject to a Decision Based Solely on Automated Processing (Article 22); Section 5, item 8, explains how to ask for a person to review a moderation decision
• Right to Lodge a Complaint with your local Data Protection Supervisory Authority.

To exercise these rights, contact privacy@odysseyjournal.app.

11California Privacy Rights (CCPA / CPRA)

California residents have the right to request disclosure of personal information collected, request deletion of personal information, opt-out of the sale of personal information (we do not sell personal information), and not be discriminated against for exercising these rights. Inquiries should be sent to privacy@odysseyjournal.app. We do not sell or share personal information for cross-context behavioural advertising, and we use precise location only for the features you choose to use.

12Children's Privacy

Odyssey Journal is intended for adults only: it is not intended for or directed to anyone under the age of 18, or under the age of majority in your country where that is higher. When you register, you separately confirm that you are 18 or older; accepting the Terms of Service also confirms that you meet this age requirement. We do not knowingly collect personal data from children. If we discover that a child has provided us with personal data, we will immediately delete such data from our servers. Parents or guardians who believe their child's data has been collected can contact privacy@odysseyjournal.app.

13Cookies & Local Storage

Odyssey Journal sets no advertising, analytics, profiling, or cross-site tracking cookies on either the mobile application or odysseyjournal.app. We run no third-party ad networks and no behavioural analytics scripts, which is why you will not see a cookie consent banner.

The only browser storage this website uses is strictly necessary and stays on your own device:

• oj-theme — remembers whether you chose the light (Parchment) or dark (Sepia Night) reading theme.

This value is written to your browser's localStorage, is never transmitted to our servers or to any third party, and can be cleared at any time by clearing your browser's site data.

Within the mobile application, the following is kept in the App's private storage on your device and is not shared with other apps:

• your sign-in session (Section 3);
• your language and theme choices, and whether you have seen the introduction screens;
• whether you have given permission for the AI content check on this device (Section 5);
• whether you have already been asked for your home location;
• a cache of place names, and a copy of recently loaded content, kept for up to 24 hours so the App opens quickly and cleared when you sign out.

14Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect modifications in our services, technologies, or legal obligations. When significant changes occur, we will notify you by email and update the "Last Updated" date at the top of this document. If a change requires your consent, we will ask for it again in the App.

15Contact Information

For any inquiries, questions, or requests regarding this Privacy Policy or your personal data:

• Privacy & KVKK Requests: privacy@odysseyjournal.app
• Customer Support: support@odysseyjournal.app
• General Inquiries: hello@odysseyjournal.app
• Postal & Digital Verification: Arif Gültaş, Istanbul, Türkiye
• Website: odysseyjournal.app/privacy-policy