1. Data we collect
- Account: email address, full name, username and password (stored only in hashed form). Optionally, your mobile number (only so friends can find you from their contacts; verified with a one-time SMS code, never shown on your profile or shared). If you turn off “Findable from contacts”, no one can find you by your number. If you sign in with Apple, the name and email Apple shares with us.
- Profile: profile photo, school (optional) and yearly goal.
- What you share: ratings and rankings, posts, photos, comments, likes, saves, links and notes in My List, follows, reports and blocks.
- Location: used only if you allow it and only while the app is open, for the “Near me” feed and the map. Your location is used in a live query to find nearby posts and is not stored on our servers.
- Photos and camera: only the photos you choose or take to share are uploaded; we don’t access the rest of your library.
- Contacts: read only if you allow it and only when you tap “Scan contacts” or “Contacts” in a post. Mobile numbers in your contacts are sent to our server to find friends already on Expeat and are stored only as irreversible hashes; names and other contact details never leave your device. The hashes are used to let you know when a contact joins later and are deleted when you delete your account.
- Invites: when you add someone from your contacts to a post who isn’t on Expeat, their number is stored as a hash; if they join and verify their number, they’re matched to your invite and we let you know. You send the invite message yourself from your own WhatsApp or Messages app; we never message anyone.
2. How we use it and legal bases
We use your data to create and manage your account, show what you share to other users, suggest places near you and places your friends recommend, keep the service secure and enforce our community guidelines. Legal bases: performance of our contract with you, our legitimate interests, and your consent (e.g. for location).
We don’t show ads, we don’t sell your data and we don’t track you across other apps or websites. We don’t use third-party analytics or advertising tools.
3. Who can see it
Your profile (name, username, photo, school), ratings, posts and comments are visible to Expeat users. Lists you create (title, description, notes and your scores for the places) are also visible to Expeat users. Your email is never shown to other users. People you block can’t see you or your content.
4. Service providers and international transfers
Your data is stored with our infrastructure provider Supabase in its European Union region (Frankfurt, Germany), which means it is transferred outside Türkiye under Article 9 of the KVKK. If you use Sign in with Apple, authentication is handled by Apple. Phone verification codes are sent to your number through our SMS provider. We don’t share your data with anyone else except where required by law.
5. Retention and deletion
We keep your data while your account is active. When you delete your account via Settings > Delete account, your profile, ratings, posts, photos, comments and all other data are permanently deleted. Records we are legally required to keep may be retained for the period the law requires.
6. Your rights
Under Article 11 of the KVKK (and, where applicable, the GDPR) you have the right to know whether your data is processed, request information, ask for correction or deletion, object to processing, and seek compensation for damages. You can edit or delete most of your data in the app; for anything else, contact us.
7. Children
Expeat is not directed at children under 13 and we don’t knowingly collect data from them.
8. Security and changes
Your data is transmitted over encrypted connections (HTTPS) and access is restricted by row-level security rules. We may update this policy and will announce significant changes in the app.
9. Contact
For privacy questions and requests: destek@expeat.app