PENDING LEGAL REVIEW — this text has not been approved by a lawyer. Highlighted parts are not decided yet.
KVKK Information Notice (Turkish Personal Data Protection Law)
This notice informs you; it is not a consent. Your explicit consent for health data is asked separately on the Emergency Profile screen and can be withdrawn there.
1. Data controller
Under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), the data controller is operator details (legal name, address, registration number) will be published soon ("Koruya"). Contact: privacy@koruya.app. KEP (registered e-mail): registered e-mail (KEP) address will be published soon. VERBİS: VERBİS registration status will be published soon.
2. Personal data processed
If you use Koruya without an account, your data stays on your device and is not sent to Koruya's servers; records you enter in the web app (app.koruya.app) are also kept only in your browser. With an account, or when you use the feature concerned, the following is processed:
- identity and contact: name, e-mail, phone, country, language; if you sign in with Google, the e-mail, name and account ID Google provides;
- account: user ID, a hash of your password (the password itself is not stored), organisation and role verification details if any, the times you accepted the terms and the notices, account audit records;
- location: your current location to show nearby disasters, weather and critical places; if you turn on location sharing in a family group, the location you share with it; your location in an SOS you share with your family; a location you add to an "I'm Safe" check-in with "add location";
- special category data — health: blood type, allergies, chronic conditions, medications, medical devices, disability, pregnancy, organ donation and doctor's note. Sent to the cloud only if you enter it and give separate explicit consent to store it there;
- data about other people: name, phone, e-mail and relationship of the emergency contacts and family group members you add. You are responsible for informing them;
- images: profile and cover photo (location data removed);
- your content: "I'm Safe" notes, family group status notes, shared calendar entries and meeting points;
- security of operations: in a version that includes crash reports and if you turn them on, crash and error records, device model, operating system, app version and a random installation ID (today's store version has no crash reporting); your IP address with every request;
- notification registration and Koruya announcements (draft; with the announcements feature): once server notifications are switched on and you allow notifications, your two-letter country code (e.g. TR; not coordinates) and your service announcement / preparedness reminder preferences are added to the device registration; delivery and open records of announcements are kept [30 days — draft]. Today's store version makes no device registration;
- app health measurements (draft; only if you turn them on in Settings): start-up and save times, counts of what worked and what failed, the app version, the platform, the country from your phone's language setting and a random measurement ID replaced every 30 days. They contain no location, address, message, health, contact, family, e-mail, phone or account data and are never linked to your account. Today's store version has no such measurements.
3. Purposes
- to provide disaster and emergency alerts, the map, critical places and weather;
- to run emergency features such as SOS and location sharing;
- to create, protect and sync your account;
- to provide sharing features such as the family group and "I'm Safe";
- to find and fix errors and keep the service secure;
- to deliver Koruya announcements (service announcements, preparedness reminders) in the right country and language, following your preferences; they are not official alerts and can be turned off in Settings;
- if you turn measurements on, to check that the emergency functions (start-up, offline map, saving an SOS) really work;
- to meet legal obligations and answer your requests.
4. Legal grounds
- performance of a contract (KVKK Art. 5/2-c): account and app features;
- protecting life or bodily integrity where consent cannot be given (Art. 5/2-b): emergency features;
- legitimate interest (Art. 5/2-f): debugging and security;
- performance of a contract (Art. 5/2-c) for service announcements, legitimate interest (Art. 5/2-f) for preparedness reminders [draft; a commercial message also needs consent under Law No. 6563 and IYS];
- explicit consent (Art. 5/1) for app health measurements [draft];
- legal obligation (Art. 5/2-ç);
- explicit consent for health data (Art. 6/2).
- [Pending legal confirmation.]
5. How data is collected
Electronically through the app and the web app, partly by automated means: from what you enter and, as far as you allow it, from your device's location service.
6. Transfers
Data may be transferred only for the purposes above, to:
- our hosting provider Supabase — European Union, AWS eu-west-1 (Ireland) [region commitment — legal confirmation] (account and cloud data; app health measurements if you turn them on);
- Cloudflare (a US company): the koruya.app site, the web app, the admin panel's access control, e-mail routing and content delivery — your IP address with every request;
- Resend: sending account confirmation and password reset e-mails — your e-mail address and the e-mail's content;
- Google (USA): authentication if you sign in with Google; Firebase Cloud Messaging once server notifications are switched on (notification token and notification content);
- Google Firebase Crashlytics (USA), in a version that includes crash reports and while they are on: the error type, its cleaned text, the code line and device details; no name, account, location, health or alert content; can be turned off in Settings → Privacy → Crash Reports;
- services that answer location and search requests. These requests carry no name or account ID; your IP address goes with every request:
- earthquake data: USGS (USA) and EMSC (France) — rounded coordinates (about 11 km);
- weather forecast: MET Norway (Norway) — rounded coordinates (about 1 km);
- air quality and floods (where on in this version): Open-Meteo (Switzerland) — rounded coordinates (about 1 km);
- official disaster warnings: in the USA, NWS (US National Weather Service) — rounded coordinates (about 1 km); without any location, the lists of the NOAA tsunami centres and USGS volcano warnings (USA) and GeoNet (New Zealand);
- offline map, road and emergency places packs: Koruya's pack server maps.koruya.app (Cloudflare; a US company, R2 storage location Eastern Europe — eeur [a location hint; data residency commitment to be confirmed by legal review]) — no coordinates; the name of a province pack downloaded automatically shows the province you are in;
- place search: done in the city directory on your phone (GeoNames) — the search text is sent nowhere;
- news search: GDELT Project (USA) — the search text you type;
- your device's address service (Google or Apple, USA) — coordinates;
- app update check (iOS only): the Apple App Store lookup itunes.apple.com (USA) — only the app's bundle ID, no location;
- disaster and news feeds that receive no location or personal content (IP address only): GDACS (EU), NASA EONET, NASA Science, NOAA and USGS news (USA);
- only where the feature is on in this version: MET Norway Oceanforecast (Norway) and, in a build allowed to use it, Open-Meteo Marine (Switzerland) for sea conditions — rounded coordinates (about 1 km); the World Health Organization www.who.int (Switzerland) for outbreak news — no location;
- members of your family group, for what you share with them;
- public authorities legally entitled to it.
Most of these recipients are outside Turkey: the USA, European Union countries (France, Ireland and others), Norway and Switzerland [countries as stated by the providers; to be verified]. Transfers abroad are made under KVKK Art. 9 [basis: standard contract / explicit consent — legal decision]. Details: Service Providers and International Transfers.
7. Retention
On-device and in-browser data stays there until you delete it or uninstall the app. Cloud data is kept until you delete your account, and is deleted with it. Periods set in the code: family SOS records 30 days after the SOS ends, family status updates 30 days, used invites 30 days, membership records 180 days. Server logs are deleted after [period], crash reports after [period], app health measurements after [90 days — draft]; turning measurements off deletes the ones on the phone at once. Records the law requires us to keep are kept for that period. Full list: Privacy Policy §12.
8. Your rights (KVKK Art. 11)
- to learn whether your personal data is processed;
- to request information if it is;
- to learn the purpose of processing and whether data is used accordingly;
- to know the third parties in Turkey or abroad it is transferred to;
- to have incomplete or inaccurate data corrected;
- to have it erased or destroyed under KVKK Art. 7;
- to have corrections and erasures notified to those third parties;
- to object to a result against you arising solely from automated analysis;
- to claim compensation for damage caused by unlawful processing.
9. Requests
Send requests about your rights to privacy@koruya.app, to our KEP address (registered e-mail (KEP) address will be published soon) or in writing to postal address for requests will be published soon, as set out in the Communiqué on the Procedures for Applications to the Data Controller. We answer free of charge within 30 days at the latest. You can delete your account in the app under Profile → Account → Delete account, or via https://koruya.app/en/delete-account/. If you are not satisfied with our answer you may complain to the Personal Data Protection Board. How to apply: the Contact and Requests page.