PENDING LEGAL REVIEW — this text has not been approved by a lawyer. Highlighted parts are not decided yet.
Service Providers and International Transfers
This list shows the service providers (processors) Koruya uses when processing personal data and the data sources it reads, with the data sent and the country. The legal basis for transfers has not been approved by counsel yet [KVKK Art. 9 and GDPR Arts. 44–49 bases — legal decision].
1. Service providers that process data
- Supabase — database, authentication, file storage, server functions. Data: cloud account, profile, health profile with consent, emergency contacts, family group, "I'm safe" check-ins, account deletion. Location: European Union, AWS eu-west-1 (Ireland) [the provider company's country, data processing agreement (DPA) — legal confirmation].
- Cloudflare, Inc. (USA) — the koruya.app site, the app.koruya.app web app, the admin panel and Cloudflare Access, the content server, map packs (R2, location hint Eastern Europe — eeur), e-mail routing. Data: IP address and request details, the name of a downloaded province pack, the e-mail of a team member signing in to the admin panel, e-mails sent to Koruya addresses [data residency commitment and DPA — legal confirmation].
- Resend — sending account confirmation and password reset e-mails. Data: recipient e-mail address and the e-mail's content [chosen region, retention of sending logs — to be confirmed by the owner].
- Google LLC (USA) — Sign in with Google (if you choose it: e-mail, name, account id); distribution through Google Play; the Android address service (coordinate → city/district name). Firebase Cloud Messaging only once server notifications are switched on (notification token, notification content) and Firebase Crashlytics only in a version that includes crash reports and while it is on (cleaned error record, device details) — today's store version has neither.
- Apple Inc. (USA) — once the iOS version is published, Sign in with Apple, the App Store, the iOS address service and version lookup [no iOS version yet].
2. Data sources we read
These sources do not process data on Koruya's behalf; the app asks them for public information. Requests carry neither your name nor your account id; every source sees your IP address.
- MET Norway (Norway) — weather forecast, sea and warnings; rounded coordinates.
- USGS (USA) — earthquakes and volcanoes; rounded coordinates for earthquakes.
- EMSC (France) — earthquakes; rounded coordinates; a real-time feed while the app is open (no location sent).
- NWS (USA) — official warnings only if you are in the United States; rounded coordinates.
- GDACS (EU), NASA EONET and NASA Science (USA), NOAA (USA), GeoNet (New Zealand) — no location sent.
- NASA FIRMS (USA) — Koruya's server queries a fixed area; your location is not sent (Wildfire Watch is off in the store version).
- GDELT (USA) — news search; the search text you type.
- OpenStreetMap / Protomaps — map data is downloaded from Koruya's pack server (Cloudflare); no request goes to OpenStreetMap or Protomaps servers.
- Only in developer / test builds: Open-Meteo (Switzerland), the OpenStreetMap tile, Overpass, Nominatim, FOSSGIS and OSRM servers (Germany, United Kingdom; the Overpass fallback maps.mail.ru in Russia), OpenTopoMap, Esri. The store version sends no request to any of them.
- AFAD data is not used in the app today [source permission pending].
3. International transfers
Most of the providers and sources above are outside Türkiye (EU, USA, Norway, United Kingdom, Switzerland, New Zealand). A transfer from Türkiye abroad needs one of the conditions of KVKK Art. 9 (adequacy decision, standard contract notified to the Board, or explicit consent); a transfer from the EU / EEA needs GDPR Art. 46 safeguards (standard contractual clauses) or an adequacy decision [which basis is used and the agreements to sign with the providers — legal decision].
4. Changes
When a new service provider is added or a feature (e.g. server notifications, crash reports) is switched on, this list is updated first and its version number goes up. Questions: privacy@koruya.app.