myRota Terms of Use and Privacy Policy (October 2026)

Last Update: October 10, 2026 (social sharing features, user content, disclaimer)
Applicable Platforms: myRota mobile applications offered via the Apple App Store (iOS) and Google Play (Android), and related server services
Data Controller / Service Provider: Burak Bayram (“myRota”, “we”, “the App”)
Contact: burakbayram@outlook.com

This document jointly comprises: (A) the User Agreement (Terms of Use), (B) the Privacy Policy, and (C) the information notice elements under Law No. 6698 on the Protection of Personal Data (“KVKK”). Downloading the App, creating an account, using it as a guest, choosing a username, or continuing to use the services means that you have read, understood, and accepted this document with all of its provisions.

Important: All information, routes, and user posts in the App are for general informational purposes only and are provided “as is”. To the maximum extent permitted by law, myRota accepts no liability whatsoever for the accuracy, safety, or lawfulness of travel information, artificial intelligence outputs, or other users’ posts. Details: Art. 7, 9, 10, and 13.

A. USER AGREEMENT

1. Parties, Acceptance, and Scope

1.1. This agreement is entered into between the natural person using the myRota application (“User”, “you”) and Burak Bayram.

1.2. The agreement covers the iOS and Android clients, cloud authentication / database / file storage / server function infrastructure, notification services, social sharing features, and payment integrations.

1.3. Using the App means you accept these terms and the Privacy Policy in advance. If you do not accept them, do not use the App and delete your account.

1.4. myRota may update these terms at any time. The current text is published via in-App links and/or at https://www.burakbayram.com. Reasonable notice will be attempted for material changes; continued use after an update constitutes acceptance of the new terms.

2. Description of the Service and Features

myRota is a digital platform for discovering and organizing travel programs, tracking personal travel content, and sharing travel experiences with other users. Services may include the following. Features may change, be added, be restricted, or be removed entirely over time without prior notice:

Feature	Description
Manual / ready-made routes (programs)	Travel programs presented in a continent, country, city, and pin (stop) structure; some are free, some are unlocked with Gezgin Puan (Traveler Points).
RotaAI	Personalized route suggestions via artificial intelligence (Google Gemini, etc.). Free daily quota and/or additional use with Gezgin Puan.
Collection	Visited countries/cities, cups/mugs, magnets, books, stamps, postcards, currencies/tokens, game cards, Seven Wonders / passport-style visits, and related images and notes.
Check-in	Check-in to program activities; contributes to the profile step / level system.
Favorites	Favoriting programs.
Reviews and ratings	Star ratings and text reviews for programs (subject to moderation).
Travelers leaderboard	Public ranking based on steps / level (name and profile image may be visible).
Profile	Name, email, profile photo, level, badges, points balance; when social features are enabled, username, display name, bio, post/follower/following counts, and post grid.
Social sharing	Photo posts, adding a program pin or a free location to a post, likes, comments and replies, comment likes, @mentions, saving, following / follow requests, private account, blocking, reporting, Explore feed, social notifications. See Art. 13.
Traveler posts	Aggregated display of administrator-approved pin-tagged posts under program activities, on pin pages, and on program purchase pages (“Traveler Posts”).
Country information pages	Content blocks; third-party sourced content such as exchange rates and Spotify / YouTube playlist information.
Notifications	Push notifications for announcements, subscriptions, leadership rewards, content / RSS, and social interactions (likes, comments, follows, mentions, pin approvals) (subject to permission and preference).
Guest use	Limited features (e.g., limited RotaAI); features requiring an account and social features are locked.
Premium subscription	Monthly / yearly subscription with expanded limits (e.g., Collection capacity, RotaAI daily allowances).
Gezgin Puan	In-app virtual points; package purchases, welcome bonus, rewards; spendable to unlock routes and for additional RotaAI use.

The term “Content” covers routes, “Things to Know Before You Go” pages, banners, reviews, user posts, collection data, statistics, and all other data provided through the App.

3. Account, Authentication, and Security

3.1. Account creation methods: email and password, Sign in with Google, and (on iOS) Sign in with Apple. Guest use may not create a registered account; limited use may be provided via a device identifier.

3.2. You alone are responsible for the accuracy, currency, and confidentiality of your account information. Do not share your password with third parties. All actions performed through your account are deemed to be yours.

3.3. myRota endeavors to take reasonable technical and administrative measures for account security (e.g., application integrity checks, session / security logs, account ban mechanisms). No system is 100% secure. myRota cannot be held liable for unauthorized access, third-party attacks, breaches originating from service providers, or security vulnerabilities caused by the User (cases that cannot be limited by law are reserved).

3.4. For security, prevention of abuse, and legal obligations; on successful logins and at certain intervals in sessions, IP address, device identifier, device model, operating system version, application version, and client software information may be recorded server-side. Details are in the Privacy Policy.

3.5. myRota reserves the right to suspend, ban, or terminate without prior notice accounts that violate the terms of use, the law, or third-party rights, or that engage in abuse, fraud, spam, manipulation, or create a security risk. For banned accounts, login may be disabled and session refresh rights may be revoked. No compensation or refund may be claimed from myRota for losses incurred as a result.

4. Account Deletion and Consequences

4.1. An account deletion request may be initiated from within the App (Profile → Settings). For security reasons, re-authentication (password / Google / Apple) may be required.

4.2. Account deletion is permanent and irreversible. myRota deletes personal data associated with your account on the server side. This includes in particular:

Your account and profile information (name, email, profile image, etc.);
Collection, check-in, favorites, purchased / unlocked routes, points balance and history, reviews, step / level / badge data;
Your social data: your username and social profile, your posts and post photos, comments and likes received on those posts, comments and likes you made on other posts, your saved items, your following / follower / follow request / blocking relationships, and your social notifications;
Your Travelers leaderboard record, application open statistics, RotaAI usage counters;
Notification identifiers and notification preferences;
Your security login / session records (IP / device);
Your profile, collection, and post images in cloud storage;
Your authentication (login) record.

4.3. RotaAI routes stored on the device and local cache are attempted to be cleared during deletion. Separately deleting the App or device data helps remove remaining local traces. Cached copies of your posts on other users’ devices, screenshots, or copies they have made by their own means are not under myRota’s control and may not be deletable.

4.4. For statistical purposes, only an anonymous deleted-account counter may be incremented. No archive of name, email, or user ID belonging to deleted accounts is retained; no list of “users who deleted their accounts” is created. Records that must be retained under legal obligations (e.g., the report and moderation records referred to in Art. 13.12) may be retained for the period prescribed by legislation.

4.5. After account deletion:

Active Premium rights, remaining Gezgin Puan, and access to purchased content are irreversibly lost;
Your username is released and may be taken by another user;
You may open a new account with the same email (old data is not transferred to the new account);
No refund, compensation, or restoration may be claimed for loss of subscription, points, content, posts, or data (mandatory consumer / store rules reserved).

4.6. Billing, receipt, and subscription records on the Apple App Store / Google Play / RevenueCat side are subject to the policies of the relevant store / payment intermediary; those records may not be under myRota’s control.

4.7. To cancel store subscriptions, in-App account deletion alone is not sufficient; you must cancel via Apple ID / Google Play subscription management. Otherwise billing may continue, and myRota is not responsible for this.

4.8. If you cannot delete from within the App or need additional support, you may write to burakbayram@outlook.com.

5. Payments, Subscriptions, and Gezgin Puan

5.1. Purchases are processed via the Apple App Store on iOS and Google Play on Android; technical management of subscription and points packages is handled through RevenueCat. Card details are not stored on myRota servers.

5.2. Premium subscriptions (monthly / yearly) and Gezgin Puan packages are store products. Prices, tax, renewal, trial period, cancellation, and refunds are subject to Apple / Google terms and the relevant store policies.

5.3. myRota is not responsible for payment processor outages, incorrect charges, store-related technical issues, or account / device incompatibilities. For refund / cancellation requests, contact the relevant store first.

5.4. Purchased Gezgin Puan, Premium rights, and routes unlocked with points cannot be converted to cash, transferred to another account, or sold. myRota reserves the right to change points pricing, package contents, and the points cost of a feature (e.g., points for additional RotaAI) with or without prior notice.

5.5. Free points such as welcome bonuses and leadership rewards may be clawed back in cases of abuse, error, or system violation.

5.6. In the event of account deletion, ban, or closure for breach of terms; no refund may be claimed from myRota for unused points / subscription period (mandatory legislation and store rules reserved).

5.7. User posts and program recommendations displayed on a program’s purchase page or on a pin page are for informational purposes only. They do not constitute a commitment or warranty by myRota regarding the content, quality, currency, or suitability of the program. The purchase decision is entirely yours.

6. RotaAI (Artificial Intelligence) Terms of Use

6.1. RotaAI sends requests to Google Gemini or similar models via a server-side secure proxy. Request content typically consists of travel preferences such as country, city, duration, time range, category, and language.

6.2. The accuracy, currency, safety, legal compliance, or completeness of generated routes is not guaranteed. AI outputs are suggestions only; verification from official sources before travel is the User’s responsibility.

6.3. Generated RotaAI content is as a rule stored locally on your device (the device’s local / encrypted preferences storage). Deleting the App, changing devices, or clearing local data may result in loss of these routes; myRota is not responsible for such loss.

6.4. Quotas, points spending, and usage counters may be kept on the server. Lifetime / device-based limits may apply for guest users.

6.5. Using RotaAI for illegal, harmful, misleading purposes or for purposes that violate third-party rights is prohibited.

7. Content, Disclaimer, and Intellectual Property

7.1. Travel information: Manual routes, country pages, fees, hours, locations, user posts, and AI outputs may be outdated, incorrect, incomplete, or misleading. The User is obliged to verify information before travel. myRota cannot be held liable for direct, indirect, incidental, or consequential damages arising from errors in such information or its loss of currency. Such damages may include travel cancellation, delay, additional expenses, accidents, injury, loss of property, denial of entry, or penal sanctions.

7.2. Third-party content: Spotify, YouTube, map applications, exchange-rate providers, etc. are subject to their own terms. myRota is not responsible for outages, errors, or content changes of those services.

7.3. Reviews: Reviews are not mandatory. When you submit a review, you alone are responsible for the content’s compliance with the law. With respect to published or moderated reviews, you are deemed to grant myRota a worldwide, perpetual, royalty-free, sublicensable, commercially usable license. The license covers the rights to use, reproduce, modify, publish, and remove. myRota reserves the right not to approve, to hide, or to delete reviews.

7.4. Collection and user content: You represent that you own the rights to the photos and text you upload or have obtained the necessary permissions. Unlawful, obscene, hateful content or content that infringes others’ rights is prohibited. Upon detection, it may be deleted and sanctions may be applied to the account. Detailed rules on social posts are set out in Art. 13.

7.5. The application software, design, brand, ready-made route content, and other elements belonging to myRota are the intellectual property of Burak Bayram or licensors. The following are prohibited: unauthorized copying, reverse engineering (legal exceptions reserved), unauthorized data scraping (including user profiles and posts), or resale.

7.6. myRota reserves the right to change, limit, or remove User programs, purchased content access, or user content with or without notice. This right may be exercised on grounds of legal obligation, security, technical maintenance, or service integrity. In such cases, no fee refund or compensation may be claimed (mandatory legislation reserved).

8. Acceptable Use

Users may not:

Use the service for illegal purposes;
Open an account on behalf of another person, impersonate someone, or take a username that impersonates another person;
Use automated bots or unauthorized data scraping tools; attempt to bypass security, integrity, quota, or daily limit systems;
Access other users’ data without authorization, or collectively save or export profiles and posts;
Spread malware or overload the service;
Engage in fake purchases, points / subscription manipulation, or refund abuse;
Make fake or mass reports, fake likes / follows, spam comments, or engage in interaction manipulation;
Share the prohibited content listed in Art. 13.3.

9. Limitation and Disclaimer of Liability

9.1. The App and all of its content are provided “as is” and “as available”. No express or implied warranty is given regarding merchantability, fitness for a particular purpose, uninterrupted / error-free operation, preservation of data, or accuracy of content.

9.2. To the maximum extent permitted by law, myRota is in no way liable for the following:

Other users’ posts, comments, messages, profiles, conduct, and their accuracy, lawfulness, or safety;
Places visited, trips taken, or events attended in reliance on user posts, or relationships and meetings established between users outside the App;
Copying, screenshotting, downloading, resharing, or misuse of your posts or profile information by third parties;
The location, identity, or private-life information of you or others being inferred from the location, pin, or photos you add to a post;
Failure of automated scanning or moderation to detect content, or erroneous hiding of content;
Moderation, report review, content removal, or account restriction decisions and their duration;
Loss of content, posts, photos, comments, followers, likes, or data;
Temporary or permanent suspension, modification, or removal of the service or social features;
Indirect, incidental, special, or consequential damages, lost profits, loss of reputation, data loss, travel cancellation, and similar harms.

9.3. Where liability cannot be entirely excluded by law, myRota’s total liability is limited to the net amount the User directly paid to myRota in the last twelve (12) months preceding the event (excluding store commissions). If no payment has been made, this amount is zero.

9.4. These limitations do not apply, solely to the extent required by law, in respect of myRota’s intent or gross negligence and cases of liability that cannot be limited by law (including mandatory consumer rights and legal obligations relating to the protection of personal data).

10. Indemnification

The User agrees to indemnify myRota against any and all claims directed at myRota arising from the User’s own content (including posts, comments, photos, locations, and profile information), use, or breach of this agreement. Such claims may come from third parties, other users, or competent authorities. Indemnification covers claims, administrative fines, damages, litigation costs, and reasonable attorneys’ fees. The User further agrees to hold myRota harmless from such claims.

11. Governing Law

This agreement is governed by the laws of the Republic of Türkiye. Without prejudice to mandatory consumer legislation, the Istanbul (Central) Courts and Enforcement Offices have jurisdiction over disputes.

12. Miscellaneous Provisions

12.1. Invalidity of one provision of the agreement does not affect the other provisions. The invalid provision shall be applied in the closest sense permitted by law.
12.2. Failure by myRota to exercise a right does not constitute a waiver of that right.
12.3. The User may not assign their account or rights arising from this agreement to a third party.
12.4. This document constitutes the entire agreement between the parties (mandatory legal rights reserved).

13. Social Features and User Posts

13.1. Scope and username

Social features are rolled out gradually. myRota reserves the right to offer these features to all users, to certain user groups, or to no users, and to disable or remove them at any time.
Social features are not available to guest users.
To use these features (likes, comments, follows, posts, etc.), you must choose a unique username (@username). When social features are enabled, a username selection screen is shown to you after you sign in.
Username and display name:
On the selection screen, a username that is automatically generated from your first and last name and currently available is suggested (e.g., “Burak Bayram” → burakbayram).
The “Display name” field is pre-filled with your first and last name.
Before saving, you may change the suggestion and the display name, or delete the display name entirely.
The username and display name you save are public. If you do not want your real name to be visible, it is your responsibility to change them.
Usernames are 3-30 characters long and may contain lowercase letters, numbers, periods, and underscores. Usernames that impersonate others or are misleading, obscene, or insulting are prohibited. myRota may change such usernames without notice or apply sanctions to the account.
Certain words (e.g., “myrota”, “admin”, “support”) are reserved.
You may change your username at most at certain intervals (currently once every 14 days).

13.2. Ownership of content and license

You are the owner of the photos and text you post.
By posting, you grant myRota a worldwide, non-exclusive, royalty-free, and transferable license to process your content for the following purposes. The license also includes the right to grant sublicenses to service providers.
Displaying it within the App (including on your profile, Explore, pin pages, program activities, and program purchase pages);
Storing, resizing (small and large images), and caching it;
Processing it for content moderation and automated scanning;
Operating, developing, and promoting the service within the App.
The license ends when you delete the content. The exceptions are: technical backups and caches kept for a reasonable period, legal retention obligations, and copies of the content obtained by others before it was deleted.
myRota does not use your content in advertising campaigns outside the App without obtaining your separate permission.
If the content you post contains other people’s faces, voices, names, vehicle license plates, or personal data, you represent that you have obtained the necessary permissions from those persons. All responsibility in this regard lies with you.

13.3. Prohibited content

myRota applies zero tolerance to inappropriate content and abuse. You may not post the following:

Nudity, sexual content, violence, blood / gore, hate speech, discrimination, harassment, bullying, or threats;
Inappropriate or exploitative images of persons under the age of 18;
Content protected by another person’s copyright or trademark rights;
Private images taken or personal data of others (identity, home address, telephone, license plate, location, etc.) without their permission;
Spam, misleading content, false information, advertising, commercial referrals, or link sharing;
Content that promotes illegal activities, drug use, self-harm, or dangerous behavior;
Content intended to damage the reputation of myRota or others;
Misleading content unrelated to the pin, city, or program with which the post is tagged.

13.4. Pin-tagged posts, administrator approval, and “Traveler Posts”

You may tag your post with pins (stops) of cities in programs you have purchased.
Pin-tagged posts are visible only on your profile until a myRota administrator approves them.
After approval, your post may also be shown to other users in the following places:
In the “Traveler posts” strip under the relevant program activity;
On the pin page, where all posts for the pin are listed;
In the “Traveler Posts” section on the purchase pages of all programs that include that pin.
In these places, your post may be displayed together with the pin name and sorted with the most recently approved at the top.
On pin pages, programs that include that pin may be recommended to other users. Your post may appear on the same page as the promotion of these programs. This does not give rise to any fee, commission, or right for you.
myRota may refuse approval without stating any reason, or revoke an approval previously granted. A rejected post remains on your profile.
Approval does not mean that the accuracy, lawfulness, or content of the post is endorsed by myRota.

13.5. Free location

You may add a location to your post via map search. The location name, address, and coordinates you add are visible to anyone who can see the post.
We strongly recommend that you do not add private locations such as your home address, workplace, or current whereabouts. Adding a location is entirely optional. Any and all consequences that may arise from the location you add are your responsibility.

13.6. Automated scanning and moderation

Uploaded photos may be passed through an automated image scanning service (Google Cloud Vision SafeSearch) to detect prohibited content. Posts found to be inappropriate may be hidden automatically. Automated scanning is not guaranteed to be error-free.
Users may report posts, comments, and profiles. Content that receives a certain number of reports may be hidden automatically until the review is completed.
myRota has no obligation to pre-screen or monitor user content.
myRota may apply the following actions to content and accounts it considers to be in breach of the agreement: removal, hiding, temporary/permanent restriction of the right to post and comment, suspension of the social profile, and a complete ban of the account. These actions may be taken without prior notice and without stating a reason.

13.7. Limits

Daily limits are applied to prevent abuse. Examples: a maximum of 20 photos per post, a maximum of 20 posts per day; daily limits for comments, follows, reports, views, and username checks. Limits may be changed without prior notice.

13.8. Private account, following, and blocking

Your social profile is public by default.
If you make your account private:
Only followers you have approved can see your posts.
Your posts are not shown in the Explore feed, pin strips, pin pages, or program purchase pages.
Your post, follower, and following counts remain visible to everyone; the lists are not visible.
If you make your account public again, pending follow requests are automatically accepted.
When you block a user, the mutual following relationship is removed. You cannot follow each other, open each other’s profiles and posts, or interact with each other. Public posts may technically be viewable in aggregate feeds (e.g., Explore). Blocking is not a guarantee of safety.

13.9. Interactions and visibility

Your likes and comments may be seen by people who can see the post. The owner of the post may choose to hide the like count or turn off comments.
The total view count of your posts is kept. Information about who viewed them is not shared with other users.
Your saved posts and your “Contents” lists (liked, commented on, saved) are visible only to you.
A notification may be sent to a person you mention by @username in a post. In private accounts, mentions are notified only to followers.

13.10. Deletion

You may delete your posts and comments at any time. You may also delete comments made on your own posts. Photos of a deleted post are deleted from the server. For the consequences of account deletion, see Art. 4.

13.11. Content responsibility

You alone are responsible for all content you post (photos, captions, comments, location, username, profile information) and its consequences.
myRota is not the owner, author, or publisher of user content and does not endorse such content. It does not guarantee the accuracy, currency, safety, or lawfulness of the content.
The user who posted the content is responsible for any and all claims, damages, and sanctions arising from user content (see Art. 9 and 10).

13.12. Reports, appeals, and unlawful content (Law No. 5651)

You may report a post, comment, or profile using the “Report” option within the App. myRota endeavors to review reports of inappropriate content with reasonable effort and, where possible, within 24 hours. This period is not a commitment or guarantee.
If your content has been removed or hidden, a pin approval has been rejected, or your right to post or your profile has been restricted, you may file an appeal. Please send your appeal to burakbayram@outlook.com, stating your username and the relevant content, within 30 days of the action. Appeals are reviewed within a reasonable period. The decision issued as a result of the appeal is final.
With respect to social features, myRota acts in the capacity of a hosting provider under Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed Through Such Publications. It has no obligation to monitor user content or to investigate whether any unlawful activity is taking place. When duly notified of unlawful content, it removes the content to the extent prescribed by law.
Applications alleging a violation of personal rights (Law No. 5651 Art. 9) and a violation of the privacy of private life (Law No. 5651 Art. 9/A) are accepted via burakbayram@outlook.com and reviewed within the statutory periods.
Content removal and access blocking decisions issued by courts, the Association of Access Providers, or competent authorities are implemented.
Report and moderation records may be retained for security and legal obligations (see Privacy Policy Art. 6).

13.13. Age limit

You must be at least 13 years old to use the social features. If you are under 18, you may use the social features only with the permission and under the supervision of your parent or guardian. The user and their parent are responsible for the accuracy of the age declaration and for supervising minors’ use of the App.

B. PRIVACY POLICY

1. Scope

This policy relates to personal data processed through the myRota iOS and Android applications, related servers, and support channels. The own privacy policies of Apple, Google, RevenueCat, Google Gemini, Google Cloud Vision, and other third parties also apply separately.

2. Data Collected

2.1. Identity and account

First / last name (or display name), email
User ID, sign-in method (email, Google, Apple)
Profile photo links (while the account is active, older links may be retained temporarily; removed upon account deletion)
Account creation date, account type (standard / premium / admin), subscription type and expiry information
After account deletion: no personal identity / contact archive is retained; only an anonymous deleted-account counter may be incremented

2.2. Usage and content data

Favorite programs, purchased / unlocked programs
Check-in records (activity, city, time information; a snapshot of username/email may be included)
Reviews and ratings
Collection data and images (countries, cities, cups/mugs, magnets, books, stamps, postcards, currencies/tokens, game cards, Seven Wonders visits, notes, dates)
Profile steps, level, badges; name / photo / steps for the leaderboard
Gezgin Puan balance, purchase and spending history
RotaAI usage quota / counters (server); generated routes (on device)
Application open statistics (open count, day information, last open; may be associated with email and name)
“Rate us” status
Notification preferences (including social notification preferences) and notification identifiers (platform, language, application version)

2.3. Social feature data

Data	Who can see it	Purpose	Retention
Username, display name, bio, profile photo	Everyone (except people who have blocked you)	Social profile	Until the account is deleted
Post / follower / following counts	Everyone	Profile	Until the account is deleted
Photos, caption, @mentions	Public account: everyone; private account: approved followers	Posting	Until you delete them
Pin tag	Everyone who can see the post; after approval, the pin strip, pin page, and purchase pages of the relevant programs	Linking the post to a stop, “Traveler Posts”	Until the post is deleted
Free location name, address, and coordinates	Everyone who can see the post	Linking the post to a place	Until the post is deleted
Pin approval status and approval time	You and administrators; approval time is used for sorting	Moderation, sorting	Until the post is deleted
Likes, comments	Those who can see the post (only the post owner if the like count is hidden)	Interaction	Until you remove them
Saved, liked, and commented-on lists	Only you	“Contents” section	Until you remove them
View count	Total count, to those who see the post (who viewed it is not shared)	Statistics	Until the post is deleted
Follows, follow requests	Follow lists: everyone for a public account, followers for a private account	Social relationship	Until you remove them
Block list	Only you	Security	Until you remove them
Social notifications	Only you	Notification inbox and push	Automatically deleted after 90 days
Reports (including a copy of the content at the time of reporting) and moderation records	Only myRota administrators	Security, legal obligation, appeal review	For the duration of legal obligations and legitimate interest (maximum 2 years)
Daily usage counters (posts, comments, follows, reports, views, username checks)	No one (system)	Prevention of abuse	Automatically deleted after 3 days
Post upload drafts	No one (system)	Upload security	Automatically deleted shortly afterwards

Username suggestion. When social features are enabled, the first and last name information in your account is processed on the server in order to suggest a username to you, and it is checked which candidates are available. Your name is not shown to other users during this process. If you save the suggested username or the pre-filled display name, this information becomes public.

Photo metadata. Post photos are resized on your device. Location and device information such as EXIF / GPS is removed before upload. Only the image pixel data reaches the server.

Image links. Post images are served via links containing an unguessable access key. When you delete a post, the files are deleted from the server. Cached copies on the devices of people who previously viewed it may remain for a while. People who have previously obtained the link may continue to access the image for a while even after the post has been hidden.

Program recommendations. On pin pages, you are shown programs that include that pin and that you have not yet purchased. This filtering is performed on your device using your purchase information; no additional data is collected for this purpose.

2.4. Security and technical data

IP address (server-side, in login and session security records)
Device identifier (a persistent identifier generated in the device’s secure storage), device model, operating system version, application version, client software information
Last login time, last login IP address, last device identifier, last platform (iOS/Android), last session time
Account ban information (whether banned, reason, time); social profile suspension and posting restriction status
Application integrity / device verification signals
Application usage metrics that analytics services may automatically collect (at device / session level; advertising identifiers are not knowingly used)
Device information you choose to share in feedback emails

2.5. Payment data

Sensitive payment information such as card numbers is not stored by myRota.
Apple / Google / RevenueCat process the following data: transaction ID, product ID, subscription status, and a payment account identifier matched to the user ID. Premium / points status is reflected to the server via automatic sync.

2.6. Data we do not collect / do not request

Device GPS / location permission is not used. The “location” in check-in and the free location added to a post are content selected by the user; your device’s location is not read automatically.
Advertising identifiers are not knowingly collected; advertising ID permission is not used on Android.
Contacts / address book are not collected.
A separate crash-reporting software is not used (system / infrastructure logs reserved).
There is no private messaging feature between users.

3. Purposes of Processing

Data is processed for the following purposes:

Account creation, authentication, session management
Provision of the service (routes, collection, check-in, reviews, ranking, notifications)
Provision of the social sharing service: username suggestion, profile, posts, interactions, following, Explore, “Traveler Posts” on pin and program pages
Content moderation, automated image scanning, review of reports and appeals
Operation of the Premium and Gezgin Puan economy, fraud prevention
RotaAI generation and quota management
Information security, prevention of abuse, account banning, provision of information to legal authorities (including IP and device security records)
Measuring / improving application performance and usage
Support, feedback, and mandatory notices
Fulfilment of legal obligations (including hosting provider obligations under Law No. 5651)

4. Legal Bases (KVKK Art. 5)

Processing may be based on the following legal bases: establishment/performance of a contract (Art. 5/2-c), legitimate interest (Art. 5/2-f; security, moderation, automated scanning, service improvement, prevention of abuse; provided that fundamental rights and freedoms are not harmed), the data having been made public by the data subject themselves (Art. 5/2-d; posts, username, and profile information on public accounts), legal obligation (Art. 5/2-ç), and explicit consent (e.g., optional notifications, camera / gallery access).

5. RotaAI and Third-Party Artificial Intelligence / Image Scanning

5.1. RotaAI requests are forwarded to Google via the server. As a rule, name / email are not sent in the prompt; travel preferences are processed.

5.2. Google’s AI / cloud service terms apply separately. Generated content is stored on your device; quota records are kept on the server.

5.3. Post photos may be sent to the Google Cloud Vision SafeSearch service for the purpose of detecting inappropriate content. Only the image is processed in this operation; your name or email is not sent.

6. Retention Periods

Data	Period (summary)
Active account profile and service data	For as long as the account is active
Social profile, posts, comments, likes, follow relationships	Until you delete them or the account is deleted
Social notifications	90 days (automatically deleted)
Daily usage counters	3 days (automatically deleted)
Report and moderation records	For the duration of legal obligations and legitimate interest, maximum 2 years
Personal data after account deletion	Permanently deleted (no archive of name, email, or user ID is retained; legal retention obligations reserved)
Anonymous deleted-account counter	May be retained for statistics (does not identify a person)
Security login / session records (IP, device)	Approximately 18 months while the account is active; related records are also deleted upon account deletion
Application open statistics	While the account is active; deleted upon account deletion
Store / payment intermediary records	Subject to the relevant provider’s policy (may be outside myRota’s control)
Local RotaAI routes	On device; attempted to be cleared upon account deletion / App or data deletion
Notification identifiers	While the account is active; deleted upon account deletion / sign-out

Periods may be extended or shortened based on legitimate interest and legal obligations.

7. Sharing and Transfer

Personal data may be shared with / transferred to the following recipients:

Recipient	Purpose
Google Firebase / Google Cloud (authentication, database, file storage, server functions, notifications, integrity checks, analytics)	Hosting, identity, data, notifications, security
Google Cloud Vision	Automated content scanning of post photos
Google Gemini	RotaAI generation
Sign in with Google	Social sign-in
Apple	Sign in with Apple, Apple notification service, App Store payments, location search on iOS (MapKit; your search terms are sent to Apple)
Google Play / Google Maps	Android payments, Play integrity verification, location search on Android (your search terms are sent to Google)
RevenueCat	Subscription / in-app purchase management
Spotify / YouTube / exchange-rate services (via server)	Content enrichment
Other users	Approved reviews; name/photo/steps on the leaderboard; social profile (username, display name, bio, photo, counts); your posts, likes, comments, and follow lists according to your account privacy setting; display of your approved pin posts on pin and program pages
Competent public authorities	Court orders, legal obligations, requests under Law No. 5651
Professional advisors	Legal / accounting (under confidentiality obligations)

Some servers operate in the Europe region (europe-west1); Google / Apple may use global infrastructure. Your data may therefore be transferred abroad. Transfers are carried out with the relevant safeguards (standard contracts, etc.) under KVKK Art. 9 and/or with your explicit consent.

No advertising network is used. Data is not sold.

8. Cookies and Similar Technologies

Classic web cookies are not used in the mobile App. Secure storage on the device, local preferences, local cache (including post images), and software identifiers may be used.

9. Permissions

Permission	Platform	Purpose
Camera / Photo gallery	iOS and Android (photo picker)	Collection, profile, and post images
Notifications	iOS & Android	Push notifications (including social notifications)
Internet	Both	Service communication
Location (GPS)	None	—
Advertising ID	Not used	—

If you do not grant permission, the related feature may not work; basic browsing may still be possible.

10. Data Security

Encrypted connection in transit, server-side access rules, application integrity checks
Social write operations (posts, comments, follows, moderation) being performed only via the server; the public profile being kept in a separate record that does not contain email or first and last name
Removal of location / device metadata from photos before upload
Sensitive keys not embedded in the App (artificial intelligence / Spotify, etc. routed via server)
Restriction of administrator access and logging of administrator actions
Practices such as not writing raw IP to operational logs in production for security records

100% security is not guaranteed, and myRota cannot be held liable, to the maximum extent permitted by law, for breaches occurring despite reasonable measures. In case of a breach, notices required by legislation are made.

11. Account Deletion and Data Subject Requests

11.1. In-App account deletion permanently deletes your account and your personal data held by myRota, including your social data (see User Agreement Art. 4). Only an anonymous deleted-account counter and records that are legally required to be retained may be kept. Records at store / payment providers are subject to their own policies.

11.2. From within the App, you may delete your posts and comments, make your account private, block users, and turn off social notifications individually (likes, comments, follows, mentions).

11.3. For your rights under KVKK (access to information, rectification, erasure/destruction, objection, complaint, etc.), you may apply to burakbayram@outlook.com. Identity verification may be required.

12. Policy Changes

This policy may be updated. The effective date is stated above. For material changes, notice via in-App or email / store notes will be attempted.

C. KVKK NOTICE SUMMARY

Data controller: Burak Bayram — burakbayram@outlook.com

Main data processed: Identity (first and last name, username, display name), contact, account, usage, user content (reviews, collection, post photos and captions), visual records, location (only the location and pin tag you add to a post yourself), social interaction (likes, comments, follows, blocks, views), transaction security (IP, device, report and moderation records), payment status (store-sourced), notification identifiers.

Purposes: Service provision, contract performance, social sharing service, content moderation, security / prevention of abuse, legal obligation, improvement.

Legal bases: KVKK Art. 5/2 (c) performance of a contract, (ç) legal obligation, (d) making public, (f) legitimate interest; where necessary, Art. 5/1 explicit consent.

Collection method: Electronically; directly from you, from your device and your use of the service; from payment providers.

Transfer: Recipients in Section B.7; domestic / foreign service providers (KVKK Art. 8 and 9).

Special categories of data warning: If special categories of personal data such as health, religion, ethnic origin, or political opinion are visible in the photos and text you post, you will have made such data public of your own free will. We recommend that you do not post such content. If it is posted, the responsibility lies with you.

Your rights: KVKK Art. 11 — right to apply; complaint to the Personal Data Protection Authority.

Special note on security records: IP and device information on logins and sessions may be retained for approximately 18 months while the account is active, for information security, account protection, banning, and legal requests. When the account is deleted, these records belonging to you are also deleted. The IP is not sent by the client; it is determined by the server.

D. CONTACT

Applications concerning the agreement, privacy, KVKK, content reports, appeals, and under Law No. 5651: burakbayram@outlook.com