Privacy Policy

Draft. This text has not yet been reviewed by a lawyer and is not in effect.

Draft date: 1 November 2026

This text explains how the Lusir mobile app (iOS and Android) and the lusir.app website handle personal data. It informs you and does not ask for your consent. Consent for location is requested on a separate screen in the app.

Data controller and contact

Data controller: [Developer name] (natural person), Türkiye. Email: destek@lusir.app [Decision pending: registered email and postal address.]

How we collect data

Data we store on the server

The data below is stored in Supabase. The database runs in the European Union (Frankfurt).

User ID
Created even if you use Lusir without an account.
Why: To know who records belong to.
Legal basis: Entering into and performing a contract (KVKK Art. 5(2)(c)).
When it is deleted: When the account is deleted. Without an account, after 180 days of inactivity.
Google identity data
Only if you sign in with Google: email, name, Google ID and profile picture address.
Why: To sign you in and show your name in Profile.
Legal basis: Entering into and performing a contract (KVKK Art. 5(2)(c)).
When it is deleted: When the account is deleted.
Session information
IP address, device information and dates.
Why: To run the session and prevent abuse.
Legal basis: Legitimate interest (KVKK Art. 5(2)(f)).
When it is deleted: When the session or the account is deleted.
Server logs
Technical records that may contain IP addresses.
Why: Security and fault tracking.
Legal basis: Legitimate interest (KVKK Art. 5(2)(f)).
When it is deleted: Automatically, within 7 days at most.
Favorites, personal lists and list names
Why: Saving places and route mode.
Legal basis: Entering into and performing a contract (KVKK Art. 5(2)(c)).
When it is deleted: When the account is deleted.
Discovered places (reading history)
Why: The discovery list and the “Next Story” suggestion. We use this record only for these features; we do not infer religion or similar sensitive information from it, and we do not build profiles from themes.
Legal basis: Entering into and performing a contract (KVKK Art. 5(2)(c)).
When it is deleted: When the account is deleted.
Problem report
The text you write, the category, the place, the app version, your phone type and the language.
Why: Reviewing errors and content.
Legal basis: Legitimate interest (KVKK Art. 5(2)(f)).
When it is deleted: When the account is deleted, the link to you is removed and the text remains. [Decision pending: deleting the text and its time limit.]
Error log
The error’s type and severity, the name of the operation, a short error code, the app version, iOS or Android.
Why: To see errors shown on screen and errors caught during save operations.
Legal basis: Legitimate interest (KVKK Art. 5(2)(f)).
When it is deleted: After 90 days.
Error log counter
User ID, counter start time and count.
Why: To limit error logs to 20 per user in 24 hours.
Legal basis: Legitimate interest (KVKK Art. 5(2)(f)).
When it is deleted: When the account is deleted. Expired counters are deleted each night, so a counter stays for about 48 hours at most.

What stays on your phone, and search

Location

We use your location to show where you are on the map, to display distances on cards, and for the “Near me” feature. Your location is processed on your phone; it is not sent to Lusir and is not stored. Legal basis: Explicit consent (KVKK Art. 5(1)).

The app explains this first, then your phone asks for permission. You can withdraw your consent at any time in Profile → Settings → Location. The rest of the app works without location.

Because the map loads from Google, the visible map area is sent to Google. See Third-party services for details.

Error logs and crash reports

Error logs are not linked to your identity: they contain no user ID, access keys, location or free text, and the error message itself is not recorded. The counter carries your user ID but is not linked to the logs. Connection errors are not logged, and nothing is logged when there is no session. The same error is logged once while the app stays open. The app can only add these logs, not read them; the team reads them from the admin panel. Error logs have no separate setting.

If the app crashes or fails at startup, a report goes to Google’s Firebase Crashlytics service so that we can fix it. The report contains the technical trace of the crash, your phone’s model and operating system, the app version, and identifiers given to this installation of the app (Crashlytics installation ID, Firebase installation ID). We do not match these identifiers to your Lusir account, and your name and email are not in the report. Google keeps this data for 90 days, then starts the deletion process. Because the report is not linked to your account, deleting your account does not delete this data immediately; it is cleared when the period ends. Crash reports cannot be turned off. Legal basis: Legitimate interest (KVKK Art. 5(2)(f)).

Sign in with Google

If you sign in with Google, we receive your email address, name, Google ID and profile picture address from Google. We use them to sign you in and to show your name in Profile. We store them in Supabase and delete them when your account is deleted. We do not use them for advertising or tracking.

Third-party services and transfers abroad

Because of these services, your data is transferred outside Türkiye. [Signature pending: transfer mechanism and the equal protection sentence Apple requires.]

What we do not use at present

Lusir currently has no advertising, tracking or Firebase Analytics. If this changes, this policy will be updated too.

Retention and deletion

The deletion time for each type of data is listed above. You can delete your account in the app (Profile → Account → “Delete account”) or by following the steps on the Account Deletion page.

When an account is deleted, the account, session records, favorites, lists, discovered places and the error log counter are deleted. Problem reports remain with the link to you removed. Error logs are not linked to your identity, so they stay until their 90-day period ends.

For people who use Lusir without an account, anonymous accounts unused for 180 days are deleted automatically each night. The account of someone who keeps using the app is not deleted. [Decision pending: retention period for accounts signed in with Google.]

Your rights and requests

Under Article 11 of Türkiye’s Personal Data Protection Law (KVKK), you have the right to:

You can send your request to destek@lusir.app. We resolve requests as soon as possible, free of charge, within 30 days at the latest, and we reply in writing or electronically. If your request is rejected, you find the reply inadequate, or you get no reply in time, you can complain to the Personal Data Protection Board.

Security

Access rules are switched on for every database table the app reaches. One user cannot read or change another user’s data. The app is not given an administrator key.

Children

Lusir is not directed to children. [Decision pending: age limit.]

Website

lusir.app is hosted on GitHub Pages. GitHub logs and stores visitors’ IP addresses for security purposes. The site has no cookies, analytics or external scripts. Legal basis: Legitimate interest (KVKK Art. 5(2)(f)).

Email correspondence

When you write to destek@lusir.app, your address and message are processed to solve your issue. Mail is forwarded through Cloudflare to the developer’s Gmail account and stored there. Legal basis: Legitimate interest (KVKK Art. 5(2)(f)); for deletion requests and KVKK applications, legal obligation and protection of a right (KVKK Art. 5(2)(ç), Art. 5(2)(e)). [Decision pending: mail service and retention periods.]

Transfer to a company

If Lusir is transferred to a company in the future, the service and user data may pass to that company. We will tell you in the app at least 30 days before the transfer. If you do not accept, you can delete your account before the transfer.

Changes and language

If the app or the way we process data changes, we update this policy. The current text is published on this page.

This text is published in Turkish and English, and both have the same content. If they differ, the Turkish text prevails. This rule does not limit mandatory rights you have under the law of the country where you live.