Privacy Policy

1. Data Controller

Artempo is the data controller responsible for the processing of your personal data. We operate under Turkey's Personal Data Protection Law No. 6698 ("KVKK") and, where applicable, the EU General Data Protection Regulation ("GDPR").

Contact: info@artempo.app

2. Data We Collect

We collect personal data in the following categories to operate the Service:

• Account data: name/username, email address, profile photo, year of birth, interests.
• Location data: live location for map and route features; background location during an active route for stop-approach/arrival notifications; geofenced location for check-ins.
• Content: your feed posts, routes you create, photo uploads, comments, likes.
• Social graph: users you follow and users following you.
• Device and push data: device model, operating system, language, Expo push token, FCM/APNs token.
• Usage data: screens visited, anonymous interaction metrics.

3. Purposes of Processing

We process your data to:

• Create accounts and authenticate users
• Show nearby venues, exhibitions and routes on the map
• Send stop-approach/arrival notifications during an active route
• Power check-ins, visit counters, passport and gamification features
• Enable follows, likes, comments, feed and social interactions
• Send important updates and personalized notifications (with your consent only)
• Detect abuse, fraud and content policy violations
• Meet legal obligations

4. Legal Basis

We process your data under: (a) performance of the service contract, (b) your explicit consent (location, push, marketing), (c) legitimate interest (abuse detection, service improvement), (d) legal obligation.

Consent for location data and push notifications is obtained through the operating system's permission dialogs and can be withdrawn at any time via device settings.

5. Third Parties We Share With

Your data is shared only with the following technical infrastructure providers, only to the extent necessary to operate the Service:

• Supabase Inc. — authentication, database, file storage (EU servers).
• Expo (650 Industries, Inc.) — app distribution and push notification relay.
• Google Firebase Cloud Messaging (FCM) — Android push delivery layer.
• Apple Push Notification service (APNs) — iOS push delivery layer.
• Protomaps + Cloudflare R2/Workers — map tiles (sees user IP; no coordinate or content data shared).
• MapLibre — client-side map rendering library (no server data transmission).
• OSRM (self-hosted, Hetzner Germany) — walking route calculation.
• Mapbox Isochrone API — reach distance calculation (anonymous coordinates).
• Resend — email delivery (newsletter, system notifications).
• Vercel — website hosting.

These providers' own privacy policies apply. They are contractually bound to process data only on our behalf.

We do not sell or rent your data to third parties for marketing purposes.

6. Location Data — Detailed Disclosure

The Service uses location in three distinct ways:

• Foreground location: Used while the app is open to position nearby venues on the map. If permission is denied, the map centers on a default city location.
• Background location (active route only): When you start a route, we listen for location in the background to trigger approach (50m) and arrival (20m) notifications. Listening stops when the route completes or is cancelled.
• Check-in location: A visit record is created when you are inside a venue's geofence. Location is stored as a visit, not as a raw coordinate stream.

Background location is processed locally on your device to generate notifications; the raw GPS stream is not sent to our servers. Only check-in events (venue + time) are stored in Supabase.

7. Data Retention

• Account data: until the account is deleted.
• Content (posts, comments, visits): as long as your account is active or until you delete them.
• Device push token: automatically removed when the app is uninstalled or becomes invalid (DeviceNotRegistered).
• Server logs: maximum 30 days.
• On account deletion: personal data is irreversibly deleted within 30 days, subject to legal retention obligations.

8. Your Rights (KVKK Art.11 / GDPR Art.15-22)

You have the following rights:

• Know what data is processed
• Access and request a copy of processed data
• Request correction of inaccurate/incomplete data
• Request deletion or anonymization of data
• Request data portability
• Object to automated decision-making
• Withdraw consent

To exercise these rights, contact info@artempo.app. We respond within 30 days. You may also delete your account directly within the app under Profile > Settings.

9. Children

The Service is not designed for children under 13. We immediately close any account and delete the data of a user we learn to be under 13. Parental consent is recommended for users under 18.

10. Data Security

Your data is transmitted encrypted via TLS, and access is controlled via Supabase Row-Level Security. Passwords are hashed with bcrypt. Nevertheless, no internet transmission is 100% secure; absolute security cannot be guaranteed.

11. International Data Transfers

Providers such as Supabase, Expo, Google, Apple and Mapbox may process data in the EU and the US. Transfers are made under the EU-US Data Privacy Framework (DPF) or EU Standard Contractual Clauses (SCCs).

12. Cookies and Local Storage

The website uses only strictly necessary cookies and local storage for language/variant preferences. We do not use third-party tracking cookies. The mobile app stores session information locally in AsyncStorage.

13. Policy Changes

We may update this policy from time to time. For material changes we will notify you via in-app notice or email. The current version's effective date is at the top of this page.

14. Contact

Questions and requests: info@artempo.app