Privacy Policy

Gezenti is a mobile app in which you photograph real places to collect stickers and complete albums. This policy explains what we do with your personal data when you use the Gezenti app and the gezentiapp.com website. In this policy, “we” means Oğuz Han Kıdık, who develops and publishes Gezenti as an individual and is the controller of your personal data.

The notice required by Turkey’s Personal Data Protection Law No. 6698 (KVKK) is on its own page: KVKK notice. This is an English version; if it differs from the Turkish one, the Turkish version prevails.

In short

• When you photograph a place, we use your exact location to check that you were really there. Others see the place, never your location. We delete the exact location no later than 31 days after the capture is decided.
• Your photos are shown only to the people your profile privacy setting allows, and only after an automated check.
• No ads. We don’t sell your data or track you across other apps.
• You can delete your photos and your account from the app at any time, and whatever you delete is deleted at once.

Controller

Oğuz Han Kıdık
Email: destek@gezentiapp.com

What we process and why

Your account

When you sign in with Apple or Google, we receive an identifier for your account, your email address and, if you share it, your name. If you choose to hide your email with Sign in with Apple, we receive the relay address Apple gives us.

• Your name becomes the display name on your profile. You can change it at any time from Profile.
• We give you a username starting with user_. You can change it once.
• We keep your email address only to recognize your account and to confirm your identity when you make a request. We don’t send newsletters or marketing emails.

Why: to create your account and provide Gezenti to you.

Your captures: photo, location and time

When you take a photo for a sticker, or pick one from your gallery, the following is sent to our servers:

• Photo. Before uploading, the app shrinks the photo on your phone (at most 2048 pixels on the long edge) and removes its EXIF data (such as location, device and camera details). The server also makes a small preview copy.
• Location. The exact location where the photo was taken and its accuracy, in meters. For camera captures this is your phone’s position at that moment; for gallery photos it is the location stored in the photo.
• Time. When the photo was taken and when the capture reached the server.
• For camera captures: a one-time code issued by the server, which shows that the capture is fresh, and, on Android, whether a mock location app is on.
• For gallery photos: the time the photo was taken and a fingerprint of the original file (a SHA-256 hash). The server also computes a similarity hash of the uploaded photo.
• Device details: iOS or Android, the operating system version, the phone model and the app version.

Why: to check on our servers that a capture is genuine before awarding its sticker, and to prevent cheating. The server checks:

• Was the photo taken inside the place’s area?
• Is there an impossible journey between this capture and your earlier ones? For example, captures a few minutes apart in two distant cities.
• For camera captures: is the time fresh, and is the location real?
• For gallery photos: is the time consistent, and has the same photo already been used for this place, by you or by another user?

These decisions are automated. If you’d like to contest a rejected capture, write to us and a person will review it.

When you pick a photo from your gallery, the app reads only that photo’s location and time. On Android, the app reads the list of photos on your phone to show your gallery in its own picker; photos you don’t pick never leave your phone. The app never saves anything to your gallery.

Photo moderation

Before others can see it, every verified photo is checked automatically with Amazon Web Services’ (AWS) Rekognition service, on servers in Frankfurt, Germany. The check looks for inappropriate content such as nudity, violence, disturbing images and hate symbols.

• Only the photo itself is sent to AWS; your name, username and location are not.
• No face recognition is done.
• We keep the result of the check and the labels it found.
• A person reviews photos the automated check isn’t sure about.
• We have opted out of AWS using these photos to improve its own services.

Why: to protect users from inappropriate content.

Your profile and social features

We process:

• your display name, username, profile privacy setting and the title you pick;
• the stickers you collect and the badges and titles you earn;
• the people you follow and who follow you, and follow requests;
• the likes you give to albums and photos;
• the people you block;
• reports you send with Report, and the note you add if you choose to.

Why: to run Gezenti’s social features and keep the community safe.

Notifications

If you allow notifications, we keep:

• your phone’s notification token,
• its platform (iOS or Android),
• the app’s language.

We send notifications through Expo’s push service, which passes them on to Apple (iPhone) or Google Firebase Cloud Messaging (Android). A notification can include the name of the person who followed or liked you, and an album, place or badge name. It never includes a location.

You can turn notifications off in your phone’s settings. When you sign out, that phone’s notification token is deleted.

Why: to tell you about follows, likes and capture decisions.

The map, the camera and albums near you

The app reads your location only while it’s open, never in the background.

• Map. If you’ve allowed location, your position is shown on the map on your phone. The bounds of the area you’re looking at are sent to the server to fetch the places in it.
• Camera. While the camera screen is open, an area of about 2 km around you is queried to find nearby places. The same happens for a gallery photo, using the photo’s location.
• Explore. For “Albums near you”, your location rounded to about 1 km is sent, if you’ve already allowed location.

These queries are used only to answer them and are not stored.

Map images load from OpenFreeMap, which sees the area you’re viewing and your IP address. When you get directions to a place, its name and location are passed to your phone’s maps app (Apple Maps or Google Maps).

Usage data

To understand how the app is used, we use PostHog’s servers in the European Union (Frankfurt, Germany). The app sends:

• Screens opened. Only the kind of screen (for example “a profile”), not its content.
• Events. Signing in, submitting a capture, a capture being verified or rejected and why, earning a badge, following, liking, sharing a profile and deleting the account.
• The app opening and closing. If a link opened the app, that link is sent too.
• Your account’s identifier. This is a random code, not your name or email.
• Device details. The device model, operating system, app version, language, time zone and screen size.

Your photos and location are not sent. Your IP address isn’t stored or turned into a location.

This sharing is on by default. You can turn it off at any time in Profile → About → Share usage data.

Why: to improve the app.

Crash reports

When the app crashes or hits an unexpected error, a report is sent to Sentry’s servers in the European Union (Germany). It contains:

• the error’s details,
• the names of the screens opened at the time and the last taps,
• your account’s identifier,
• the device model, operating system and app version.

Your name, email, photos and location are not sent. To measure the app’s speed, performance measurements are also sent from a small share of sessions. Crash reports don’t depend on the “Share usage data” setting.

Why: to find and fix errors.

Support emails

When you write to destek@gezentiapp.com, we process your email address and what you write. Emails to that address are forwarded through Cloudflare to our inbox on Google’s Gmail.

Updates and technical logs

• When it opens, the app asks Expo’s update service whether a new version is available. Expo then sees a random identifier for the installation and your IP address.
• On iPhone, the app sends a short request to a Google address to check your internet connection.
• Our server provider, Supabase, keeps connection details such as IP addresses in short-lived logs to run and protect the service. When an error happens, our server functions write the related capture’s or account’s identifier to those logs.

gezentiapp.com

The website has no analytics, advertising or tracking cookies. It’s hosted on Cloudflare, which processes connection details such as IP addresses to serve the pages and protect the site, and may set a strictly necessary cookie for security.

What others see

People who aren’t signed in to Gezenti can’t see any profile. For signed-in users:

• Name and username. Unless your profile is hidden, your display name, username and the title you pick show in search and in lists of people.
• Your profile’s contents. Your albums, progress, badges, titles, photos and follow lists follow your Profile → Settings → Profile privacy setting:
  • Public: anyone signed in can see them.
  • Followers only: only the followers you accept can see them.
  • Hidden: no one can find or see your profile.
• Photos. A photo shows to others only after it’s verified and passes the automated check. Photos of rejected captures are never shown to others.
• Location and dates. Others see where a sticker’s place is, never your location. Dates show only as a month and year (for example “October 2026”).
• Explore. Only public profiles’ albums and photos appear in Explore, and only after at least 6 hours. That way Explore never tells strangers where you are right now. Your followers and anyone who opens your profile see a new photo straight away.
• Likes. You see who liked your album or photo. When you like something, its owner sees it.
• Blocking. You and the people you block don’t see each other anywhere.

What stays on your phone

• Your session and your preferences (language, appearance, the usage data setting) are kept in the app’s own storage.
• Captures not yet uploaded wait on your phone, with their photo and location, and upload when you’re back online. The phone’s copy of a decided capture is deleted after 7 days.
• Signing out doesn’t delete these copies; deleting your account does.

Who we share data with

We don’t sell or rent your personal data, and we don’t use it for advertising. We work with these service providers to run Gezenti. Each receives only what it needs for its job:

Provider	What for	Where the data is processed
Supabase	Database, sign-in, photo storage, server functions	Frankfurt, Germany
Amazon Web Services	Photo moderation (Rekognition)	Frankfurt, Germany
PostHog	Usage data	Frankfurt, Germany
Sentry	Crash reports	Germany
Expo	Sending notifications, app updates	United States
Apple	Sign in with Apple, iPhone notifications	United States
Google	Google sign-in, Android notifications, support email (Gmail), the connection check on iPhone	United States
OpenFreeMap	Map images	Outside Türkiye
Cloudflare	gezentiapp.com and forwarding support email	Global network

Otherwise we disclose personal data only to public authorities and courts that are legally entitled to it, where the law requires. What other users see is described in “What others see” above.

International transfers

Our providers’ servers are outside Türkiye, so your personal data is transferred abroad.

• The main database and photos, photo moderation, usage data and crash reports are kept in the European Union (Germany).
• The notification, sign-in and update services are in the United States.

For transfers from Türkiye, we comply with the conditions of Article 9 of the KVKK. Transfers from the European Economic Area rely on the providers’ safeguards, such as the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

How long we keep data

Data	How long
The exact location where a photo was taken	Deleted by a daily automated cleanup no later than 31 days after the capture is decided (verified or rejected). After that, only check results remain, such as the distance to the place and the location’s accuracy.
Photos and their preview copies	Until you delete them or your account. When you delete a photo, the photo and its preview copy are deleted at once and for good, and no one sees it any more. This includes photos of rejected captures, which only you can see.
Capture records, check results and moderation results	Until you delete your account
Profile, stickers, badges, titles, follows, likes, blocks, reports	Until you delete your account
One-time capture codes	7 days
Notification token	Until you sign out or delete your account. Sending records: 1 to 7 days.
Usage data (PostHog)	Up to 1 year
Crash reports (Sentry)	Up to 90 days
Server logs (Supabase)	Up to 7 days
Support emails	As long as needed to resolve the request and any dispute that may follow

When you delete your account, your data is deleted at once and for good: your photos, captures, stickers, badges, titles, follows, likes, reports, blocks and profile. There is no waiting period. A few records may stay for a short time:

• In notification sending records, your notification token stays for up to 1 day.
• Usage data and crash reports are deleted when the periods above end. Write to us if you’d like them deleted sooner.
• The system’s job queues may keep technical identifiers that can no longer be linked to your account.

Your rights and choices

In the app, you can do these yourself:

• Change your profile privacy: Profile → Settings → Profile privacy.
• Change your display name.
• Delete one of your photos.
• Turn off usage data: Profile → About → Share usage data.
• Turn off notifications, and location, camera and photo access, in your phone’s settings. You can’t capture without location and camera access.
• Block or report someone.
• Delete your account: Profile → Delete account. The steps are on the Delete your account page.

You can also write to us to:

• get a copy of your data,
• correct inaccurate data,
• contest an automated decision and have a person review it,
• restrict or object to processing.

Your rights under Article 11 of the KVKK, and how to apply, are in the KVKK notice. We answer requests free of charge within 30 days.

If you live in the European Economic Area, the United Kingdom or Switzerland, you also have the rights the General Data Protection Regulation (GDPR) gives you:

• access, rectification and erasure,
• restriction of processing,
• data portability,
• objection,
• a complaint to the data protection authority where you live.

We process your data on these legal bases:

• performing our contract with you, for your account, captures and the social features (GDPR Art. 6(1)(b));
• our legitimate interests, for verification and preventing cheating, moderation, security, crash reports and usage data (Art. 6(1)(f));
• our legal obligations (Art. 6(1)(c)).

Children

Gezenti isn’t for children under 13. If we learn that someone under 13 has created an account, we delete it. If you’re under 18, use Gezenti with your parent’s or guardian’s knowledge.

Security

• All connections between the app and our servers are encrypted (HTTPS).
• Photos are kept in a storage area that isn’t public, and they’re shown only to people allowed to see them, through links that expire quickly.
• In the database, each user can reach only the records they’re allowed to see.
• Only we can access the data as administrators. We look at exact locations only for verification, moderation and support.

No system is perfectly secure. If a security breach affects your data, we’ll notify the Personal Data Protection Board and you, as the law requires.

Changes

When we update this policy, we change the date at the top of this page. We announce significant changes in the app or on this page before they take effect.

Contact

For questions and requests: destek@gezentiapp.com