Last updated: October 14, 2026
The data controller is Berke Özcan; contact: destek@biyapsak.com. biYapsak provides event and restaurant discovery, plan creation, and nearby place and route information across Türkiye. Public transport routes are for Istanbul. Data is collected electronically through information you enter, location you permit and automatic technical error reports. You can browse events, restaurants and route information without an account. Plans, posts and social features require an account opened with Apple or Google. A random session identifier is used for server-side trip directions and data management.
With permission, your location is processed by our server and the relevant map provider to answer route, stop and nearby searches. The starting point you choose for a trip may form part of its plan data. The location picker resolves province and district names using data bundled on the device; no data is sent to Google for this step. The province or district you select manually is stored on the device.
When you enable Lock Screen tracking, accept the in-app explanation and grant the required device permissions, location may update your active journey while another app is open or your screen is locked. Only the latest location, observation time and accuracy are kept on your device for this tracking; the background task does not upload your location or create a location history. Turning tracking off or finishing the journey deletes this tracking record and stops location tracking. The iOS Live Activity or Android ongoing notification may show your destination and stop/journey details to anyone who can see the screen. Turn tracking off in the app and manage permissions and notification visibility in device settings. The feature is optional; you can continue in the app. Tunnels, permission changes or force-closing the app may stop updates; the last displayed information may be out of date.
Recent routes, favorites, your profile name/photo and saved addresses are stored on your device. You can manage them in the app. Your operating system’s device backup settings also apply. On iOS, plan titles, times, meeting places, confirmed participants’ names and downloaded photos are copied to the shared on-device App Group store; home-screen and lock-screen widgets and Siri read this copy. It is cleared on logout or when plans cannot be fetched. Siri can read the next plan; creating plans and “On my way” open the app. An exported .ics file or system calendar form may contain title, times, place, note and app link; the whole calendar is not read. Files in a selected Android folder may remain until you delete them. Memory cards and year recaps are generated on-device from existing plans and participation; shared images may contain plan details and participant photos. They go to your selected sharing app; private meeting places are omitted from memory cards.
Trip suggestions from the prepared venue catalog, your preferences and newly saved plans are processed and stored on your device; they are not sent to Gemini to generate a plan. When you request directions or transport for a day, the starting point, selected venues and travel time are sent to our server and the relevant map provider. These operations use an anonymous session and abuse limits. Any server plans remaining from older versions require the relevant session authority for access or deletion.
Deleting a catalog trip created on your device removes that local record. The server-deletion information below applies to server records remaining from older versions and their sessions. Deleting a saved trip removes its server record using your current session or a device-held permission that can only delete that trip. The trip-data deletion action in Account also covers plans and unfinished trip records belonging to sessions for which this device retains deletion permission. Deletion is not complete until the server confirms it. Offline or partial failures may leave some confirmed records deleted; remaining records and retry information are kept. To prevent data from being recreated through an old session, the server may retain a one-way digest of its identifier and deletion time, and the device may retain a receipt usable only to retry deletion. These records contain no trip content and currently have no automatic timed cleanup. Deletion from live records does not immediately change earlier backups; backups are considered separately for data requests. Contact support if the old session and deletion permissions have been lost.
You can browse events, places to eat and directions without an account. Making plans, commenting, saving, joining and messaging need an account. You open an account with Sign in with Apple or Google; you do not create a password. From Apple or Google we receive only an identifier unique to your account and, if available, your name; we do not request or store your email address. Our server stores this identifier and the sign-in provider, your display name, your username (generated from your name; you can change it), the account creation time and your biYapsak record. The biYapsak record covers events you joined and saved, your plans (time, meeting place, names of people you added and notes) and events you created (title, time, place and location, description, co-organiser). If you pick a cover photo from your phone for a public event, the photo is resized on the phone and uploaded to the server; photo metadata, including location, is removed on upload. Cover photos of other events are not uploaded; they stay only on that device. A random key is created for your session; it is kept in your device’s secure storage, and the server keeps only a one-way digest of it with the session’s creation, last-use and expiry times. A session ends 90 days after its last use. An event you mark “Public” (title, time, place and location, description, cover) is shown, together with your display name and username as organiser, to everyone on biYapsak. The events you join are stored on the server; your friends see your name, other users see only the number of people going. Reports you make (which event and why) and the people you block are stored on the server; the person you report or block is not told. Your saved items are not shown to other users; for friends, plans and “My friends” events see “biYapsak friends and plans”. We process this data to provide the account, sync between your devices and public events and to enforce the community rules, on the legal basis of establishing and performing the contract. biYapsak data is stored outside Türkiye on our server and database hosted by Railway; our server runs in the Netherlands (Amsterdam). This is a transfer abroad under the KVKK. During sign-in, Apple or Google process data under their own terms. A biYapsak account is only for people aged 15 or over; you confirm this when you open it. To find friends you may optionally add your own phone number: it is turned into a one-way digest on your device, the server keeps only that digest hashed again with a server key, never the plain number, and shows it to no one. If you choose to find friends from your contacts, the numbers are turned into digests on your device only and only those digests are sent for matching; names and numbers are not sent and the digests are not stored. Add to calendar adds the event to your device calendar; other entries are not read.
In Profile > Settings you can download your data as a JSON file, sign out or delete your account. You can change your name and username in Profile > Edit profile. The download contains your account details (including the sign-in provider’s identifier), session dates, your biYapsak record, your public events, participations, reports, the people you blocked, your friendships, plans and invite codes. Signing out deletes that session from the server; expired session records may remain until the account is deleted. When you delete the account, your sessions end at once, your profile and public events are no longer shown to other users and your participations stop counting. Your data is kept for 30 days: during that time you can undo the deletion by signing in with the same Apple or Google account, or download your data without undoing it. After 30 days your account, the biYapsak record on the server, your public events and their covers, and your participation, report and block records are permanently deleted; a copy of the biYapsak record on this phone may stay on your device until you remove the app. If you signed in with Apple, an Apple sheet opens once when you request deletion and the app tries to revoke biYapsak’s Apple connection right then (signing in with Apple again is enough to undo the deletion); you can also remove it in your Apple ID settings. You can remove the Google connection in your Google Account’s security settings. To prevent a sign-in token issued before deletion from recreating the account, the server keeps for 90 days a one-way digest of the sign-in provider’s identifier, made with a secret key, and the deletion time. This record contains no name, username or biYapsak content, and your identifier cannot be recovered from the digest. If you sign in with the same Apple or Google account after the account has been permanently deleted, a new, empty account is created. Deletion from live records does not immediately change any earlier backups. Data exports also include your created polls, votes, recurring-plan series, skipped meetings and venue ratings; these account-linked records are removed on permanent account deletion.
If you have a biYapsak account, other users can find you by searching your name and username. If you optionally add your phone number, its hash is stored on the server for friend matching. Find from contacts reads contact names and numbers on your device only with your permission; number hashes are sent for matching. Raw contact names and numbers are not sent in this matching request. Users who are not your friends see your name, username, the public events you host and your mutual friends on your profile; your friend list and count are shown only to you. Our server stores your friendships and friend requests (who, to whom, when and their status; a request you decline is not reported to the sender), your personal invite code (valid for 30 days; you can renew it), reports you make about people, plans you make with friends (event name, date and place, meeting time and place, note, invitees and their replies) and your participation in Biletix or Etkinlik.io events (event name, time and place). Only your friends see the events you join and your “My friends” events. Access to plan chat depends on membership and participation status; in a public plan, only its creator and members who said “I’m in” can open the chat. A person who sends a join request sees its approval status; the full address and chat are locked before approval. Answers to activity questions in a public plan may be shown before approval. Someone who opens your personal invite link and wants to join sends you a friend request; you become friends when you accept it. When a plan’s owner leaves, the plan passes to the first person who said “I’m in”; plans you own are handed over the same way when you delete your account. Blocking someone ends your friendship and your membership in each other’s plans. The app never sends messages on your behalf by itself; invites go only through the share sheet you open. We process this data on the same legal basis as the biYapsak account (establishing and performing the contract) and on the same server; it is deleted under the deletion rules above when the account is deleted. Plan-chat polls store questions, options, your vote and vote time on the server; voters’ names, usernames and photos are shown to members authorized to open the chat. Recurring plans store frequency, templates, next creation times and skipped meetings. Your venue star rating and optional note are linked to the plan and account; summaries and friends’ ratings may be displayed. Invitees answering “Not coming” cannot see private meeting places, notes or participant details. Web previews omit participant profiles and exact meeting addresses. A web guest’s name and response are stored with a hash of the invitation cookie; “Coming” awaits the owner’s approval. The invitation-specific HttpOnly cookie is set for 366 days.
If you allow biYapsak notifications, your device’s notification token and platform (iOS or Android) are stored on our server, linked to your account; the token is used only to send you biYapsak notifications. When you sign out, the app deletes this device’s token from the server; when you request account deletion, all your tokens are deleted at once. Notifications are sent for friend requests and accepts, plan invites and changes, plan chat, cancellations or announcements of events you joined, and “On my way”; they contain the sender’s name, the plan or event name and the first 80 characters of the message or announcement. Notifications are delivered through Expo’s notification service (650 Industries, USA) to Apple or Google; this text passes through these services and is processed outside Türkiye. You can turn notification types off in Profile > Settings > Notifications, mute a single plan’s chat on the plan page, or stop all notifications in your phone’s settings; these settings are stored on the server. Only plan members see plan chat messages; messages are deleted after 90 days. “On my way” shares only how many minutes until you arrive, never your location; it is deleted after 3 hours. If you open a business page, the business location you pick on the map is shown to everyone together with the page’s name, description and deals; it is not your device’s location. We process this data on the same legal basis as the biYapsak account; the Download my data file also contains your registered tokens, notification settings and muted plans. Notification cards in the app may show the plan or event cover image or the sender’s profile photo. To attach a cover to an iOS reminder notification, the app downloads the image and keeps it in the device cache. If you leave a rating and review on a venue or business page, the rating, review text and any photo you choose are sent to the server. The business’s reply and reports about the review are also sent to the server; you can delete your own review. The iOS notification extension may download notification images and sender photos; temporary files present the notification on-device. Live Activities may show the plan name, place, time, confirmed participants and already shared arrival minutes on the lock screen; no GPS tracking is used for this. Departure reminders and enabled rain alerts are scheduled on-device. Location and notification permissions follow a shared explanation screen; granting permission or enabling a feature is not consent to other optional transfers. When you open or claim a business, the name or company title, mobile number, message and tax plate photos you enter are processed only to review your request; only the biYapsak administrator sees them, they never appear on the business page or to its owner, and they are deleted 30 days after the decision.
Photos, stories, captions, comments and likes you share in biYapsak are stored with your account in our server database (Postgres). Photos are resized on your phone before upload; location (GPS), device and other EXIF/XMP data are removed on the server. Depending on the audience you choose, your posts and stories are visible to everyone, only your friends, or only you. Stories are deleted with their photos after 24 hours; photos uploaded but not shared within 24 hours are deleted too. You can delete your posts and comments at any time. When reports from other users reach a set number (2 for posts and stories, 3 for comments), the content is hidden automatically. Deleting your account deletes all of this content.
biYapsak users can exchange direct messages without being friends. If the other person enables «Receive invitations only from friends», you must be friends to start a new chat; this setting does not close existing chats. You cannot message someone you blocked or who blocked you; to prevent abuse, the number of new chats a person can start per day is limited. Your messages, the two people in each chat, the read marker showing what each person has read and your mute setting are stored on our server, linked to your account; only the two people in the chat see its messages. Messages are deleted after 90 days; you can delete your own message at any time. If you block someone, the chat is hidden on both sides. You can report a message; the report (which message and why) is stored on the server, the message disappears for you at once and the other person is not told. New-message notifications contain the sender’s name and the first 80 characters of the message (see biYapsak notifications). If you add a profile photo, it is cropped square and resized on your phone and uploaded to the server; location (GPS), device and other EXIF/XMP data are removed on the server. Anyone who can see your profile sees your photo (including friend lists, search, event attendees, comments and messages). The photo is deleted when you remove it or delete your account. We process this data on the same legal basis as the biYapsak account; the Download my data file also contains the messages you wrote, your chats and your reports.
Unexpected errors may send an error message, technical stack trace, platform and app version to the server. Reports that could not be sent may be held temporarily on the device for retry. No location field is added, and sensitive text is filtered before sending. The server keeps the latest 200 reports; reports aged 30 days are not listed. If disk storage is enabled, reports are restored after a restart. Expired records are removed from disk at startup; as the file grows, it is rewritten with the latest 200 records. Expired records are also deleted from disk every hour. Hosting logs are separately subject to the provider’s retention period. Network addresses may be processed to limit abuse.
If you send feedback, its text, type and any category, place name/identifier and report reason are sent to the server to improve the service. Sending is optional. The server list is limited to the latest 1,000 records; records aged 180 days are not listed. If disk storage is enabled, records are restored after a restart; expired records are removed from disk at startup, and the growing file is rewritten with the latest 1,000 records. Expired records are also deleted from disk every hour.
Free text you type in Ne Lazım is matched to a need category by TypeSafe (the Jev classifier) only with your explicit consent to this transfer; no coordinates or session identifier are added to the request. Your explicit consent is the basis for this optional transfer; using the app or granting location permission does not replace it. Without consent, normal place search continues. Text and results may be cached in server memory: results are valid for 24 hours, and expired entries are removed on the next classification cache access or restart. Service providers we use: Railway (hosting; our server runs in Amsterdam, the Netherlands), Google and, where needed, Geoapify (place and route searches), İBB / Metro İstanbul (transit and city information), Sentry when enabled (technical error data) and TypeSafe (the optional classification above). Google, Geoapify, TypeSafe and Sentry may process data outside Türkiye; the countries where they process it and how long they keep it are governed by each provider’s own privacy policy. The Google Maps Terms of Service and Google Privacy Policy are linked below. External services have their own terms. Duty-pharmacy services import pharmacy names, addresses, phones, coordinates and duty periods from official provincial chambers and İzmir Metropolitan Municipality; user location is not sent to those list providers. OSM/Overture place data is stored on the server; nearby search uses an approximately 200-metre grid cache and distance calculations. Daily Google search quotas count a keyed hash of the account or IP address. İzmir and Bursa municipal events cache titles, dates, venues, coordinates and poster links on the server; external posters may connect the device to their image provider. Plan forecasts use MET Norway; the Türkiye weather service sends roughly 0.1-degree coordinate cells only to a configured self-hosted Open-Meteo server and uses an hourly cache. It does not call public Open-Meteo; without self-hosted configuration no data is supplied. Fuel-price collection is inactive; only links to official EPDK pages are provided.
For questions, withdrawal of explicit consent and data requests, write to destek@biyapsak.com. You may ask whether your data is processed, for information about processing, its purpose and use in line with that purpose, and recipients in Türkiye or abroad; request correction of incomplete/incorrect data, deletion/destruction when the legal conditions are met and notification of these actions to recipients; object to an adverse result based solely on automated analysis and seek compensation for harm caused by unlawful processing.
Google Maps Terms of Service · Google Privacy Policy
Contact: destek@biyapsak.com