Privacy Policy

This policy explains how personal data is processed in connection with the Waykin mobile app and related web pages (together, the “Service”), in accordance with the EU General Data Protection Regulation (“GDPR”) Art. 13, the UK GDPR and the Turkish Personal Data Protection Law No. 6698 (“KVKK”).

1. Data controller

Onur Ahmet Yemez (sole proprietorship), operating the Service under the Waykin brand, is the data controller.
Address: İstiklal Mah. 310. Sk. C Blok D:2, 54050 Serdivan / Sakarya, Türkiye
Email: support@waykin.co

2. Personal data we process

Camera, photo library and microphone permissions are requested only when you want to take or pick a photo, pick a document or record a voice message. Only the content you pick or record is uploaded.

We do not collect special categories of data (health, religion, ethnic origin, etc.). Please do not share such information in your bio, messages or trip notes.

3. Location data

• Device location (GPS): With your permission, it is used in only two cases. (1) When you tap “go to my location” to move the map to where you are; this stays on your device. (2) When you add an ongoing trip, start a planned trip, change the city of your ongoing trip or accept an invite to an ongoing trip, to confirm you are in that city. In this case the coordinates are sent to our server once for that action, used only to calculate your distance to the city, and not stored. We do not collect location in the background.
• Map visibility: optional and off by default; when enabled it switches off automatically after the period you choose or, with the “until trip ends” option, on your trip’s end date (or when you complete the trip if it has no end date); it never outlasts your trip. While on, other users see you at a rounded position based on the city of your planned or active trip, randomly shifted (about 1.5 km) on every request. Your real location is never shown.
• A point you pick on the map: When you tap the map, the coordinates are sent to Google’s and OpenStreetMap’s (Nominatim) geocoding services to find the name of the city, district or region; they are not stored.
• Nearby traveller notifications: users who are visible on the map and have a trip in the same city receive a notification with each other's name and the city. You are never matched with people you have blocked.

4. Who can see what

• Signed-in users: your name, profile and cover photo, bio, country, native language, badges, trust score, rating average and join date.
• Your trips: visited, planned and active trips can each be set to “Everyone / Friends / Nobody” (default: Friends). Photos you choose to share to the Discover feed follow the visibility setting of their trip: all users see them if it is “Everyone”, only your friends if it is “Friends”.
• Travel companion requests: requests you publish are visible, together with the trip's city, dates and your name, to all signed-in users in the Discover feed and to anyone on the request's share page, regardless of your trip visibility settings. If you don't want this, don't publish a request. You can delete a request at any time.
• Rating comments: comments you receive are visible to your friends.
• Public share pages: when a profile, trip or request link is shared, people who are not signed in can view that page. A trip page shows the trip's city, dates and owner only if that trip status is set to “Everyone”. Otherwise the page shows no trip details. If your profile visibility is “Friends”, these pages show only your name and limited summary information.
• Trips you join: When you join a trip as a participant, the trip owner and other participants see you in the participant list. The trip also appears on your profile and in your trip lists according to the visibility the owner chose for that trip status.
• Messages: Only the person you are chatting with sees your texts, voice recordings, photos and documents. Your friends can see when you are online and when you were last seen; you can turn this off in settings. Users who are not your friends can also message you; people who have blocked you, or whom you have blocked, cannot.

5. Purposes and legal bases

We do not rely on consent for any processing. We do not send marketing or promotional notifications; if we ever do, we will ask for separate, optional permission. We do not use your data for advertising, profiling or sale. We do not make decisions producing legal or similarly significant effects based solely on automated processing; the automatic content filter only prevents text containing prohibited terms from being posted.

6. Recipients

We use the following service providers (processors), who process data only on our behalf and on our instructions:

We may also disclose data to competent public authorities when legally required, and only to the extent necessary. For city and place information, only the city or place name, place category, place ID and the city’s coordinates are sent to Wikipedia, Wikidata, Wikimedia Commons, Geoapify and Google; no personal data is sent.

The “Call”, “Website” and “Directions” buttons in place details open the phone, browser or maps app on your device. Those apps and the sites you visit are subject to their own privacy policies; no data about these interactions is passed to us.

7. International transfers

Some of the providers above are located outside the European Economic Area and Türkiye. Transfers from the EEA/UK rely on adequacy decisions or the European Commission's Standard Contractual Clauses (GDPR Art. 46) and the UK equivalents; transfers from Türkiye rely on the appropriate safeguards under KVKK Art. 9, including the standard contracts published by the Turkish Data Protection Board.

8. Retention

• Account and content: kept while your account exists. When you request deletion, your account is suspended immediately and hidden from other users; unless you sign in and cancel within 30 days, your profile, trips, photos, messages (including the other party's copy), ratings you gave and received, notifications, and your report and block records are permanently deleted. We email you when you request deletion and when it is completed.
• Frozen accounts: when you freeze your account, your data is not deleted but is hidden from other users; your account is reactivated when you sign in again.
• Unverified sign-ups: sign-ups whose email is not verified and that have no profile are deleted automatically after 7 days.
• Accounts without accepted Terms: if you sign in with Google or Apple but don't accept the Terms of Use, your profile and data are deleted automatically after 7 days.
• Media in messages: Photos, voice recordings and documents sent in messages are deleted from our servers as soon as they are downloaded to the recipient’s device; if they are never downloaded, they are deleted automatically no later than 7 days after they are sent. When a message is deleted for everyone, or by both people, its media is deleted immediately. The message record stays in the chat.
• Administrator action logs: kept for security and accountability; your identifying details in them are anonymised when your account is deleted.
• Backups and server logs: may remain in our infrastructure providers' automatic backups and technical logs for a limited period (generally not exceeding 30 days) and are then deleted.
• If there is a legal dispute or an official request, relevant data may be kept for as long as that process requires.

9. Your rights

Depending on where you live, you have the right to access your data, to rectification, to erasure, to restriction of processing, to data portability, to object to processing based on legitimate interests, and to lodge a complaint with a supervisory authority. Under KVKK Art. 11 you also have the right to learn whether your data is processed, to know the third parties it is transferred to in Türkiye or abroad, to request that corrections or deletions be notified to them, to object to a result against you arising solely from automated analysis, and to claim compensation for damage caused by unlawful processing.

How to exercise them: you can correct your profile in the app and delete or freeze your account via Profile → Settings → Account management. For any other request (including a copy of your data), email support@waykin.co from the email address registered to your account, or write to the address above. We respond free of charge within 30 days (one month under GDPR).

Complaints: you can complain to the data protection authority of your country of residence in the EU/EEA, to the UK Information Commissioner's Office, or to the Turkish Personal Data Protection Board (KVKK Kurulu).

10. Age requirement

The Service is not intended for anyone under 18, and you confirm that you are at least 18 when signing up. If we learn that an account belongs to someone under 18, we delete the account and its data. You can report this to support@waykin.co.

11. Security

Data is encrypted in transit (HTTPS/TLS). Session tokens are stored in your device's secure storage. Uploaded photos are re-processed and embedded metadata (EXIF), including location, is removed. Database access is restricted. No system is completely secure; if a personal data breach occurs we will notify the authorities and you as required by law.

12. Cookies and tracking

The app contains no advertising, marketing analytics or tracking SDKs and does not track you across other apps or websites. The app uses Sentry solely for error and crash reporting: when an error occurs, the error details, device and app information and your user ID are sent; your name, email, messages or other content are not. This data is used only to fix errors. Our website only stores your theme and language preference on your device (the language preference in a session cookie that is deleted when you close the browser); it uses no tracking, analytics or advertising cookies.

13. Changes

We may update this policy. We will announce material changes in the app. The current version is always available on this page.

14. Contact

support@waykin.co · Onur Ahmet Yemez, İstiklal Mah. 310. Sk. C Blok D:2, 54050 Serdivan / Sakarya, Türkiye