Privacy Policy and KVKK Notice
This is an English translation. The Turkish text, Gizlilik Politikası ve KVKK Aydınlatma Metni, is the binding version; if the two differ, the Turkish text prevails.
This notice explains how your personal data is processed when you use the Rastlio mobile app and the rastlio.com website. It is the information notice required by Article 10 of Türkiye's Personal Data Protection Law No. 6698 (KVKK).
In short
- Your location is never shown to anyone. There is no map of where you are, no distance and no direction; your location history is never kept.
- Your location is used only while you are visible. The one exception: once, at the moment you share with the "My city" audience.
- Posts are deleted after 24 hours.
- No ads, no tracking and no analytics. Your data is never sold.
- You can delete your account from the app at any time.
1. Data controller
Rastlio is operated by Acar Kerem Gürbaşak, who is also the data controller for your personal data. For any question or request: rastliotr@gmail.com.
2. What data we process
Account
- Sign in with Google: your email address and Google account ID. The full name and profile picture Google sends are not stored on our servers; they are deleted during sign-in.
- Sign in with Apple: the account ID Apple provides and your email address. This may be the address Apple provides through "Hide My Email". We do not ask Apple for your name.
- Sign in with email: your email address and password. Your password is stored only in a non-reversible form (as a hash); no one can see it. A one-time code is sent to your email to verify your account and to reset your password.
- Session data: the IP address and device information of the device you sign in on, and your last sign-in time.
Profile
- Your first name, date of birth (others only see your age), gender, intent (Dating, Friendship or Chat), the text you write about yourself, and your interests.
- Your username (@name). Anyone who can see your profile sees it; nobody can search by username. The dates of your username changes are kept to apply the rule of at most 2 changes in 14 days.
- Between 2 and 6 photos. Photos are re-saved on your device before upload; all metadata, including location, is removed.
- Optionally, your school (chosen from a list, not verified) and department.
Preferences
- Your "Who would you like to see" and "Who can see me" choices, whether you are visible, your "Let me know when someone arrives" request, whether your online status is shown, and your notification preferences.
- Taken together with your gender, the "Who would you like to see" choice may reveal sensitive information. It is never shown to anyone. It is used only to decide who is listed for you and who your requests can go to.
Requests, chats and messages
- The requests you send and receive, the notes you add to them, and the responses.
- Your chats, messages and read receipts.
- When you last had the app open. This is used only for the "Online" label in accepted chats and can be turned off in Settings.
Posts
- Your photo and text posts, their captions, the text you write on images, the audience you choose, and likes. Text on images is also stored separately for screen readers and for reviewing reports.
- The camera is used only while the Share screen is open. The microphone is never used.
- Your gallery opens through your phone's own picker; access to your photo library is not requested.
- Post drafts are kept only on your device.
- Who viewed your story is not recorded.
Safety and moderation
- The people you block.
- Reports you make and reports about you: the reason, description, the chat or post concerned, and the post's text at the time of the report.
- A copy of the reported post's photo.
- The review status of your profile photos and the status of your account (for example, suspended).
- Records of declined requests: kept to prevent repeated requests to the same person.
Rastlio Plus
If you subscribe to Rastlio Plus: whether you have a subscription, when it starts and ends, whether you are in a free trial, which store it was bought from (App Store or Google Play), store transaction IDs and your purchase history. When you use your stand out and priority request allowances is also kept to count your daily allowances. Payment details such as your card number never reach us; Apple or Google takes the payment.
Notifications
Your device's notification token, its type (iOS or Android) and your app language (so that notification text is sent in that language). Notifications never include anyone's name or photo.
Technical logs
Our hosting provider keeps a log of every request to the server. The log contains your user ID, IP address, approximate place derived from the IP (country and city), internet provider, device information, and the type and time of the request. These logs contain no location coordinates.
Support
When you email us, your email and the information in it.
What stays on your device
Your session, language choice, post draft, image cache and which stories you have seen. This information stays on your device and is not sent to us.
What we do not process
Phone number, contacts, microphone, advertising ID, your last name and full name. The app contains no advertising, tracking or analytics tools.
3. Location
- Only while you are visible. When you choose "Go visible" in the app, your device sends its location to the server. The server rounds it to a grid of about 40 metres and keeps only this rounded latest location. There is a single record per person and no history; the raw location is never stored anywhere.
- Even when the app is closed. Until you turn visibility off, your location keeps updating while the app is closed, so your circle stays current. On Android, a "You're visible" notification stays in the notification bar during this time. If your phone stays still for a long time, a notification with no content may briefly wake the app to send a single location.
- When you go invisible. Your latest location is deleted immediately and location is no longer used. If no location arrives from your device for 45 minutes, your latest location is also deleted.
- City. The province you are in is determined from your location. Only the province is stored and it is never shown to anyone. When you share with the "My city" audience, your location is taken once at that moment to find your city, even if you are invisible.
- Other people's location. No one's location is sent to you, and yours is not sent to anyone. The server only works out whether you are in the same 150-metre circle.
- Density map. The map contains no information about people. Areas of about 500 metres are shown at 4 levels. An area appears only if at least 3 people are in it (at least 5 in the Women and Men modes). The view refreshes every 10 minutes and no history is kept. Your own place is not shown on the map.
- Fake location. Unusually fast location jumps are flagged to prevent abuse with fake locations.
- You can withdraw location permission in your phone's settings at any time. You then can't see people around you; the rest of the app keeps working.
4. Purposes and legal grounds
Your data is collected by automated or partly automated means: through the information you enter in the app, the device permissions you grant (location, camera, notifications), sign-in with Apple, Google or email, and server logs. It is processed on the following legal grounds in Article 5(2) of the KVKK:
- Formation and performance of a contract (c): creating and managing your account; showing your profile; the age check; finding people in the same circle; requests, chats and posts; notifications; account deletion.
- Legitimate interest (f): the security of the service and its users; preventing fake locations, spam and abuse; reviewing reports and moderation; technical logs and debugging; answering support requests.
- Legal obligation (ç) and the establishment, exercise or protection of a right (e): requests from competent authorities, reporting illegal content, and disputes.
5. Who your data is shared with
Your data is never sold and never used for advertising.
Other users
- Your profile is seen only by people who can see you: those in the same circle at that moment, those who see a post of yours that is open to them, and those you have a request or chat with.
- Your school and department are visible only to people who can see your posts and people you have opened a chat with.
- Your location, city and "Who would you like to see" choice are never shown to anyone.
- The person reported is never shown who reported them.
Service providers
We use the providers below to run the app. Your data is transferred to these providers and the countries they operate in, limited to the purposes below.
| Provider | What for | Where |
|---|---|---|
| Supabase (Supabase Pte. Ltd., Singapore) | Database, sign-in, server operations and technical logs | Data is in Germany (Frankfurt). The provider's support team and sub-processors may access it from other countries, including the USA. |
| Cloudflare (Cloudflare, Inc., USA) | Storing and serving photo files | Files are stored in the European Union. When you upload or view photos, your IP address and device information go to Cloudflare. |
| Expo (650 Industries, Inc., USA), Apple and Google | Delivering notifications: the notification token and the anonymous notification text | USA |
| Apple and Google | Verifying your identity at sign-in | USA |
| Resend (USA) | Sending you verification and password reset codes for sign-in with email. Also the notification email sent to the moderator when a report comes in; this email contains no photo, no reporter identity, name, email address or location. | USA |
| RevenueCat (RevenueCat, Inc., USA) | Managing and validating your Rastlio Plus subscription: your random user ID, purchase and subscription history, store transaction IDs, device type and app version. Your name, email address and location are not sent. | USA |
| OpenAI (OpenAI, L.L.C., USA) | Automatic check of profile photos and post images for inappropriate content before they are published. Only the image is sent; your name, user ID and location are not. OpenAI does not use these images to train its models and may keep them for up to 30 days to monitor abuse. | USA |
| Google (Gmail) | Support and moderation mailbox | USA |
| OpenFreeMap (Hyperknot Software Kft., Hungary) | Base map images for the density map. Your IP address and the area you look at on the map go to the provider. | European Union; the content delivery network may include the USA |
Competent authorities
Where legally required, to competent public institutions and courts.
6. Retention periods
- Account, profile, photos, preferences, blocks: until you delete your account. You can also delete photos one by one.
- Latest location: immediately when you go invisible; after 45 minutes if no location arrives.
- City: deleted if not updated for 30 days.
- Posts and likes: 24 hours. You can delete them earlier. Photo files are then also deleted from the server within about 20 minutes at most.
- Requests: declined or unanswered requests are deleted after 7 days. Accepted requests are kept until the account is deleted.
- Messages: until one of the parties deletes their account. "Delete chat" hides the chat only on your side.
- Reports, decline records and fake location flags: until the account concerned is deleted.
- Photo copy of a reported post: when the report is closed, at the latest after 30 days.
- Report notification emails: 30 days at the email provider; in the moderation mailbox, at most 30 days after the review is finished.
- Rastlio Plus records: until you delete your account. When you delete your account, your RevenueCat record is deleted too; Apple and Google keep their own purchase records under their own rules.
- Stand out and priority request records: 2 days.
- Photo check results (scores): 30 days.
- Username: when you change your username or delete your account, the name you leave is not given to anyone else for 14 days, then it becomes free.
- Notification token: when you sign out or delete your account.
- Technical logs: we can access them for about 1 day. The hosting provider may keep them longer for its own security purposes.
- Support correspondence: at most 1 year after your request is resolved.
- Backups: copies remaining in backups are deleted when the backup expires (at most 7 days).
When you delete your account, your account, profile, photos, requests, chats and the reports about you are deleted. Details: Account deletion.
7. Moderation and automated processing
- Profile photos and post images are checked automatically (OpenAI) before they are published. An image with a high explicit sexual content score is not published and you are asked to choose another photo.
- Profile photos are reviewed by a person before they are shown to others.
- If a chat is reported, the moderator may read that chat's messages solely to review the report. Messages are never read for any other purpose.
- The photo of a reported post is kept for at most 30 days so it can be reviewed even if the post is deleted.
- A post reported by 3 different people is automatically hidden and put under review. Unusual location jumps are also flagged automatically. You can write to us to object to these automated actions; a person reviews the objection.
- Accounts that break the rules may be suspended or closed (Terms of Use).
- Content and accounts suspected to belong to someone under 18 are reviewed first and reported to the competent authorities where necessary.
8. Security
- All connections between the app and the servers are encrypted.
- Location data and other users' data are closed to direct access. Each piece of information is given only to the person authorised to see it, after passing the rules on the server.
- Photo files are not public. They are shown only to the person authorised to see them, through a signed address valid for 1 hour.
- Photo metadata is removed on your device before upload.
9. Your rights and how to apply
Under Article 11 of the KVKK, you have the right to:
- learn whether your personal data is processed,
- request information about it if it has been processed,
- learn the purpose of processing and whether it is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom it is transferred,
- request correction if it is incomplete or inaccurate,
- request deletion or destruction under the conditions in Article 7 of the KVKK,
- request that corrections and deletions be notified to the third parties the data was transferred to,
- object to a result against you that arises from analysis of your data exclusively by automated systems,
- claim compensation if you suffer damage because of unlawful processing.
How to apply: send an email to rastliotr@gmail.com with the subject "KVKK request". Include your name, information that lets us find your account (your sign-in method and, if any, the email address linked to your account) and your request. We may ask for additional information to confirm the account is yours.
Your request is resolved free of charge within 30 days at the latest. If the action involves an additional cost, the fee set by the Personal Data Protection Board may be charged. If you find the answer insufficient or do not receive an answer in time, you can file a complaint with the Personal Data Protection Board.
The fastest way to delete your account and data is in the app: Profile › Settings › Delete account.
10. Age limit of 18
Rastlio is only for people aged 18 and over. Your date of birth is checked at sign-up. If an account belonging to someone under 18 is found, it is closed and its data deleted.
11. The rastlio.com website
The website uses no cookies, stores nothing in your browser and contains no analytics tools. The font is loaded from Google Fonts, which sends your IP address to Google. The website is hosted on Vercel (USA); Vercel keeps technical access logs. The "Let me know" section only opens your email app; the website records nothing.
12. Changes
We may update this notice as the app or the law changes. The current version is always on this page; we also announce important changes in the app.