The Cala application (formerly known as Kıyı Rehberi) (the "App") is developed and operated by Yunus Emre Tugay (the "Data Controller"). For any privacy-related questions or requests, you can write to emre@pimrobotics.com.
Account information: When you sign up, your e-mail address, display name (derived from the part of your e-mail address before the @ sign unless you set one yourself) and password (passwords are stored as irreversible hashes; your plain-text password never reaches us) are processed. Authentication and session data (session tokens) are processed to keep you signed in. If you use Sign in with Apple, the identity information Apple provides to us and (if you allow it) your name and e-mail address are processed.
Location: If you grant location permission, your location is used to show nearby beaches, calculate distances and personalize rankings. Your location is not tracked continuously; it is processed momentarily for the map and ranking features. When you submit a crowd report for a beach, your approximate location (reduced to roughly 1 km precision) is stored with the report to verify that it was sent from near that beach.
Crowd reports: The crowd level you submit, the report time and a randomly generated device identifier (used to limit repeated submissions) are recorded. This identifier is not an advertising identifier and your reports are never displayed together with your identity. Because the same device identifier is also used in account-linked features such as notification registration, it may be indirectly matched to your account on our servers; this matching is kept solely for abuse prevention and service operation and is not used for any other purpose. Crowd reports are deleted after 90 days.
Reviews and public profile: When you submit a review for a cove, your rating (1-5), review text and any photos you attach are processed. Reviews and photos are examined before publication (pre-moderation); until approved they are visible only to you and the review team, and once approved they are published in the App publicly (including to users who are not signed in) together with your public profile information. Your public profile includes your display name, username, profile photo (visible as soon as you upload it), "about" text, contribution badges and, only if you turn it on (it is off by default), your list of favorites. When you like a review, your like is recorded in association with your account; other users only see the total number of likes, not who liked it. When you delete your account, your reviews, photos, likes and public profile are deleted entirely.
Notifications: If you grant notification permission, your device's notification token (generated by Apple), your device identifier, your app language and your time zone are stored linked to your account so that we can send you notifications. When you revoke notification permission the record is deactivated; when you delete your account it is deleted.
Usage measurement: To understand and improve how the App is used, limited usage events are collected: a randomly generated device identifier, an event name from a predefined list (e.g. app launch, search used), the screen where the event occurred and the app version. These records do not contain your user identity or the identity of the cove you viewed, and they are deleted after 90 days. In addition, on first launch an installation record consisting of the device identifier and app version is created to measure the number of installations. While the App is open, an irreversible digest of your device identifier is transiently sent to the server so that we can see the number of devices currently online; this value is not stored and is not matched to your identity.
Cove suggestions and photos: When you use the "Suggest a Cove" feature, the cove information you submit (name, location, type, amenities, description) and photos are processed; the suggestion is associated with your account. Photos and suggestion content are kept private until approved and are viewed only for review purposes; if your suggestion is approved, it is published publicly in the App. The reward granted for your first approved suggestion (1 month of Premium) is kept as a reward record on your account.
Business and change requests: When you fill in the "I am the business owner / Suggest a change" form for a beach record, your name and surname, e-mail address, (optionally) phone number, request note and the cove the request relates to are processed to evaluate your request and get back to you. This data is stored on the Supabase infrastructure and is kept for at most 1 year after the request is concluded, after which it is deleted.
Purchase information: When you purchase a Premium subscription (weekly or monthly), payment is processed by Apple; your credit card details never reach us. Your subscription status (active/inactive, expiry date) is processed through our subscription infrastructure provider RevenueCat; your user account identifier (user ID) is sent to RevenueCat so that your subscription can be matched to your account.
Favorites: Beaches you add to favorites are associated with your account.
Your data is not sold to third parties and is not used to show you targeted advertising. To measure the impact of our advertising campaigns, the app sends limited usage data to Meta Platforms: that the app was installed, that it was opened, and that an in-app purchase was made. This data is sent without your advertising identifier (IDFA) and flagged as "tracking disabled"; Meta may not combine it with data collected from other apps and websites to show you targeted ads. We do not ask for tracking permission on your device; no "Allow tracking" prompt appears in the app.
The App works with the following providers to deliver the service:
The servers of the service providers listed above may be located abroad. For this reason your account, favorite, review and public profile, notification, usage measurement, report and subscription status data may be stored and processed on servers abroad so that the service can be provided. The legal basis of this transfer (Article 9 of the Turkish Personal Data Protection Law, "KVKK") is further explained in the KVKK Notice presented during sign-up; as there is no adequacy decision for the relevant countries, the transfer relies on the explicit consent you give during sign-up. Data processed in flows that do not require an account (crowd reports, business/change requests) is either processed without directly identifying information (crowd reports) or transferred to these servers on the basis of the explicit consent you give by submitting the relevant form.
Your data is retained for the following periods depending on the data type:
| Data Type | When You Delete Your Account | Retention Period |
|---|---|---|
| Profile (e-mail, display name, consent record) | Deleted | As long as the account is active |
| Favorites | Deleted | As long as the account is active |
| Cove suggestions and photos | Published suggestions may remain as guide content; removed upon your request | As long as published; deleted upon request (unpublished suggestions are deleted after evaluation or when the account is deleted) |
| Business and change requests | Not affected if not linked to an account; deleted upon request | At most 1 year after the request is concluded |
| Crowd reports (not linked to an account; contain a device identifier) | Not affected; report content is not displayed together with your identity | Deleted after 90 days |
| Reviews (rating, review text, photos) and likes | Deleted entirely (including published ones) | Until you delete them or your account is deleted |
| Public profile (display name, username, profile photo, about, favorites sharing preference) | Deleted | As long as the account is active |
| Notification records (notification token, device identifier, language, time zone) | Deleted | Deactivated when permission is revoked; deleted when the account is deleted |
| Usage events (random device identifier, event name, app version) | Not affected; contain no user identity | Deleted after 90 days (the installation record is retained for statistical purposes; it contains no identity information) |
| Purchase records (subscription status) | Deleted together with the profile record; records held by Apple/RevenueCat are subject to their own policies | Deleted with the profile on the App side; payment/invoice records are retained by Apple for the periods required by the applicable financial legislation |
Records subject to statutory retention obligations are kept for the periods required by the relevant legislation.
You can delete your account from the Profile section within the App or request its deletion by e-mailing emre@pimrobotics.com. When you delete your account, your profile, public profile (username, profile photo, about), favorites, reviews and review photos, likes, notification records, pending suggestions and the private photos you uploaded are deleted. Only your published cove suggestions may remain as guide content in a form not linked to your identity (anonymous); they too are removed upon your request.
Your data is encrypted in transit (HTTPS) and access is restricted through row-level authorization rules. No system can be guaranteed to be fully secure; reasonable technical and administrative measures are applied.
The App is not directed at children and we do not knowingly collect data from children. Where required by applicable law, use of the App requires the consent of a parent or guardian.
For your rights regarding your personal data and how to exercise them, please see the KVKK Notice.
This policy may be updated. Significant changes are announced within the App; the current version is always published on this page.