Privacy policy

1. Data controller and contact

The data controller is Burak Atmaca, who operates Popin (Antalya, Türkiye). For any question or request about your personal data, you can write to kvkk@popin.tr or use Settings › KVKK request in the app. General support: destek@popin.tr.

2. What data do we process?

We use the camera only to scan QR codes or take photos, and the calendar only to add an event or crew to your calendar; the scanned QR image is not stored, and the entry added to your calendar is not sent to us. When you pick photos, only the photos you select are taken; we don't access your whole gallery.

3. Location

• Nearby events and your district: if you grant location permission, your location is read once, at the moment it's needed.
• Check-in: we check whether you are at the event venue; your raw coordinates are not stored, only the result and the distance are recorded.
• Arrival reminder: if you grant "Always" permission, your phone works out on its own that you've arrived at the event venue and reminds you once to check in; only the fact that you "arrived" reaches the server, never coordinates.
• Live location with your trusted person: shared only if you start it, and only with the person you choose; only the latest point is kept, and it's deleted when sharing ends. Sharing stops automatically no later than 60 minutes after the meetup ends.
• Sharing a place in chat happens only if you send it.

You can turn off location permission in your phone's settings at any time; the app also works without location, only these features won't be available.

4. Data we don't collect

• We don't collect selfies, facial recognition data or any other biometric data.
• We don't ask for special categories of data such as sexual orientation, religion, health or political opinions; apart from the optional reason you can pick when you cancel an event (for example "I'm ill"), no information about your health is kept, and that choice is used only to count cancellation reasons and is not sent to Firebase. (Spark is a signal; no one is asked about their orientation, and an unreturned signal is never shown to anyone.)
• We don't access your phone contacts.
• On iPhone, we don't read the advertising identifier (IDFA) and we don't ask for permission to track you across apps.
• We don't ask for an identity document for account recovery.
• The content of your messages, your precise location, your phone number and your verification codes are not written to logs or analytics data.

5. Analytics and crash reports

To understand which parts of the app are used, we use Google Firebase Analytics and event records on our own server. These records are kept under a random ID unique to you, not your phone number or name. Sensitive actions such as Connect / Spark signals and "Who was there" are never sent to Firebase. Firebase also receives device model, operating system, language and the city derived from your IP address. Google's ad personalization permission is always off on iPhone and for the 16–17 age group; on Android it is on for ages 18 and over. When the app crashes, an error report not linked to you (device model, operating system, app version, where the error occurred) is sent to Firebase Crashlytics.

6. Ad measurement

To measure whether our ads work, we use Tenjin (Tenjin, Inc., USA). When installed from the store, the app reports the install and two events (completing sign-up, first attendance) to Tenjin. The following data is used for this:

• Android: advertising ID, app set ID, Google Play install referrer (which link you installed the app from), device and operating system information, IP address.
• iPhone: Apple's SKAdNetwork (Apple gives us an aggregated result not linked to you), the vendor identifier (IDFV) your device generates for this app, device and operating system information, IP address. The advertising identifier (IDFA) is not read.
• To match an install to an ad click, IP address and device characteristics may be used in short-term (looking back at most 1 day) probabilistic matching.
• If you installed the app from a Meta (Facebook, Instagram) ad, Meta and Tenjin share the install information to match the install to that ad.

On Android, you can reset or delete your advertising ID in your phone's Settings › Google › Ads. No ads are shown in the app, and your data is not sold for advertising.

7. Who sees your data?

• Other users: see your profile (name, photos, age group and the information you share). In an event's attendee list, people you're not connected with see you by your initial and a blurred photo; only the event owner and your connections see your full name. Only approved members see a crew's exact meeting place. One-to-one chat opens only after a mutual connection.
• Visitors without the app: don't see anyone's name or photo on shared event and crew pages, only counts.
• Businesses and event owners: see the attendees and check-ins of their own events.
• Our team: has access only for support, reviewing reports and security, only as much as the task requires, and with access logged.
• Public authorities: only where the law requires it, and only as much as requested.

8. Service providers and transfers abroad

We work with the providers below to run the service. These providers process your data only on our behalf and for these purposes. Some of them process your data outside Türkiye; these transfers are made in accordance with Article 9 of KVKK.

We don't sell your data, and we don't share it with anyone outside this list for advertising or marketing.

9. How long do we keep it?

Data whose period has expired is deleted automatically every night. If there is an ongoing legal dispute or an official request, the relevant data may be kept until that matter is closed.

10. Deleting your account

You can delete your account in the app with Settings › Delete account; if you can't open the app, use the popin.tr/hesap-sil page. After a deletion request, your account is hidden immediately, your sessions are signed out, and it is permanently deleted after 30 days; if you sign in during this period and tap "Cancel deletion", the deletion is cancelled.

• Deleted: your profile and photos, your settings, your sign-in methods, your sessions, your "Going" and check-in records, your connections and one-to-one chats, your notifications, your badges and your loyalty cards.
• De-identified: the content of your messages in crew chats is deleted and replaced with "Deleted user"; your ID in analytics records is deleted and Google is asked to delete it.
• Kept for a while: report and moderation records (2 years); if the account was banned or deleted while a report about it was open, an irreversible hash of the phone number to stop it being reopened (2 years in the case of an open report); permission and security records that must be kept by law. Deleted data is removed from encrypted backups within 35 days at most.

11. Age limit and young people

Popin is for people aged 16 and over; people under 16 can't open an account. There are extra protections for users aged 16–17: Spark never works between different age groups; they can't join 18+ events and crews; their trusted person must be from their own age group; in mixed-age crews, external group links are not shown to them and images are moderated more strictly; they are not asked for marketing permission and are not sent marketing notifications.

12. Your rights

Under Article 11 of KVKK, you have the right to learn whether your data is processed, to request information about it, to learn the purpose of processing and who it has been transferred to, to request correction if it is incomplete or inaccurate, and to request its erasure or destruction, to request that these actions be notified to those it was transferred to, to object to a result against you arising solely from analysis by automated systems, and to claim compensation if you suffer damage due to unlawful processing.

• Download my data: from Settings, you get a copy of your data (JSON and photos) within 24 hours.
• KVKK request: Settings › KVKK request or kvkk@popin.tr. We respond to your request free of charge within 30 days at most. For requests made outside the app, we may ask for the phone number linked to your account to verify your identity.
• Trust level: your trust level is calculated by the system; if you object to a result against you, a person reviews it.

If you are not satisfied with our response, you can file a complaint with the Personal Data Protection Board.

13. Website

popin.tr does not use analytics or advertising cookies. The site's server keeps IP addresses and browser information in short-term logs for security. On pages that show a map, your browser loads map images from OpenFreeMap. If you fill in the "Notify me" form, your email address is kept only to let you know when your city opens (30 days if not confirmed, 12 months if confirmed); you can unsubscribe with the link in every email.

14. Security

Your data is encrypted in transit (HTTPS), backups are kept encrypted, and our team's access is limited by role and logged. If a data breach occurs, we notify the Board and the people affected as required by law.

15. Changes

If we change this notice, we publish the current version on this page and in the app; we also let you know about important changes in the app.