Privacy Policy
Last updated: 8 October 2026
In short
- The map shows animals, never people. Where you are is never shown to anyone and isn't stored on our servers.
- We show no ads, don't sell your data, don't use your advertising ID and don't track you across other apps.
- Location data (EXIF/GPS) is removed from your photos before upload. Photo checks run on your phone.
- Usage statistics are only collected if you agree, and you can change your mind any time in Settings.
- You can delete your account in the app in one step (Settings → Delete account).
1. Who is responsible
The PatiPal app (“PatiPal”, “we”) is developed and run by Emirhan Torun, an individual based in Türkiye, who is the data controller under the EU General Data Protection Regulation (“GDPR”) and Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”).
Contact: patipal.support@gmail.com
2. What we process and why
Your data is collected electronically and automatically while you use the app: what you enter, what you share, and the technical information the app needs to work.
| Data | Purpose | Legal basis |
|---|---|---|
| Account: the account ID and email address from Sign in with Apple or Google (Apple lets you hide your email) | Creating your account and signing you in | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Profile: username, display name, short bio, your pixel avatar, country | Showing your public profile | Performance of a contract |
| Posts: photo, animal group, the name and note you add, the post's location, place name, country, time | Showing your post on the map and on your profile | Performance of a contract; you make the post public yourself (KVKK Art. 5(2)(d)) |
| Lost pet posts: details of the animal (color, age, collar and so on) and the phone number you add | Letting the person who finds your pet reach you | Performance of a contract |
| Activity: likes, “I saw it too”s, comments, saved posts, cases you take on and their updates, a log of the notifications you receive | Running the app's features | Performance of a contract |
| Followed areas: the approximate center of the area, its radius and name, and your phone's time zone | Telling you about lost and injured animals there, keeping quiet at night | Performance of a contract |
| Notifications: your phone's push token and language | Sending comment, reply and area notifications | Performance of a contract |
| Safety and moderation: reports (reason and details), people you block, records kept for posting limits, who viewed the number on a lost pet post | Preventing abuse, fake posts and fraud, enforcing the rules | Legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) and legal obligations |
| Usage statistics (only if you agree): which screens are opened, the app opening and closing, the kind of things you do (e.g. “posted”, “commented”, “fed their Pal”), phone model, operating system and app version; your account ID once signed in | Seeing where the app is hard to use and improving it | Consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)) |
Usage statistics never include your name, what you write, your photos or your location.
Location
If you allow it, your phone's location is used while the app is open, to show animals near you and to mark where the animal you share was. Where you are isn't stored on our servers. The only location we keep is that of the animal you post:
- If you choose approximate, the server snaps the location to the center of an area about 500 m across and never stores the exact spot. Adoption posts are always approximate.
- If you choose exact, the point you mark is stored as is. Injured animal posts are always exact, so helpers can find them.
- Profiles and the archive show only a place name, never coordinates.
Place names (neighborhood, district) come from your phone's own system, which sends the coordinates to Apple (iOS) or Google (Android).
Photos
Photos are re-encoded before upload, removing location, device and date information. Whether a photo shows an animal and whether it is explicit is checked by models inside your phone; the photo isn't sent anywhere for this. Photos you post are visible to other users.
What stays on your phone
Your Pal, its room and your game progress are kept only on your phone, as are your language and notification preferences.
3. Who sees your data and who we share it with
Other users
Signed-in users can see your profile, your posts (photo, name, note, location, place name), your comments and the status of cases you take on. The number on a lost pet post isn't on the map: only signed-in people see it when they tap “Reach the owner”, and each person can see at most 10 numbers a day. What you save, who you block and what you report are never visible to anyone.
Service providers
We use the following companies to run PatiPal. They process data on our behalf and on our instructions:
| Provider | Purpose | Where the data is |
|---|---|---|
| Supabase | Database and sign-in | EU (Frankfurt, Germany) |
| Cloudflare | Storing photos and serving them quickly | Servers worldwide |
| PostHog (only if you agree) | Usage statistics | EU (Frankfurt, Germany) |
| Mapbox | Map images (the area the map shows and your IP address). Mapbox's usage data collection is turned off. | USA |
| Expo | Delivering notifications to your phone | USA |
| Apple, Google | Sign-in, delivering notifications, finding place names | USA and other countries |
| OpenStreetMap (Overpass) | Finding vets nearby (only your approximate area, about 1 km, is sent; never your account) | Germany |
| GitHub | Encrypted database backups | USA |
We may also share data with public authorities where the law requires it. We don't sell your data or share it with anyone for advertising.
International transfers
Some of these providers are outside the European Economic Area and outside Türkiye. Transfers rely on appropriate safeguards such as data processing agreements and the European Commission's standard contractual clauses (GDPR Chapter V), and on the safeguards required by KVKK Art. 9.
4. How long we keep it
- Sightings stay on the map for 72 hours; injured, lost and adoption posts for 7 days, and a post marked “resolved” stays up to 24 hours more. When a post expires it is deleted with its comments and view records.
- Of your posts that left the map, the latest 9 stay on your profile with a place name but no location. Those with 3 or more likes stay in Trending for 1 year. You can remove them from your profile any time.
- Saved posts stay until you remove them, and are fully deleted within 30 days after that.
- Notification records are kept for 30 days and posting-limit records for 8 days. Reports are deleted when the reported content is deleted.
- Your phone's push token is deleted when you sign out or turn notifications off.
- When you delete your account, your profile and all your posts, comments, likes, saved posts and other records are deleted at once; your photos within a few hours.
- Encrypted database backups are kept for 14 days and then deleted automatically, so deleted data leaves the backups by the end of that period.
- Usage statistics are kept for up to 1 year. Deleting your account doesn't delete them automatically; just email us and we will.
5. How we protect it
All connections between the app and our servers are encrypted. Access rules in the database make sure everyone sees only what they should, and limits and rules are enforced on the server. Backups are stored encrypted.
6. Your rights
Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict its processing, to receive it in a portable format, to object to processing based on legitimate interests, and to withdraw your consent at any time without affecting processing before the withdrawal. KVKK Art. 11 gives you similar rights in Türkiye.
You can do much of this in the app yourself: edit your profile, delete your posts and comments, remove shots from your profile archive, turn off usage statistics and location access, and delete your account. For anything else, email patipal.support@gmail.com; we answer free of charge within 30 days.
You can complain to the data protection authority where you live, or in Türkiye to the Personal Data Protection Board (KVKK).
7. Children
PatiPal isn't for children under 13. If we learn that a child under 13 has an account, we delete it.
8. Changes
When we update this policy we change the date at the top. We announce important changes in the app as well.