This Privacy Policy explains how Toroti ("we") collects, uses, protects and shares your personal data. We respect your privacy and process your data in accordance with Türkiye's Personal Data Protection Law No. 6698 (KVKK) and applicable legislation.

1. Data We Collect

When you create an account and use our services, we may collect the following information:

Account information: Name, email address and password (stored in encrypted form)
Trip plans: Routes you create, places you add and notes you save
Usage data: Pages you visit, clicks and device information
Location data: Only when you grant permission, for map features

2. How We Use Data

We use the data we collect to:

Provide and maintain our services, including trip plans and map features
Manage your account and provide support
Improve our services and introduce new features
Provide personalized content and recommendations
Protect our services and prevent misuse

3. Analytics and Cookies

We use analytics tools—self-hosted Umami and PostHog for product analytics—to understand how our platform is used. These tools collect anonymous usage data. See our Cookie Policy for details.

4. Data Sharing

We do not sell your personal data. We may share it only:

With service providers required to deliver the service, such as map infrastructure providers
When required by law or requested by a competent authority
In connection with a business transfer or merger

5. Data Security

We use industry-standard security measures to protect your data. Data is stored in encrypted databases and access is restricted. Please remember, however, that no internet transmission is completely secure.

6. Your Rights Under KVKK

Under Türkiye's Personal Data Protection Law No. 6698 (KVKK), you have the right to:

Learn whether your personal data is being processed
Request information about the processing
Learn the purpose of processing and whether the data is used for that purpose
Request correction of incomplete or inaccurate data
Request deletion or destruction of your data
Request that your data be transferred to another environment where applicable

To exercise these rights, contact us.

7. Data Retention

When you delete your account, your personal data is permanently deleted within a reasonable period. Data that must be retained to meet legal obligations is kept for the applicable retention period.

8. Children's Privacy

Our services are not intended for anyone under 18. If you are under 18, do not create an account without parental permission.

9. Changes

We may update this Privacy Policy from time to time. We will post a notice on the platform when material changes are made.