Privacy Policy

1. In short

• Your location is shared only in ride mode. Location is used in the background only after you tap "Start ride". No location history is kept on the server: only your last position, deleted when the ride ends.
• Your health data is kept apart. The emergency profile is optional, filled in with your separate explicit consent and stored encrypted. It never goes to analytics, advertising or content moderation.
• We do not sell your data. We do not use your personal data for advertising, and we do not sell or rent it. We use no analytics or advertising trackers.
• Your phone number stays private. It is never shown to other users.
• You can delete your account at any time. In the app: Settings > Delete my account. If you cannot reach the app, you can ask by e-mail (section 10).

2. Data controller and scope

This policy covers the MotoKonvoy app for iPhone and Android, the emergency card page opened from the QR code on a helmet or motorcycle, and the https://motokonvoy.app website. "We" means the data controller below.

Data controller

Kaan Nurel (individual)

E-mail

info@motokonvoy.app

Web

https://motokonvoy.app

3. What data we process

We describe your data feature by feature. If you do not use a feature, its data is not processed.

3.1 Account and sign-in

• Sign in with Apple: the e-mail address Apple passes on (this can be Apple's "Hide My Email" address), your Apple user ID and, if you share it at the first sign-in, your name.
• Sign in with Google: your e-mail address and Google user ID.
• Phone sign-in: your phone number. The verification code is sent through our SMS provider.

Creating events and groups requires a verified phone number, to reduce fake accounts. We record when you accepted the Terms of Use.

3.2 Profile and garage

Your profile can hold your name, username, photo, city, the year you started riding, riding styles and a short bio. In your garage you can add the make, model, year and colour of your motorcycles, the plate and a photo.

• Other riders see your profile card. You can hide your garage and your event count from it.
• Only you see your plate.
• When you upload a photo we access only the photo you pick. It is resized on your phone, and its location (GPS) and other embedded data (EXIF) are removed before upload.
• Your profile photo is stored at an address anyone with the link can open; motorcycle photos are shown only to users of the app.

3.3 Events, groups and messages

• Events: title, description, date, meeting point, route and stops, conditions, participants and roles. Changes to an event are logged with who made them and when, and shown to participants.
• Discover: if you allow it, we use your current location to find nearby events; it is not stored. Otherwise you pick your city. Discover shows only the neighbourhood of an open event; only approved participants see the exact meeting point.
• Check-in: we use your current location to confirm you are within about 200 metres of the meeting point, or you scan the organiser's QR code. Your location is not stored, only the check-in time.
• Groups and messages: your group memberships and the messages you write in direct, group and event chats are stored on our servers so they can be delivered. Messages are encrypted in transit but not end-to-end.
• Reports and blocks: the content and people you report, the reason, and the users you block. We never show the reporter's identity to the person reported.

3.4 Ride mode and live location

MotoKonvoy uses your location while the screen is locked or the app is in the background, so the convoy screen and crash alerts can work. It does so only while ride mode is on.

• You start and end ride mode yourself. On iPhone the app asks for "Always" location and "Motion & Fitness" permission; you can turn them off in your phone's settings at any time.
• Your live location is seen by the approved participants of the event you ride in, and by the people you choose to share it with, for 1 hour, today or until you turn it off. You can stop sharing at any moment.
• The server keeps only your last position, speed, heading and its time. It is deleted when the ride ends, or within 6 hours if the app could not end the ride. The live updates sent to the convoy are deleted within a minute.
• On the convoy screen other participants can see your place in the line, the distance between you and that you have not moved for a while.

3.5 Ride log, route rating, photo and story

• Ride summary: we record the distance and duration of every ride in ride mode to calculate your total kilometres and helmet league points. You can hide your total kilometres on your profile.
• Route track: the track of a ride is stored only if you choose "Save route". The first and last 500 metres are removed, so places like your home and work do not show.
• Route rating: the stars and tags you give a route. For event rides your rating counts towards the event route's average.
• Ride photo: one photo you can add to a ride. Only you see it.
• Instagram story: the story image is made on your phone and is not uploaded to us. It shows no clock time or top speed, and the first and last 500 metres of the route are cut. When you tap "Share to story", the image is handed to the Instagram app on your phone; only the image and MotoKonvoy's Meta app ID go to Instagram. The story you post is subject to Instagram's (Meta's) own privacy policy. For story points we record only which ride you shared and when.

3.6 Crash detection (optional, beta)

If you turn on crash detection, your phone's motion sensors and GPS speed are evaluated on your phone in ride mode. Unless a possible crash is detected, this sensor data does not leave your phone.

• At a possible crash, your location, the time and a short sensor summary of the trigger are sent to our server. A 30-second countdown starts; if you are fine you cancel it and nobody is messaged.
• If you do not cancel, or your phone cannot be reached, your emergency contacts get an SMS with your name and a location link, and the other riders of the event are notified. If it was a false alarm, "I'm OK" sends everyone a correction.
• SMS are sent from our server; the app does not send SMS from your phone and never calls 112 by itself.

3.7 Emergency profile and health data (special category data)

The emergency profile is optional. If you fill it in, we store your blood type, allergies, chronic conditions, medications, a small photo, and the name, relation and phone number of up to three emergency contacts. Health data is special category data under Article 6 of the KVKK, so before you fill in the profile we ask for your explicit consent on a separate screen that explains what is collected, who sees it and where it is transferred, with a checkbox that is not ticked in advance. Without consent no emergency profile is created; you can still use every other feature of the app.

• Your health data and your contacts' names and phone numbers are stored encrypted (AES-256). In the app only you see them.
• The emergency card is a page opened from the QR code, with no sign-in; its address contains a code that cannot be guessed, and search engines are kept out. Whoever opens it first sees only your name and photo. Your health data and emergency contacts appear only after they tap the "show details" button.
• Each time the card is opened we log the time and, if the scanner's browser allows it, an approximate location (about 100 metres), and notify you. When the details are shown, your emergency contacts get an SMS (at most once every 10 minutes per card).
• So that the card opens even when our main servers are down, it runs on Cloudflare's global network, which holds a copy of what the card shows.
• You give us your emergency contacts' details; please let them know.
• You withdraw your consent by deleting your emergency profile. The profile is deleted at once and the card's copy within a few minutes. If your QR sticker is lost, you can unlink it in the app.

3.8 Content moderation

To protect the community, your name and bio, event and group names and descriptions, messages in group and event chats, and profile and motorcycle photos are screened automatically a few seconds after posting, against a Turkish word list and by OpenAI's moderation service. Content found objectionable is hidden and reviewed by a moderator; content hidden by mistake is restored. Content reported by three different people is hidden until reviewed. Direct messages are checked only against the word list; direct messages and emergency data are never sent to OpenAI. OpenAI does not use data sent through its API to train its models.

3.9 Notifications, crash reports and technical records

• Notifications: to deliver event changes, messages and safety alerts we keep your in-app notifications and your phone's push token and platform.
• Crash reports: when the app crashes, a technical report (device model, operating system, app version, error log) goes to Sentry (EU data region). It never includes your name, phone number, user ID, location or emergency data.
• Maps: maps load from Mapbox. Mapbox receives your IP address and the map area shown and may collect anonymous usage data under its own policy.
• Abuse prevention: to stop permanently banned people from signing up again, we keep a one-way hash of their phone number and device ID.
• No ad tracking: we do not collect the advertising identifier (IDFA) or track you across other companies' apps or websites.

3.10 Support

When you write to us through the support form or by e-mail, we process your e-mail address and message to answer you.

3.11 Website

The https://motokonvoy.app website has no forms, cookies, analytics or trackers; fonts load from the site itself. Cloudflare, which hosts the site, processes your IP address and browser details to deliver the pages and protect against attacks.

4. Purposes and legal grounds

5. Who we share your data with

• Other users: your profile card, the events and groups you join, what you write in chats, and your live location in ride mode, to the people described above.
• Your emergency contacts and whoever opens your card: in the cases described in 3.6 and 3.7.
• Authorities: only when the law requires it, and only to the extent requested.

We use the providers below to run the service. They process your data only to provide their service.

We do not sell or rent your personal data or share it with ad networks or data brokers.

6. Transfers abroad

Some of the providers above have servers outside Türkiye, so your data is transferred abroad. We make these transfers in line with Article 9 of the KVKK, using the standard contracts published by the Turkish Personal Data Protection Board for countries without an adequacy decision.

7. How long we keep it

Records the law requires us to keep longer are kept for the period the law sets.

8. How we protect your data

• All connections between the app, our servers and the emergency card are encrypted (TLS).
• The database uses row-level authorisation: each record can be read only by those allowed to see it.
• Health data and emergency contacts are additionally encrypted, with the key kept in a vault apart from the data.
• We keep no more than we need: neighbourhood-level location in Discover, saved tracks with their ends removed, and only the last position on the server instead of a location history.

9. Your rights under the KVKK

Under Article 11 of the KVKK you have the right to learn whether your personal data is processed and to request information about it, to learn the purpose of processing and whether it is used accordingly, to know the third parties in Türkiye or abroad it is transferred to, to request correction if it is incomplete or wrong, to request its deletion or destruction and that these steps are notified to those third parties, to object to a result against you that arises solely from automated analysis, and to claim compensation for damage caused by unlawful processing.

Write to info@motokonvoy.app; we answer free of charge within 30 days. If you are not satisfied with our answer you can complain to the Turkish Personal Data Protection Board (www.kvkk.gov.tr). You can withdraw your consent at any time; this does not affect processing before the withdrawal.

10. Deleting your account and data

• In the app: Settings > Delete my account. Before deleting, you can download a copy of your data under Settings > Download my data.
• If you cannot reach the app: send an e-mail with the subject "Account deletion" to info@motokonvoy.app, giving the phone number or e-mail address of your account. Once we have confirmed the account is yours, we delete it within 30 days.

When your account is deleted, your profile, garage, photos, rides, crash records, emergency profile and card view logs are deleted; your emergency card is switched off and your QR stickers are unlinked. Events you organise are handed to another admin or cancelled. Messages you sent stay in chats without your name and are deleted after 12 months. If you signed in with Apple, the link with Apple is removed too. Records the law requires us to keep and the hashes of banned accounts are kept for the periods in section 7.

11. Age limit

MotoKonvoy is for people aged 18 and over. If we find an account belonging to someone under 18, we close it and delete its data.

12. Changes and contact

We may update this policy for new features, new providers or changes in the law. We announce important changes in the app and ask for new consent where needed. For any privacy question write to info@motokonvoy.app.