OtoYorum Privacy Policy
OtoYorum Privacy Policy
Last Updated: June 5, 2025
This Privacy Policy explains how I, as the sole developer of OtoYorum (“the App”), collect, use, and protect your personal data. By using OtoYorum, you consent to the practices described here. If you have any questions or concerns, you can contact me at:
tgbaozkn1995@gmail.com
1. Data Controller and Contact Information
Data Controller: OtoYorum (developed and maintained solely by me)
Email Address: tgbaozkn1995@gmail.com
2. Which Personal Data Is Collected?
I collect only the personal data necessary to operate the App and provide its features. Specifically:
Registration Data
Full Name: Required for user identification within comments.
Email Address: Required for account verification, password recovery, and communication.
I do not collect phone numbers or any other personal identifiers beyond name and email.
Authentication Data
Email & Password: Used exclusively for Firebase Authentication to verify your identity.
User-Provided Content
Username (Nickname): Displayed publicly when you post a comment or ask a question.
Comment Text: Your feedback on secondhand vehicles (pros, cons, personal experience), shown to other users.
Question Text: Your queries in the “Ask the Mechanic” section, also visible to others.
Automatically Collected Data
Device Information: Anonymized technical details (device model, OS version, App version) to help troubleshoot and improve performance.
Usage Statistics: Anonymous analytics (e.g., screen views, button taps) to understand how the App is used, always without personally identifying you.
3. Purposes and Legal Basis for Processing
I process your data strictly for the following purposes and under the legal bases described by Turkish Personal Data Protection Law (KVKK) and, where applicable, GDPR:
Account Registration & Authentication
Legal Basis (KVKK Article 5(2)(f) – Performance of Contract / Article 5(2)(e) – Legitimate Interest):
I need your name and email to create and manage your account, ensure secure login, and allow you to access comment and question features.
Commenting & Q&A Features
Legal Basis (KVKK Article 5(2)(e) – Legitimate Interest):
Your username, comments, and questions allow other users to benefit from real-life experiences. I display your username and content publicly, but never share your email or other sensitive details.
Communication & Support
Legal Basis (KVKK Article 5(2)(a) – Explicit Consent / Article 5(2)(b) – Legal Obligation):
If you ask for technical help or notifications, I use your email to respond. I will never send unsolicited marketing messages. If you opt into any newsletters, you can unsubscribe at any time.
Legal Compliance & Security
Legal Basis (KVKK Article 5(2)(d) – Legal Requirement):
If required by law or a court order, I may need to disclose data to authorities. I reserve the right to cooperate with legal requests (e.g., to prevent fraud, abuse, or comply with judicial requests).
4. Data Storage and Retention
Account Information (Name, Email, Username)
Retained for as long as your account exists. If you delete your account, I will permanently erase these details from my systems within 30 days, except where legal obligations require otherwise.
Comments & Questions
Stored until you explicitly delete them or delete your account. Once you delete a comment or question, it is removed from the database within 24 hours.
If there is an ongoing legal dispute or official request, I may retain your content until the matter is fully resolved, after which it will be deleted.
Analytics & Logs
Usage logs and anonymized analytics are kept for up to 90 days, after which they are purged automatically. These records never include your email, name, or any data that can identify you as an individual.
5. Data Sharing and Third Parties
Firebase Services (Authentication & Firestore)
I use Google’s Firebase for user authentication and to store comments, questions, and user profiles. Firebase may store data in servers located in various countries, but always under strict security measures and encrypted connections.
Analytics Providers (Optional)
If you consent, I may use Firebase Analytics or a similar service to track anonymous usage patterns. No personal identifiers (name, email) are shared—only aggregate statistics.
Legal Obligations
If a court order or government agency requests your data, I will comply to the extent required by law.
Anonymized Data
I may share fully anonymized, aggregated data (e.g., “Number of comments per model over the past month”) for research or reporting purposes. Such data cannot be traced back to any individual user.
6. Cookies and Similar Technologies
OtoYorum is a mobile application and does not use browser cookies.
Any analytics rely on anonymized App Instance IDs or Device IDs, which cannot be used to identify you.
7. Your Rights
Under KVKK (and, where applicable, GDPR), you have the following rights regarding your personal data:
Right to Know & Access
You can request confirmation of whether I process your data, and if so, receive a copy of the stored information (e.g., name, email, comments).
Right to Rectification
If your name or other stored information is inaccurate or incomplete, you can request corrections.
Right to Erasure (“Right to Be Forgotten”)
You can request deletion of your personal data (profile, comments, questions). I will comply unless a legal obligation prevents deletion (e.g., an ongoing court case).
Right to Object
You can object to data processing based on legitimate interests. If I cannot demonstrate an overriding legal basis, I will cease that processing.
Right to Data Portability
You may request a machine-readable export of your personal data (e.g., your profile details, comments, questions).
Right to Withdraw Consent
Where processing is based on explicit consent (e.g., optional analytics), you may withdraw consent at any time. Withdrawal does not affect prior processing under valid consent.
To exercise any of these rights, please email me at tgbaozkn1995@gmail.com. I will respond within 30 days.
8. Security Measures
I implement the following technical and organizational measures to protect your data:
Technical Measures
Encrypted Communication: All data in transit between the App and Firebase servers uses TLS/SSL encryption.
Secure Storage: Firestore enforces access controls so only authenticated users can read or write appropriate documents.
Regular Updates: I keep all dependencies (Firebase SDK, Flutter packages) up to date to mitigate known vulnerabilities.
Organizational Measures
Access Control: Only I (as the sole developer) have access to production Firebase resources, protected by multi-factor authentication.
Monitoring: I regularly review usage logs for suspicious activity and address any security issues promptly.
Data Minimization: I collect only the data strictly required to provide OtoYorum’s features.
9. Children’s Privacy
OtoYorum is not intended for users under the age of 18. I do not knowingly collect personal data from minors. By registering, you confirm that you are at least 18 years old. If I become aware that a minor under 18 has provided personal data without parental consent, I will delete that data immediately.
10. External Links and Third-Party Content
Comments or questions posted by users may include external links. I am not responsible for the privacy policies or practices of any third-party websites linked within user-submitted content. Please review any external site’s own privacy policy before providing personal data to them.
11. Changes to This Policy
I may update this Privacy Policy to reflect changes in legislation, technology, or App functionality. Whenever I make significant updates:
I will revise the “Last Updated” date at the top.
I may notify you within the App or via your registered email if the changes are substantial.
Your continued use of OtoYorum after any updates indicates your acceptance of the revised policy.
12. Your Responsibilities
Provide Accurate Information: Ensure your name and email are correct. Inaccurate information may prevent you from accessing certain features.
Maintain Account Security: Keep your password confidential and choose a strong, unique password.
Appropriate Content: When posting comments or questions, avoid sharing private details (e.g., address, national ID, phone number). Also refrain from hate speech, defamation, or any illegal content.
13. How to Contact Me
For any inquiries, data requests, or concerns about this Privacy Policy or my data handling practices, please email:
tgbaozkn1995@gmail.com
I aim to respond to all legitimate requests within 30 days. If you remain unsatisfied, you may lodge a complaint with the Turkish Personal Data Protection Authority (KVKK).
By using OtoYorum, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of your personal data as described above.