Berid Tracker — Privacy Policy

Effective date: April 28, 2026 · Last updated: April 28, 2026

Berid Tracker ("the App") is an equestrian training and community application. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and your rights when you use the App. This policy is prepared in compliance with Türkiye's Personal Data Protection Law (KVKK No. 6698), the EU GDPR where applicable, and Apple App Store requirements.

1. Data Controller

Data controller: Uğur Yılmaz
Contact email: [email protected]
App Bundle ID: com.ylmzuraz.equitrack

2. Personal Data We Collect

2.1. Account Information

• Full name
• Email address
• Phone number (optional)
• Profile photo (optional)
• Password (hashed, never stored in plain text)
• If you sign in with Google or Apple, the user identifier returned by the provider

2.2. Location Data

• GPS coordinates (latitude, longitude) — during ride tracking
• Speed, heading, altitude
• Location accuracy
• Background location (only while a ride is active)

2.3. Health and Activity Data

• Heart rate read from Apple HealthKit (optional — with user consent)
• Device motion sensor data (used to detect walk/trot/canter/gallop gaits)
• Ride activities written back to Apple HealthKit (distance, duration, calories)

2.4. Emergency Information

• Names and phone numbers of emergency contacts you manually add
• Location and timestamp shared when an SOS is triggered

2.5. Content and Usage Data

• Ride photos you take (user-generated content)
• Social feed posts, comments, likes
• Horse records (name, breed, age, health history, etc.)
• Messages

2.6. Device and Technical Data

• Device model, OS version, language preference
• Push notification token
• Crash reports (do not contain personal data)
• Anonymous usage statistics

3. How We Use Your Data

Purpose	Data used
Account creation and login	Email, name, password, OAuth token
Ride tracking and statistics	GPS, speed, altitude, heart rate
Maps and route display	GPS coordinates
Social feed and community	Profile info, posts
SOS safety feature	Emergency contacts, real-time location
Inactivity alert	Motion sensor, GPS
Push notifications	Notification token, account ID
Debugging and improvement	Crash reports, usage stats

4. Third-Party Sharing

Your data is not sold, rented, or shared for marketing purposes. It is only shared with the following technical service providers, strictly as required to deliver the service:

Provider	Purpose	Data shared
Supabase (self-hosted)	Database, authentication, file storage	All app data
Google Sign-In	Sign-in option	Email, name, profile picture
Apple Sign In	Sign-in option	Anonymous Apple ID, email
Mapbox / MapTiler	Map tiles	Real-time location (anonymous)
Open-Elevation	Elevation lookup	Coordinates (anonymous)
NetGSM	SOS SMS delivery (only when SOS is triggered)	Emergency contact number, user name, location link
OpenWeatherMap	Weather data	Real-time location (anonymous)
Sentry	Crash reporting	Device model, stack trace (no personal data)
Apple Push Notification Service	Notifications	Notification token

5. Data Retention

• Your data is retained while your account is active.
• When you delete your account, your personal data is permanently deleted within 30 days. (This window allows for backup purging.)
• Records we are legally required to keep (e.g., billing) are retained for the period required by law.
• Anonymized statistical data may be retained indefinitely.

6. Your Rights

Under KVKK Article 11 and the EU GDPR, you have the right to:

• Know whether your data is being processed
• Request information about how it is processed
• Learn the purpose of processing and whether the data is used in line with that purpose
• Know the third parties to whom data is transferred domestically or internationally
• Request correction if data is incomplete or inaccurate
• Request erasure or destruction
• Request that corrections/erasures be communicated to third parties
• Object to outcomes produced by automated systems
• Claim compensation for damages caused by unlawful processing

To exercise these rights, email [email protected]. We respond within 30 days at the latest.

You can also delete your account from inside the app: Settings → Delete Account.

7. Children's Privacy

Berid Tracker is not designed for users under 13 years of age. We do not knowingly collect data from children under 13. If you are a parent and notice that we have collected information from your child, please contact us; we will delete it promptly.

8. Data Security

• All network traffic is encrypted with HTTPS/TLS.
• Sensitive data on the device is stored in AES-256 encrypted MMKV.
• Server-side Row-Level Security (RLS) policies ensure users can only access their own data.
• Passwords are stored as bcrypt hashes, never in plain text.
• Regular backups and access controls are in place.

9. Cookies

The mobile app does not use cookies. Only secure session tokens are stored on the device.

10. Location Permissions

The app uses location data only during active rides and only with your explicit consent.

• Foreground location: When the ride screen is open
• Background location: While a ride is in progress (until you stop the ride)
• Location permission can be revoked any time in your device settings.

11. Push Notification Permissions

Permission is requested for inactivity alerts, social interactions, and reminders. This is optional and can be disabled in your device settings.

12. Policy Changes

This policy may be updated. Significant changes will be announced inside the app and/or sent to your registered email address. The most up-to-date version is always available on this page.

13. Contact

For any privacy questions or requests:
Email: [email protected]