Privacy Policy

Who is responsible

Ashmate is operated by Onur Ulusoy, who is the controller of the personal data described here. For any privacy question or request, write to [email protected].

What we collect

• Account data: username, email address, and password. The password is stored only as a salted one-way hash. Optionally your display name, bio, and profile photo.
• Content you create: notes about places and dishes, ratings, prices, tags, photos, lists, comments, likes, follows, saved places, blocks, reports, and feedback you send us. Photos are re-encoded on upload, which removes embedded metadata such as GPS location.
• Security data: when you register, sign in, or change your password we record the type of event and a salted one-way hash of your IP address, so we can detect abuse without keeping the address itself. Server logs exclude passwords, tokens, and cookies.
• Error reports: when something breaks, we store the error message, technical details, the page address without its query string, and your account ID if you are signed in, so we can fix it.
• Usage events: inside the app we record a small set of events, such as starting or finishing a note or saving a place, linked to your account. They never contain note text or photos.
• Map and location: the map area you look at, and your position if you allow location access, are sent to our server and to Google to find nearby places. We do not store your position.
• Analytics: only if you agree, Google Analytics measures page visits with cookies (see “Cookies and similar technologies”).

Why we use it

• To provide the service you signed up for: your account, your notes, lists, and the people you follow (performance of a contract; GDPR Art. 6(1)(b), KVKK Art. 5(2)(c)).
• To keep the service secure and prevent abuse, and to understand which features work (legitimate interests; GDPR Art. 6(1)(f), KVKK Art. 5(2)(f)).
• To measure visits with Google Analytics, only with your consent, which you can withdraw at any time (GDPR Art. 6(1)(a), KVKK Art. 5(1)).

Who can see your content

Your username, display name, profile photo, and bio are public. Each note and list has its own visibility: public items can be seen by anyone, including people without an account and search engines through shared links; friends-only items are visible to people you follow who also follow you; private items are visible only to you and, for lists, the collaborators you add.

Service providers

• Cloudflare delivers the website and stores uploaded photos (Cloudflare R2).
• Google provides the map and place information (Google Maps Platform). When you use the map or search for places, Google receives your IP address and the request. Google’s Privacy Policy applies: https://policies.google.com/privacy
• Google Analytics, only after your consent.
• An email provider, to send account emails such as password resets.

The servers that run Ashmate are operated by Onur Ulusoy. Some providers process data outside the EU and Türkiye, including in the United States; such transfers rely on the providers’ standard contractual clauses or other safeguards required by law.

Cookies and similar technologies

• Necessary: a sign-in cookie that keeps you logged in for up to 30 days, and a cookie that remembers your language.
• Local storage on your device: your theme, recent searches, unsent drafts, and your cookie choice. It stays on your device.
• Analytics: Google Analytics cookies, set only after you accept them. You can change your choice at any time with “Cookie settings” at the bottom of the page.

How long we keep data

• Account data and content: until you delete them or your account. Deleted photos are removed from storage within minutes.
• Usage events: 13 months.
• Security events: 180 days.
• Error reports: 30 days.
• Backups: up to 30 days, after which deleted data is gone from them too.

Your rights

You can ask for access to your data, correction, deletion, restriction, a copy in a portable format, and you can object to processing based on legitimate interests or withdraw consent. Residents of Türkiye have the rights in Article 11 of the KVKK. You can download your data and delete your account yourself in Settings. For any other request, write to [email protected]; we answer within 30 days.

You can also complain to a data protection authority, for example the one in your country of residence or, in Türkiye, the Personal Data Protection Authority (KVKK).

Children

Ashmate is not intended for anyone under 16, and we do not knowingly collect their data.

Changes

When this policy changes we update the date below. For important changes we will tell you in the app before they take effect.