Features Plans FAQ
Language
TR EN
Get the App
Legal // Privacy

Privacy Policy

We explain clearly which of your data we collect while you use Waycon, why, and how we protect it. You stay in control of your location, ride records and profile.

Last updated: October 18, 2026 Effective: October 18, 2026

01Data Controller

The data controller of the Waycon mobile app (the “App“) and the waycon.app website is:

This Policy is prepared with regard to the Turkish Personal Data Protection Law (“KVKK“) and the California Consumer Privacy Act (CCPA/CPRA). The provisions below apply to all users; country-specific rights are stated separately.

02Data We Collect

2.1 Account and profile data

  • When you sign in with Apple or Google: email address, name (if shared by Apple/Google) and a unique user ID.
  • What you set in the App: username, profile photo, preferred language, country and unit preferences.
  • Public profile: Your username, profile photo, follower/following counts and the routes you publish are visible to other users and can be found through user search.

2.2 Location data

  • Live location: Shared in real time only with members of the private voice channel you joined. It is not stored in a database; it is transmitted only while connected.
  • Ride recording: When you start a ride (or confirm automatic ride detection), your route points (GPS track), distance, speed, duration and estimated carbon value are saved to your account. Recording can continue while the app is in the background and the screen is locked, and stops when you finish. Very short or motionless recordings (below roughly 0.3 km or too few points) are not saved.
  • Temporary location buffer for ride detection: While automatic ride detection is on and location permission is “Always”, location samples from roughly the last 3 hours are kept temporarily on your device only and are not sent to our servers. If you confirm recording, these samples are added to the ride from its start; if you do not, they are deleted when the time window expires.
  • Raw GPS samples: When a ride ends, raw GPS samples with their accuracy values are saved with your ride record for map matching and are used only for route correction; they are not shown to other users. They are deleted when you delete the ride.
  • Map matching (route correction): When your ride ends, your GPS track is sent to a map-matching server that we operate ourselves (Valhalla, EU/Frankfurt) to snap the route to the road. The server does not store the track; it only returns the corrected route, which is saved with your ride record in your account. The track is not sent to third-party map services.
  • Routes you publish: If you share a ride as a route, its track, title, difficulty and statistics become visible to all users. You can unpublish at any time. For your privacy, roughly the first and last 100 meters of a route are hidden from other users; still, keep in mind that the start and end areas may hint at your home or private places.
  • Weather: When weather alerts are on and while the temperature is shown in the channel screen, your approximate location is sent to Apple WeatherKit through our server to obtain a forecast; the location is not stored for this purpose.
  • Crash detection: Motion sensor readings are processed on your device. When a crash is detected, your location is used only in a call or SMS draft that you start (as a location link).
  • Accident report location: The location you enter when creating a KTT report is stored as part of that report (see §2.5).

2.3 Motion sensors

Crash detection analyses accelerometer/gyroscope data on the device. Raw sensor data is not sent to our servers.

2.4 Camera, photos, microphone and speech recognition

  • Camera / photo library: To add document and scene photos to a KTT report or to choose a profile photo; processed only when you select them.
  • Microphone: For speaking in voice channels and for KTT voice narration. Voice channel conversations are not recorded; audio is processed in real time by the communication infrastructure (LiveKit).
  • Speech recognition: KTT voice narration is converted to text by the device’s speech recognition service (Apple/Google).

2.5 Accident report (KTT) data — requires special care

Within KTT you may enter your own information and that of the other party involved (“Party B“):

  • Full name, national ID number, driver’s licence number, plate, vehicle make/model, chassis number, insurance company, policy/agency numbers,
  • Accident narration (written/voice), impact points, scene photos, signature image and sketch.

This data is highly sensitive and is stored only within the report you create. The photos and narration you provide are sent to the Anthropic (Claude) AI service to suggest field values and sketches (see §4). Please read the Party B responsibility in §7.

2.6 Garage and vehicle data

Make, model, model year, mileage, average fuel consumption, last service mileage, service interval and expense records of your vehicles. These values are evaluated on the server to send maintenance reminders.

2.7 Emergency contact

The name and phone number you enter as an emergency contact are stored in your account and used only in the SMS draft that opens, with your confirmation, when a crash is detected. We recommend informing that person before sharing their details.

2.8 Social interaction data

Users you follow / who follow you, routes you like or save, channels you belong to, channel invites you send/receive and users you block.

2.9 Subscription and purchases

Purchases for paid plans (Rider, Leader) are made through the Apple App Store or Google Play; we do not see your card details. We match your subscription status (plan, expiry) through our subscription provider RevenueCat.

2.10 Notification and device data

A device-specific push token, platform (iOS/Android) and language are stored to send notifications.

2.11 Usage and technical data

Firebase Analytics collects usage events linked to a pseudonymous user ID (e.g. screen views, feature use) and Firebase Crashlytics collects crash reports (device model, OS version, stack trace). This data is used to improve the product and keep it stable.

03Why We Process Data

  • Account and authentication — performance of the contract.
  • Voice channels, live location, ride recording, route sharing, garage, user search and follow — performance of the contract; explicit consent for location.
  • Crash detection, emergency SMS draft, weather alerts, maintenance reminders — performance of the contract and explicit consent.
  • KTT assistant — explicit consent.
  • Purchases and subscription management — performance of the contract.
  • Push notifications — explicit consent / legitimate interest (invites and social notifications; can be switched off).
  • Security, abuse prevention, error diagnosis and product improvement — legitimate interest.
  • Legal obligations — legal obligation.

For US users: your data is not sold and is not shared with third parties for advertising (no “sale/share” in the CCPA/CPRA sense).

04Who We Share Data With — Service Providers

Your data is shared with the following providers only for the stated purpose:

  • Supabase — database, authentication, file storage (EU, Frankfurt).
  • Oracle Cloud Infrastructure — hosting of our self-operated map-matching (Valhalla) server (EU, Frankfurt). Route traces are not stored on this server.
  • LiveKit — real-time voice communication (US-based).
  • Anthropic (Claude) — KTT text/photo analysis, field and sketch suggestions (US-based).
  • Apple / Google — sign-in (Sign in with Apple, Google Sign-In), in-app purchases, maps and speech recognition services.
  • RevenueCat — subscription and purchase status management (US-based).
  • Google Firebase (Analytics, Crashlytics) — usage measurement and crash reporting.
  • Expo — push notification delivery (US-based).
  • Apple WeatherKit — weather forecast and weather alerts (approximate location).

In addition, your profile, published routes and channel memberships may be visible to other users (see §2.1, §2.2). Your data is not sold or rented for marketing.

05International Transfers

Although the main database is hosted in the EU (Frankfurt), providers such as LiveKit, Anthropic, RevenueCat, Expo and Google may process data in the US or other countries. For users in Türkiye this is a cross-border transfer under KVKK Art. 9; it is carried out as far as necessary to provide the service and on the basis of your explicit consent.

06Retention

  • Account data: Until you delete your account. When deleted, your profile, vehicles, rides, KTT and social data are deleted.
  • Ride records: At most 20 completed, unpublished rides are kept; older ones are deleted automatically. Routes you publish remain until you unpublish or delete them.
  • Corrected route: Kept with the ride record; deleted when the ride or your account is deleted.
  • Live location: Not stored permanently.
  • KTT reports: Until you delete them; you can delete them from the app at any time.
  • Push token: Deleted when the account is deleted or the token becomes invalid.
  • Analytics and crash data: For Firebase’s default retention periods.

07Important: Responsibility for Entering Party B (Third-Party) Data

The KTT assistant does not replace an official accident report and does not produce a legally binding document towards insurers or law enforcement (see Terms of Service §7).

When entering the other driver’s (Party B) identity, licence or insurance data, you are responsible for:

  • Entering it only for a genuine traffic accident record, in line with accuracy and proportionality,
  • Making sure Party B does not object to their details being recorded, or giving a reasonable explanation,
  • Not making false statements.

Party B may request deletion of their data by writing to info@waycon.app.

08Your Rights

KVKK Art. 11 (Türkiye): You may learn whether your data is processed, request information, learn the purpose, know the third parties it is transferred to, request correction, request deletion when conditions are met, request notification to those parties, object to a result against you arising from automated analysis, and claim compensation for damage.

CCPA/CPRA (California): You have the right to know, delete, correct, opt out of “sale/sharing” (we do neither) and not to be discriminated against.

All users: You can delete your account and data in the app under Settings → Account, or write to info@waycon.app. We respond within 30 days.

09Children’s Privacy

The App is not intended for persons under 16 and we do not knowingly collect data from children under 13. If we learn you are under 16 we will delete your account and data.

10Data Security

Your data is protected by row-level security, encryption in transit (TLS) and our providers’ industry-standard measures. No system is 100% secure and absolute security cannot be guaranteed.

11Permissions

  • Location (while using / always): Live location sharing and ride recording while the screen is locked.
  • Motion sensors: Crash detection.
  • Camera / photos: KTT documents and profile photo.
  • Microphone and speech recognition: Voice channels and KTT voice narration.
  • Notifications: Invites, maintenance reminders, weather alerts and social notifications.

You can revoke permissions in device settings at any time; the related feature will stop working. You can switch off notification types separately in Settings.

12Policy Changes

For material changes we will inform you in the app and refresh the “Last updated” date.

13Contact

For questions: info@waycon.app