Privacy policy
This policy explains what personal data the Pelvoy app and pelvoy.com collect, why, who processes it, how long we keep it and how you control it. It is written for the EU General Data Protection Regulation (GDPR) and Türkiye's Personal Data Protection Law No. 6698 (KVKK). A Turkish summary (aydınlatma metni) is at the end.
1. Who we are
The data controller is Emirhan Cabuk, Türkiye ("Pelvoy", "we"). Contact for anything about your data: contact@pelvoy.com. Help with the app: support@pelvoy.com.
2. The short version
- We collect what the features you use need, and nothing to build an advertising profile.
- Your voice is turned into text while you speak. We do not save the audio.
- Photos you send to read a menu or a sign are not saved. Only the text answer is.
- Your Travels profile is private until you make it public. Public map spots are rounded to about 1 km.
- We do not sell your data. Ads appear only between GIFs, only for adults who said yes.
- You can download or delete everything, in the app or at pelvoy.com/delete.
3. What we collect, why, and how long we keep it
| Data | Why | Kept |
|---|---|---|
| Your questions and the AI's answers | To answer you, and to keep your chat history in your account so you can open it on any phone. | Until you delete the chat, all chats or your account. You can turn saving off in Settings. Photos you send to the AI are never saved, only the text. |
| Precise location, only while the app is open | Nearby places, walking routes, weather, the country guide, and (if you turn on Travels) the cities you visit. | Not stored, except the city-level visits you choose to save in Travels. Coordinates sent to the weather service are rounded to about 100 m. |
| Microphone audio | Speech to text for voice chat and live translate. | Streamed to Amazon Transcribe and turned into text as you speak. We do not save the audio. The only audio we keep is a voice message you choose to send in a group chat. |
| Camera and photos you pick | Reading menus, signs and tickets; your Travels posts, stories and group chat photos. | Menu and sign photos: not stored. Posts and chat photos: see below. Location data inside photos (EXIF/GPS) is removed on your phone before upload. |
| Email address | Signing in with a one-time code; important messages about your account. | Until you delete your account. |
| Profile: name, username, bio, photo, birth year, interests, languages | Your Travels profile. Your birth year sets the age rules. | Until you delete your account. |
| Travels: visited cities and countries, photos, videos (up to 60 s), stories, albums, captions, tips, questions and answers, likes, comments, saves | The Travels and community features you use. | Until you delete them or your account. Stories: 24 hours. |
| Follows, requests, notifications, blocks, reports | To connect people, tell you what happened, and keep the community safe. | Follows and blocks: until removed. Notifications: 60 days. Reports: up to 12 months. |
| Direct messages and travel buddies (18+ only) | Messages between adults who follow each other; showing your city, dates and a short line to other adults. | Messages: until your account is deleted. Buddy dates: until the trip ends. |
| Group trips: members, plan, votes, expenses, chat, photos, voice messages, shared location, GIFs, stickers | The group features you use. Only members see them. A location is shared only when you tap "Share where I am". | Chat, photos and voice messages: 12 months, or until deleted. The rest: until the group is deleted. |
| Family links (teens) | So a parent can approve groups and see "I'm safe" check-ins. | Until unlinked or an account is deleted. Only the latest check-in is kept. |
| Stickers and sticker packs | To send them; shared packs (18+) appear in the public sticker store. | Until you delete them or your account. |
| Optional age check: three selfie photos | Only to estimate whether you are 16+ or 18+, with your explicit consent. This is biometric data. | Deleted seconds after the check. We keep only the result and the date. No face template is made. |
| Your choice about ads in GIFs (adults) | To show ads between GIFs only if you said yes. | Until you change it or delete your account. |
| Saved flights, spending, packing lists, rate alerts | Your trip tools. | On your phone. Rate alerts are also kept on the server until you remove them. |
| Feedback you send | To fix problems and improve the app. | Up to 24 months. |
| Technical data: IP address, app version, language, time of requests | To run and secure the service, stop abuse and fix errors. | Server logs: 30 days. |
| Notification topic (no device list) | To send news in your language through Firebase Cloud Messaging, if you allow notifications. | Until you turn notifications off or uninstall. |
We do not collect contacts, call logs, SMS or advertising identifiers, and we do not track you across other apps or websites.
4. Why we may use it (legal bases)
| Purpose | GDPR | KVKK |
|---|---|---|
| Providing the features you ask for, your account, groups and messages | Contract, art. 6(1)(b) | Art. 5/2(c) |
| Saving Travels location history, public sharing, ads in GIFs, the optional age check (biometric) | Consent, art. 6(1)(a) and 9(2)(a) | Explicit consent, art. 5/1 and 6/2 |
| Safety: moderation, reports, abuse prevention, security logs | Legitimate interest, art. 6(1)(f) | Art. 5/2(f) |
| Legal duties, such as reporting child abuse material or answering authorities | Legal obligation, art. 6(1)(c) | Art. 5/2(ç) |
You can take back any consent at any time in Settings. This does not affect what was done before.
5. AI and automatic checks
Answers, translations and descriptions are made by AI models. They can be wrong; please check important facts. Photos, videos and stickers are checked automatically by Amazon Rekognition, and short texts by our AI, to block nudity, violence and hate. This can hide a post. It never makes decisions with legal effects about you. If you think a check was wrong, write to contact@pelvoy.com and a person will look at it.
We do not use your data to train AI models. Our AI providers process your request only to answer it, under their terms.
6. Who processes your data
We use these providers. Each gets only what its job needs.
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services (AWS) | Servers, database, file storage, sign-in (Cognito), email codes, speech (Transcribe, Polly), translation, maps, places and routes (Location Service), safety checks and age check (Rekognition), AI (Bedrock) | United States |
| Google (Gemini API) | AI answers, for now, while our AWS AI is being enabled | United States |
| Google (Firebase Cloud Messaging) | Delivering notifications | United States |
| KLIPY | GIF search (your search words). For adults who said yes: ads between GIFs, chosen with your browser type, screen size, language and a random ID that is not your account. | United States |
| Tripadvisor | Ratings and prices of places near a search (place names and coordinates) | United States |
| MET Norway | Weather (rounded coordinates) | Norway |
| Wikimedia (Wikipedia, Commons) | Photos of places and the area (coordinates of the place, place names) | United States |
| Frankfurter (European Central Bank rates) | Money conversion (currency codes only) | EU |
| Deezer | Music search and 30-second previews (search words) | France |
| Travelpayouts / Aviasales | Flight prices (airport codes and dates only) | EU |
| AeroDataBox (RapidAPI) | Live flight status (flight number and date only) | EU / United States |
| Vercel | Hosting pelvoy.com (IP address in short-lived logs) | United States / EU |
| Cloudflare | Our domain and email forwarding for support@ and contact@ | Global |
When you open a booking, eSIM, ticket or map link (for example Booking.com, Airbnb, Skyscanner, Aviasales, Airalo, GetYourGuide, Google Maps), you leave Pelvoy and that company's own privacy policy applies. Some links are affiliate links: we may earn a small fee if you book. You pay the same price, and we do not send your account data with the link.
We may also share data when the law requires it, to protect people from harm, or as part of a merger or sale of Pelvoy (you would be told first).
7. Transfers outside Türkiye and the EU
Most providers above are in the United States. For transfers from Türkiye we rely on the safeguards in KVKK Article 9, as amended by Law No. 7499 in 2024, mainly standard contracts notified to the Personal Data Protection Board, or your explicit consent where the law allows it. For transfers from the EU we rely on the European Commission's adequacy decisions (including the EU–US Data Privacy Framework where the provider is certified) or standard contractual clauses. You can ask us for a copy of the safeguards.
8. Security
All traffic is encrypted (HTTPS/TLS). Data is encrypted at rest. Photos are stored privately and shown only through short-lived links. Access to the servers is limited to the people who run Pelvoy. If a breach puts your rights at risk, we will tell you and the authorities as the law requires (within 72 hours under the GDPR).
9. Your rights
You can ask to know whether we process your data, get a copy (in a portable file), correct it, delete it, restrict or object to its use, and take back consent. Under KVKK Article 11 you can also ask why it is processed and to whom it was sent, and claim damages caused by unlawful processing.
- In the app: Settings → Privacy and account → Download my data, or Delete account.
- On the web: pelvoy.com/delete.
- By email: contact@pelvoy.com. We answer within 30 days, free of charge.
You can complain to the Turkish Personal Data Protection Authority (kvkk.gov.tr) or to the data protection authority where you live in the EU.
10. Children and teens
Pelvoy is for people aged 13 and over. We do not knowingly collect data from children under 13; if we learn of one, we delete the account. Ages 13–17 use teen mode: the profile is always private, groups are joined only with an invite code, adults cannot follow them, direct messages and travel buddies are off, GIFs use the strictest filter, ads are never shown, and the AI does not suggest alcohol, nightlife or adult content. Under 16, a parent with their own Pelvoy account must link to the account before groups, photos and stickers open. A linked parent approves group join requests and sees "I'm safe" check-ins, but never sees messages. See our child safety standards.
11. Phone permissions
| Permission | Used for | If you say no |
|---|---|---|
| Location (while using the app) | Places, routes, weather, guide, visited cities | You can type a city instead |
| Microphone | Voice chat, live translate, voice messages | Typing still works |
| Camera and photos | Reading menus and signs, posts, chat photos, age check | Those features are off |
| Notifications | Messages, group news, rate alerts | You see them when you open the app |
12. Our website
pelvoy.com uses no advertising or tracking cookies. The live demos (time, weather, translation) send only what you type or the city you pick. Our host keeps your IP address in short-lived logs to keep the site secure.
13. Changes
If we change this policy in a way that matters, we will tell you in the app before it takes effect. The date at the bottom shows the latest version.
Türkçe özet: KVKK aydınlatma metni
Veri sorumlusu: Emirhan Cabuk, Türkiye. İletişim: contact@pelvoy.com.
İşlenen veriler: kimlik ve iletişim (ad, kullanıcı adı, e-posta, doğum yılı), konum (yalnızca uygulama açıkken), görsel ve işitsel kayıtlar (fotoğraf, video, sesli mesaj; konuşmanız metne çevrilir, ses kaydedilmez), paylaşımlar ve mesajlar, işlem güvenliği verileri (IP adresi, kayıtlar) ve isteğe bağlı yaş doğrulamasında biyometrik veri (yalnızca açık rızanızla; fotoğraflar saniyeler içinde silinir).
Amaçlar ve hukuki sebepler: hizmetin sunulması ve sözleşmenin ifası (m. 5/2-c), gezi geçmişi, herkese açık paylaşım, GIF reklamları ve biyometrik yaş doğrulaması için açık rıza (m. 5/1, m. 6/2), topluluğun güvenliği ve kötüye kullanımın önlenmesi için meşru menfaat (m. 5/2-f), hukuki yükümlülükler (m. 5/2-ç).
Toplama yöntemi: uygulama ve internet sitesi üzerinden, elektronik ortamda, otomatik ve kısmen otomatik yollarla.
Aktarım: veriler, yukarıdaki tabloda yazan hizmet sağlayıcılara (başta ABD'deki Amazon Web Services) aktarılır. Yurt dışına aktarım, 7499 sayılı Kanunla değişen KVKK m. 9'daki güvencelerle, özellikle Kurula bildirilen standart sözleşmelerle yapılır.
Haklarınız (m. 11): verinizin işlenip işlenmediğini öğrenme, bilgi isteme, amacını ve aktarıldığı kişileri öğrenme, düzeltme, silme, otomatik analizle aleyhinize çıkan sonuca itiraz etme ve zararın giderilmesini isteme. Başvurularınızı uygulamadan, pelvoy.com/delete adresinden veya contact@pelvoy.com adresinden yapabilirsiniz; en geç 30 gün içinde ücretsiz yanıt verilir. Kişisel Verileri Koruma Kurumu'na şikâyet hakkınız saklıdır.
Last updated 14 November 2026