Privacy Policy
Effective date: May 2, 2026 Last updated: October 16, 2026
This document explains how the rabbitgo mobile app (the "App") collects, processes, and protects your personal data. It is prepared in line with GDPR and Türkiye's KVKK (Personal Data Protection Law No. 6698).
1. Data controller
Operated by Verselya. For questions: [email protected]
2. Data we collect
2.1 Account data
When you sign up, we store via Supabase:
- Email address
- Password (hashed; never stored in plain text)
- Account creation date
2.2 Anonymous usage
If you do not have an account, a random UUID is generated for your device. This UUID:
- Is used only to track daily AI suggestion limits
- Cannot be linked to your personal identity
- May be merged with your account when you sign up
2.3 Location
- Location permission is optional; the App works without it
- If granted, it is used to surface nearby places on the map
- Location data never leaves your device — not uploaded, not shared with third parties
- You can revoke permission anytime in device settings
2.4 User content
- Routes you create (city stops + notes)
- Reservation metadata (hotel name, dates, party size, price — entered by you or returned by a third party)
- Favorite places
- AI query texts (transient — not stored after the response)
2.5 Automatic data
- Device type (iOS/Android version)
- App version
- Error logs (no personal data)
We do not use analytics tools (Mixpanel, Amplitude, etc.). Future versions will update this document before adding any.
3. Why we process your data
| Purpose | Legal basis |
|---|---|
| Account creation + login | Performance of contract |
| Storing routes/reservations/favorites | Performance of contract |
| AI suggestion rate-limit tracking | Legitimate interest |
| Error diagnosis | Legitimate interest |
| Statutory obligations | Legal obligation |
We do not process data for marketing or add you to mailing lists without explicit consent.
4. Sharing with third parties
| Service | Data shared | Purpose |
|---|---|---|
| Supabase | Email, hashed password, UUID, content | Auth + database |
| Mapbox | Anonymous route coordinates | Inter-city directions |
| Overpass API (OSM) | Anonymous queries (bbox) | POI data |
| OpenRouter + AI | AI query text (anonymous) | Local suggestion generation |
| Hotel providers | Redirect on click | Reservation (handled by them) |
Hotel providers (Booking, Hotels.com, Etstur) have their own privacy policies. Once you leave the App, you are subject to their data practices.
We do not sell your data to ad networks, data brokers, or marketing firms.
5. Retention
- Account data: while your account is active + 30 days after closure
- User content: while your account is active
- Anonymous UUID: deleted after 90 days of inactivity
- Error logs: 30 days
When you delete your account ([Profile → Delete account]) all your data is erased immediately, no backups retained.
6. Your rights (KVKK Art. 11 + GDPR Arts. 15-22)
You have the right to:
- Access: Learn what data we process
- Rectification: Correct inaccurate data
- Erasure: Delete your account and data (one-tap from Profile screen)
- Portability: Receive your data in a machine-readable format
- Object: Object to specific processing purposes
- Complain: File a complaint with KVKK (Türkiye) or your EU data protection authority
Send requests to: [email protected] — we respond within 30 days.
7. Children
The App is not directed to children under 13. We do not knowingly collect data from anyone under 13. If you are a parent and learn your child created an account, contact [email protected] and we will delete the data.
8. Security
- All transit uses HTTPS/TLS
- Passwords are stored with one-way hashing (bcrypt-style)
- Database access is restricted to authorized personnel
- Regular backups + access logs
We cannot guarantee absolute security; in case of a known data breach we will notify you and KVKK within 72 hours.
9. Changes
If we update this document:
- We will change the effective date
- For material changes we will send an in-app notice
- Continued use of your account means you accept the updated version
10. Contact
For questions, requests, or complaints: