Privacy Notice
Privacy Notice
Under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK), this notice explains who processes your personal data when you use the Kunduzo application and web pages, for what purposes, on which legal grounds and how, to whom it is transferred, and what your rights are.
This is information only. You do not need to approve it and you are not asked to tick a box. Separate texts are shown for processing that relies on your explicit consent, and you choose each of them separately.
Effective date: 1 October 2026
1. Data controller
The data controller within the meaning of the KVKK is:
| Item | Value |
|---|---|
| Trade name | HİPOPOTAMYA BİLİŞİM LTD. ŞTİ. |
| Address | Değirmiçem Mah. Nail Bilen Cad. Uğur Plaza No:5/149 Şehitkamil/Gaziantep, Türkiye |
| MERSİS number | 0463132778200001 |
| info@hipopotamya.com | |
| KEP (registered electronic mail) address | hipopotamyabilisim@hs06.kep.tr |
2. Personal data processed
| Category | Data |
|---|---|
| Identity | Full name, username |
| Contact | Email address |
| Visual | Profile photo (optional) |
| Profile | Short bio, city, country, home flying site, year you started flying, language, unit, time zone and visibility preferences |
| Customer transaction | Registration date, time of email verification, time of your declaration that you are over 18, Google or Apple account link, follow relationships, badges, notification preferences and notification history, calendar subscription address |
| Transaction security | Password (stored as an irreversible hash), session tokens, device records, IP address and browser or device information (in session and security records) |
| Location | The full GPS track of your flights (raw IGC file), your phone's current location when you search for sites near you, take-off and landing coordinates, thermal points within a flight, your favourite sites, your flight intent stating that you will go to a given site on a given day, the site and time you choose in the landing timer, the location and capture time embedded in a site photo you upload |
| Professional experience | Licence level, issuing body and number, IPPI level and number, licence endorsement year and expiry date, insurance policy details and expiry date, wing check date, instructor grade, flight statistics, equipment and maintenance records |
| Health (special category) | Blood type, allergy information, medical certificate date |
| Third-party data | Name and phone number of your emergency contact |
| Social interaction | Posts, comments, likes, your place in club and league rankings, club memberships and roles, event attendance, ride sharing, competition attendance declarations, site reviews, photos and field reports, weather forecast ratings, safety contacts |
| Legal transaction | Report and block records, moderation decisions and their reasons |
| Support | In-app problem reports, any screenshot you attach, device, operating system and app version information, the last screen you opened and the last lines of the application log |
| Consent record | Which consent you gave or withdrew, against which text version, when and through which channel, and which version of this notice you saw and when |
You are not asked for your date of birth, national identity number, postal address or payment card details. The application does not track your location in the background. Your phone's location is read only if you have granted location permission and when you ask for sites or weather near you; it is sent to the server for that search and is not stored. Other location data comes from the flight files you upload and the information you enter.
2.1 Flight tracks
An IGC file usually carries one GPS point per second throughout your flight and shows where you were, when and for how long, minute by minute. You upload the file yourself and its raw form is stored unchanged. You choose who can see each flight: public, followers, club or only you. A flight you make public can be viewed without signing in, through a web link and a share image; that page is closed to search engines.
2.2 Health information
Blood type and allergy information are special category personal data within the meaning of Article 6 of the KVKK. This information is processed only if you enter it on your pilot card and only with your explicit consent, is stored encrypted in the database and is visible only on your own screen. No one, including your club officers, can see it, and it is not transferred to any third party. For membership and document tracking, your club officers can see only the date of your medical certificate; the content of the certificate is not held in the application.
2.3 Emergency contact
If you enter the name and phone number of someone close to you on your pilot card, that information is that person's personal data, and that person is not a user of the application. This person's information is collected only from your statement; this notice is also publicly available to them on our web page. Before entering it, you must inform that person and pass this notice on to them. It is stored encrypted, is visible only on your own screen and is not shared with anyone. The application does not send messages to this person or call them.
3. Purposes of processing
| Purpose | What it covers |
|---|---|
| Membership and account management | Registration, sign-in, email verification, password reset, age declaration, session and device management |
| Flight logbook service | IGC file upload, flight analysis (thermal detection, distance scoring), statistics, licence progress, logbook export |
| Flying site information | Finding sites near you, site records, photos, reviews, field reports, site alerts, site statistics |
| Weather information | Site-based forecast, nearest airport observation, flyability assessment, written summary, morning notification for your favourite sites |
| Club management | Membership, roles, licence verification, tracking of licence, endorsement, insurance and document dates, announcements, events, attendance and ride sharing, calendar subscription |
| Community | Posts, comments, likes, follows, club and league rankings, flight intent ("I'm going flying today"), the "who flew here today" list, competition attendance declarations |
| Flight safety tools | Landing timer ("landed safely"), safety contacts, pre-flight checklist, equipment maintenance reminders, pilot card |
| Moderation | Reports, blocking, hiding content, warnings, restrictions and account closure decisions |
| Information security and audit | Session records, audit trail, prevention of misuse and unauthorised access, rate limiting |
| Support and operation of the service | Answering problem reports, reviewing error and crash records |
| Emergency information | Blood type, allergies and emergency contact on the back of the pilot card (with your explicit consent) |
| Evidencing rights and obligations | Consent records, moderation decisions, account deletion and data requests |
| Marketing communication | Announcement and campaign messages (with your explicit consent) |
| Usage measurement | Measuring how the application is used (with your explicit consent; not carried out on the effective date of this notice) |
| Location inference | Inferring site preferences from your flight tracks and favourites (with your explicit consent; not carried out on the effective date of this notice) |
4. Method of collection and legal grounds
Your personal data is collected through the mobile application and web pages, by partly automated means, from your own statements, the files you upload and the records created while you use the application, and, if you have granted location permission, from your phone's location service. If you choose to sign in with Google or Apple, the sign-in takes place in that company's own service and your account identifier and email address are passed to us. Your emergency contact's details are collected from your own statement.
| Data and purpose | Legal ground |
|---|---|
| Account, profile, flight logbook, flying sites, weather, club, community and flight safety tools | Necessary for the establishment and performance of a contract (KVKK Art. 5/2-c) |
| Club officers tracking membership, licence, endorsement, insurance and document dates and verifying the licence | Performance of a contract (Art. 5/2-c) and the data controller's legitimate interest in providing clubs with a membership management service (Art. 5/2-f) |
| Session, IP address, device information and audit records | The data controller's legal obligation (Art. 5/2-ç) and legitimate interest in information security (Art. 5/2-f) |
| Moderation, reports and blocking | Legitimate interest (Art. 5/2-f) |
| Support requests, error and crash records | Performance of a contract (Art. 5/2-c) and legitimate interest in keeping the service running (Art. 5/2-f) |
| Consent records, moderation decisions, account deletion and data request records | Establishment, exercise or protection of a right (Art. 5/2-e) and legal obligation (Art. 5/2-ç) |
| Blood type and allergy information | Explicit consent (KVKK Art. 6) |
| Emergency contact's name and phone number | The data controller's legitimate interest in providing the emergency information you ask to show on your pilot card (Art. 5/2-f); these fields are enabled together with the health information explicit consent |
| Marketing communication | Explicit consent (Art. 5/1) |
| Usage measurement | Explicit consent (Art. 5/1) |
| Location inference | Explicit consent (Art. 5/1) |
Declining processing that relies on explicit consent does not prevent you from using the service; only the related feature does not work. You can withdraw a consent you have given at any time under Settings → Privacy in the application.
5. Transfer of personal data
5.1 Within Türkiye
Within Türkiye, your personal data is transferred only to the following recipients, for the stated purpose:
| Recipient | Data transferred | Purpose |
|---|---|---|
| Officers of the club you are a member of | Your licence level and issuing body, IPPI level, instructor grade, endorsement, IPPI, insurance, medical certificate and wing check dates, whether your licence has been verified, your membership and event information | The club's membership and document tracking |
| Your safety contacts who have accepted and, if you chose so, your club's officers | When you do not respond, the landing timer's site name, your expected landing time and your note | Landing alert |
| Other users | Your name, username, profile photo, licence level and whether your club has verified your licence, your place in rankings; your content to the extent of the visibility you choose | Community features |
| Competent public authorities | The data required by a lawful request | Legal obligation under KVKK Art. 8 and Art. 5/2-ç |
Your licence number, insurance policy number, IPPI number, blood type, allergy information and emergency contact are not shown to club officers or other users.
5.2 Abroad
The following service providers receive personal data and are located outside Türkiye:
| Recipient | What it does | Data transferred | Country |
|---|---|---|---|
| OVH (server and file storage) | The server the application runs on and the file store | All data listed in this notice and the files you upload | European Union |
| Email delivery service provider | Verification, password reset, export and account deletion emails; forwarding your problem reports to our support mailbox | Your email address, your name, the content of the email; for a problem report, your message, device and version information and the last screen you opened | European Union |
| Thunderforest (map images) | Displaying maps | Directly from your device: the map tile coordinates of the area you view and your device's IP address | United Kingdom |
| Google Firebase Cloud Messaging (push notifications) | Delivering notifications to your phone | Your device's notification token and the notification text; on iOS devices the notification also passes through Apple's notification service | United States of America |
The push notification transfer takes place once push notifications start being sent to your phone. On the effective date of this notice, the application's notifications are shown on the notifications screen inside the application and no device token is sent to Firebase Cloud Messaging.
Transfers abroad are made under KVKK Art. 9 by signing with the recipient the standard contract announced by the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) and notifying the signed contract to the Board. You can write to us for information about the standard contracts.
5.3 External services that receive no personal data
Requests are sent to the following services for weather information. These requests are made by our server, not by your device, and they contain no name, account, flight track, IP address or any other personal data of yours.
| Service | What is sent |
|---|---|
| Open-Meteo (weather forecast) | The latitude and longitude of the flying site, the forecast model and the time range |
| Aviation Weather Center, aviationweather.gov (airport observation) | The airport's four-letter international code |
| Artificial intelligence provider (weather summary) | The flying site's name, elevation, flyable directions, wind limits and hourly forecast values |
Error and crash records of the application and the server are processed on our own server and are not sent to any third party.
6. Your rights
Under KVKK Art. 11, by applying to the data controller you have the right to:
- Learn whether your personal data is processed;
- Request information if it has been processed;
- Learn the purpose of processing and whether it is used in line with that purpose;
- Know the third parties in Türkiye or abroad to whom it is transferred;
- Request rectification if it is incomplete or inaccurate;
- Request erasure or destruction under the conditions set out in KVKK Art. 7;
- Request that rectification, erasure and destruction be notified to the third parties to whom the personal data has been transferred;
- Object to a result against you arising from the analysis of processed data exclusively by automated systems;
- Claim compensation for damage suffered due to unlawful processing of personal data.
You can exercise some of these rights directly in the application:
| Right | Where in the application |
|---|---|
| Seeing your data | Profile and pilot card screens |
| Getting a copy of your data | Settings → Account → download your data |
| Rectification | Editing your profile and pilot card |
| Erasure | Settings → Account → delete account |
| Withdrawing consent | Settings → Privacy |
6.1 How to apply
To exercise your rights, you can send your application in writing from the email address registered to your account to info@hipopotamya.com, to the KEP address hipopotamyabilisim@hs06.kep.tr, or to Değirmiçem Mah. Nail Bilen Cad. Uğur Plaza No:5/149 Şehitkamil/Gaziantep, Türkiye. Your application must state your name, surname, the email address registered to your account and your request. We verify your identity so that your data is not given to someone else; this may require the application to come from the email address registered to your account or additional information to be requested from you.
Your application is concluded free of charge as soon as possible according to the nature of the request and within 30 days at the latest. If the action requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your application is rejected, you find the answer insufficient or no answer is given in time, you may lodge a complaint with the Personal Data Protection Board under KVKK Art. 14.
7. Retention periods and destruction
Your personal data is kept for as long as the purpose of processing requires; when that period ends it is erased, destroyed or anonymised.
| Data | Retention period |
|---|---|
| Account, profile, flights, raw IGC files, equipment, posts and comments | As long as your account is open. A flight, post, comment or equipment record you delete one by one is no longer shown; the record itself and the flight's raw IGC file are kept until your account is deleted |
| Pilot card, health information and emergency contact | As long as your account is open; erased when you clear the field on the pilot card |
| Session tokens and device records | Until you sign out or delete your account; a device record unused for 180 days is erased |
| In-app notifications | 30 days |
| Flight intents | Erased 30 days after the flying day |
| Landing timer records | A closed timer is erased after 30 days; an unanswered timer is kept as long as your account is open |
| Audit records | 2 years from the date the record was created |
| Moderation decisions | As long as your account is open |
| Export files | The account archive is erased after 48 hours and the logbook backup after 7 days; the request itself stays on record |
| Consent records | Kept after your account is deleted, with the link to you removed |
| Database and file backups | The database backup is taken daily and erased after 30 days; erased data or files remain in backups and in earlier versions in the file store for at most 30 more days and are not restored |
7.1 Deleting your account
You can delete your account from within the application. When you make the request, a 7-day waiting period begins. During this period your account keeps working; you can sign in, download your data and cancel the request. At the end of the 7th day the deletion takes place and cannot be undone. If you own a club, you must first transfer it to another member.
Data erased: your profile, profile photo, pilot card (including health information and emergency contact), flights, raw IGC files and share images, equipment, club memberships, club invitations you created, device and session records, Google/Apple link, role assignments, favourites, posts, comments, likes, follow and block relationships, badges, flight statistics, bulk upload records, announcement read status, "helpful" marks, site reviews and field reports, weather forecast ratings, event and competition attendance, ride sharing, pre-flight checklist records, flight intents, landing timers and safety contact relationships, notifications, calendar subscription, moderation decisions and export files.
Data kept with the link to you removed: flying site records and their edit history, site photos you uploaded, site alerts, events and club announcements you created, reports you made, your problem reports (with the screenshot erased), audit records (with the IP address and browser information erased) and your consent records. No name or link to your account remains in these records.
Other traces remaining after deletion: club and league rankings of closed periods are kept frozen, and your name and username remain in those rankings; the files of photos you attached to posts remain in the file store. You can request their erasure through the application route in §6.1.
Consent records are kept because the burden of proving that consent was obtained lies with the data controller. What remains is "a user, on this date, against this text version, gave this consent"; no IP address is ever stored in a consent record.
You can register again with the same email address; the new account is entirely new and none of the old data comes back.
7.2 A copy of your data
You can request a copy of your data from within the application. The package contains machine-readable JSON files and your raw IGC files unchanged: profile and pilot card, flights, equipment and maintenance records, club memberships, posts, comments, likes, follows, site reviews and field reports, flight intents, landing timers and safety contacts, notification preferences and history, consent records and the time of your age declaration. For your other data not included in the package, you can request information through the application route in §6.1. When the package is ready, a signed download link personal to you is sent to you by email, and the file is erased after 48 hours.
8. Changes to this notice
When this notice is updated, a new version is published and shown to you when you open the application. A published version is never changed afterwards; every version remains readable on the web page together with its publication date.