Privacy Policy

Last updated: October 31, 2026. Draft: legal review in progress. This text may change before the app and website launch. The Turkish version is the governing text.

This policy explains which personal data the wagora.app website, the waitlist and the Wagora iOS app process, for what purpose, on what legal basis and for how long, under Turkey's Personal Data Protection Law No. 6698 (KVKK).

1. Data controller

The data controller is Mustafa Abdullah Kaya (individual developer).

Email: hello@wagora.app (support and data requests sent from the app go to support@wagora.app)
Postal address available on request: hello@wagora.app

2. In short

Your exact location never leaves your phone. Only your neighborhood and a location rounded to a grid of about 500 meters reach the server. Other users only see the neighborhood name and a distance band such as “1–3 km”.
Before a match, only your dog's profile and your neighborhood are visible. Your name, photo and note are shown only after a mutual match, and only to that match.
No ads, no tracking, no third-party analytics. We don't sell your data or use it for advertising.
You can delete your account in one step from the app's Settings screen.

3. Website and waitlist

What we collect

Waitlist form: your email address, the neighborhood you choose, optionally your dog's name, the form's language (Turkish/English), the time of your consent and the version of the notice you agreed to.
What we don't store: we don't record your IP address or browser details (user agent). The website uses no cookies and contains no analytics or tracking tools.
Bot check: Cloudflare Turnstile protects the form from bots. Turnstile processes your IP address and browser signals on Cloudflare's side to do this. That data isn't passed on to us.
Hosting: the website runs on Cloudflare Pages. Cloudflare briefly processes technical connection data (such as IP addresses) in its own systems to serve the site securely.

Purpose and legal basis

We use this data only to email you that Wagora has opened in your neighborhood. The legal basis is the explicit consent you give in the form (KVKK art. 5(1)). You can withdraw it at any time.

How long we keep it

When the opening announcement for your neighborhood is sent, your sign-up is deleted automatically. The process that sends the announcement deletes each sign-up as soon as its email has been sent.
Even without an announcement, every sign-up is deleted automatically after 6 months at the latest.
You can have your sign-up deleted at any time by writing to hello@wagora.app.

4. The Wagora app

What we collect

Data the app processes
Data	Details	Who sees it
Email address	To send passwordless sign-in codes and recognize your account.	Only you.
Owner profile	Display name (it doesn't have to be your real name), optional photo and short note, neighborhood.	Only people whose dog has a mutual match with yours.
Location	Taken only while the app is open and only with your permission. Your neighborhood is chosen on your phone. Only a location rounded to a grid of about 500 m reaches the server, which also stores it rounded. At most 5 updates a day are stored. Distances in the Parks tab are calculated on your phone only. If you don't allow location access, you can choose your neighborhood by hand.	Nobody. Others only see the neighborhood name and a distance band.
Dog profile	Name, breed, birth month (not day), sex, size, spayed/neutered, vaccination statement, up to 6 photos, optional details (favorite toy, treat, park, short intro).	Other users in Discover.
Temperament survey	Energy, daily walk time, play style, sociability, reactive-match preference, behavior with small dogs, meetup preference.	The server, to calculate compatibility; other users as a summary on the profile.
Interactions	“Be playmates” and “skip” choices, matches, chat messages, park meetup suggestions, when you last read a chat, users you blocked.	Messages and meetup suggestions: only the two people in the match. Who liked you is never shown; read status isn't shown to the other person.
Confirmations	The time you confirmed you're over 18 (no birth date is asked), the versions and times of the texts you accepted, optional permission for news and offers.	Only you.
Safety records	Reports and their review status, rate-limit counters, flagged messages (see below), moderation decisions.	The data controller (moderation). A reported person is never told who reported them.
Infrastructure logs	For sign-in security, the sign-in logs of our infrastructure provider Supabase may contain IP addresses.	The data controller and Supabase.

Photos

Photos are re-encoded on your phone before upload, so no file metadata (EXIF), including GPS location, is sent. They are kept in non-public storage and shown only through short-lived signed links. The app doesn't ask for camera or photo library access; it only receives the photos you pick in the system photo picker.

Message and intro screening

Under our Community Rules, sharing money, sales and contact details on Wagora is limited. Chat messages, dog intros and owner notes are therefore screened automatically on the server:

A message containing an IBAN or card number is not sent and its content is never stored; we only keep, for 1 year, in which match and when it was refused. Such text is not saved in an intro or note.
Messages mentioning money, payment, sales or breeding, phone numbers or links are delivered but flagged, and both people see a Community Rules notice.

Automated decisions

The compatibility score and order in Discover are calculated automatically from the temperament survey, size and distance. A dog that receives a certain number of reports or sends messages that break the rules may be hidden from Discover automatically until a review is complete. Decisions to restrict or close an account are made by a person. You have the right to object to an automated outcome (section 8).

Purpose and legal basis

Providing the service (account, profiles, matching, chat, park suggestions): entering into and performing the contract (KVKK art. 5(2)(c)).
Protecting users and dogs (age confirmation, reports and blocking, message screening, rate limits, blocking disposable email services, preventing closed accounts from reopening): legitimate interest (art. 5(2)(f)) and establishing, exercising or defending a right (art. 5(2)(e)).
Lawful requests from authorities: legal obligation (art. 5(2)(ç)).
News and offers emails: only if you separately allow them in the app, explicit consent (art. 5(1)).

5. Retention

Retention periods
Data	Period
Account, profiles, dog, temperament, photos, likes, matches, confirmations	Until you delete your account.
Messages of ongoing matches	While the match lasts and both accounts exist.
Messages and read marks of ended matches	Deleted 1 year after the match ended. If a report about that match is still open, kept until the review is complete.
Reports	Deleted 1 year after the report is closed.
Report evidence taken when an account is deleted (the report and the messages up to the time of the report)	1 year, then deleted.
Records of refused messages (no content)	1 year.
A one-way hash (HMAC) of the email of an account closed under the Community Rules	1 year from closure.
Waitlist	The three rules in section 3: deleted on announcement, after 6 months at the latest, or on request.
Supabase infrastructure logs	For the limited period set by the provider.

6. Deleting your account

You can delete your account in the app under Settings → Delete account; you don't need to send an email or visit a website. Your account, profiles, dog, photos, likes, matches and the messages in those matches (for both people), blocks and consent records are deleted right away.

Exceptions: if you reported someone or someone reported you, we keep the report and the messages it covers for one year for safety reviews, then delete them. If you made the report, your identity isn't kept with it. If your account was closed under the Community Rules, a hash of your email is kept for 1 year.

7. Sharing and international transfers

We don't sell your data or share it with anyone for advertising or marketing. To run the service we work only with these providers, and only as far as needed:

Supabase (database, sign-in, file storage): servers in the European Union, Frankfurt (Germany).
Resend (sign-in code emails and the waitlist announcement): servers in the European Union, Ireland.
Apple (App Store distribution and maps in the app, MapKit): map requests go from your phone directly to Apple.
Cloudflare (website hosting and the Turnstile bot check): US-based, global network.

Because these providers' servers are outside Turkey, these are international transfers under KVKK art. 9 and are carried out under standard contracts. Data may also be disclosed to competent public authorities when they make a lawful request, to the extent the law requires.

8. Your rights (KVKK art. 11)

Regarding your personal data, you have the right to:

learn whether it is processed and, if so, request information about it,
learn the purpose of processing and whether it is used accordingly,
know the third parties in Turkey or abroad to whom it is transferred,
ask for it to be corrected if it is incomplete or wrong,
ask for it to be deleted or destroyed,
ask that corrections and deletions be notified to the third parties it was transferred to,
object to an outcome against you that results solely from automated analysis,
claim compensation if you suffer damage from unlawful processing.

To help us verify your identity, please send your request from the email address registered in the app, if possible, to hello@wagora.app or support@wagora.app. The “Request a copy of my data” row in the app's Settings prepares this email for you. We answer free of charge within 30 days at the latest. If you're not satisfied with our answer, you can complain to the Turkish Personal Data Protection Board (KVK Kurulu).

9. Age limit

Wagora is only for dog owners aged 18 and over. Someone who says they're under 18 can't open an account; if we find we have unknowingly processed data of someone under 18, we delete the account.

10. Changes

When we change this policy we update the date at the top. For significant changes we ask for your consent again in the app.