Privacy Policy

Summary

1. Who we are

“Palmie”, “we”, “us” and “our” mean Yiğit Efe Toz, an individual developer based in Türkiye, who operates the Palmie app for iPhone and the website thepalmie.com. Under data-protection laws such as the EU and UK GDPR and Türkiye's Personal Data Protection Law No. 6698 (KVKK), Palmie is the data controller (veri sorumlusu) of personal data processed through the app, except where Apple or another provider decides for itself how to use data in its own service (for example Apple's sign-in and payments, or Google's advertising).

Contact for anything privacy-related: [email protected]. We handle all requests by email. We have not appointed a Data Protection Officer because we are not required to. If we become required to appoint a representative in the EU or the UK, we will publish the details here.

2. What this policy covers

This policy covers the Palmie app for iPhone, the website thepalmie.com and the email address [email protected]. It does not cover third-party websites or apps that Palmie links to, or the independent services listed in section 6, which have their own policies. “Personal data” means any information that relates to you or can reasonably be linked to you.

3. What we collect

Palmie is designed to collect as little as possible. This table describes what the app handles and where it goes.

What we do not collect. Palmie does not access your contacts, photos, camera, microphone, health data, calendar or browsing history, and it does not collect your precise location in the background. We do not run our own account database, and the app does not contain analytics or crash-reporting SDKs. The only advertising SDK in the app is Google's. If that changes, we will update this policy before the change takes effect and, where the law requires, ask for your consent.

Sensitive information. We do not ask for, and the app does not need, sensitive personal data such as health, religion, political opinions, sexual orientation, biometric or financial data. Please do not type it into the chat. If you do, it is sent to our AI provider like any other message (section 5).

4. How and why we use it

We use the information above to:

• show your position, nearby places, routes and offline maps;
• generate answers, travel plans and place suggestions;
• remember your trips, saved places, countries and settings on your device;
• list events for the destinations you search;
• process purchases and restore what you bought;
• show ads in the free version and measure them;
• keep you signed in, secure the service and prevent abuse and fraud;
• reply to your questions, requests and feedback; and
• meet our legal obligations and defend our legal rights.

Legal bases

Under KVKK we process data on the grounds in Article 5 of Law No. 6698: that processing is necessary to perform a contract, is necessary for our legitimate interests without harming your fundamental rights and freedoms, is required by law, and, where needed, rests on your explicit consent. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do not profile you for any purpose beyond what is described in section 7.

5. AI features

Localizer and the plan generators are powered by a third-party AI provider (currently OpenAI). When you use them, the text you write, the trip details you give and, if available, your approximate location are sent through our gateway to the provider to produce a response. We do not store your messages or the replies on our servers; our gateway only passes them through. The conversation you see is stored on your device.

Under the provider's API terms at the time of writing, data sent through the API is not used to train its models by default and may be kept for a limited period (typically up to 30 days) for security and abuse monitoring. Those terms are set by the provider and can change; please read OpenAI's privacy policy for current details.

AI replies can be wrong, out of date or incomplete, and can reflect biases in the underlying model. Check opening hours, prices, safety, visa and entry requirements with official sources before you rely on them. Do not put sensitive personal information, passwords, financial details or ID numbers in chat.

6. Who we share it with

We do not sell your personal information. We disclose information only to the service providers below, and only what each needs to do its job.

We may also disclose information: (a) when you ask us to, for example when you share a plan; (b) to comply with law, court orders or lawful requests from authorities; (c) to protect the rights, safety and security of our users, the public or Palmie, and to enforce our Terms; and (d) in a merger, acquisition, financing or sale of assets, in which case we will make sure your information stays protected and tell you about any material change.

When you share a plan

The share feature creates a link that contains the plan's content. Anyone who has the link can open and read it, so share it only with people you trust. Palmie does not store shared plans on a server.

Links to other sites

The app may open third-party websites, for example for hotel or flight searches. Those sites have their own privacy practices that we do not control.

7. Advertising

The free version of Palmie shows ads: a banner on some screens, full-screen ads at natural breaks (for example after you finish a chat or when you switch tabs) and an optional rewarded video you can watch to unlock extra chat questions. Palmie Plus and the one-time Remove Ads purchase turn ads off. Ads are provided by Google AdMob (Google LLC, and Google Ireland Limited for users in the EEA, UK and Switzerland).

To show and measure ads, AdMob may collect and use your IP address, device and app information, and, only if you allow it, your device's advertising identifier (IDFA) to personalise ads and measure their effectiveness. Google may also use this data for fraud prevention and to improve its services, as described in Google's advertising policy. We do not send your chat messages, saved trips or location to ad providers.

Your choices.

• The first time you use the app we ask for permission through Apple's App Tracking Transparency prompt. If you decline, ads are still shown but are not personalised using your advertising identifier. You can change this at any time in iOS Settings → Privacy & Security → Tracking.
• If you are in the EEA, the UK or Switzerland, we show Google's consent form where required, and you can review your choice later from the app.
• You can also limit ad personalisation at adssettings.google.com.
• To remove ads completely, subscribe to Palmie Plus or buy Remove Ads.

Some US state laws treat this kind of ad measurement as “sharing” or “targeted advertising”. Declining tracking in iOS, or removing ads, is how you opt out (see section 13).

8. Cookies and similar technologies

The app does not use browser cookies. The advertising SDK may use device identifiers and local storage on your device as described in section 7, and the app stores your settings on your device.

The website thepalmie.com does not set cookies and has no advertising trackers. Our host, Cloudflare, may process technical data (IP address, browser type, pages requested) in server logs and may measure page performance with privacy-focused tools that do not use cookies or track you across sites. We do not use this to identify you.

9. International transfers

Palmie is operated from Türkiye, and our providers process data in other countries, including the United States and EU member states. If you are in the EEA, the UK, Switzerland or another region that restricts transfers, we rely on the safeguards our providers use, such as the EU–US Data Privacy Framework, the European Commission's Standard Contractual Clauses and the UK transfer addendum, or adequacy decisions where available. For KVKK, we transfer data abroad only as permitted by Article 9 of the law. You can ask us for details at [email protected].

10. How long we keep it

11. Security

We use reasonable technical and organizational measures to protect information handled by the app, including encrypted connections (HTTPS) to every service we use, API credentials kept on the server rather than in the app, rate limiting, and on-device storage protected by iOS. No system is perfectly secure, so we cannot guarantee absolute security. If a breach affecting your personal data occurs, we will notify you and the relevant authorities as the law requires.

12. Your rights

Depending on where you live, you have some or all of these rights over your personal data:

• Access a copy of the personal data we hold about you and information about how we use it;
• Correct data that is inaccurate or incomplete;
• Delete your data (“right to be forgotten”);
• Restrict or object to certain processing, including processing based on legitimate interests and direct marketing;
• Portability: receive your data in a structured, commonly used format;
• Withdraw consent at any time, without affecting earlier processing;
• Not be subject to solely automated decisions with significant effects (we do not make any); and
• Complain to your data-protection authority.

How to use them. Most of your data lives on your device, so you can already view, change and delete it inside the app, and switch off location, tracking and notifications in iOS Settings. You can erase everything Palmie stores on your device, including trips, saved places, conversations, profile, trophies and downloaded maps, at any time with Account → Delete Account. For anything else, email [email protected] from the address you use with Palmie. We may ask you to verify your identity, and we will respond within the time the law requires (generally 30 days; 45 days under California law, extendable where the law allows). We will not discriminate against you for exercising your rights. If we refuse a request, you can appeal by replying to our message, and you may contact your local authority.

13. Region-specific information

European Economic Area, United Kingdom and Switzerland

You have the rights in section 12 under the GDPR, UK GDPR and the Swiss Federal Act on Data Protection. You can lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner).

Türkiye (KVKK)

Under Article 11 of Law No. 6698 you may ask whether we process your personal data; request information about it; learn the purposes and whether it is used accordingly; learn the third parties it is transferred to in Türkiye or abroad; request correction or deletion and that these actions be notified to third parties; object to a result against you produced by exclusively automated analysis; and claim compensation for damage caused by unlawful processing. Send your request to [email protected]; we answer free of charge within 30 days where possible. You may also complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

California and other US states

In the last 12 months we have collected the categories below. We collect them from you and your device, for the purposes in section 4, and disclose them only to the providers in section 6. We do not sell personal information for money. In the free version, ad measurement by Google AdMob may count as “sharing” for cross-context behavioral advertising or “targeted advertising”.

Precise geolocation counts as sensitive personal information; we use it only to provide the features you ask for and not to infer characteristics about you. Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states with privacy laws may ask to know, access, correct, delete or port their data, and to opt out of sale, sharing and targeted advertising, by declining tracking in iOS Settings or by emailing us. We honor opt-out preference signals such as Global Privacy Control where technically possible on the website, which does not track you anyway. You may use an authorized agent. California's “Shine the Light” law lets residents ask which personal information we disclose to third parties for their direct marketing; we do not do so.

Brazil, Canada, Australia, Japan, South Korea, India and other countries

You have the rights your local law provides, which generally include those in section 12: for example under Brazil's LGPD, Canada's PIPEDA and provincial laws (including Quebec's Law 25), Australia's Privacy Act, Japan's APPI, South Korea's PIPA, India's Digital Personal Data Protection Act, Singapore's, Thailand's and Malaysia's PDPA, South Africa's POPIA, and the UAE and Saudi Arabia's personal data laws. Contact us at [email protected] and we will respond as the law requires. You may also contact your local data-protection authority.

14. Children

Palmie is not directed to children and is not designed for them. You must be at least 13 years old, or the higher minimum age your country sets for consenting to the processing of personal data (for example 14 to 16 in some EU countries), to use the app. We do not knowingly collect personal information from children under those ages, and ads are not meant to be targeted to children. If you believe a child has given us personal information, contact us and we will delete it. Parents can also use Apple's Screen Time and Ask to Buy controls on their child's device.

15. This website

thepalmie.com is a static website. It does not use cookies, advertising trackers or behavioral analytics (see section 8). If you email us from the site, we handle your message as described in this policy.

16. Changes to this policy

We may update this policy as Palmie grows. When we make material changes we will update the date at the top of this page and, where appropriate, notify you in the app. The latest version is always at thepalmie.com/privacy.html. Earlier versions are available on request.

17. Contact

Questions, requests or complaints about this policy or your data: [email protected]
Yiğit Efe Toz (Palmie), Türkiye