What personal data we collect, why we use it and how you can exercise your rights.
1. Controller
Your personal data is processed by Onur Sercan Yılmaz, who operates urlreview, as data controller. Contact: destek@urlreview.com
Users in Türkiye can find additional information in the KVKK Notice.
2. Data we collect
- Account data: name, email address, profile picture and account id from Google or Apple sign-in (with Apple's “Hide My Email”, only the relay address).
- Profile data: username, display name, bio, website, country and language; if you choose to upload them, your profile and header photos (photos are resized on your device and stripped of embedded data such as location).
- User content: your ratings, reviews, replies, likes, reposts, bookmarks, follows, reports and blocked accounts.
- Usage and security data: IP address, device and browser details, sign-in times, page views (de-duplicated with a random visitor id), moderation records.
- Notification data: if you allow push notifications, your device's push token, device type and which notifications you want.
- Error reports: when the app runs into an error, the error message, technical trace (stack trace), app version, platform and page; your account id if you are signed in.
- Preferences: theme, language and country (in a cookie and in your account).
3. How we use it
- To create your account, sign you in and provide the Service.
- To personalise your feed, show trends for your country and deliver notifications.
- To send push notifications, only if you allow them and only of the kinds you choose.
- To find and fix errors.
- To enforce the Community Guidelines: profanity and spam filters, AI-assisted content checks, handling reports, preventing abuse.
- To keep the Service secure and meet legal obligations such as Turkish Law No. 5651.
- To produce aggregated, anonymous statistics that improve the Service.
We do not sell your data, use it for advertising or share profiles with third parties.
4. Public information
Your username, display name, profile and header photos, bio, website, country, follower and following counts, published reviews, likes and reposts are public and may appear in search engines. Your email address, language/theme and notification preferences, blocked accounts and moderation status are not shared with other users.
5. Service providers and international transfers
We share data only with providers that process it on our instructions:
- Supabase (database, authentication, server functions)
- Vercel (website hosting)
- Google and Apple (sign-in)
- Expo / EAS (mobile app delivery and updates)
- Expo push service, Apple Push Notification service and Firebase Cloud Messaging (push notifications; only the push token and the notification text)
- Anthropic (if AI moderation is enabled; only review text and uploaded profile/header photos)
- Google Safe Browsing (if enabled; the reviewed Link only)
Their servers may be located outside your country (US and EU). Transfers rely on the safeguards required by Article 9 of the KVKK and the GDPR (such as standard contractual clauses). We may disclose information in response to lawful requests from authorities.
6. Automated decisions
Reviews and profile details pass an automatic word filter, spam rules and, where enabled, an AI-assisted check before they are published. These systems may block content or hold it for moderator approval. No permanent measure against your account (such as a ban) is taken by automated systems alone. To contest an automated decision and ask for human review, write to destek@urlreview.com.
7. Authorities and legal requests
We disclose personal data only in response to a court order or a request from a competent authority that complies with applicable law, limited to the scope of the request. If we believe there is an imminent risk to someone's life or physical safety, we may give the authorities the information needed.
8. Retention
- Account and content data are kept while your account is open and deleted or anonymised within 30 days after you delete it.
- Traffic and access logs required by Law No. 5651 are kept for the legally required period (1 to 2 years).
- Moderation records are kept for up to 2 years to prevent abuse and respond to legal claims.
- Push tokens are deleted when you sign out, uninstall the app or turn notifications off.
- Error reports are deleted automatically after 30 days.
9. Your rights
Under the KVKK (Article 11) and the GDPR you can access, correct, delete, restrict and port your data and object to its processing. Send requests to destek@urlreview.com; we answer free of charge within 30 days.
You can permanently delete your account in the app at any time in Settings > Delete my account. You may also complain to your data protection authority (in Türkiye, the Personal Data Protection Board).
10. Security and children
Data is transmitted over encrypted connections (HTTPS), access is restricted and the database is protected with row-level security rules. No system is perfectly secure; if a data breach is detected we notify the Personal Data Protection Board within 72 hours under KVKK Article 12 and inform affected users as soon as possible.
The Service is not intended for children under 13 and we do not knowingly collect their data.
11. Changes
When this policy changes the new version is published here; for material changes you are notified in the Service and asked to accept again where required.