Privacy Policy

This Privacy Policy explains how Codepad Yazılım ve Dijital Hizmetler ("Codepad", "we") collects and processes personal data when you use Tripwell. We follow the EU General Data Protection Regulation (GDPR) and, for users in Türkiye, the Turkish Personal Data Protection Law No. 6698 (KVKK).

1. Data controller

The data controller for personal data processed in Tripwell is Codepad Yazılım ve Dijital Hizmetler, located at Çankaya, Ankara, Türkiye. You can reach us at help@codepad.studio.

2. Data we collect

We collect only what we need to operate Tripwell.

Account data

• Email address (when you create an account or use Sign in with Apple).
• An opaque Apple user identifier (when you use Sign in with Apple).
• Optional display name.

Trip data

• Destinations, dates, group composition, vibes, and the itineraries we generate for you.
• Notes, saves, edits, and shared trip links you create.

Device & technical data

• Device model, OS version, app version, language, time zone.
• Crash reports and basic diagnostic logs.

Usage data

• Anonymized analytics events (which screens are visited, which features are used) so we can improve the product.

Optional, with your consent

• Push notification token (if you enable notifications).
• Approximate location (only during an active trip, to surface nearby suggestions).

Payments

Subscriptions are processed by Apple. We never see or store your card details. We only receive a transaction confirmation and your subscription status.

3. Legal basis

We rely on the following legal bases under GDPR Art. 6 and KVKK Art. 5:

• Contract performance — to provide the service you requested (account, trips, subscription).
• Legitimate interests — to keep the service safe, prevent fraud, and improve the product, balanced against your interests.
• Consent — for optional items like push notifications, approximate location, and any marketing communications. You can withdraw consent at any time.
• Legal obligation — to comply with tax, accounting, and other legally required record-keeping.

4. Processing purposes

• Generate itineraries and operate the planning features.
• Manage your account and subscription.
• Provide customer support.
• Detect and prevent fraud or abuse.
• Improve features, fix bugs, and measure aggregated product usage.
• Send service announcements (e.g., outage notices, terms updates).

5. Sharing & processors

We share data only with service providers who help us run Tripwell, under written agreements that bind them to confidentiality and security obligations. Current categories:

• Apple Inc. — App Store distribution, in-app purchases, Sign in with Apple, push notifications.
• Hosting — Heroku (Salesforce, Inc.) for our application servers.
• AI itinerary providers — third-party large-language-model APIs that help generate plans. Trip prompts are sent without your account email.
• Image hosting — Google Cloud Storage for destination posters.
• Crash & analytics — anonymous diagnostic and product-usage analytics.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

6. International transfers

Some of our processors are located outside Türkiye and the EEA (notably the United States). When we transfer your data internationally we use lawful transfer mechanisms, including the European Commission's Standard Contractual Clauses and, for KVKK, your explicit consent or other lawful grounds under Article 9. By using Tripwell you acknowledge these international transfers.

7. Retention

• Account & trip data — until you delete your account, then up to 6 months in backups before permanent deletion.
• Subscription & billing records — for the period required by Turkish tax and accounting law.
• Crash logs — up to 90 days.
• Anonymized analytics — indefinitely (cannot be linked back to you).

8. Your rights

Depending on where you live you have rights including:

• To know what personal data we hold about you and to receive a copy.
• To correct inaccurate or incomplete data.
• To request deletion of your data.
• To restrict or object to certain processing.
• To data portability where applicable.
• To withdraw consent at any time, without affecting the lawfulness of past processing.
• To lodge a complaint with your data protection authority (in Türkiye, the KVKK; in the EU, your local supervisory authority).

Email help@codepad.studio to exercise any of these rights. We respond to requests within the timelines required by applicable law (in Türkiye, within 30 days under KVKK Art. 13).

9. Children

Tripwell is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with data, contact us and we will delete it.

10. Security

We use industry-standard safeguards including TLS in transit, encryption at rest where supported by our infrastructure, access controls, and least-privilege principles for our team. No system is perfectly secure; if we ever learn of a personal data breach affecting you, we will notify you and the appropriate authority within the timeframes required by law.

11. Changes

We may update this policy from time to time. The "Last updated" date at the top will always reflect the latest version. Material changes will be announced in the app.

12. Contact

For privacy questions or to exercise your rights, contact help@codepad.studio or write to: Codepad Yazılım ve Dijital Hizmetler, Çankaya, Ankara, Türkiye.