Privacy Policy

Raf Gezgini is a consumer application offering store and product discovery, household shared shopping lists, in-household messaging, photo sharing, location for nearby stores, crowd-sourced price observations, and optional push notifications.

Raf Gezgini does not sell products, take payments, or act as a marketplace or seller. This Policy informs you about processing under Law No. 6698 on the Protection of Personal Data (“KVKK”) and related secondary legislation.

Where explicit consent (açık rıza) is required, it is requested separately and clearly. This Policy and the Disclosure Notice below do not themselves constitute consent.

Under KVKK, the data controller is Lika Yazılım.

Contact: email info@likayazilim.com — phone +90 501 618 32 08.

This text does not invent registry details such as Ltd./Inc. suffixes, postal address, tax ID (VKN), MERSIS, KEP, or VERBIS numbers. Treat such details as unpublished unless officially announced. See the contact section for current channels.

This Policy applies to (i) registered users and guest (account-free) visitors of the Raf Gezgini mobile app and API, (ii) household members and shared-list participants, and (iii) visitors of the rafgezgini.com website.

Authentication via LikaHesabım (account.likayazilim.com) OIDC may also be subject to LikaHesabım’s own privacy and terms. Data processed by Raf Gezgini and data processed independently by LikaHesabım may be functionally distinct; transfers are described in the relevant sections.

Third-party websites, store pages, or external apps are outside this Policy.

Categories of personal data depend on the features you use and the information you provide. Typical categories include:

• Identity and account: identifiers and profile fields received via LikaHesabım, user IDs, display name (to the extent provided).
• Contact: email or other details you share in support requests.
• Household and lists: memberships, invitations, personal/shared shopping lists and list items.
• Messaging: in-household message text and related metadata; temporary message images.
• Content: photos and images you upload.
• Contributions: store, product, barcode, price observation and similar catalog inputs.
• Location: device location to show nearby stores (where you grant permission).
• Device and push: FCM device tokens and notification preferences.
• Technical: IP address, device/app version, request timestamps, security and error logs.
• Website: no cookies; localStorage keys for theme and locale (raf-gezgini-theme, raf-gezgini-locale).

Data may be collected when you use the app, submit information via forms or support channels, sign in with LikaHesabım, grant device permissions (location, notifications, media), and through automated technical logging.

Guests may browse the catalog without an account; processing is then limited to technical and usage data needed for that functionality.

For geocoding/maps, the device may call third-party services such as OpenStreetMap Nominatim; those requests may go from your device to the relevant service.

Personal data are processed primarily for the following purposes:

• Providing the service: catalog, lists, household, messaging, photos, and contributions.
• Authentication and session management (LikaHesabım OIDC and sessions of about 30 days).
• Location-based features to show nearby stores.
• Delivering optional push notifications.
• Security, abuse prevention, troubleshooting, and continuity of service.
• Responding to user requests, support, and KVKK applications.
• Complying with legal obligations.
• Remembering theme and language on the website (localStorage).

Under KVKK Article 5, personal data may not, as a rule, be processed without the data subject’s explicit consent; however, processing without consent is possible in the cases listed in Art. 5/2. Typical mappings for Raf Gezgini activities are below. Each processing activity is assessed in light of the data and context.

• Art. 5/2-c (processing of the parties’ personal data is necessary provided that it is directly related to the establishment or performance of a contract): delivering the service to registered users, household/list/messaging features, maintaining sessions.
• Art. 5/2-ç (mandatory for the controller to fulfil a legal obligation): legal retention, responses to authorities, and similar duties.
• Art. 5/2-e (mandatory for the establishment, exercise, or protection of a right): disputes, abuse claims, or legal claims.
• Art. 5/2-f (mandatory for the legitimate interests of the controller, provided that it does not harm the data subject’s fundamental rights and freedoms): information security, fraud/abuse prevention, service quality and technical logging (subject to proportionality).
• Explicit consent (Art. 5/1): activities that legally require consent or are based on consent (e.g. certain optional notification or location uses when a separate approval mechanism is offered) — consent is obtained separately from the information notice and is withdrawable.

Special categories of personal data are additionally governed by KVKK Art. 6; see the dedicated section.

Raf Gezgini does not aim to request or process special categories of personal data within the meaning of KVKK Art. 6 (such as health, biometric, religion, race, or political opinions).

If users voluntarily write such data into messages, photos, or free-text fields, that content may be processed as part of technical delivery of the service. Sharing such data is discouraged. Unless statutory conditions apply, processing of special categories is assessed under Art. 6.

Location data may be processed, within your device permissions, to show nearby stores and support location-based discovery.

If you deny location permission, related features may be limited or unavailable; other parts of the catalog may still work for guest or signed-in use.

When the device calls geolocation services such as OpenStreetMap Nominatim, those providers’ own privacy practices may also apply.

Full-featured use requires sign-in via LikaHesabım OIDC (account.likayazilim.com). Some account credentials are held by LikaHesabım; Raf Gezgini receives and processes identity/profile data needed for sessions and service delivery.

Sessions may be configured to remain valid for about 30 days. You can revoke a session in the app; there is no self-service account-deletion API. Requests to delete an account or personal data must be sent by email under the KVKK application procedure.

Household creation, member invitations, shared and personal shopping lists and list items are processed to coordinate shopping among members.

Other household members may see data related to you within membership and shared list content. Household administration and membership changes follow the app’s features.

Household messaging is offered for shopping coordination rather than as a general-purpose chat app. Message text and related metadata are stored to provide the feature.

No automatic timed purge policy has been identified for message text; retention is assessed against purpose and legal requirements. Temporary images attached to messages are cleaned after about 24 hours.

Users may upload photos to show shelves/products, as message attachments, or as contributions. Uploaded images are processed and stored on the server as needed for the feature.

An S3-style storage path is scaffolded, but uploads currently use local disk. If infrastructure changes, this Policy will be updated.

Do not upload images of others or unlawful content without a lawful basis.

Users may submit stores, products, barcodes, and price observations. These contributions are processed to enrich the catalog and inform other users.

Contribution data may become part of catalog content visible to the public or a broad user base. Do not submit misleading or unlawful contributions.

Optional push notifications may use Firebase Cloud Messaging (FCM / Google). Device tokens and notification preferences may be processed for this purpose.

You may disable notifications in device or app settings; doing so may not affect core service delivery in every case.

IP address, request metadata, device/app information, and similar technical records may be kept for security, performance, troubleshooting, and abuse prevention.

Such records are retained for periods appropriate to the purpose, under legitimate interests and/or legal obligations, and with proportionality.

Your personal data may be disclosed or made accessible, to the extent necessary and on lawful grounds, to:

• Household members and shared-list participants (within shared content).
• LikaHesabım / authentication infrastructure.
• Notification infrastructure providers (e.g. FCM / Google).
• Geo / map services (e.g. OpenStreetMap Nominatim — device-originated requests).
• Authorised hosting, storage, and operations providers (as processors).
• Competent public authorities and judicial/administrative bodies where legally required.

Lika Yazılım may use technical service providers (processors) to operate Raf Gezgini. Processors should act only on instructions and for the stated purposes under contracts.

Notable third-party components: LikaHesabım (OIDC), Firebase/FCM (Google), OpenStreetMap Nominatim (from the device). The website itself does not use analytics cookies.

Under KVKK Article 9 (post-2024 regime), transfers of personal data abroad are subject first to adequacy (countries or Board adequacy decisions offering sufficient protection), failing which to appropriate safeguards (such as Board-approved undertakings / standard contracts, binding corporate rules, or other safeguards provided by law), and then to limited exceptional cases.

The former “consent-first for every transfer” model does not replace the current Art. 9 framework. Transfers occur only where a processing ground under KVKK Art. 5 or 6 exists and an Art. 9 transfer path applies.

Honest disclosure: FCM/Google and LikaHesabım infrastructures may involve transmission to or access from systems outside Türkiye by nature of the service. OpenStreetMap Nominatim requests may leave your device toward that infrastructure. The concrete transfer path depends on the provider’s location and safeguards.

Known or configured periods:

• Sessions: about 30 days.
• Temporary images attached to messages: cleaned after about 24 hours.
• Message text: no automatic timed purge policy has been identified; assessed by purpose and legal needs.
• Website localStorage preferences: may remain until you clear them in the browser.

Fixed multi-year periods are not invented for other categories. Data are kept for as long as required for the processing purpose and any legal retention duties; when the purpose ends, they are deleted, destroyed, or anonymised under KVKK Art. 7.

Under KVKK Art. 7, when the conditions for processing cease, personal data are deleted, destroyed, or anonymised ex officio or upon request.

There is no in-app self-service account-deletion API or end-to-end “delete account” flow; session revoke is available. Requests concerning account or personal-data deletion must be sent to info@likayazilim.com with a verifiable KVKK application.

Some records may be kept for a limited time due to legal retention, disputes, or security needs.

Lika Yazılım endeavours to take appropriate technical and organisational measures to prevent unlawful processing and access and to ensure safekeeping of personal data (KVKK Art. 12).

No system can promise absolute security. If you suspect unauthorised access, contact us promptly and review your account/session security.

As a data subject under KVKK Article 11, you have the right to:

• Learn whether your personal data are processed,
• Request information if they have been processed,
• Learn the purpose of processing and whether it is used in line with that purpose,
• Know the third parties in Türkiye or abroad to whom data are transferred,
• Request rectification if processed incompletely or inaccurately,
• Request deletion or destruction under KVKK Art. 7,
• Request that rectification / deletion / destruction be notified to third parties to whom data were transferred,
• Object to a result against you arising from analysis of processed data exclusively by automated systems,
• Claim compensation if you suffer damage due to unlawful processing,

These rights apply as set out in KVKK.

Under KVKK Art. 13 and the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit applications in Turkish with information sufficient to verify your identity.

Channel: info@likayazilim.com. Applications should include name-surname, Turkish ID number (or nationality and passport/ID number for foreigners), address for notices, email/phone if any, and the subject of the request. Further identity verification may be requested.

The controller concludes requests as soon as possible and within thirty (30) days at the latest, free of charge. If the process entails an additional cost, the fee set in the Communiqué may apply. KVKK Art. 13 does not contain a GDPR-style general one-time 30-day extension; the statutory period is thirty days.

If the application is refused, the reply is insufficient, or no reply is given in time, you may complain to the Board under KVKK Art. 14.

Raf Gezgini is not designed as a service directed at children. Collection of children’s personal data without parental/guardian authority is not intended.

If you believe a child’s data have been processed, notify info@likayazilim.com for assessment.

If commercial electronic messages are sent under Law No. 6563 on the Regulation of Electronic Commerce and related rules, required approvals are obtained and an opt-out is offered.

Mandatory/transactional service notices (security, service status, household invitations, etc.) may be assessed separately from commercial messaging rules.

The rafgezgini.com website does not use cookies. There are no analytics or advertising cookies.

Theme and language preferences use browser localStorage keys: raf-gezgini-theme and raf-gezgini-locale. You may clear them in browser settings.

The mobile app and API may use technical identifiers for session, security, and functionality; those are distinct from the website’s zero-cookie approach.

The app or site may contain third-party links (store pages, external sites, etc.). Lika Yazılım is not responsible for those sites’ privacy practices; review their policies.

This Policy may be updated. The current version is published on the legal pages at rafgezgini.com with a “last updated” date.

Material changes may be communicated by reasonable means. Continued use after changes may mean acceptance of the then-current Policy; cases that legally require fresh consent remain reserved.

For privacy and KVKK requests: Lika Yazılım — info@likayazilim.com — +90 501 618 32 08.

Brand: Raf Gezgini. Web: rafgezgini.com.

This section is a separate Disclosure Notice (Aydınlatma Metni) prepared under the KVKK Art. 10 duty to inform. Disclosure is distinct from explicit consent; where consent is required, it is obtained separately and clearly.

Controller: Lika Yazılım. Contact: info@likayazilim.com / +90 501 618 32 08. Registry details (address, VKN, MERSIS, KEP, VERBIS, etc.) are not invented in this text.

Categories: identity/account and session data; contact; household and lists; messages and temporary images; photos; store/product/price contributions; location (if permitted); FCM device data; technical logs; website localStorage preferences.

Purposes: service delivery; authentication and sessions; location-based discovery; push notifications; security and abuse prevention; support and KVKK applications; legal obligations; theme/locale preference.

Collection methods: app/API use, LikaHesabım OIDC, device permissions, support channels, automated technical logs, guest catalog browsing, device Nominatim requests.

Legal grounds (by activity, summary): contract performance (Art. 5/2-c) — signed-in service, household/lists/messaging; legal obligation (Art. 5/2-ç); establishment/protection of a right (Art. 5/2-e); legitimate interests (Art. 5/2-f) — security and logs (proportionate); explicit consent (Art. 5/1) — optional consent-based activities. Special categories: Art. 6.

Recipients / transfer purposes: household members (sharing); LikaHesabım (auth); FCM/Google (notifications); OSM Nominatim (geo queries); technical providers; authorities. Cross-border transfers under KVKK Art. 9 (2024+) — adequacy / appropriate safeguards / limited exceptions — together with Art. 5/6 grounds.

Data-subject rights: the full Art. 11 list (learn, request information, purpose, transfers, rectification, deletion/destruction, notify third parties, object to solely automated analysis, claim compensation).

Application: Turkish, verifiable application to info@likayazilim.com including Communiqué elements; conclusion within 30 days (KVKK Art. 13).

This Disclosure Notice is informational; it is not an explicit-consent declaration.

You can delete your Raf Gezgini account from the mobile app settings or at rafgezgini.com/en/account-delete.

When you request deletion, a 15-day grace period begins. If you sign in to Raf Gezgini again with LikaHesabım during this period, the deletion request is automatically cancelled without extra confirmation.

After 15 days, your Raf Gezgini account and associated personal data are deleted or anonymized. Messages in household chats may be retained for community integrity; sender information is anonymized so it is no longer personally identifiable.

Your LikaHesabım account is not affected by this process and no deletion request is sent to LikaHesabım.

Limited records required by law, dispute resolution, or security may be retained for the period required by applicable law, without personally identifiable information.