Privacy Policy (KVKK)
Version: 2.0 · Last updated: 29 October 2026
Note: This English version is provided for convenience. The Turkish version, Gizlilik Politikası ve Aydınlatma Metni, is authoritative under Turkish law (KVKK) in case of any conflict.
1. Data Controller
Under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by the team operating the "Dipnot" application as data controller, within the scope described below.
- Data Controller: Dipnot Team (co-founders)
- Contact email: info@dipnot.app
2. Personal Data Collected, Purposes of Processing, and Legal Basis
When you register for and use the Dipnot application and the dipnot.app website, the following data is processed:
| Data Category | Data Collected | Purpose of Processing | Legal Basis (KVKK art. 5) |
|---|---|---|---|
| Identity | First name, Last name | Account creation, identifying users, personalising profiles | Establishing and performing the contract |
| Contact | Email address | Account verification (email verification), password reset, sending notifications, communicating with the user | Establishing and performing the contract |
| Usage Data | Articles read and reading time, likes, saved content, session durations | Content recommendations, improving the experience, trend analysis, guiding the app's development | Legitimate interest |
| Technical Data | Device and app information (e.g. device model, operating system and app version, install ID), IP address | Ensuring the app works, debugging, security, preventing abuse | Legitimate interest |
| Competition Data | The list of dive centres you voted for | Recording competition participation, preventing more than one vote for the same centre, computing the results | Legitimate interest |
| Account Security Data | A non-reversible digest derived from your e-mail address | Preventing several accounts on one inbox and sign-ups with disposable addresses | Legitimate interest |
| Newsletter | Email address | Sending the newsletter | Explicit consent |
| Contact Form | Name, email, subject, message; IP address and browser information | Answering your message; preventing abuse and spam | Legitimate interest |
Competition. Participation is optional. Results are published only as total vote counts per dive centre; which user voted for which centre is never disclosed publicly and is never shared with dive centres. To detect cheating, your vote records, together with your account, in-app activity and device information, may be reviewed and compared with other accounts by Dipnot team members holding an administrator role only. That processing rests on our legitimate interest in a fair outcome (KVKK art. 5/2-f). These records are kept for 3 months after the winner is announced, even if you delete your account. Details: clause 10 of the Competition Rules (Turkish).
One account per inbox. To prevent several accounts on one inbox and sign-ups with disposable addresses, a non-reversible digest of your e-mail address is kept. The digest does not contain your address itself, but can be matched with the same address. This processing relies on our legitimate interest in preventing abuse and keeping the competition fair (KVKK art. 5/2-f). The digest is deleted when the last account on that inbox is deleted; it is kept only in the deletion record in section 5, for the period stated there.
Usage statistics. To see how the app is used and to guide its development, your usage data is processed by our analytics service. It is held under a pseudonymous identifier assigned to your device, not under your name or email address. It is not used for advertising and is not shared with ad networks.
Website and cookies. Only if you choose "Accept" in the cookie notice, dipnot.app runs our analytics service (Google Analytics) to measure, in aggregate, how the site is used. Your browser then stores the first-party cookies _ga and _ga_<id> (up to 2 years). Data collected includes a pseudonymous client ID, pages viewed and on-page interactions, the referring address, browser and device type, and approximate location derived from your IP address. This processing is based on your explicit consent. If you choose "Reject", the analytics service is not loaded. You can change your choice at any time via the "Cookie preferences" link at the foot of every page; withdrawing consent stops collection and deletes these cookies.
Account deletion pages. When you open the Account Deletion and deletion confirmation pages, Google reCAPTCHA runs to protect the form against bots. Google stores a third-party security cookie named _GRECAPTCHA (180 days) in your browser, and verification entries in browser storage. These are required for the site's security, so they do not depend on your consent; they rely on our legitimate interest in preventing abuse (KVKK art. 5/2-f).
3. Third Parties and Cross-Border Transfers
Your personal data is shared only with the service providers below, for the purposes listed. Elsewhere in this policy these services are referred to by general names such as "our database", "our servers" and "our analytics service".
| Service Provider | What For | Server Location |
|---|---|---|
| Google Firebase and Google Cloud (Google LLC) | Authentication, database, file storage, server functions, push notifications | European Union |
| Google Analytics (Google LLC) | App and website usage statistics | USA |
| Expo (Expo Application Services, Inc.) | Delivering push notifications, app updates, error and stability monitoring | USA |
| Brevo (Sendinblue SAS) | The confirmation email for an account-deletion request | European Union (USA and India through sub-processors) |
| Google reCAPTCHA Enterprise, Apple App Attest, Google Play Integrity | Verifying that requests come from the genuine app and site; bot and abuse protection | USA |
Bot and abuse protection. The verification services process technical information about the integrity of your device, the app or your browser, and interaction signals on the website, to confirm that requests come from the genuine app and site. This verification does not identify you as a Dipnot user. This processing is based on our legitimate interest in preventing abuse (KVKK art. 5/2-f).
Because our service providers' servers are located abroad (European Union and USA), your personal data is transferred abroad. These transfers are carried out under KVKK article 9.
4. Method of Collection and Legal Basis
Your personal data is obtained when the Dipnot registration form is filled in, through in-app interactions, through the forms on dipnot.app, and via automatic collection of technical data. Our processing activities rely on the following legal bases set out in KVKK article 5:
- Establishing and performing the contract (the identity and contact information your account needs)
- Explicit consent (for the newsletter, push notifications, website analytics cookies)
- Legitimate interest (for analysis of usage and technical data, preventing abuse, the contact form, running the competition and detecting cheating)
- Legal obligation and the protection of rights (for the deletion record in section 5)
5. Retention Period
Your personal data is kept for as long as your account is open.
Deleting your account. You can delete your account in the app or on the Account Deletion page. Your account is closed at once. Within 30 days you can reopen it by signing in to the app. At the end of the 30 days your data is erased or anonymised.
What is kept after deletion. Once your account is deleted, the following is kept:
- Deletion record. A minimal record proving that your account was deleted and which text versions you had accepted. It contains a digest derived from your email address, not the address itself, so that a possible complaint can be matched to the record. It is accessible to authorised team members only and is deleted 5 years after the deletion. It relies on KVKK art. 5/2-ç (the obligation to log deletion operations) and art. 5/2-e (protecting our rights in a possible complaint or dispute).
- Usage statistics. Data in our analytics service is held under a pseudonymous identifier, so it is not deleted with your account. It is deleted 14 months after your last activity.
- Competition records. Records taken to detect cheating are kept for 3 months after the winner is announced, under clause 10 of the Competition Rules (Turkish).
- Backups and technical logs. Deleted within 30 days at the latest.
Other data that must be retained due to legal obligations is kept for the periods specified in the relevant legislation.
6. Data Subject Rights (KVKK art. 11)
Under KVKK article 11 you have the following rights:
- To learn whether your personal data is being processed
- To request information if it has been processed
- To learn the purpose of processing and whether it is used for its intended purpose
- To know the third parties to whom data has been transferred domestically or abroad
- To request correction if data has been processed incompletely or incorrectly
- To request deletion or destruction under the conditions set out in KVKK article 7
- To request that the above correction and deletion actions be communicated to third parties to whom data has been transferred
- To object to an outcome adverse to you resulting from analysis of processed data solely by automated systems
- To claim compensation for damage suffered due to unlawful processing
Write to us first. To exercise these rights, write to info@dipnot.app with information sufficient to verify your identity. We take every request seriously and answer it free of charge within 30 days at the latest (KVKK art. 13).
If it isn't resolved. If your request is refused, you find our answer insufficient, or you receive no answer within 30 days, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning our answer, and in any case within 60 days of your request (KVKK art. 14). Your right to go to court is reserved.
To delete your account and data without signing into the app, you can also use the form on the Account Deletion page.
7. Advertising and Marketing Emails
Dipnot does not currently use any advertising network. If we wish to send informational emails about product updates, new features, or special offers in the future, we will ask for your explicit consent separately. You can give this consent at registration or from the settings screen, and withdraw it at any time.
8. Children's Data
Dipnot does not knowingly or intentionally collect personal data of individuals under 18 years of age. Use of the application by children without parental supervision is not recommended.
9. Changes
This Privacy Policy may be updated as needed. Updates that change the purposes or legal bases for which your data is processed, who it is transferred to, or your rights are announced in the Dipnot app, and the current text is shown to you; you are asked to state that you have read and understood it before you can continue using the app. Every such update is listed with its date on the Change History page and raises the version number (for example 2.0 → 3.0). Updates that are only in your favour take effect without being shown to you separately, are listed on the same page, and raise the second digit (for example 2.0 → 2.1). For wording, spelling and layout fixes only the update date changes.
Changes to this text: Change History