Privacy Policy
Wibto ("we," "us," or "our") is a territory-conquest running application operated by Serhan Emre Telatar. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use the Wibto mobile application (the "App") and associated backend services (collectively, the "Service").
This Privacy Policy applies to all users worldwide and has been prepared in compliance with the European Union General Data Protection Regulation (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR), the Turkish Personal Data Protection Law No. 6698 (KVKK), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and other applicable data protection laws.
By creating an account or using the Service, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.
1. Data Controller
The data controller responsible for processing your personal data is:
Serhan Emre Telatar
Email: privacy@wibto.com
For KVKK purposes, the data controller (veri sorumlusu) is Serhan Emre Telatar. For GDPR purposes, the data controller is the same individual. Wibto does not currently have an EU/UK representative appointed under Article 27 GDPR; one will be designated if required by regulatory guidance.
2. Data We Collect
2.1 Data You Provide Directly
| Data Category | Specific Data | Purpose |
|---|---|---|
| Identity Data | First name, last name, username (3–30 chars) | Account creation, public profile display, leaderboard identification |
| Contact Data | Email address | Account authentication, verification codes, password reset, service communications |
| Demographic Data | Date of birth (full date, ISO 8601), gender (male/female/other/prefer not to say) | Age-appropriate content, leaderboard filtering, performance analysis. Not displayed on your public profile. |
| Preference Data | Selected activities (up to 10), fitness goals (up to 20), fitness level (beginner/intermediate/advanced) | Personalization of app experience |
| Profile Content | Profile photo (JPEG, 0.8 compression), display location (free text, max 100 chars) | Public profile display |
| User-Generated Content | Run names, territory names, squad names, challenge titles | Service functionality, social features |
| Authentication Credentials | Password (8–128 chars, hashed by Firebase Auth) | Secure account access. We never store your password in plaintext. |
2.2 Data Collected Automatically
| Data Category | Specific Data | Purpose |
|---|---|---|
| Precise Location Data | GPS coordinates (latitude/longitude at ~7 decimal places / ~1 cm precision), collected continuously during runs with 5-meter distance filter | Core functionality: run route tracking, territory boundary creation, conquest calculations |
| Walk Data (Auto Conquest, Wibto Pro, optional) | Only if you turn on Auto Conquest for the day. Your device's motion activity detection (Core Motion on iOS, Activity Recognition on Android) is used on the device to tell when you are walking, and GPS coordinates with timestamps and accuracy are recorded while you walk. Motion activity data never leaves your device. Walk routes are stored only on your device until you choose to collect them; walks you do not collect are deleted from your device after 7 days. When you collect a walk, its route is sent to our servers. On iPhone, if you also turn on automatic start, Wibto uses your location in the background, even when the app is closed, only to detect and record walks; this requires “Always” location permission, is explained in the app before you grant it, and can be turned off at any time. You can set up to three privacy zones on your device; nothing is recorded inside them, and they are never sent to us. | Core functionality: turning walks you choose to collect into unclaimed territory hexes; detecting simulated locations and vehicle travel |
| Fitness & Activity Data | Run duration (seconds), distance (km), calories burned, area captured (km²), run path coordinates (up to 5,000 points per run), territory boundary polygons (up to 1,000 vertices) | Core functionality: territory conquest, leaderboard ranking, achievement evaluation, analytics |
| Workouts written to Apple Health / Health Connect (Wibto Pro, optional) | Only if you turn this on and grant permission. Each run is written to Apple Health (iOS) or Health Connect (Android) on your device as a running workout with its duration, distance, active calories burned and, where you allow it, its route. Wibto only writes this data; it never reads anything from Apple Health or Health Connect. See Section 4.4. | Letting you keep your runs alongside your other workouts in the health app of your choice |
| Device & Technical Data | Firebase User ID (UID), Firebase Cloud Messaging (FCM) device token | Account management, push notification delivery |
| Crash & Diagnostic Data (Android) | Crash reports and a small set of non-fatal error reports from release builds of the Android app, collected by Firebase Crashlytics: stack trace, device model, OS version, app version and an installation identifier. No user ID, email or location is attached. | Finding and fixing crashes and errors |
| Usage Analytics | App events: sign-up method, login, logout, run started/completed, territory captured, profile viewed, screens visited, the fact that a user search was made (the search text itself is never sent). Tracked via PostHog (EU-hosted) and Google Analytics for Firebase, which also records an app instance ID, device model, OS version and app version. | Product improvement, feature usage analysis, error diagnostics |
| Invite Data | Only if you join through a friend’s invite (a duel link, a squad or league code, or a profile link) within 7 days of signing up: who invited you, which kind of invite it was and when. On Android, the invite reaches the app after installation through the Google Play install referrer. On iPhone, after you sign up the app can open an invite link you copied; it reads your clipboard only when you tap Paste, only on your device, and sends us nothing but the Wibto link it finds. For duel links we also store who created the link, its duration, when it expires and who accepted it. | Starting duels from shared links; crediting the person who invited you; the invite reward (7 days of Wibto Pro for both of you once you capture your first hexagon, limited to 10 rewards per inviter per month) |
| Derived Data | Total runs, total area captured, total distance, achievement progress, leaderboard rank, streak data, personal bests | Gamification, competitive features, user statistics |
2.3 Data We Do NOT Collect
We do not collect: advertising identifiers (IDFA/GAID), any data read from Apple Health (HealthKit), Health Connect or Google Fit (the optional health integration only writes your runs, see Section 4.4), contacts, calendar data, call logs, SMS content, microphone audio, clipboard content (apart from the invite link you choose to paste, see Invite Data in Section 2.2), browsing history, or data from other apps on your device. The mobile app does not use cookies (it is a native app with a REST API backend). Our website, wibto.com, uses analytics cookies only if you accept them — see Section 2.4.
2.4 Our Website (wibto.com)
Our website uses Google Analytics 4 (Google LLC) to understand how visitors find and use the site, for example which pages are viewed and how many people tap the App Store button. Analytics cookies are only set after you choose "Accept" in the cookie notice; if you choose "Decline" or make no choice, no analytics cookies are stored and Google receives only cookieless, aggregated signals under Google Consent Mode. We do not use the website for advertising or sell this data. To change your choice, clear this site's data in your browser and the notice will appear again. Website analytics data is retained for 14 months. On a duel invite page (wibto.com/duel/…), tapping the App Store badge or Copy link puts the duel link on your device’s clipboard so you can paste it into the app after installing; the website does not send it anywhere.
3. Legal Bases for Processing
We process your personal data on the following legal bases under GDPR Article 6(1) and KVKK Article 5(2):
| Processing Activity | GDPR Legal Basis | KVKK Legal Basis |
|---|---|---|
| Account creation and authentication | Performance of contract (Art. 6(1)(b)) | Necessary for contract performance (Art. 5(2)(c)) |
| GPS tracking during runs and territory creation | Performance of contract (Art. 6(1)(b)) | Necessary for contract performance (Art. 5(2)(c)) |
| Push notifications for attacks and challenges | Legitimate interest (Art. 6(1)(f)) | Legitimate interest of data controller (Art. 5(2)(f)) |
| Leaderboard ranking and public profile | Performance of contract (Art. 6(1)(b)) | Necessary for contract performance (Art. 5(2)(c)) |
| Analytics (PostHog and Google Analytics for Firebase, anonymized events) | Legitimate interest (Art. 6(1)(f)) | Legitimate interest of data controller (Art. 5(2)(f)) |
| Crash reporting (Firebase Crashlytics, Android) | Legitimate interest (Art. 6(1)(f)) | Legitimate interest of data controller (Art. 5(2)(f)) |
| Writing your runs to Apple Health / Health Connect | Consent (Art. 6(1)(a) and Art. 9(2)(a)), given by turning the feature on and granting permission | Explicit consent (Art. 6(2)) |
| Invite links, invite attribution and invite rewards | Legitimate interest (Art. 6(1)(f)) | Legitimate interest of data controller (Art. 5(2)(f)) |
| Email verification and password reset | Performance of contract (Art. 6(1)(b)) | Necessary for contract performance (Art. 5(2)(c)) |
| Subscription management via the Apple App Store (StoreKit) and Google Play Billing | Performance of contract (Art. 6(1)(b)) | Necessary for contract performance (Art. 5(2)(c)) |
| Fraud/cheating prevention and security | Legitimate interest (Art. 6(1)(f)) | Legitimate interest of data controller (Art. 5(2)(f)) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) | Obligation prescribed by law (Art. 5(2)(a)) |
4. How We Use Your Data
4.1 Core Service Delivery
We use your GPS location data, run metrics, and profile information to provide the core Wibto experience: recording your runs, creating territory polygons from your GPS paths, calculating territory conquests when your territory overlaps another user's territory (using a 90% overlap threshold for full conquest), ranking users on leaderboards by total area captured, evaluating achievement progress, and enabling competitive features such as 1v1 challenges and squad competitions. If you use Auto Conquest (Wibto Pro), we use the walk routes you choose to collect to add the empty hexagons they pass through to your territory. The first and last 150 meters of every walk are discarded before this, so the start and end of your walk (for example, your home) never become territory, and stretches faster than a jog are discarded as vehicle travel.
4.2 Automated Decision-Making & Profiling
We engage in the following automated processing:
Leaderboard Ranking: Your total area captured and distance are aggregated monthly to rank you against other users. You may opt out of public leaderboards via Settings > Privacy > Show on Leaderboard.
Territory Conquest: When a new territory polygon encloses 90% or more of an existing territory, the system automatically transfers ownership. Partial overlaps result in geometric clipping of the original territory. These calculations are deterministic and based solely on geographic geometry.
Achievement Evaluation: After each run, the server evaluates your cumulative statistics against predefined thresholds (e.g., total distance, total runs, streak length) to unlock achievement badges. This is purely threshold-based with no subjective scoring.
You have the right to object to automated decision-making and to request human review under GDPR Article 22 and KVKK Article 11(1)(g). Contact us at privacy@wibto.com to exercise this right.
4.3 Analytics
We use PostHog (hosted in the European Union at eu.i.posthog.com) to track anonymized usage events. Events include sign-up method, run completion metrics (duration, distance, calories, sectors captured, area), screen views, and error contexts. We intentionally exclude error messages from analytics events to prevent accidental personal data leakage. You are identified in PostHog by your Firebase UID and username only.
The iOS and Android apps also send the same events to Google Analytics for Firebase (Google LLC), which gives us aggregate reports such as daily active users and retention. Google Analytics for Firebase receives your Firebase UID (not your username, email or name) and a random app instance ID that it generates on your device. It does not receive advertising identifiers: the apps are built without IDFA support on iOS and with the Android advertising ID disabled, and ad personalization signals are turned off. Your precise GPS location, routes and territory cells are never sent to either analytics provider. The app instance ID is reset when you sign out.
Release builds of the Android app also use Firebase Crashlytics (Google LLC) to report crashes and a small number of non-fatal errors, such as a run the server could not accept. These reports contain technical information only (stack trace, device model, OS and app version, an installation identifier) and are not linked to your account.
4.4 Apple Health and Health Connect
Wibto Pro can save your runs to Apple Health on iPhone or to Health Connect on Android. This is off by default. It starts only when you turn it on in Settings and grant permission in the system dialog, and you can turn it off or revoke the permission at any time in Wibto's Settings, in the Health app (iOS) or in Health Connect's settings (Android).
What Wibto writes: after each run you save, a running workout with its start and end time, distance, active calories burned and, where you have allowed it, its route. On Android these are written as Health Connect exercise session, distance and active calories burned records.
What Wibto reads: nothing. Wibto does not request read access to Apple Health or Health Connect and never reads, collects or uploads data from them.
Where it goes: the data written to Apple Health or Health Connect stays on your device, under the control of those apps. Writing it sends nothing to our servers or to any third party. The same run is stored on our servers only as part of your normal Wibto run history (Section 2.2), whether or not this feature is on.
What we never do: we do not use health data for advertising, we do not sell it or transfer it to data brokers, and we do not use it to determine credit-worthiness or for any purpose unrelated to the feature described above. Wibto's use of Health Connect follows Google Play's Android health permissions requirements, including their data minimization and use restrictions.
Workouts already written stay in Apple Health or Health Connect if you turn the feature off or delete your Wibto account; you can delete them there.
5. Data Sharing and Third-Party Services
We share your personal data with the following categories of recipients, solely for the purposes described:
| Service Provider | Data Shared | Purpose | Data Location |
|---|---|---|---|
| Google Firebase Authentication | Email, password (hashed), UID, display name | Identity management, secure authentication | Global (Google-managed infrastructure) |
| Google Cloud Firestore | All user data, runs, territories, achievements, leaderboards | Primary database storage | europe-west1 (Belgium) |
| Google Firebase Cloud Messaging | FCM device token, notification payloads | Push notification delivery for attack alerts and challenges | Global (Google-managed) |
| Google Firebase Storage | Profile photos, squad photos | Image storage for user-uploaded content | Configured via project settings |
| Google Cloud Pub/Sub | Territory ID, user ID, boundary coordinates, timestamps | Asynchronous territory conquest processing | europe-west1 (Belgium) |
| Mapbox | Map tile requests containing visible region coordinates, access token. Mapbox telemetry (usage and location data Mapbox would otherwise collect for its own purposes) is turned off in the apps. | Map rendering and territory visualization | Global (Mapbox infrastructure) |
| PostHog | Firebase UID, username, anonymized usage events | Product analytics | EU (eu.i.posthog.com) |
| Google Analytics for Firebase | Firebase UID, app instance ID, anonymized usage events, device model, OS and app version | App usage analytics (active users, retention) | Global (Google infrastructure) |
| Google Firebase Crashlytics (Android) | Crash and error reports: stack trace, device model, OS and app version, installation identifier | App stability and error diagnostics | Global (Google infrastructure) |
| SMTP Email Provider | Email address, verification/reset codes | Email delivery for OTP and password reset | Configured via environment variables |
| Apple App Store / StoreKit | Purchase receipts, subscription status | In-app purchase processing and validation | Global (Apple infrastructure) |
| Google Play Billing | Purchase token, product ID, subscription status (payment details are handled by Google Play and never reach us) | In-app subscription processing and server-side validation on Android | Global (Google infrastructure) |
| Google Sign-In | Google OAuth token, profile data (name, email) | Social login authentication | Global (Google infrastructure) |
| Apple Sign-In | Apple ID token, authorized scopes | Social login authentication | Global (Apple infrastructure) |
We do not sell your personal data. We do not share your data with advertising networks, data brokers, or any third party for marketing purposes. We do not engage in cross-app tracking.
6. Data Visible to Other Users
The following data may be visible to other Wibto users depending on your privacy settings:
| Data | Visibility | Your Control |
|---|---|---|
| Username | Always visible if profile is public | Toggle: Settings > Privacy > Public Profile |
| Display location | Visible on public profile and leaderboard entries | Editable in profile; toggle profile visibility |
| Profile photo | Visible on public profile | Optional; removable |
| Total area captured, total runs, total distance | Visible on public profile and leaderboard | Toggle: Show on Leaderboard |
| Territory polygons on map | Visible to all authenticated users on the global map | Cannot be hidden individually; territories are a core feature |
| Run paths | Optionally visible on your profile | Toggle: Settings > Privacy > Share Run Path |
| Walk routes (Auto Conquest) | Never shown to other users. Hexagons captured from a walk appear on the map like any other territory | Auto Conquest is off unless you turn it on for the day; uncollected walks can be deleted in the app |
| Leaderboard rank and stats | Visible if opted in | Toggle: Settings > Privacy > Show on Leaderboard |
| That you joined through an invite | The person who invited you gets a notification with your username when you capture your first hexagon; whoever accepts your duel link sees your username and profile photo | Don’t open an invite you don’t want credited; block a user to stop their notifications about you |
| Squad membership | Visible to squad members and via squad leaderboard | Leave squad to remove |
Important: Your date of birth and gender are never displayed on your public profile or shared with other users.
7. Data Retention
| Data Category | Retention Period | Basis |
|---|---|---|
| User account data | Retained until you request account deletion | Contract performance |
| Run records and GPS paths | Retained indefinitely until account deletion | Contract performance; historical leaderboard integrity |
| Invite records | Who invited you is retained until your account is deleted; if the inviter deletes their account, their name is removed from yours. Duel invite links stop working after 7 days or once used, and are deleted together with the account of the person who created or accepted them | Contract performance; preventing abuse of the invite reward |
| Collected walk routes (Auto Conquest) | Route coordinates are deleted from our servers 30 days after you collect the walk; the walk summary (time, distance, hexagons captured) is retained until account deletion | Contract performance; fraud and cheating prevention during the 30-day review window |
| Territory data | Retained indefinitely; conquered territories marked as such | Core gameplay mechanic |
| Achievement progress | Retained until account deletion | Contract performance |
| Leaderboard snapshots | Monthly snapshots retained indefinitely. Note: historical snapshots may retain your username, avatar URL, and display location even after account deletion. | Legitimate interest in competition integrity |
| Follow relationships | Retained until account deletion. Note: follow records may persist after account deletion due to a known data retention gap. | Contract performance |
| Challenge history | Retained indefinitely | Competition records |
| Verification/reset codes | 10-minute expiry; deleted upon use | Security |
| FCM device tokens | Retained until overwritten by new token or account deletion | Push notification delivery |
| Analytics events (PostHog) | Governed by PostHog's data retention policies | Legitimate interest |
| Analytics events (Google Analytics for Firebase) | Up to 14 months | Legitimate interest |
| Crash reports (Firebase Crashlytics, Android) | 90 days | Legitimate interest |
| Firebase Auth records | Deleted upon account deletion via admin API | Contract performance |
| Cloud Functions logs | 30 days (Google Cloud Logging default) | Security, debugging |
We acknowledge that certain data (leaderboard snapshots, follow relationships, challenge history) may not be fully purged upon account deletion. We are working to improve our deletion cascades to address these gaps. If complete erasure of all traces is important to you, please contact us at privacy@wibto.com and we will perform a manual review.
8. International Data Transfers
Your personal data is primarily stored in Google Cloud's europe-west1 region (Belgium). However, certain data may be transferred to or processed in other jurisdictions:
Firebase Authentication: Identity data is processed on Google's global infrastructure, which may include servers in the United States.
Mapbox: Map tile requests are processed on Mapbox's global CDN infrastructure.
Apple services: StoreKit purchase validation and Apple Sign-In occur on Apple's global infrastructure.
Google Play: Google Play Billing purchase validation occurs on Google's global infrastructure.
Google Sign-In: OAuth token exchange occurs on Google's global infrastructure.
Google Analytics for Firebase and Firebase Crashlytics: App analytics events and Android crash reports are processed on Google's global infrastructure, which may include servers in the United States.
For transfers from the EU/EEA/UK to countries without an adequacy decision, we rely on the following safeguards:
Google LLC: EU-U.S. Data Privacy Framework certification and Standard Contractual Clauses (SCCs) per Google Cloud's data processing terms. Apple Inc.: Standard Contractual Clauses as part of Apple's developer agreements. Mapbox: Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework where applicable. PostHog: Data hosted in the EU (eu.i.posthog.com); no transfer outside the EU.
For KVKK purposes: Cross-border data transfers are conducted in accordance with KVKK Article 9, relying on adequate safeguards and, where required, explicit consent. The primary data storage location is within the EU, which is recognized by Turkey as providing an adequate level of protection.
9. Data Security
We implement the following technical and organizational security measures:
Transport Security: All data in transit is encrypted via TLS/HTTPS. The App implements SSL/TLS certificate pinning for API calls to api.wibto.com to prevent man-in-the-middle attacks. Firebase, Mapbox, Apple and Google Play services use their own TLS configurations.
Storage Security: All data at rest in Google Cloud Firestore and Firebase Storage is encrypted using AES-256, managed by Google's key management infrastructure. Passwords are hashed by Firebase Authentication and never stored in plaintext in our database. Sensitive tokens (Firebase ID tokens) are stored in the iOS Keychain with the kSecAttrAccessibleWhenUnlockedThisDeviceOnly access flag, meaning they are not backed up to iCloud or iTunes. On Android, they are stored in EncryptedSharedPreferences, encrypted with an AES-256 key held in the Android Keystore, and the app's data is excluded from Android backups.
Application Security: App Transport Security (ATS) is fully enabled with no exceptions on iOS, and the Android app's network security configuration forbids unencrypted (cleartext) traffic. Rate limiting is enforced on all API endpoints (200 requests per 15 minutes globally; 5 attempts per 15 minutes for authentication; 30 run submissions per hour). GPS data is filtered to reject readings with horizontal accuracy greater than 50 meters or speeds exceeding 12 m/s (approximately 43 km/h). Input validation is applied to all user-submitted data on both client and server sides.
Access Controls: Firestore security rules enforce default-deny access. Protected fields (totalArea, totalRuns, totalDistance) cannot be modified by client requests. Run records are readable only by their owner. Verification and password reset codes are inaccessible to clients. Administrative endpoints require a Firebase custom claim.
10. Your Rights
10.1 Under GDPR (EU/EEA/UK Residents)
- Right of Access (Article 15): Request a copy of all personal data we hold about you.
- Right to Rectification (Article 16): Update or correct inaccurate data via your profile settings or by contacting us.
- Right to Erasure (Article 17): Request deletion of your account and associated data. You can initiate this via Settings > Privacy > Delete Account, which schedules permanent deletion after a 30-day grace period.
- Right to Restriction (Article 18): Request that we limit processing of your data in certain circumstances.
- Right to Data Portability (Article 20): Export your run data in GPX format via Settings > Privacy > Export My Data.
- Right to Object (Article 21): Object to processing based on legitimate interests, including analytics and automated leaderboard ranking.
- Right Related to Automated Decision-Making (Article 22): Request human review of automated decisions (territory conquest, achievement evaluation, leaderboard ranking).
- Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
- Right to Lodge a Complaint: You may file a complaint with your local data protection authority.
10.2 Under KVKK (Turkish Residents)
Under KVKK Article 11, you have the right to: learn whether your data has been processed; request information about the purpose and use of processing; know the domestic or foreign third parties to whom your data has been transferred; request rectification of incomplete or inaccurate data; request deletion or destruction of your data under KVKK Article 7; request notification of these actions to third parties; object to any result against you arising from automated analysis; and request compensation for damages arising from unlawful processing.
To exercise your KVKK rights, send a signed petition to privacy@wibto.com or via registered mail. We will respond within 30 days as required by law.
10.3 Under CCPA/CPRA (California Residents)
California residents have the right to: know what personal information we collect and how we use it; request deletion of personal information; opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioral advertising); non-discrimination for exercising privacy rights; correct inaccurate personal information; and limit the use and disclosure of sensitive personal information.
We collect the following categories of personal information under the CCPA: identifiers (name, email, username, UID), geolocation data (precise GPS coordinates), internet activity (analytics events), and inferences (leaderboard rankings, achievement progress).
We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
11. Children's Privacy
The Service is not directed to children under the age of 13 (or under 16 in the EU/EEA, or under the applicable minimum age in your jurisdiction). We do not knowingly collect personal data from children below these age thresholds. While we collect date of birth during registration, we are implementing age-gating logic to prevent minors from creating accounts.
If you believe a child has provided us with personal data, please contact us immediately at privacy@wibto.com. We will promptly investigate and delete such data if confirmed.
12. Data Breach Notification
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (as required by GDPR Article 33) and will notify affected users without undue delay (as required by GDPR Article 34). For KVKK purposes, we will notify the Turkish Personal Data Protection Board (KVKK Kurulu) and affected data subjects as soon as possible, in accordance with KVKK Article 12(5).
13. Third-Party Services and Links
The Service integrates with third-party services as described in Section 5. Each third-party service is governed by its own privacy policy. By using the Service, you are also subject to: Google's Privacy Policy (Firebase, Google Analytics for Firebase, Firebase Crashlytics, Google Sign-In, Google Play Billing, Health Connect), Apple's Privacy Policy (Apple Sign-In, StoreKit, Apple Health), Mapbox's Privacy Policy, and PostHog's Privacy Policy. We encourage you to review these policies.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify you of material changes by: displaying a prominent notice within the App, sending a notification to your registered email address, or requiring renewed acknowledgment upon next login. The "Effective Date" at the top of this document indicates the date of the last revision. Continued use of the Service after any update constitutes acceptance of the revised Privacy Policy.
15. Contact Us
For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:
Email: privacy@wibto.com
For KVKK-related inquiries, you may submit a signed application in Turkish to the above email address or via registered mail.
We aim to respond to all legitimate requests within 30 days. In complex cases, we may extend this period by an additional 60 days, and we will notify you of any such extension.
16. Governing Law and Jurisdiction
This Privacy Policy is governed by the laws of the Republic of Turkey. For EU/EEA residents, nothing in this policy limits your rights under the GDPR as enforced by your local supervisory authority. For UK residents, the UK GDPR and Data Protection Act 2018 apply. For California residents, the CCPA/CPRA applies to the extent its provisions provide greater protection.
© 2026 Wibto. All rights reserved.