TRAKNOCK

Privacy Policy and Privacy Notice

Version 2 — 18 September 2026 · Previous version: 7 September 2026

1. Identity of the data controller (KVKK Art. 10/1-(a), GDPR Art. 13/1-(a))

In this policy, "we" and "Traknock" mean the data controller identified above. "You" and "your" mean the data subject for the purposes of the GDPR and the relevant person (ilgili kişi) for the purposes of the KVKK. Plain language has been used deliberately: KVKK Art. 10 and GDPR Art. 12(1) both require that information be provided in a concise, transparent, intelligible and easily accessible form, so legal concepts are named precisely while their explanation is given in ordinary words.

Traknock is additionally, within the meaning of Turkish Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications, a content provider in respect of the material it produces itself and a hosting provider in so far as it hosts material produced by users. The notice-and-takedown processes attaching to those capacities are set out in the Community Rules.

2. Nature and scope of this document

This document serves two functions at once: it is a privacy policy (the document required by app store rules and by the general principle of transparency) and a privacy notice in the technical Turkish sense (the aydınlatma metni required by KVKK Art. 10).

Under Principle Decision No. 2026/347 of the Turkish Personal Data Protection Board, dated 18 February 2026, the privacy notice and the explicit-consent text must be presented separately; giving notice is an information duty and may not be tied to any approval mechanism. Reading this text therefore does not mean that you have consented to any processing activity. Processing that requires explicit consent is identified separately in section 6, and consent for it is obtained inside the app by a separate and independent choice.

This policy covers the mobile app, the web pages under the traknock.com domain and the server-side processing behind them. Third-party services you leave the app for (for example a Google Play store listing) are governed by their own privacy policies.

3. Categories of personal data processed

The tables below are the complete inventory of the data the app processes. The "Who can see it" column reflects the current state of the server-side authorisation rules — not how the interface happens to present it.

3.1. Account and profile data

3.2. Location and movement data

3.3. Communications and content data

3.4. Moderation, enforcement and security data

The raw device identifier (ANDROID_ID on Android) is never transmitted to or stored on the server; only its irreversible digest is sent. That digest cannot be matched against the data held by any other application.

3.5. Payment, wallet and transaction data

The nature of the ledger must be stated plainly: it is a detailed record of your behaviour inside the app — which conversation you opened and when, how many road reports you filed, how many ads you watched can all be read from it. It is accessible only to you and to the server.

3.6. Technical data and data collected by third-party infrastructure

3.7. Data that stays on your device and is never sent to us

The following is stored only on your own device and is not transmitted to us. Because it still falls within the definition of "processing" under the KVKK and the GDPR, it is listed here as well:

• A copy of your open session: account ID, name, username, "about" text, photo paths, vehicle details (including the registration plate), token balance, Prime status, daily allowance counters, your block list
• An account archive kept so that you can return after signing out
• Chat list cache (including the text of the most recent messages)
• Cache of nearby users — here it is not your own data but the position and profile of other users that is held on your device
• Road report cache (including coordinates)
• Whether the driving-safety acknowledgement has been given, your language preference, a 7-day cache of the administrator check
• Local copies of your profile and vehicle photos

3.8. Data that is not collected

Traknock does not collect email addresses, telephone numbers, passwords, dates of birth, national identity numbers, home addresses or payment/card details. Sign-in uses anonymous authentication. For in-app purchases, payment is processed directly by Google Play; Traknock never sees or stores card details.

The app does not collect location in the background. Background location, microphone and file-system permissions are deliberately not requested and do not appear in the app's permission list.

4. How personal data is collected (KVKK Art. 10/1-(ç))

• Directly from you: the username and display name you enter at sign-up; profile and vehicle details; photos you take or select from your gallery; messages and road reports you write; votes you cast and abuse reports you file.
• Automatically from your device hardware and operating system: location, heading and speed; the device identifier hash; the notification address; the technical state of the device at the moment of a crash.
• Derived from your use of the app: geographic cell code, street room identifier, last-seen timestamp, violation counters, reputation score, wallet movements.
• From third-party services: the receipt and order details returned by Google Play purchase verification.

Collection takes place entirely by electronic means, through the mobile app and server-side software, partly and wholly by automated means. No data is collected on paper.

5. Purposes of processing (KVKK Art. 10/1-(b), GDPR Art. 13/1-(c))

• Creating, identifying and maintaining your account
• Showing nearby users on the map and enabling mutual visibility
• Delivering help calls to nearby users and showing who is responding
• Publishing road reports and verifying them through community voting
• Operating the direct, street and general chat features
• Operating the window-knock, profile-view and friends features
• Sending notifications
• Automated moderation of content and prevention of abuse, harassment and fake accounts (see section 12)
• Verifying token and subscription purchases, operating the balance, preventing double redemption
• Serving and measuring advertising (no ads are shown to Prime subscribers)
• Monitoring app stability and fixing defects
• Handling data subject requests, managing legal claims and disputes, and responding to lawful requests from competent public authorities

Your personal data is not processed for any purpose other than those listed above. In particular: your location history is not accumulated or analysed, no behavioural profile is built from your activity, no location-targeted advertising is served to you, and your data is not sold to third parties for marketing purposes.

6. Legal basis for processing (KVKK Art. 5, GDPR Art. 6)

We do not process your personal data at large. Each processing activity rests on a legal basis identified separately below:

6.1. Processing that requires explicit consent

As at today's date there is no processing activity in Türkiye that relies on explicit consent. If any of the following is introduced in future, separate and independent explicit consent will be obtained for each, and refusing consent will not prevent the service being provided to you:

• Accumulation and analysis of location history
• Location-targeted advertising
• Marketing messages containing campaigns, discounts or win-back offers (which additionally require consent under Turkish Law No. 6563 on the Regulation of Electronic Commerce and registration with the Turkish Message Management System, İYS)
• Sharing personal data with a third party that is not necessary for the provision of the service

You may withdraw any consent you have given at any time and without giving a reason (GDPR Art. 7(3)). Withdrawal does not render processing carried out before it unlawful with retrospective effect.

6.2. Special categories of personal data (KVKK Art. 6, GDPR Art. 9)

Traknock does not knowingly collect and does not request the special categories of personal data listed in KVKK Art. 6 and GDPR Art. 9 (health, sex life, religion, political opinion, biometric data and the others).

Your profile photo is not processed as biometric data. The photo is examined on your own device, by general image labelling, solely to check whether it depicts a real person and whether it contains inappropriate content. No facial recognition is performed, no face template or vector is extracted, photos are not matched against one another, and photos are not used for identity verification. In the same way, reading the registration plate from the vehicle photo is performed entirely on your device, and the plate that is read is not transmitted to the server.

Please do not write special categories of personal data (such as your state of health, your beliefs or your political views) into free-text fields such as the "about" text, messages or the free-text part of a road report. Those fields are not designed to process such data and there is no mechanism that filters it out.

7. Location data — detailed explanation

7.1. When and how often it is written

Your location is written to the server, and shown to other users on the map, only while the "Be Visible" setting is on. While it is off, your location is never written to the server — that is, no new location record is created; the map and the street name continue to work on your device alone.

While the setting is on, a location write must pass three gates:

In other words a write happens at most every four seconds and at least every four minutes. The coordinates are written unrounded, as the raw GPS value. Positions not updated in the last 15 minutes drop off the map.

7.2. Is location history retained?

Directly, no: the latitude and longitude fields on your account are overwritten on every write. There is no separate location history or trail collection, and no analysis of any kind is performed on location history.

Indirectly, yes — and we are not hiding it. Content you submit carries the position you were in at the moment you submitted it:

• Road reports carry the exact coordinates of the incident together with your account and username. Depending on type, they are deleted automatically within 24 hours at the latest (see section 11.1).
• Street chat messages carry the identifier of the street room they were written in. That identifier denotes a geographic cell of roughly 1 km resolution, and its centre coordinates can be derived from it.

7.3. The permanent location trace left by street chat

8. What other users can see

By the nature of the app, some data is open to other users. The list below reflects the current state of the server-side authorisation rules:

• Your display name, username, "about" text, vehicle details (including the registration plate) and vehicle photo
• Your location, heading and speed — you are listed on the map only while "Be Visible" is on; even with the setting off, the last position written remains readable on your account record (see section 7.1)
• Messages you post in general and street chat
• Road reports you submit and votes you cast
• Your Prime subscription status and tier

9. Recipients of personal data and the purpose of disclosure (KVKK Art. 10/1-(c), GDPR Art. 13/1-(e))

Your data is never sold. It is disclosed only to the following recipients, and only for the purpose shown:

Image labelling and plate reading performed with Google ML Kit run entirely on your device; no image is sent to Google for those operations. The profile and vehicle photos themselves are, however, uploaded to file storage so that they can be displayed on the map and on your profile. This distinction must be preserved: what stays on the device is the analysis of the photo; what goes to the server is the photo itself.

10. International transfers (KVKK Art. 9, GDPR Chapter V, Art. 44 et seq.)

Because the controller is established in Türkiye, data leaving Turkish territory constitutes a transfer abroad within the meaning of KVKK Art. 9. The fact that the data sits within the European Union does not make it "domestic" as a matter of Turkish law.

10.1. The regime applied under Turkish law

KVKK Art. 9 was rewritten in its entirety by Law No. 7499, and the new text entered into force on 1 June 2024. The regime in force today has three tiers:

10.2. Transfers outside the European Union

In operations arising from Google AdMob and Google Play, data may be transferred to Google's global infrastructure, including the United States. Google states that it relies on the EU-U.S. Data Privacy Framework and on the European Commission's standard contractual clauses for those transfers. That is Google's own statement; Traknock is not in a position to audit transfers within Google's infrastructure on its own account.

11. Retention and erasure (KVKK Art. 4/2-(d) and Art. 7, GDPR Art. 5(1)(e))

KVKK Art. 4/2-(d) requires personal data to be retained "for the period prescribed in the relevant legislation or required for the purpose for which it is processed"; Art. 7 requires data to be erased, destroyed or anonymised once the grounds for processing it cease to exist. GDPR Art. 5(1)(e) imposes the equivalent storage limitation principle.

11.1. Periods enforced automatically on the server

The following periods are defined in the app's code and are applied automatically, server-side, by a cleanup job that runs every 30 minutes. Deletion cannot be undone.

11.2. Purpose-bound periods

11.3. Periodic erasure — present position and undertaking

12. Automated decision-making and content moderation (KVKK Art. 11/1-(g), GDPR Art. 22)

The system:

• Scans direct messages, street chat messages and road reports server-side, at the moment they are posted
• On detecting profanity or sexual content, deletes the road report, masks the message with the marker [kaldirildi] ("removed") and suppresses the notification
• Records the violation against your account and stores the original of the removed text (up to 500 characters) as an audit record
• Bans the account automatically once a threshold is crossed

The thresholds differ deliberately: a user who loses their temper in traffic and writes something is not treated in the same way as a user sending sexual content.

There is a necessary consequence of this scanning, and it must not be concealed: your messages are not end-to-end encrypted and can be read by the server. Encryption exists only in transit (TLS) and at rest on disk. We do not make a promise of the "your messages stay between you and the other person" kind, because it would not be true.

12.1. Your right to object and to human review

If your account has been banned automatically, you may ask for the decision to be reconsidered by a human being. Writing to privacy@traknock.com is enough; we conclude such requests within thirty days at the latest.

The reason for the closure is written to the account record on the server; however, there is today no screen inside the application that shows that reason, and no separate notification is sent at the moment of closure. You can obtain the reason by writing to the address above. Adding a screen that displays the reason inside the app has been identified as work to be done and will be completed before the app is published in the stores (Article 22.4/a of the Terms of Use).

This right derives from two separate instruments, and because they do not grant the same thing we set them out separately:

• GDPR Art. 22(3) — expressly confers the right to obtain human intervention, to express one's point of view and to contest the decision in relation to automated decisions.
• KVKK Art. 11/1-(g) — confers the right "to object to a result to the detriment of the person arising from the analysis of the processed data exclusively by automated systems". A right to human review is not regulated in the KVKK with that degree of clarity.

Human review is therefore something we undertake of our own volition, going beyond what the KVKK requires. For users resident in Türkiye the right of objection under KVKK Art. 11/1-(g) is additionally reserved.

13. Data security (KVKK Art. 12, GDPR Art. 32)

The technical and organisational measures in place:

• All traffic between device and server is encrypted with TLS; data is also encrypted at rest on disk
• Access to the database and file storage is restricted by authorisation rules at row and file level, and the correct operation of those rules is verified by automated tests
• Notification addresses and gift records are held in protected areas open only to the account holder
• Automated moderation records, abuse reports, device records and the administrator action log are entirely closed to the client
• Chat photos are open only to the participants in that conversation; that check is performed server-side by reading the participant list of the conversation
• Administrative actions run server-side only, after an authorisation check, and are logged
• Purchase receipts are verified against Google on the server; the same receipt cannot be used twice
• The device identifier is never transmitted in raw form; only an irreversible digest is retained
• The app does not collect location in the background; unnecessary permissions have been removed from the manifest

13.1. Personal data breach notification

No system can offer absolute security. If a breach affecting your personal data occurs:

• We notify the Turkish Personal Data Protection Board without delay and within 72 hours at the latest of the time we become aware of the breach, pursuant to KVKK Art. 12/5 and the Board's decision No. 2019/10 of 24 January 2019. If notification cannot be made within that period, the reason for the delay is explained together with the notification.
• We notify you, pursuant to KVKK Art. 12/5, within the shortest reasonable time after it is established that you are affected by the breach.
• For users within the scope of the GDPR, notification is additionally made to the supervisory authority within 72 hours under Art. 33, and to the data subject without undue delay under Art. 34 where the breach is likely to result in a high risk to their rights and freedoms.

Note of correction: the figure of 72 hours does not appear in the text of KVKK Art. 12/5; the article says only "within the shortest time". The 72 hours is the interpretation the Board placed on that wording in its decision No. 2019/10. The previous version attributed the figure directly to the statute; the basis has been corrected.

14. Deleting your account and erasing your data

You can delete your account permanently from inside the app: Profile → Edit Profile → Delete Account. You can also send a deletion request to privacy@traknock.com.

14.1. Deletion removes the following

• Your profile record: display name, username, "about" text, vehicle details (including the registration plate)
• Your username reservation
• Your location data
• Your profile and vehicle marker photos — both the device copy and the server copy
• Photos you sent in conversations
• The record of who viewed your profile
• Your device's notification address and your pending gift inbox
• Your account ID within the device record
• Your authentication account
• Your session record, account archive and local photo copies on your device

14.2. What remains after deletion — complete list

Under KVKK Art. 7 and Art. 11/1-(e), and under GDPR Art. 17, you are entitled to know which data continues to be held after a deletion request and on what ground. The list below is intended to be exhaustive:

For more detail and for requesting deletion from outside the app, see Account and Data Deletion.

15. If you live in Türkiye — rights of the data subject (KVKK Art. 11)

If you are resident in Türkiye, KVKK Art. 11 gives you the right:

• (a) to learn whether your personal data is processed
• (b) to request information if it has been processed
• (c) to learn the purpose of processing and whether the data is used in accordance with that purpose
• (ç) to know the third parties, at home or abroad, to whom the data is transferred
• (d) to request rectification where the data is incomplete or incorrect
• (e) to request erasure or destruction within the conditions of KVKK Art. 7
• (f) to request that action taken under (d) and (e) be notified to the third parties to whom the data was transferred
• (g) to object to a result to your detriment arising from analysis of the data exclusively by automated systems
• (ğ) to claim compensation where you suffer loss as a result of unlawful processing

15.1. How to make an application

Under Article 5 of the Turkish Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your application by one of the following routes:

• In writing — to the postal address in section 1, by a wet-signed letter
• Using a registered electronic mail (KEP) address
• Using a secure electronic signature or a mobile signature
• Using an email address that you have previously notified to the data controller and that is registered in our systems
• Through software or an application developed for the purpose of making such applications

Under Article 5 of the Communiqué, your application must contain:

• Your name and surname, and your signature if the application is in writing
• Your Turkish identity number (for foreign nationals, nationality, passport number or identity number)
• Your place of residence or business address for service
• Your email address, telephone and fax number for notification, if any
• The subject of your request
• In addition, your username in the app — this is necessary for us to match the request to your account, because we do not collect email addresses and have no other way of linking you to it

15.2. Response time, fees and the route of complaint

• We conclude your application in the shortest time appropriate to its nature and within thirty days at the latest, pursuant to KVKK Art. 13/2 and Article 6 of the Communiqué. We either accept the application or reject it stating our reasons; our response is notified in writing or by electronic means.
• An application is free of charge as a rule. Under Article 7 of the Communiqué, where the response exceeds ten pages a processing fee of 1 Turkish lira per page may be charged, and where the response is provided on a recording medium such as a CD or flash drive, a fee not exceeding the cost of that medium may be charged. Traknock undertakes not to apply those fees, as responses will be provided by electronic means.
• If your application is rejected, if you find our response inadequate, or if we fail to respond in time, you may complain to the Turkish Personal Data Protection Board pursuant to KVKK Art. 14 within thirty days of learning of our response and in any event within sixty days of the date of your application. Applying to the data controller first is a precondition of the route of complaint to the Board.
• Your right to claim damages under the general provisions is reserved (KVKK Art. 11/1-(ğ)).

16. If you live in the European Economic Area or the United Kingdom (GDPR / UK GDPR)

Your rights under the GDPR in full, with the corresponding articles. The same rights apply under the UK GDPR and the Data Protection Act 2018 if you are in the United Kingdom.

Response times (Art. 12(3)). We provide information on the action taken on a request under Articles 15 to 22 without undue delay and in any event within one month of receipt. Where necessary, taking into account the complexity and number of requests, that period may be extended by two further months; in that case we inform you of the extension, together with the reasons for the delay, within one month of receipt of the request.

On data portability (Art. 20). On request, your data is prepared as a structured, commonly used and machine-readable file covering your username, profile details, vehicle details, road reports, chat messages and wallet ledger. This work is currently done by hand; there is no automated export tool yet. The period may therefore be extended within the limits permitted by GDPR Art. 12(3), and you will be told if it is, together with the reasons.

17. If you live in California (CCPA/CPRA)

As a California resident you have the right to know what personal information is collected about you and how it is used (Cal. Civ. Code § 1798.100), to request its deletion (§ 1798.105), to request its correction (§ 1798.106), to opt out of the sale or sharing of your personal information (§ 1798.120), to limit the use and disclosure of sensitive personal information (§ 1798.121), and not to be discriminated against for exercising any of these rights (§ 1798.125).

We do not sell your personal information, and we do not knowingly sell or share the personal information of consumers under 16 years of age. The advertising ID used to serve ads may nevertheless fall within the CCPA definition of "sharing" for cross-context behavioural advertising. You can switch off ad personalisation or reset the advertising ID in your device settings; Prime subscribers are shown no ads at all. Requests: privacy@traknock.com.

Sensitive personal information. Precise geolocation is treated as sensitive personal information under the CCPA as amended by the CPRA (Cal. Civ. Code § 1798.140). We use your precise geolocation only to provide the service you asked for — showing nearby users, routing help calls and naming the street you are on — and not to infer characteristics about you. It is not used for profiling, is not sold, and is not disclosed for cross-context behavioural advertising.

18. Protection of children and minimum age

Traknock is a service directed at adult users. The target audience declared in the app store will be "older users".

In the European Union, if you are below the age limit set by your country under GDPR Art. 8 (between 13 and 16), you may use the app only with the consent of a parent or guardian. In the United States, the app is not directed at children under 13 within the meaning of COPPA and we do not knowingly collect their data.

If we become aware that a child below the applicable age limit has provided data, we delete the record. You can report such a case to privacy@traknock.com; on receiving the report we suspend the account and conclude our review within thirty days.

19. App permissions

Background location permission is not requested. Microphone, file-system and foreground-service permissions are likewise deliberately not requested. All permissions are optional and can be withdrawn from device settings at any time. Without location permission the map features do not work; without the others, only the related feature is disabled.

Note of correction: the previous version stated that camera permission was also requested in order to send photos in chat. The correct position is that photos sent in chat are chosen from the gallery; the camera is used only for profile and vehicle photos.

20. Cookies and identifiers stored on your device

This website uses no cookies and carries no tracking scripts or analytics. The pages consist of text and a stylesheet only. No separate cookie policy has therefore been published.

The mobile app uses no cookies either, but the absence of cookies is not on its own a sufficient safeguard: the advertising ID (AAID) and local storage on the device fall within the "access to information stored in terminal equipment" rule in Art. 5(3) of the ePrivacy Directive (2002/58/EC) in the European Union, and within the equivalent rule in the Privacy and Electronic Communications Regulations 2003 in the United Kingdom. Ads will therefore be served to EEA and UK users only after separate, express consent has been obtained (see section 6).

21. Effective date and updates

If this policy is updated, the version number and date at the top of this page change. Significant changes are announced inside the app; where a change broadens the scope of processing and requires explicit consent, your consent is additionally sought separately for each such change. Information provided in discharge of the notice obligation is in no case tied to a consent checkbox.

22. Contact

For any privacy question, request or data subject application: privacy@traknock.com
For general matters: info@traknock.com
For the postal address for written applications and the telephone number, see section 1.

To apply or complain directly to the Turkish Personal Data Protection Authority: kvkk.gov.tr