PathieTürkçePathieTürkçeEffective date: 15 August 2026
Pathie records your walks, lets you draw routes, and — if you choose — share them. This document explains which of your data we process, why, and who we send it to. It contains everything shown on the notice screen when you first open the app, plus the company and country details promised there.
The data controller is established in Türkiye, so the processing is subject to Turkish data protection law (KVKK, Law no. 6698). If you are in the European Union you also have the rights granted by the GDPR, and this document is written to satisfy both.
Your location during walks (including in the background, with the screen off), the photos you take, your notes on stops, the map area you have uncovered (your "fog"), and statistics such as distance and duration. These live in your device's own database; Pathie works fully in airplane mode.
Your email address, the username you choose, your display name and avatar, your age range, your device's encryption key, and your friend list. These are written the moment you create an account, because they are what identifies it.
We also keep when you last connected — the time only, a single value refreshed at most once an hour. What you do in the app, which screens you open, what you tap is not recorded: Pathie has no analytics SDK, no advertising identifier and no behavioural logging. The one timestamp exists for an operational reason: knowing how many people are using the app.
Each open session keeps the device's IP address and app signature; that is what answers "which device is this" under Settings → Sessions. A session lives at most 90 days and its record goes when you sign out or delete the account.
If you allow notifications, your phone's notification address (push token) is kept with your account too — it is the only way a notification can reach you. It is deleted when you withdraw the permission or delete your account.
If you subscribe, the store purchase token or receipt, account and product ids, purchase and expiry dates, store country and app version are written to the server with your subscription status. Your payment card never reaches us or RevenueCat.
The routes you publish, room messages, the photos and voice messages you send in rooms, and — if you turn it on — your live location.
Live location passes through the server unencrypted: the server relays each packet to the people you allowed and stores none of it; once the connection closes no record remains. Room messages are end-to-end encrypted and the server cannot read them.
Every photo you upload passes an automated image scan before it is stored; the result is cached for 90 days against the photo’s fingerprint (a digest of its bytes), with neither the photo itself nor who uploaded it in that record.
If you choose to share a walk, that walk's step count is written to the server as part of the share and is visible to the audience you chose (your friends, or everyone). Nothing is counted at all while the step counter is switched off in Settings.
When you like, save, copy or comment on a public route, or follow someone, that is recorded individually — there is no other way for a like to be undoable or for what you saved to stay in your list.
These records are also used to order the Discover feed for you. This is not an exception to the "no behavioural logging" sentence above but its boundary: what is recorded is your own action (what you liked), not your browsing behaviour — and none of it goes to advertising or to matching with a third party.
If you join the launch waitlist on pathie.app, your email address and the language you chose are stored on Cloudflare D1 only to tell you when Pathie is available. The entry is deleted once that message has been sent, and you can ask for it to be deleted earlier at support@pathie.app.
Map tiles, route calculation and weather cannot be produced on your phone; they come from outside. The list below is complete. None of these recipients is located in Türkiye, and Turkish law treats this as a transfer abroad.
These transfers are continuous and part of how the app ordinarily works, so they rest on appropriate safeguards rather than on your consent. That is the order KVKK Art. 9 sets: without an adequacy decision, an appropriate safeguard, with explicit consent reserved for incidental transfers (Art. 9/6). The GDPR draws the same line — Art. 46 safeguards, Art. 49 derogations. No adequacy decision has been issued for any country in the table below.
The safeguard takes one of two forms, depending on the recipient: the standard contractual clauses (EU SCCs) or data processing agreement that recipient publishes and we have accepted; or, where there is none, the standard contract issued by the Turkish Personal Data Protection Board, signed with the recipient and notified to the Authority within five business days of signature. To learn which instrument covers a particular recipient, write to support@pathie.app.
Sharing, live location and crash reports are separate from this: those rest on your explicit consent, which you can withdraw at any time from Settings → Privacy.
| Recipient | Legal entity | Country | Data sent | When |
|---|---|---|---|---|
| Expo (app updates) | 650 Industries, Inc. | United States | Your IP address, device and version information | On every launch — before the consent screen is shown |
| Mapbox | Mapbox, Inc. | United States | The map area you are viewing, the words you search for | While the map is open and when route lists are displayed |
| MET Norway (weather) | Norwegian Meteorological Institute (Meteorologisk institutt), Postboks 43 Blindern, 0313 Oslo | Norway | Your stops rounded to ~1 km, and the estimated arrival time. Your IP address is not sent — the request is made by our own server | While drawing a route and when a plan’s forecast is shown |
| OpenRouteService (fallback routing engine) | HeiGIT gGmbH, Schloss-Wolfsbrunnenweg 33, 69118 Heidelberg | Germany | The coordinates of the stops you place | When you draw a route — only if our own routing server does not respond |
| Amazon Web Services (hosting of our own routing engine) | Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg | Germany — the server runs in AWS's Frankfurt (eu-central-1) region; the engine is ours, AWS only hosts it | The coordinates of the stops you place and — when a recording is map-matched — the coordinates of the trace you walked. Your IP address is not sent — the request is made by our own server | When you draw a route and when a walk recording is map-matched |
| Apple / Google (your phone’s geocoding service) | On iOS, Apple Inc., One Apple Park Way, Cupertino, CA 95014 — in the EEA, the United Kingdom and Switzerland, Apple Distribution International Limited, Ireland. On Android, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 — in the same countries, Google Ireland Limited, Dublin | United States — Ireland for users in the EEA, the United Kingdom and Switzerland | Your location | Automatically, if you have granted location permission |
| Spotify (playlist preview) | Spotify AB, Regeringsgatan 19, 111 53 Stockholm | Sweden | The playlist link you paste | When you attach a playlist to a memory |
| Apple Music (playlist preview) | Apple Inc., One Apple Park Way, Cupertino, CA 95014 (EEA/UK/Switzerland entity: Apple Distribution International Limited, Ireland) | United States — Ireland for users in the EEA, the United Kingdom and Switzerland | The playlist link you paste | When you attach a playlist to a memory |
| Cloudflare (our server) | Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107 (EU/UK entity: Cloudflare, Ltd., London) | United States — storage is provisioned with the "eu" jurisdiction restriction, so the data itself is held within the European Union | Your account, profile, friend list and everything you share | The moment you create your account; shared items when you share them |
| RevenueCat (subscription status processing) | RevenueCat, Inc. — a processor acting on our behalf | United States | The store purchase token or receipt, your account id, product id, purchase and expiry dates, store country and app version. Your payment card is never sent | To verify subscription status; while your account exists and for as long as the store requires for its own records |
| Cloudflare Email Sending (email delivery (first route)) | Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107 (EU/UK entity: Cloudflare, Ltd., London) | United States | Your email address and the one-time sign-in code sent to you. Resend is used only when this route fails | When you request a sign-in code |
| Resend (email delivery) | Plus Five Five, Inc. (Resend is the brand name) | United States | Your email address and the one-time sign-in code sent to you | When you request a sign-in code |
| Sentry (crash reporting) | Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105 (EU representative: Sentry Software Netherlands B.V., Amsterdam) | United States | The error itself and your device model/version. Your location, routes and photos are not sent | From the app only when an error occurs and only if you consented; our own server’s errors always, carrying no identity or location |
| Cloudflare (the AI model) | Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107 (EU/UK entity: Cloudflare, Ltd., London) | United States | The text you type in the chat, a photo only if you attach one yourself, and — with every message you send — your location rounded to ~1 km. The model itself never sees coordinates; they are used only to answer a question about places around you. An attached photo is described and discarded; it is not stored. Your walks, your photo library and your fog map are not sent | Only when you send Pati a message, or attach a photo to one |
| Geoapify (places nearby) | Geoapify GmbH, Karlsruhe | Germany | Your location rounded to ~1 km and the kind of place you asked for. Your IP address is not sent — the request is made by our own server. One fallback: when our own map-matching server cannot answer, a walk’s exact coordinates and timestamps are sent here to be snapped to the road | When you ask Pati what is nearby |
| Tavily (web search) | AlphaAI Technologies Inc. (Tavily is the brand name), 1350 Broadway, 24th Floor, New York, NY 10018 | United States | The name of the place being looked up and the city it is in — not your message, not your location, not who you are | Only when Pati needs evidence about a place you asked about |
| Wikimedia (Wikipedia) | Wikimedia Foundation, Inc., 1 Montgomery Street, Suite 1600, San Francisco, CA 94104 | United States | The area you are looking at, rounded to ~1 km. Your IP address is not sent — the request is made by our own server | When a museum, park or historic place appears in Pati’s answer |
| DuckDuckGo (site icons) | DuckDuckGo, Inc., Paoli, Pennsylvania — the company’s privacy policy names no separate controller for Türkiye | United States | Only a source’s domain name, such as tripadvisor.com. Your IP address is not sent — our own server fetches the icon; nothing about you, your location or what you asked | While a place card in Pati’s answer shows its sources |
| Overpass API (street data) | Not stated — a public endpoint run by OpenStreetMap volunteers (overpass-api.de); it declares no commercial controller | Germany | The bounding box of the neighbourhood you are looking at — the neighbourhood, not your location. Your IP address is not sent; the request is made by our own server | The first time a neighbourhood’s streets are needed (the result is cached, so it is not asked twice) |
| Google (notification delivery) | Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 | United States | Your phone’s notification address and the text of the notification sent to you | When you allow notifications, and when one is sent to you |
| Amazon Web Services (elevation data) | Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109 | United States — the bucket read is in Frankfurt (eu-central-1), so the data is within the European Union | The number of the map tile your route falls in — the tile, not your location. Your IP address is not sent | While the route’s elevation profile is computed |
| Amazon Web Services (photo check) | Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109 | United States — the check runs in Frankfurt (eu-central-1), so the photo stays within the European Union | The photo you upload, to be checked for pornography, violence and similar content. Who uploaded it is not sent — only the picture, and the picture is not stored there | While a photo you upload is being saved |
If you choose to sign in with Apple or Google, the only thing that company receives is which app you signed in to; what comes back to us is your name and email address (with Apple, optionally through a private relay address). This is a different processing operation from the geocoding row above.
Apple or Google processes the subscription payment under its own privacy terms. The store takes the payment card, collects the charge and issues the receipt or invoice; neither we nor RevenueCat sees your card details.
Under GDPR Art. 15–22 and KVKK Art. 11 you have the right to learn what data of yours is processed, to access it, to have it corrected or erased, to object to processing, and to receive your data in a portable form. Most of these can be exercised inside the app, without asking anyone:
Server-side deletion is queued and normally completes within minutes; the screen does not say "deleted" until the work has actually finished. For written requests: support@pathie.app.
We answer a written request within 30 days (the KVKK application communiqué, Art. 6). A request under GDPR Art. 12(3) is answered within one month; where the request is complex that period may be extended by two further months, and you are told of the extension and its reason before the first month is out.
If our answer does not satisfy you, you may complain: in Türkiye to the Personal Data Protection Authority (Nasuh Akar Mah. 1407. Sok. No: 4, 06520 Çankaya/Ankara), and in the EU and EEA to your own country's supervisory authority.
You must be at least 16 years old to use Pathie. The app is not directed at children; people under 16 may not use Pathie and we do not knowingly collect their data.
Whenever the text changes materially, the app asks for your approval again — the document carries a version number, and raising it re-shows the screen. Changes are never made silently.