Privacy Policy
Last updated: 30 October 2026
This Privacy Policy ("Policy") explains how your personal data is processed when you use the CDR mobile application ("App") and the getcdr.app website ("Site"; together, the "Service").
This Policy serves as the privacy notice required by Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK"). If you use CDR from the European Economic Area, the United Kingdom or Switzerland, it also provides the information required by the EU General Data Protection Regulation ("GDPR").
By using CDR you acknowledge that you have read this Policy. Some data, such as location, is processed only after you grant permission on your device and turn on the related feature.
01Data controller
The data controller of your personal data is Ersin Ozan Öneyman, who develops and publishes CDR ("CDR", "we", "us").
For any question or request about privacy and personal data: ozanoney@gmail.com
02What data we process
We process only the data needed to provide, secure and improve the Service. The categories are:
- Account data: email address, password (stored only in irreversible, hashed form), account ID, account creation date and session information.
- Profile data: username, car make and model, the car you show on the map, a profile or car photo if you add one, and the date you accepted the driving safety notice.
- Location data: precise (GPS) location, speed, heading and time. When location is processed is explained in detail under "Location data" below.
- Drive data: start and end time and location of your drives, the route line, and statistics such as duration, distance, average and top speed, plus personal analysis derived from them.
- Convoy data: destination, mode, invite code and status of convoys you create or join, join and arrival times, and convoy result statistics.
- Social data: friend requests and connections, friend and convoy invites, posts you share (a short caption, a drive summary and a simplified drawing of the route), likes, comments, users you block and reports you submit.
- Notification data: your device's push token and platform, so we can send push notifications.
- Subscription data: your CDR Pro status, expiry date and purchase records. Your payment card details never reach us; Apple processes the payment.
- Technical and error data: when the App crashes or hits an error, the device model, operating system and app version, the error log and the screens visited before it. These reports are stripped of location, email and similar personal data before they are sent.
- Support correspondence: your email address and the content of your message when you email us.
- Site data: IP address, browser information and access logs kept by our hosting provider when you visit the Site, and a strictly necessary cookie that remembers your language.
Motion and activity sensor data (for example, detecting that you are driving) is used only on your device to decide when automatic drive recording should start, and is not sent to our servers.
We do not collect special categories of personal data (health, biometrics, religion, ethnic origin, etc.). Please do not share such information in posts, comments or usernames.
03Location data
CDR is a driving app, so location is essential to its core features. Your location is processed only in the situations below and within the permission you grant in iOS. You can change or withdraw that permission at any time in your device Settings; the related features will then stop working.
- Maps and places. Mapbox receives the map area and coordinates needed to display maps and calculate live routes. Apple Core Location can provide address information to help classify roads during drive detection. For destination searches, Photon receives the search text and a coarse area rounded to one decimal degree. To label a saved drive, Photon receives the start and end coordinates rounded to three decimal places.
- Convoy: when you join an active convoy, your live location is shared in real time with the other participants of that convoy for as long as it runs, including while the App is in the background. Live location points are relayed only to participants and are not stored on the server. Sharing stops when the convoy ends or you leave it. Result statistics such as arrival time, duration and distance are saved with the convoy.
- Automatic drive recording (optional): if you turn it on and grant "Always" location permission, CDR uses a geofence around where you parked to detect when you start driving. During the drive it records your route with precise GPS. The recorded drive is uploaded to your account. You can turn the feature off in the App at any time.
- Nearby drivers (optional): if you turn this on in the map, your username, map car and near real-time location are shown to other CDR users nearby while the App is in the foreground. Your location is deleted from the server when you turn it off or the App leaves the foreground, and locations that stop updating are hidden after 90 seconds. Users you block cannot see you.
Drive routes can reveal sensitive information, such as places you visit often like your home or workplace. For this reason your drive routes are visible only to you by default. When you share a drive to the feed, a simplified drawing of the route becomes visible to the audience you choose (friends or everyone). Please keep this in mind before sharing.
04Why we process your data and on what legal basis
We process your personal data for the purposes below, based on the legal grounds in KVKK Article 5 (and, where the GDPR applies, Article 6):
- Creating your account, signing you in and providing the Service (map, convoys, drive recording, statistics, friends and feed): necessary for the conclusion or performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
- Verifying your CDR Pro subscription and unlocking Pro features: performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
- Sending notifications such as convoy invites, convoy starts, friend requests and drive start/end: performance of a contract and your notification permission.
- Keeping the Service safe; preventing abuse, spam, harassment and inappropriate content; reviewing reports and operating the block feature: our legitimate interests, provided they do not override your fundamental rights and freedoms (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)), and legal obligations.
- Finding and fixing bugs and improving the App's stability and performance: our legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).
- Answering support requests and handling personal data requests: performance of a contract, legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)) and legitimate interests.
- Establishing, exercising or defending legal claims and responding to requests from competent authorities: KVKK Art. 5/2-e and 5/2-ç; GDPR Art. 6(1)(c) and 6(1)(f).
If a processing activity legally requires your explicit consent, we will ask for it separately before that processing starts. You can withdraw your consent at any time; withdrawal does not affect the lawfulness of earlier processing.
We do not use your data for advertising, share it with ad networks, track you across apps and websites, or sell your personal data.
05How we collect your data
We collect personal data electronically, by fully or partly automated means, through the information you enter in sign-up and profile forms, records created while you use the App, your device's location and notification services, App Store purchase records, automatic error reports and emails you send us.
06What other users can see
- CDR users: your username, car details, map car and profile photo, if any.
- Your friends: in addition, summary statistics such as total drives, distance and duration, and the weekly friends leaderboard. Friends cannot see your detailed routes.
- Convoy participants: your live location during the convoy and your convoy results.
- Feed: posts and comments you share, visible to the audience you choose for the post (friends or everyone).
- Nearby drivers: when you turn it on, your location and username as described above.
When you block a user, neither of you can see the other's profile, posts or comments, send each other invites, be in the same convoy, or see each other's live location.
08International transfers
The servers of the providers above may be located outside Türkiye, including in the European Union and the United States. Your personal data is therefore transferred abroad.
These transfers are made in line with KVKK Article 9 and Chapter V of the GDPR. Where appropriate, we rely on safeguards such as standard contractual clauses. Where no appropriate safeguard is available and no other legal condition applies, the transfer is based on your explicit consent so that the Service can be provided.
09How long we keep your data
We keep personal data for as long as the purpose requires and for any period set by applicable law:
- Account, profile, drive, convoy and social data: while your account is open. You can delete individual drives and posts in the App at any time, and you can ask us to delete your other content.
- Nearby drivers location: only while sharing is on; it is deleted as soon as you turn it off.
- Convoy live location points: not stored on the server; they are relayed to participants in real time only.
- Reports and moderation records: for as long as needed to complete the review and for possible legal disputes.
- Error reports: for the limited retention period set by the provider.
- Support correspondence: until your request is resolved and for a reasonable follow-up period.
Data whose retention period has ended, or whose processing conditions no longer apply, is deleted, destroyed or anonymized. Deleted data may remain in system backups for a short, limited period and is then removed from backups as well. Statutory retention obligations are reserved.
10Deleting your account
You can delete your account at any time in the App with the "Delete account" option in your Profile. If you cannot access the App, you can also request deletion by emailing us from your registered email address.
When you delete your account, your profile, drives, convoy records, friendships, posts, comments, push tokens and uploaded photos are permanently deleted, and you are signed out on all devices. This cannot be undone.
If you used Sign in with Apple, you can separately remove the access permission managed by Apple after your CDR account is deleted. The App shows the steps Settings > your name > Sign in with Apple > CDR and a link to Apple’s help page. This extra step is not a condition for deleting your CDR account and data.
Deleting your account does not cancel your App Store subscription. To avoid further charges, cancel your subscription separately in your Apple ID settings. Purchase records that Apple and RevenueCat keep for legal or accounting reasons are subject to their own policies.
Data stored locally on your device (for example, drives not yet uploaded and app preferences) is deleted when you remove the App from your device.
11Your rights
Under KVKK Article 11, you have the right to apply to the data controller to:
- learn whether your personal data is processed,
- request information about the processing,
- learn the purpose of the processing and whether data is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom your data is transferred,
- request correction of incomplete or inaccurate data,
- request deletion or destruction of your data under the conditions in KVKK Article 7,
- request that correction, deletion or destruction is notified to third parties who received your data,
- object to a result against you that arises solely from automated analysis of your data,
- claim compensation for damage caused by unlawful processing.
Where the GDPR applies, you also have the rights of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and withdrawal of consent.
You can send requests from your registered email address to ozanoney@gmail.com. We may ask for additional information to verify your identity. We will resolve your request free of charge as soon as possible and within 30 days at the latest. If the request involves an additional cost, a fee may be charged according to the tariff set by the Turkish Personal Data Protection Board.
If your request is rejected, you find the answer insufficient, or we do not answer in time, you may complain to the Turkish Personal Data Protection Board. If you live in the EEA or the UK, you also have the right to complain to your local data protection authority.
12How we protect your data
We take reasonable technical and organizational measures to protect your data: data is encrypted in transit (TLS), database access is restricted to authorized users with row-level security rules, passwords are stored in irreversible form, administrative access is limited, and error reports are stripped of personal data.
No method of transmission or storage is completely secure. If a data breach occurs, we will notify you and the competent authorities as required by law. Do not share your password with anyone, and tell us immediately if you notice unauthorized activity on your account.
13Children's privacy
CDR is not designed for children under 13, and children under 13 may not create an account. Users aged 13 to 17 need the permission of a parent or legal guardian. If we learn that we have processed data belonging to a child under 13, we will delete it. If you are aware of such a case, please let us know.
15Changes to this Policy
We may update this Policy to reflect changes to the Service or the law. The current version is always published on this page with its last updated date. We will announce material changes in the App or by email before they take effect. If new processing requires explicit consent, we will ask for it separately.
16Contact
Data controller: Ersin Ozan Öneyman
Email: ozanoney@gmail.com
Web: getcdr.app
If there is any difference between the Turkish and English versions of this Policy, the Turkish version prevails.