Privacy Policy
Last updated: July 25, 2026
1. Who we are (Data Controller)
Jouvida ("Jouvida", "we", "our", or "us") is an independent project that operates the Jouvida website at jouvida.com and the Jouvida mobile application (together, the "Service"). The website is supported by third-party advertising (Google AdSense). For the purposes of the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK), Jouvida is the data controller for personal data processed through the Service.
For any privacy question or to exercise your rights, contact us at mustafasahin307@gmail.com.
2. What data we collect
Account data (only if you sign in): you can create an account with an email address and password, or with Google or Apple Sign-In — in which case we receive your email address and display name from them. We store your email address and, if you provide one, a display name. Browsing Jouvida does not require an account.
Profile details you choose to add: a username, a short bio, a profile photo you upload, and — so the travel information cards can tell you which visa and entry rules apply — your country of residence and the country that issued your passport. All of these are optional, you can edit or clear them at any time on your account page, and they are visible only to you. Jouvida has no public profiles and no social feed.
Content you create: the destinations you save, collections and trips you build, places you mark as visited, and any notes you add.
Approximate location: only if you grant permission, we use your approximate location on your device to show nearby destinations. It is processed in your device/session and is not stored on our servers.
Technical & usage data (website): subject to the consent rules in section 5, Google Analytics collects standard analytics data (pages viewed, approximate region, device/browser type, referring page). Your hosting provider also processes server logs (e.g. IP address) as needed to deliver and secure the site.
Crash reports (mobile app): when the app crashes, Google Firebase Crashlytics sends us a technical report so we can fix it: the error and the code path that produced it, plus your device model, operating-system version, app version and a randomly generated installation identifier. It contains nothing you typed, saved or looked at, and is not used to profile you or to advertise. We rely on our legitimate interest in keeping the app working; reports are retained for up to 90 days.
Usage data (mobile app): the Jouvida app can use Google Firebase Analytics to record which screens are opened and basic device information (device model, operating-system version, app version, country, and a randomly generated app-instance identifier). The app shows no advertising and does not track you across other apps or websites. In the EEA, the UK and Switzerland this collection is off until you switch it on in Settings → Usage analytics; elsewhere it is on by default and the same switch turns it off.
Advertising data (only with your consent): the website shows ads via Google AdSense. When you accept advertising cookies, Google and its partners may use cookies and similar identifiers, together with your IP address and interaction data, to serve and measure ads — including, for personalised ads, based on your prior visits to this and other websites. You can review and control this anytime at adssettings.google.com and aboutads.info/choices.
Local storage on your device: we store your theme choice, your cookie-consent choice, and (when not signed in) your saved places and last map position in your browser's local storage. This stays on your device.
3. Legal bases for processing (GDPR Art. 6)
- Consent — analytics and advertising. On the website, where consent is legally required (the EEA, the UK and Switzerland) Google Analytics and AdSense cookies stay switched off until you accept them in the consent message. In the mobile app, analytics is off until you switch it on in Settings in those same regions. You can withdraw consent at any time.
- Performance of a contract — creating and operating your account and saving your content so the Service works for you.
- Legitimate interests — keeping the Service secure, preventing abuse, and ensuring it functions reliably (essential cookies/local storage and server logs); and, outside the regions listed above, measuring aggregate usage and funding the Service with advertising.
4. How we use your data
- Provide the map, search, destination pages, collections and trips
- Create and manage your account and your saved content
- Understand aggregate usage to improve the Service (only with consent)
- Show advertising that helps keep the Service free, via Google AdSense (only with consent)
- Keep the Service secure and prevent misuse
We do not sell your personal data. We show third-party ads through Google AdSense, which — only if you consent to advertising cookies — may personalise ads based on your activity; you can opt out of personalised ads at any time (see section 5).
5. Cookies, analytics & advertising
We use a small number of essential cookies / local-storage items that are required for the site to work, plus Google Analytics and Google AdSense advertising cookies.
In the EEA, the UK and Switzerland no analytics or advertising cookie is set before you accept: Google's certified consent message appears on your first visit and the tags stay blocked until you decide. Ads are served non-personalised until you accept advertising cookies. Elsewhere, where local law does not require a prior consent step, these cookies are set without a prompt — you can still block them in your browser and opt out of personalised advertising at adssettings.google.com.
Where the consent message applies, you can change your choice anytime via the “Manage cookies” option in our Cookie Policy, which also lists every cookie in full.
6. Service providers (processors)
We rely on a few trusted providers that process data on our behalf:
- Supabase — database, authentication and storage. Our data is hosted in the EU (eu-west-1, Ireland).
- Vercel — website hosting and content delivery (server logs).
- Google Sign-In and Apple Sign-In — authentication, if you choose to log in.
- Google Analytics (website) and Google Firebase Analytics (mobile app) — usage analytics, subject to the consent rules in section 5.
- Cloudflare R2 — storage and delivery of the destination photographs (your IP is visible to the image server to deliver the picture).
- Google AdSense — third-party advertising, only with your consent. Google and its advertising partners use cookies to serve and measure ads, and to personalise them based on your prior visits to this and other sites; manage this at adssettings.google.com. See Google's how Google uses information from sites that use its services.
- OpenFreeMap — map tiles (your IP is visible to the tile server to deliver the map).
- YouTube (privacy-enhanced “no-cookie” mode) — destination videos are embedded via youtube-nocookie.com, which does not set tracking cookies unless you play a video.
Each provider processes data under its own privacy terms and our instructions.
7. International transfers
Your primary data is stored in the EU. Some providers (e.g. Google, Apple, Vercel) may process data outside the EU/EEA, including in the United States. Where that happens, transfers are covered by appropriate safeguards such as the European Commission’s Standard Contractual Clauses and/or the EU–US Data Privacy Framework.
8. How long we keep data
We keep your account and content for as long as your account is active. If you delete your account, your personal data is permanently deleted (see section 10). Analytics data is retained in aggregate for a limited period in line with Google Analytics settings. Local-storage items remain on your device until you clear them.
9. Your rights
Under the GDPR and KVKK you have the right to:
- access the personal data we hold about you
- rectify inaccurate data
- erase your data ("right to be forgotten")
- restrict or object to processing
- data portability
- withdraw consent at any time (e.g. for analytics)
To exercise any of these, email mustafasahin307@gmail.com. You also have the right to lodge a complaint with your local data protection authority (in the EU, your national supervisory authority; in Türkiye, the Personal Data Protection Authority — KVKK).
10. Deleting your account & data
If you have an account, you can permanently delete it and all associated data yourself from your account page (Account → Delete account). Deletion is immediate and irreversible. You can also email us and we will complete any deletion request within 30 days.
11. Children
The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.
12. Security
Data is stored using Supabase infrastructure with row-level security and encrypted connections. No method of transmission or storage is completely secure, but we take reasonable measures to protect your data.
13. Changes to this policy
We may update this Privacy Policy from time to time. We will revise the “Last updated” date above and, for material changes, provide a notice within the Service.
14. Attribution
Photo, map and icon credits — and how to report a copyright concern — are listed in our Legal Notice.