Privacy
Translated from Turkish with Google Translate. The Turkish source text is available through the language menu.
This policy explains how personal data of users of the Khopilot application is collected, processed, and protected. Khopilot is a driving copilot that offers motorcycle and car drivers real-time navigation assistance, curve warnings, legal speed information, IMU-based driving scoring, community notifications, and route discovery.
The operator and data controller is Şahin Uygutalp, an individual providing KHOPILOT in Türkiye. Contact: info@khopilot.com. Correspondence address: __________ · Additional contact: __________
Microsoft Clarity · 1.0.2
In version 1.0.2, Help improve the app lets you choose optional Microsoft Clarity analytics. Participation defaults off and existing choices are preserved. The integration is restricted to selected non-driving screens while the app is in the foreground and confirmed Wi-Fi is available. Microsoft reconstructs session replays from masked screen layouts and tap/gesture interactions; processing may include device and app information, performance data, SDK identifiers and approximate country/region derived from IP addresses. Khopilot does not send your account ID, email, precise GPS location or ride telemetry as Clarity custom tags. Turning participation off in Settings stops future collection; it does not automatically delete previously submitted records. Contact support for access/deletion requests about existing records. Microsoft may process data abroad; its privacy and retention information is linked below.
Microsoft Privacy Statement · Microsoft Clarity: Data retention · info@khopilot.com
1. Data We Collected
1.1 Location Data (Including Background)
Khopilot requests continuous location access in the background when initiating active driving recording. This permission is essential for the following functions: driving recording and route creation (with the screen locked), real-time curve warning and conservative geometry reference, legal speed limit detection, route refresh and route discovery, and Live Activity/CarPlay integration. Without this permission, these features may not work.
Optional Smart Destinations: Learning visits between drives is also enabled and requires iOS Always Location permission. At least 10-minute stops are learned from infrequent updates. Locations, routines, and estimated home/work tags remain on the device; you can modify or delete tags. The immediate vicinity of a deleted location is excluded from being learned again. This feature does not perform ad profiling. iOS can pause background updates.
Separate community discovery contribution: This can also be enabled separately from the Smart Destinations screen; previously granted location permission does not automatically enable this option. Daily unique contributions per account are for stops of at least 3 minutes at a known catalog point of actual driving, excluding private areas. Only if at least 5 different people contribute will a 30-day aggregate signal be reflected in the suggestions. Contribution records are kept for a maximum of 90 days; deactivating the option deletes the person's visit contributions. Visitor lists, personal routines, or visit times are not made public.
1.2 Motion and Sensor Data
Accelerometer/gyroscope (IMU) data is used for roll angle, G-force, and ride score; calculations are performed on the device during normal use. The “Share diagnostic data” option in Settings is off by default. If you explicitly enable this option, detailed sensor, position, ride-motor, and application events are sent to the Khopilot server for error analysis. Disabling the option stops new data collection and deletes any diagnostic queue on the device that has not yet been sent. Diagnostic files received by the server are kept for a maximum of 30 days. IMU-based features will not work without the "Motion & Fitness" permission.
1.3 Account Information
Required: username, encrypted password (hash). Optional: email, phone number, vehicle profile. If logging in with Apple/Google, a provider-specific identifier is used; your password is not accessible.
1.4 Driving Data
The recorded route (GPS coordinate sequence), date/time, duration, distance, average/maximum speed, lean angle, G-force, and ride score are all included. Shared rides are only visible to the community to the extent you select.
1.5 Community and Social Data
Profile information, following/follower relationships, favorite routes, lists, community notifications, and personal development logs.
Visibility and stages: New profiles start privately. Profile and ride visibility are separate; you can make the ride visible to everyone, approved followers, or only to yourself. The stage result, calculated separately from the entire ride, contributes to ranking with a masked name in private profiles or private rides; the entire private ride and account link are not shown. Such identities are pseudonyms, not anonymous. By default, 100 meters around the predicted private locations are hidden; this can be changed from the sharing preview. Your full record is preserved. Closing the share cancels the old link.
1.6 Notification Token
Apple APNs store your device token for sending push notifications; you can revoke permission at any time from iOS settings.
1.7 Purchase and Subscription Data
Subscription transactions are made through the Apple App Store and managed by RevenueCat. Khopilot does not have access to your credit card information; this information is processed by Apple. Only subscription status and an anonymized user ID are shared with RevenueCat.
1.8 First-Party Product Interaction
Product events (e.g., app launch, meaningful drive completion, road-ahead use case, paywall view, and offline zone download result) with a randomly generated persistent app/device ID are sent to the Khopilot server to measure whether the application is working and which flows are generating value. These events do not include GPS coordinates, route name or track, text-to-speech, email/phone, or vehicle make and model. Simulator/test events are also flagged and not included in actual user metrics. This first-party measurement is not cross-app ad tracking and is not sent to a third-party ad SDK.
2. Purpose of Processing and Legal Basis
Your data is processed not with malicious intent, but for the purpose of enabling the application to function, providing safe driving assistance, and improving the service.
| Data | Purpose of Processing | Personal Data Protection Law (KVKK) | GDPR |
|---|---|---|---|
| Location (background) | Driving log, curve warning, legal speed, route | Article 5/2(c) | Article 6(1)(b) |
| IMU / motion sensor | Lean angle, driving score | Article 5/2(c) | Article 6(1)(b) |
| Account information | Identity verification, profile | Article 5/2(c) | Article 6(1)(b) |
| Driving data | Recording, statistics, score, sharing. | Article 5/2(c) | Article 6(1)(b) |
| Community announcements | Accident/radar sharing | Article 5/2(f) | Article 6(1)(f) |
| Notification token | Push notifications | Article 5/1 — consent | Article 6(1)(a) |
| Subscription status | Premium access management | Article 5/2(c) | Article 6(1)(b) |
| First-party product interaction and random device identification. | Service reliability, activation and repeat usage measurement. | Article 5/2(f) | Article 6(1)(f) |
| Optional detailed diagnostics | Error analysis, measurement verification | Article 5/1 — consent | Article 6(1)(a) |
Khopilot does not sell your data to advertisers and does not share it with third parties without your permission.
3. Third-Party Service Providers
| Provider | Aim | Data Transferred |
|---|---|---|
| Apple Inc. | App Store, APNs, Sign In with Apple, CarPlay, IAP | Device token, anonymous identity, purchase record. |
| RevenueCat | Subscription management | Anonymous user ID, subscription status |
| OpenStreetMap | Map, route, location information | Location query (real-time) |
| Apple Weather | Real-time weather and forecast. | Real-time location; the query is made via WeatherKit on the device. |
| Mapzen Terrain Tiles / AWS Open Data | Route slope and elevation sampling | The map tile address required by the Khopilot server; account ID is not transferred. |
| Server infrastructure | Backend, API, database | Account, driving, community data (encrypted) |
4. Storage Times
| Data | Duration |
|---|---|
| Account and profile information | While your account is active or until you delete the relevant record. Confirmed account deletion in the app is a permanent deletion request; no 30-day cancellation or restoration period is offered. |
| Saved rides/routes | As long as the account is active or until you delete it. |
| Community announcements | Maximum 24 hours |
| Notification tokens | Account active / until permission is revoked. |
| Subscription records | 5 years (trade/tax legislation) |
| First-party product interaction records | Maximum 180 days; older records are deleted with weekly automatic retention. |
| Optional detailed diagnostic files | Maximum 30 days; deleted when the unsent queue option on the device is disabled. |
| Support emails | 2 years |
5. Your Rights Under the Personal Data Protection Law (Türkiye)
In accordance with Article 11 of Law No. 6698 on the Protection of Personal Data (KVKK): you have the rights to obtain information, access, learn the purpose of processing, information about data transfer, correction, deletion/destruction, notification, objection, and compensation for damages. You can send your requests to info@khopilot.com; they will be answered within 30 days at the latest.
6. Your Rights Under GDPR (EU/EEA)
Under GDPR 2016/679, you have the rights to: access (Article 15), rectification (Article 16), erasure/"right to be forgotten" (Article 17), restriction of processing (Article 18), data portability (Article 20), objection (Article 21), and withdrawal of consent; you can also lodge a complaint with your local data protection authority.
7. Account and Data Deletion
Request account deletion through the app's account settings or the support address. Confirmed account deletion is permanent; no 30-day cancellation or restoration period is promised. The deletion scope, any legally required retention exceptions and separate management of subscriptions are explained in the Privacy Notice and the relevant action screen.
By email: Please write to info@khopilot.com with the subject line "Account Deletion Request"; it will be processed within 30 days at the latest.
8. Children's Privacy
The content of the Khopilot app is suitable for all ages. However, account creation, subscriptions, and features that process personal data are intended for users aged 18 and over. If we become aware that personal data (account information, location, driving records, etc.) has been collected from a person under the age of 18 without the consent of a parent or legal guardian, we will immediately delete that data. If you believe your child has provided us with data, you can write to info@khopilot.com.
9. Security Measures
All communication between the application and the server is encrypted using TLS/HTTPS. Passwords are not stored in plain text (bcrypt/Argon2). Detailed IMU and location identification are only sent with the default closed/open consent option in section 1.2. Role-based access control is implemented on the server side. For vulnerability reporting: info@khopilot.com.
10. International Data Transfer
Khopilot is a Turkey-based service; data is primarily processed in Türkiye. Some data may be transferred abroad due to third-party providers (Apple, RevenueCat, and AWS Open Data); within the framework of applicable safeguards (SCC, etc.) as per Article 9 of the Turkish Personal Data Protection Law and the GDPR.
11. Policy Changes
We may update this policy from time to time. Significant changes will be notified in-app and the "Last updated" date will be updated.
12. Communication
For questions regarding this policy: Email: info@khopilot.com (Subject: Privacy / GDPR Request). All requests will be answered within 30 days at the latest.
Khopilot © 2026 · All rights reserved. This policy has been prepared in Turkish; in case of conflict between translated versions, the Turkish text shall prevail.