Privacy Policy

Who we are

Controller: Barış Durmaz. Address: 9165/2 Sok. No:16 D:4 Doğanay Mh. Karabağlar/İzmir/Türkiye. Privacy requests: privacy@vuff.app.

What we collect

• Account: your email, name, username, up to three profile photos, bio and city (chosen from a list). If you sign in with Apple or Google, they share your name and email with us (Apple can hide your real email).
• At sign-up we ask for your date of birth to confirm you are 18 or older. It isn't shown on your profile or to other members, and you can't change it yourself. We don't verify your age with a document. Accounts opened before 25 October 2026 gave an 18+ self-declaration instead, which we keep with its wording version and time.
• Your dogs: name, breed, age, sex, weight, photo and the care details you add, such as your vet’s name and phone number and health and behavior notes.
• What you share: routes with their photos, comments and likes; group walks with their photo galleries, comments and likes; map alerts and your votes on them; lost pet listings (photos and a short video, whose sound the app removes before upload) and sightings; adoption listings and applications; walk reviews; direct and group messages, including photos and reactions; support requests, reports and appeals.
• Your connections: who you follow, who follows you, follow requests, people you block, people you walked with and groups you’re in. If you invite a friend, you pick one number with the iOS contact picker and it goes only to your Messages screen; we don’t upload your address book.
• Location: see the next section.
• Vuff does not collect identity documents, selfies or criminal-record information, and does not check anyone’s identity or background.
• Device: a push notification token, your notification settings, your time zone and the app version. When you sign up, sign in or reset your password, Cloudflare Turnstile checks that you are a person (Cloudflare’s Turnstile Privacy Addendum: cloudflare.com/turnstile-privacy-policy).
• Not in this version: stories, pet care and training listings, mating listings, organization accounts and paid subscriptions aren’t available in the current app. If we bring any of them back, we will update this policy first.
• Existing purchases: we don’t sell subscriptions in this version. If the App Store still delivers a Vuff subscription transaction for your Apple account, such as a renewal or refund, the app sends it to our server, which checks it with Apple and keeps the product, status, dates and transaction ID with your account.
• Profile views: if you open the profile of a professional account from an earlier version, we record the view with your account ID for 30 days so that account can see its view totals.

Your location

Your current exact location is not shown on a public people map. A route you publish shows its path to your chosen audience. Other members only ever see a city, place, chosen pin or approximate area, as described below.

• Walking Mode: while a walk is running, your phone sends its exact location to Vuff about once a minute, also with the screen locked (iOS shows the location indicator). We use these points only to confirm who really walked together and how far you went; no one else sees them, and they are deleted when the walk ends. Your walk history keeps who you walked with, for how long, your distance and the city. When you enable visibility on the Nearby list, your profile can be discovered according to the app’s nearby distance preferences. The list displays approximate distances, and you can change the distance preference. This visibility is a separate control from sharing a walking route with the audience you choose.
• Lost pet alerts: while they are on, we keep only your most recent location, rounded to about 100 m, for at most 24 hours, so we can tell you about a lost pet near you. Turning lost pet alerts off deletes it.
• Rain reminders: if you turn them on, the app sends your approximate location, rounded to about 1 km, and your time zone. Our server keeps it for at most 3 hours and sends it to Apple WeatherKit to check for rain before your walk, without your name or account ID. Turning rain reminders off deletes it.
• Routes: your path is recorded on your phone only while you record a route, also with the screen locked, and reaches Vuff when you save the route. A route you publish shows its path to the audience you choose; you can keep any route to yourself.
• Group walks, lost pet listings and map alerts use a point you pick on the map, not your phone’s location.
• Photos and videos: location and camera details are removed on your phone and again on our servers before anything is shared.

Messages

Messages are not end-to-end encrypted. We don’t read private messages on our own. Our safety team reviews a conversation when someone reports it, or when an automatic check flags words often used in scams, such as payment requests in chats about a lost pet listing.

• Messages aren’t deleted just because they get old. They stay until you or Vuff remove them, or an account is deleted.
• “Delete for me” hides a chat or a message only for you; the other person keeps their copy. You can delete your own message for everyone within 48 hours.
• If you delete a message for everyone, or moderation hides it, we keep a hidden copy for 30 days so it can still be reported.
• When a message is reported, we keep a copy of it as it was at that moment until one year after the report is resolved.
• When a group walk ends, its chat becomes read-only; its members can still read it.

Automatic checks

Some words are blocked automatically in group names and group messages, group walk titles, and route names, descriptions and comments; text that matches isn’t posted. Private messages aren’t checked this way, apart from the scam check in chats about a listing. Content that several people report may be hidden while we review it. Warnings, feature limits and suspensions are always decided by a person. To ask for a person to review an automatic decision, write to privacy@vuff.app.

Why we use it

• To run Vuff for you: your profile, walks, routes, group walks, chats, listings, map alerts and notifications (to perform our contract with you).
• To send the lost pet alerts and rain reminders you turned on.
• To keep people and dogs safe: moderation, reports, scam warnings, bot checks and preventing abuse (our legitimate interest and legal obligations).
• To answer support requests and send account emails, such as confirmation, password reset, deletion and data export.
• To suggest people to follow and order search results: suggestions favor accounts that follow you, people in your city and accounts with a dog, and search places accounts you follow higher (our legitimate interest).
• To understand and run the service: our team sees statistics calculated from account data, such as sign-ups, completed onboarding, account types and status, top cities, dog breeds, memberships and how quickly support requests are answered (our legitimate interest). We calculate these ourselves, without a third-party analytics service.
• We don’t show ads, we don’t sell your data and we don’t use third-party tracking or analytics.

Who we share it with

• Other Vuff members see what you choose to share, with the audience you choose. A private account’s routes and follow lists are visible only to people you approve; group walks and listings you post stay visible to all members.
• Supabase processes account, content, location and message data for Vuff. Resend delivers account emails. Cloudflare hosts the website, routes contact email and provides bot protection; it also acts as a controller for signals used to improve Turnstile. Apple provides sign-in, push delivery, maps and weather (WeatherKit, for rain reminders); Google provides optional sign-in, Maps links and the Gmail inbox receiving website contact messages. GIF search (KLIPY) is off in this version. Provider roles and processing countries depend on the service.
• Each provider receives only what it needs for its part of Vuff and handles it under its data processing terms. Apple and Google also act under their own privacy policies for sign-in, maps and weather.
• Authorities, when the law requires it, for example on a court or prosecutor’s request, or to protect someone’s safety.

Transfers outside Türkiye

Supabase hosts our database, authentication and files in Frankfurt, Germany. Its contracting entity is in Singapore; support, CDN and other processing may occur in further countries. Resend, Cloudflare, Apple and Google also process data outside Türkiye. The safeguards and any required contract or notification documentation for these services’ international transfers have not yet all been verified. For the current status or to exercise your data rights, contact privacy@vuff.app.

Security

Data is encrypted in transit, and our hosting provider encrypts it at rest. Only the people who need it can access our systems, with multi-factor authentication. Each member can reach only the data the app shows them; our servers enforce this, not just the app.

How long we keep it

• We don’t delete your account or content just because time passes or you haven’t used Vuff for a while. Your profile, dogs, messages, routes, walk history, group walks and listings stay until you remove them or delete your account. You can delete your account at any time in Settings.
• Short-lived data is deleted automatically: Walking Mode points when the walk ends, nearby-walk lookups after 24 hours, your lost pet alert location after 24 hours, your rain reminder location after 3 hours, read notifications 30 days after they arrive and all notifications after 90 days.
• Lost pet listings are active for 7 days and you can renew them for free; adoption listings are active for 6 months. When the period ends, a listing leaves the active lists but stays in your history until you delete it.
• When you ask to delete your account, it is closed and hidden straight away, and you have 30 days to change your mind: sign in and choose Keep my account (signing in alone doesn’t cancel it). After that your account is deleted for good. If you use Sign in with Apple, deleting your account also revokes Vuff’s access to your Apple ID.
• Some things stay without your name after deletion, shown as “Deleted user”: messages you sent stay in the other person’s chat history, and lost pet sightings and reviews stay with their listing or walk. Removing the profile link doesn’t change what you wrote inside a message. Your username stays reserved so no one can impersonate you.
• If the date of birth you give shows you are under 18, your account is deleted straight away and we don't keep your date of birth. Until your 18th birthday we keep only a one-way scrambled (hashed) form of your email address, so the same address can't be used to sign up before then.
• You can appeal an eligible moderation decision within 180 days. Evidence in a reported case may be retained for up to one year after that case closes.
• Your data download file can be downloaded for 7 days after it’s ready.
• These periods say when cleanup is due; scheduled jobs can take a little longer to finish. Our providers’ logs and backups follow their own cycles.

How to exercise your rights

• In the app, use Settings → Download your data or Delete account, or edit your profile to correct your details. For other requests, email privacy@vuff.app from the email address registered to your Vuff account.
• If you write from another address, we verify that the request is yours before sharing or changing account data, for example by asking for confirmation through your account or registered email. We do not ask for a copy of an identity document.
• We handle your request free of charge and reply as soon as possible, within 30 days of receiving it.
• Under KVKK Article 11, you can ask whether we process your personal data, request information about it, learn its purposes and whether it is used for those purposes, and learn who receives it in Türkiye or abroad. You can request correction of incomplete or inaccurate data, deletion when the legal conditions are met, and notification of corrections or deletions to recipients. You can object to a result against you produced solely by automated analysis and seek compensation for damage caused by unlawful processing.
• If you are in the EU, the GDPR also gives you rights to restrict processing, data portability and objection, where applicable, alongside access, correction and deletion.
• Your download is a ZIP with data.json containing your account, dogs, content, routes, walks, listings, settings and related records, plus your own available media files. Direct chats include the other participant's messages as conversation context; group chats include only your own messages. You can request a download once per 24 hours after confirming your identity again. The file is available to download for seven days after it is prepared; this is the access period, not a guarantee of physical erasure of every copy.
• When you request account deletion, your account closes and becomes invisible immediately. Within 30 days, choose Keep my account to cancel the request; signing in alone does not cancel it. After that window, the scheduled job permanently deletes your account. Messages you sent can remain in the other person's chat history without a link to your profile.
• Our word filter automatically rejects content containing certain words in places such as group names, event titles, routes and comments. This word-rejection filter does not scan direct messages. You can ask us to review a rejection or other automated result through in-app support or privacy@vuff.app.
• If our reply is inadequate, or you receive no reply within 30 days, you can complain to the Turkish Personal Data Protection Board within 30 days of learning our reply and in all cases within 60 days of your application. If you are in the EU, you can also complain to the data protection authority in your country.

Age

Vuff is for people aged 18 and over. If we learn that an account belongs to someone under 18, we delete it.

vuff.app

The contact form sends your name, email and message to our team. The site remembers your language choice in your browser and uses your country only to pick a language. Cloudflare Turnstile checks the contact form for bots. We use no tracking cookies.

Website contact form messages (name, email and message) are sent by our Cloudflare Worker to vuffapp@gmail.com, a Google Gmail inbox. Email sent to info@vuff.app or privacy@vuff.app is separately forwarded there by Cloudflare Email Routing. Cloudflare processes the form request IP for rate limiting and bot verification.

Traffic metadata under Law No. 5651

Under Law No. 5651, we keep traffic metadata for one year: your account ID, IP address, time and type of action, and the affected record's identifier. Message text, other content and location are not copied into this log. Account deletion does not shorten this period. Daily cleanup removes records older than one year plus one day. We disclose these records only in response to an authorized judicial authority's request supported by a court decision.

Changes

If we change this policy in a meaningful way, we will tell you in the app before the change takes effect.