Last Updated: September 11, 2026

Privacy Policy

Plain-language information regarding privacy principles, data processing, and personal data protection for the gezirota.tr website and travel planner.

Data Controller Gezi Rota TR
Country Türkiye
KVKK / GDPR Email [email protected]
VERBİS Registry Not subject to registration
Website gezirota.tr

1. Scope and Data Controller

gezirota.tr ("Platform" or "Gezirota") is an independent, free, and account-free travel route planner offering comprehensive itineraries for Türkiye, Iceland, and Portugal. Protecting the privacy and ensuring the security of our visitors' personal data is our primary priority.

This Privacy Policy explains our data processing principles when you visit our website or use our route planning tools.

The data controller under applicable data protection laws is Gezi Rota TR. The Platform maintains no physical postal correspondence address or Registered Electronic Mail (KEP) address, and is not subject to VERBİS registration requirements. All privacy communications and statutory requests are handled exclusively by email:

2. Data We Collect

Gezirota strictly adheres to the principle of data minimization and processes only technical data necessary for providing the services:

  • No Accounts or Membership: We do not operate user accounts, registration forms, or login systems.
  • Your Itinerary Stays in Your Browser: The itineraries you build, customize, or save are never stored on our servers. They reside exclusively in your device's local browser storage (localStorage). You may export your itinerary as a JSON file or clear it at any time.
  • Essential Technical Signals: For system security, operational stability, and technical debugging, our servers process page request paths, ephemeral session identifiers (generated randomly and not retained), timestamps, IP addresses, browser/device types, and a maximum of 3 client-side JavaScript error messages per page. IP addresses are never kept as plain text on the server; they are stored encrypted using ChaCha20-Poly1305.
  • "Report a Bug" Form: When you submit feedback or report an error, we process your message (up to 1,500 characters), page URL, an optional reply email address, and optional file attachments (up to 5 files). A technical diagnostic package containing browser/OS details, viewport size, and the last 20 client errors is attached automatically. In this specific workflow, the sender's IP address is reduced to its network subnet (/24 for IPv4, /48 for IPv6) before encryption, ensuring no full IP is stored.
  • "Share Your Route" Form: If you submit a custom itinerary for consideration by our editorial team, we process your name/handle, email address, tour title, summary description, estimated duration, and itinerary data. Your email is used solely for verification and approval/rejection notifications and is never shared with third parties. If rejected, your email address is automatically and irreversibly deleted. If accepted, your name or handle appears as the contributor.
  • AI Route Planning: Free-text travel prompts (up to 500 characters) submitted via "Plan with AI" are transmitted through our server directly to Google's Gemini API. The prompt text itself is not saved in the Gezirota database; only non-personal operational metadata (timestamp, IP, status, and latency) is logged.

3. Cookies and Similar Technologies

gezirota does not set non-essential cookies without your explicit consent. Your consent choices are stored not in a cookie, but as a local record named gzOnay in your browser's localStorage. This record is not transmitted to our servers and remains solely in your browser.

Optional measurement, product analytics, and session recording tools are only activated if you grant consent via the cookie banner. If your browser broadcasts a Do Not Track (DNT) or Global Privacy Control (GPC) signal, optional tools remain disabled by default.

For a detailed breakdown of all cookie types, lifespans, and how to manage your preferences, please see our Cookie Policy.

4. Google Analytics

We use Google Analytics 4, a web analytics service provided by Google LLC, to understand general visitor volume, popular routes, and aggregate usage patterns.

  • Consent-Gated: Google Analytics 4 is initialized strictly when you grant consent to the "Analytics" category. If consent is declined, the script is never loaded and no data is sent.
  • IP Anonymization: IP anonymization is permanently active by default; your complete IP address is never stored on Google servers.
  • Personalized Advertising Signals Disabled: Google Analytics is configured with ad personalization signals switched off.

To opt out of Google Analytics measurement across the web, you may install the official Google Analytics Opt-out Browser Add-on.

For detailed information on Google's privacy practices, visit the Google Privacy Policy.

5. Advertisements (Google AdSense)

Currently, no advertisements are displayed on gezirota. When ad display begins, this section will become effective; advertising cookies will only be activated with your consent if the applicable legislation in your jurisdiction requires consent.

Third party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to users based on their visit to this site and/or other sites on the Internet. Users may opt out of personalized advertising by visiting Google Ads Settings (https://adssettings.google.com). Alternatively, users can opt out of a third-party vendor's use of cookies for personalized advertising by visiting www.aboutads.info.

To learn more about how Google uses information from partner sites and apps, please review How Google uses information from sites or apps that use our services.

6. Third-Party Services

To provide interactive mapping, routing, weather, infrastructure security, and performance services, Gezirota interfaces with the following third parties:

  • Google Analytics 4: Measuring aggregate traffic and general visitor trends (requires "Analytics" consent; IP anonymization enabled).
  • PostHog Cloud EU (Frankfurt, Germany): Measuring user funnels, product interactions, and return visits via a persistent browser identifier (gzUrunKimligi) (requires "Product analytics" consent; session recording disabled).
  • Microsoft Clarity: Analyzing clicks, scrolls, and unmasked form interactions to diagnose usability flaws (requires "Session recording" consent; route form, AI prompt, and bug report email are masked).
  • Google Gemini API: Processing generative AI requests to draft customized itineraries in the "Plan with AI" tool.
  • Open Source Routing Machine (OSRM): Calculating road route distances, geometry, and estimated driving times.
  • Nominatim (OpenStreetMap): Forward address searching and reverse geocoding from coordinates to place names.
  • Map Tiles (OpenStreetMap community): Rendering base map tiles directly in the user's browser.
  • Open-Meteo: Providing open weather forecasts for selected itinerary waypoints.
  • Cloudflare, Inc.: Providing reverse proxy caching, DDoS protection, web application firewall, and Real User Monitoring (RUM).
  • CDN & Font Providers (Google Fonts, unpkg, jsdelivr, sheetjs): Delivering web typography and open-source JavaScript libraries quickly and securely.
  • Purelymail (US): Handling transactional email verification and editorial status notifications for route submissions.

7. Purposes of Data Processing

Personal data is processed for the following defined purposes:

  • Delivering trip planning, route calculation, interactive maps, and weather forecasts,
  • Enabling visitors to build, modify, export, and print their own itineraries in their browser,
  • Maintaining network and information security, preventing abuse, and troubleshooting technical errors,
  • Storing user cookie preferences locally in accordance with legal consent standards,
  • Investigating bug reports, fixing reported bugs, and contacting the user if a reply was requested,
  • Reviewing user-submitted itineraries and publishing approved routes with contributor credit,
  • Measuring product adoption, user journeys, and feature engagement where consent has been granted,
  • Complying with applicable statutory and regulatory legal obligations.

8. Retention and Security

Data is retained only as long as necessary to achieve the specific processing purpose, respecting applicable statutory limitation periods:

  • Consent settings (gzOnay) remain in browser storage until cleared or altered by the user.
  • Server-side encrypted access logs are retained for 730 days (2 years) and deleted thereafter.
  • Where consent is given, Google Analytics 4 data is retained for 2 months, PostHog EU data for 30 days, and Microsoft Clarity session data for 30 days as configured in provider consoles.
  • Bug report logs are targeted for deletion within 30 days; route submissions within 60 days. Rejected route submission emails are automatically and irreversibly deleted.
  • All stored server IP addresses are encrypted; bug report IPs are subnet-masked prior to encryption.

For extensive legal details regarding retention schedules and technical measures, please consult the KVKK Notice & Data Protection Policy.

9. Your Rights

Under Turkish Law No. 6698 (KVKK) Article 11, data subjects possess the right to learn whether data is processed, request information, learn processing purposes, know third-party recipients, request rectification or erasure under Article 7, object to automated results, and claim compensation for unlawful processing damages.

For visitors accessing from the European Union or European Economic Area (GDPR), you hold statutory rights of access (Art. 15), rectification (Art. 16), erasure / right to be forgotten (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and right to object (Art. 21).

To exercise your rights or submit a formal inquiry, please visit our Data Subject Application Guide or email us directly at [email protected].

10. Changes and Contact

We may periodically update this Privacy Policy to reflect evolving regulatory frameworks or platform enhancements. Updates take effect immediately upon publication on this page, and the "Last Updated" date will be updated accordingly.

For any questions or inquiries regarding our privacy standards or personal data practices, please contact: