Karnet privacy addendum
Last updated: 3 November 2026
This addendum is part of the Yelkovan Privacy Policy and covers what is specific to the Karnet app. The data controller, your rights and how to make a request are in the main policy.
In short
- Your GPS location never leaves your phone. When you stamp a place, only which place it is, its district, the time and the photo you took are saved.
- The map and place details are open without an account. To stamp, you create one with Apple, Google or email; we don't ask for your real name, and you appear under a nickname.
- Your account, stamp backup and friendships are kept in Google Firebase, on servers in Europe (Belgium).
- What you share goes out at least 1 hour later, and only to the people you choose.
- Karnet has no ads, no analytics, no crash reporting and no tracking; we don't sell your data.
- You can export your data from the app, and delete your account and everything on the server in one step.
1. Publisher
Karnet is made and published by Yelkovan (Yiğit Özdemir). The app's technical identifier (com.ay.muhur) and the server project's name (muhur-yelkovan) come from the app's earlier working title, "Mühür"; if you see that name on a sign-in screen or in an email, it's the same app.
2. Using Karnet without an account
The map, place details and routes can be used without an account. Your preferences then stay on your phone only, and no personal data goes to our server; map tiles are downloaded from OpenFreeMap (see 11).
3. Location
When you allow it, we use your location only while the app is open ("While Using the App") to: open the map where you are, show nearby places, work out which city you're in, and check that you're near the place when you stamp. That check happens on your phone. Location is not used in the background.
Your coordinates (latitude, longitude) are never written anywhere and are never sent to our server. A stamp is saved with the place's identifier, its district, the time and the photo. If you have an account, this record (which place you stamped and when) goes into your backup and appears in the posts you share (see 6).
If location accuracy is low or the device reports a fake location, the stamp is saved as "pending". Only the stamp's status goes to the server, not these measurements.
Private zone: under Settings › Privacy layers you can mark places near your home or work. Stamps there are never shared, postcards and joint stamps don't open, and they don't count towards your regulars. For the private zone we store only the identifiers of the places you marked, not coordinates.
4. Camera and photos
A photo is taken only with the app's own camera, when you take it; no audio is recorded. The app doesn't read your photo library. On iPhone, permission to add to Photos is asked only when you choose to save a share card or your photos. Whether a photo is too dark or blurry is measured on your phone. The app doesn't add location data to photos.
Photos are stored on your phone. If you have an account, your stamp photos are uploaded to an area only you can access, for backup (see 8). Photos you share, send as a postcard or appeal with are also uploaded to an area recipients can open through a private link, and are deleted after 120 days.
Take care that other people's faces aren't in your photos. With "Face reminder" on, the app reminds you before sharing; it doesn't scan photos for faces.
5. Account
Stamping, friends, the feed, postcards, the leaderboard and backup need an account. You sign up with Apple, with Google, or with an email and password. Google Firebase Authentication creates a user ID (UID) and stores your email address. Sign in with Apple asks only for your email; you can choose Apple's private relay address. With Google sign-in, Firebase also keeps the name and profile photo link from your Google account in the sign-in record; Karnet doesn't show or use them. Your password is never sent to us in plain text.
An account created with email is verified with a 6-digit code sent from info@yelkovan.ai. The code is valid for 10 minutes; it isn't stored as plain text on the server, and code records are deleted after 7 days.
A profile record linked to your account is kept in Google Cloud Firestore: your nickname, your friend code and the date the account was created. Nicknames are checked on the server for inappropriate words.
6. Friends and sharing
Friendships are made with a friend code; nobody can add you without it. People who added you see your "Everyone" posts; when you've both added each other, you're mutual friends.
A stamp you add to the feed (photo, place, time, status), a postcard (photo, place, a single emoji; no text) and a joint stamp request are delivered through our server after the delay you chose (at least 1 hour); the server gives them to nobody before then. "Everyone" goes to the people who added you, "Friends" only to your mutual friends; "Only me" is never sent. Postcards and joint stamps are only between mutual friends. Feed posts are deleted from the server after 30 days, received postcards and joint stamp requests after 90 days; a postcard is downloaded to the recipient's phone.
Reactions (a single emoji) show to the post's owner and recipients as counts; who reacted isn't recorded.
Report and block: every post and postcard has "Report". A report is saved without the reporter's identity, with the post's identifier, the reported nickname and the reason, and is reviewed by us. When you block someone, the friendship is removed in both directions and mail between you stops.
Appeals: if you appeal a pending stamp, the stamp record (place, time, reason) and your photo are sent to the server for a person to review.
7. Leaderboard and regulars
Your season points, your district and how your name appears are kept on the server. Everyone with an account can see the leaderboard; people who aren't your friends see your initial by default (Settings › Privacy layers › Your name to non-friends). Pending stamps don't count on the leaderboard.
For the regulars title, only the number of days you stamped in each district over the last 60 days is sent; no dates or times. Only your mutual friends see these counts.
8. Backup
While you have an account, your stamp records, posts, postcards, joint stamps, appeals, some preferences (nickname, passport number and cover, privacy layers, blocked users) and your photos (stamp photos and postcards you received) are backed up in Google Cloud Firestore and Cloud Storage, accessible only to you. They come back when you sign in with the same account on a new phone. Language, permission explanations and the intro are not backed up. The backup stays until you delete your account.
9. Notifications
Streak, weekly quest, on-this-day-last-year and seasonal print reminders are scheduled and written on your phone; nothing goes to the server for them.
For notifications from friends (postcard, joint stamp request, ink reaction, regulars title), Firebase Cloud Messaging creates a device token. The token is stored in your profile record together with the app's language, your time offset (to respect quiet hours, 22:00–09:00) and the platform (at most 5 devices). These notifications contain no place names or location, and don't say who reacted. The token is deleted when you sign out or turn off "From friends"; notifications that couldn't be sent are deleted after 2 days. You can turn notifications off under Settings › Notifications or in your device settings.
10. Weather
To know whether it's snowing or raining when you stamp, only the name of the district you stamped in is sent to our server. Our server gets the weather for that district's centre point from MET Norway (the Norwegian Meteorological Institute); your IP address and location don't go to MET Norway. Only "rain" or "snow" is saved with the stamp.
11. Map and place details
The map is drawn with OpenStreetMap data served by OpenFreeMap. As you move the map, your phone downloads that area's map tiles from OpenFreeMap; in these requests OpenFreeMap sees your IP address and the requested area. Your location isn't sent to OpenFreeMap separately. Place names and details (OpenStreetMap, Wikidata, Overture Maps) and place photos (Unsplash, Wikimedia Commons) come inside the app; no separate requests are made for them.
12. Security
To accept requests only from the genuine Karnet app, we use Firebase App Check: Apple App Attest (or DeviceCheck) on iPhone and Google Play Integrity on Android produce a short-lived proof that the app and device haven't been tampered with. Every connection to the server is encrypted (HTTPS/TLS). Server logs are kept for 7 days and contain no user ID or email. Under the database security rules, only you can read your profile, inbox and backup through the app.
13. What we don't use
- No ads, no advertising identifier and no tracking; iPhone never asks for tracking permission.
- No analytics or crash reporting software (SDK) in the app.
- No in-app purchases or subscriptions; Karnet is completely free.
- The app doesn't access your contacts, microphone or calendar, and doesn't use location in the background.
- We don't sell your data or share it for advertising.
14. Service providers
| Provider | What for | When |
|---|---|---|
| Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Messaging, App Check) | Account, profile, friendships, sharing, backup, notifications, security | While you have an account |
| Apple (Sign in with Apple, notification service, App Attest) | Sign-in, iPhone notifications, device proof | If you sign in with Apple; on iPhone |
| Google (Google Sign-In, Play Integrity) | Sign-in, Android device proof | If you sign in with Google; on Android |
| Email service (info@yelkovan.ai) | Verification code email | When you sign up with email |
| MET Norway | Weather forecast (district centre only, from our server) | When you stamp |
| OpenFreeMap | Map tiles | When you use the map |
Firestore, Cloud Storage and Cloud Functions run in the European Union (Belgium). Firebase Authentication and Cloud Messaging run on Google's global infrastructure; their data may be processed in other countries, including the United States. International transfers and legal bases are in the main policy.
Privacy policies: Google · Firebase · Apple · MET Norway · OpenFreeMap
15. Retention
| What | How long |
|---|---|
| Stamps, photos and preferences on your phone | Until you delete them or remove the app |
| Account, profile, friendships, backup and stamp photos | Until you delete your account |
| Feed posts | 30 days |
| Received postcards and joint stamp requests | 90 days |
| Shared photos | 120 days |
| Delivery queue | 7 days |
| Email codes | 7 days |
| Notifications that couldn't be sent | 2 days |
| Closed appeals and reports | 180 days |
| Server logs | 7 days |
16. Export and deletion
- Settings › Export my data: all your data and your own photos as files, free.
- Settings › Account › Delete account: everything on the server and the data on this phone. Details: Karnet account and data deletion.
- Sign out on this device: the data on this phone is deleted; your backup stays on the server.
- Erase all data (Profile and Settings): everything on this phone; if you're signed in, you're signed out first and the backup stays on the server.
Your rights of access, correction and objection, and how to make a request, are in the main policy and the KVKK notice.
17. Children
Karnet is not directed at children under 13. General rules about children are in the main policy.