Map & More privacy addendum
Last updated: 3 November 2026
This addendum is part of the Yelkovan Privacy Policy and covers what is specific to the Map & More trip planner. The data controller, your rights and how to make a request are in the main policy.
In short
- Your trips, bags, closet and photos are stored on your phone first. Once you sign up, they are all backed up to your account, and only you can access the backup.
- For day plans and stay suggestions, the city, dates, number of days, your interests, pace and language go to our server; OpenAI's model writes the suggestions. Your name, email and account ID are not sent with these requests.
- The app has no ads, analytics, crash reporting or tracking. We don't access your location (GPS).
- You can delete your account in the app or by email; deleting in the app happens immediately.
1. Publisher
Map & More is developed and published by Yelkovan (Yiğit Özdemir).
2. What is kept on your phone
Everything you enter in the app is stored on your phone: trips and day plans, packing lists, expenses and your travel companions' names, travel documents (type, note, booking code, expiry date), trip notes, your closet, ready-made bags and your settings (language, home city, units, notification preferences). Photos you add to your closet are picked from your gallery, resized and stored in the app's folder. For the home screen widget and the live ticket on the lock screen, a summary of your next trip is written to a shared area on the phone. None of this is used for ads or analytics.
3. Account
You need an account to see your plan. You sign up with Apple, Google or an email and password. Google Firebase Authentication creates a user ID (UID) and stores your email address, how you signed in, and when the account was created and last used.
- With Google sign-in, the name and profile photo address on your Google account are also stored in Firebase; the app does not use them.
- With Sign in with Apple, only your email is requested; Apple may hide your real address and pass on a private relay address instead.
- With email sign-up, your password is never sent to us in plain text; Firebase stores only a hash of it. To verify your address, we send a 6-digit code from info@yelkovan.ai. A hash of the code is kept on our server for at most 10 minutes and deleted once it is verified. The code email is sent through Google Workspace (Gmail).
- To prevent abuse, the times of code requests and account deletion attempts are kept against your account for the last hour.
4. Cloud backup
While you are signed in, all the data in section 2 (except sample trips) and your photos are backed up to a folder tied to your account in Google Firebase Storage. The backup is stored on Google's servers in Europe. Under the security rules, only you can read or write this folder through the app. Each backup replaces the previous one. The backup exists to bring your data back when you change phones or reinstall the app, and is not used for anything else.
A photo taken with a camera may contain location information (EXIF) written by the phone. The app removes it when you pick the photo and again before backing it up, so the backup holds no location information for your photos.
Signing out does not delete the backup; deleting your account does (see 10).
5. Day plans and stay suggestions
When you ask for a plan or stay suggestions for a trip, the app sends our server (Google Cloud Functions, Europe): the city, country and the coordinates of the city centre, the number of days and the dates, the interests you picked, the pace and the app language. The request is made with your account, but your account ID is only used to count the daily usage limit; the request itself is not stored with your account.
- OpenAI (USA): plans and suggestions are written by OpenAI's language models. Only the trip details above go to OpenAI; your name, email, account ID, home city and device information do not. Under OpenAI's API terms this data is not used to train their models by default; OpenAI may keep API data for up to 30 days to monitor abuse.
- OpenStreetMap (Nominatim): suggested places and hotels are checked with the OpenStreetMap Foundation's search service. The hotel name or address you type in "I know my hotel", and the name you type when searching for your home city, are also searched there. These searches are made from our server; your IP address is not passed on.
- Wikimedia Commons: our server finds place photos by the place's name and coordinates; the photo is then loaded on your phone directly from Wikimedia. The author and licence are shown under the photo.
- Places and suggestions prepared for the same city and language are cached for 30 days without any identifier, and may be shown to other users too.
- For the daily usage limit, the number of requests made that day is kept against your account ID.
6. Map
City maps are loaded from OpenFreeMap (© OpenStreetMap contributors, OpenMapTiles). While a map is open, your phone requests the map tiles for the area you are looking at directly from OpenFreeMap, so your IP address reaches OpenFreeMap.
7. Technical logs
Our server's technical logs (request time, duration, errors) are kept in Google Cloud for up to 30 days. We don't write your email address or account ID into our own logs; Google's infrastructure may record the IP address in request logs.
8. Permissions and what is not used
- Photos: only the photos you pick to add to your closet.
- Calendar: to add flights and stays to your calendar. On iPhone only write access is requested; we don't read the events in your calendar. On Android your calendar app opens and saving is up to you.
- Notifications: trip reminders are scheduled locally on your phone. No push notification service is used.
- The app does not access your location (GPS), camera, microphone or contacts; it does not use the advertising ID; it contains no analytics, advertising or crash reporting software (SDK), and it does not track you across other apps.
9. Service providers
| Provider | What for | When |
|---|---|---|
| Google Firebase (Authentication, Storage, Firestore, Cloud Functions) | Account, cloud backup, server | While you use the app |
| Sign in with Apple · Google Sign-In | Authentication | Depending on how you sign in |
| Google Workspace (Gmail) | Verification code email, support emails | If you sign up with email or write to us |
| OpenAI (USA) | Day plans and stay suggestions | When you ask for a plan or suggestions |
| OpenStreetMap Foundation (Nominatim) | Checking places, hotel and home city search | For plans, suggestions and searches (from our server) |
| OpenFreeMap | Maps | While a map is open |
| Wikimedia Commons | Place photos | When a photo is shown in your plan |
Privacy policies: Google · Apple · OpenAI · OpenStreetMap Foundation · Wikimedia
10. Retention and deletion
Data linked to your account (sign-in account, cloud backup, photos, counters) is kept until you delete your account. When you delete the account in the app, all of it is deleted immediately and the data on your phone is cleared too. How to delete and what is deleted: Map & More account and data deletion. Data kept only on your phone without an account is deleted when you uninstall the app.
11. Children
Map & More is a travel app for a general audience and is not directed at children under 13. Because the app requires an account, children under 13 should not use it. General rules on children are in the main policy.
12. Users in Türkiye (KVKK)
In addition to the categories in the KVKK Privacy Notice, this app processes visual records (closet photos) and customer transaction data (trip records, expenses, travel documents). Trip details sent for day plans are transferred to OpenAI (USA); this transfer falls under Article 9 of the KVKK.