Privacy Policy
Version 1.7
This policy summarizes what data the "Burada" mobile application (the "App") processes, why and how. For details, see the Privacy Notice under Turkish Personal Data Protection Law No. 6698 (KVKK).
1. In short
- When you open the App, only your Instagram username and profile photo are shown to visible users within about 100 meters who have the App open at that moment, and vice versa.
- Your exact location, a numeric distance or a map is never shown to any user; others only see a "very near / near" label.
- Your foreground location is kept in server memory for at most 30 minutes and deleted when you close the App (unless "Stay visible when the screen is off" is on); no location history is kept and it is not written to the database.
- Two optional features use background location and require a separate explicit consent: "Stay visible when the screen is off" (you stay in nearby users' lists while your phone is in your pocket) and "Let me know when people are nearby". Background location is kept in memory for at most 30 minutes; your exact location is still never shown to anyone.
- With Instagram sign-in your password never reaches us; your Instagram access token is stored encrypted. No phone number is requested. Your date of birth is not stored.
- We don't sell your data, use it for advertising or track you across apps.
2. Data we collect
| Data | Why | Retention |
|---|---|---|
| Instagram user ID, account type | Instagram sign-in, one-account rule | Until account deletion |
| Instagram access token (encrypted) | Keeping your profile up to date | Until you disconnect / delete your account (valid for at most 60 days, renewed) |
| Over-18 flag | Age limit | Until account deletion |
| Instagram username, name, profile photo | Username and photo are shown to people nearby; the name only to you and in your data export | Until account deletion |
| Foreground location | Finding people nearby | At most 30 minutes (in memory) |
| Background location (optional) | Staying visible with the screen off and/or notifications | At most 30 minutes (in memory) |
| Name of the nearby venue | "Around X" information | At most 30 minutes |
| Notification preference, quiet hours, device push token | Sending notifications | Until account deletion / sign-out |
| Consent records, hashed IP | Legal proof | Until account deletion |
| Blocks and reports | Safety and moderation | Until account deletion / review completion |
History kept on your phone ("History" tab): The people you see in the list (username, photo link, coarse proximity label), the venue name and the time are stored only on your own phone; no location coordinates are written, nothing is sent to our servers and it is not included in "Download my data". The default retention is 30 days (7, 30 or 90 days can be chosen). You can turn it off or delete it in Profile; it is also deleted when you sign out or delete your account. People you block are removed from the history.
3. Your Instagram information
Instagram sign-in (recommended): We use Meta's official Instagram sign-in (Instagram API with Instagram Login). You sign in on Instagram's own page and your password never reaches us. We only request the `instagram_business_basic` permission: user ID, username, name, profile photo and account type. We have no access to your posts, messages or followers. The access token issued by Instagram is stored encrypted, renewed before it expires and used to refresh your username and photo weekly. This works for professional (business / creator) Instagram accounts.
Private and personal accounts (verify by DM): Instagram's official sign-in only works for professional accounts. To link a private or personal account without changing it, you send the code shown in the app as a message to the app's Instagram account (@buradaapp). Only the account's owner can send that message, so this verifies your account; no password is needed. Only the code is read from the message; its text is not stored. Your username, name and profile photo are obtained from Instagram's official messaging API and refreshed weekly. Accounts can't be linked by typing a username, so nobody can claim someone else's account. If you have no profile photo on Instagram, you can upload one in the app.
Disconnecting and data deletion: "Disconnect Instagram" in Settings immediately deletes your access token and photo, and you no longer appear in the list. Removing the app's access in Instagram's settings does the same; a data deletion request made through Instagram deletes your account with all its data and gives you a confirmation code and a status page.
This app is not affiliated with Instagram or Meta.
4. Who can see you
- Your profile is shown only to visible users near you (about 100 m). While the App is closed you stay in the list only if you turned on "Stay visible when the screen is off"; it can be turned off in Settings with one tap.
- While invisible, nobody can see you and you can't see the list either.
- People you block and people who block you can't see each other anywhere.
5. Who we share with
Your data is shared only with infrastructure providers strictly necessary to run the service (cloud hosting, Meta for Instagram sign-in, push notification infrastructure, venue data) and with competent authorities where legally required. The venue data provider receives current coordinates only, not linked to your identity.
6. Your rights and controls
In the App's Settings you can:
- Turn your visibility on or off,
- Turn nearby notifications on or off and set quiet hours,
- View and withdraw your consents,
- Disconnect Instagram,
- Download your data as JSON,
- Permanently delete your account and all your data.
If you can't access the App, you can request account deletion on the Account Deletion page of our website (https://burada.app/en/delete-account.html). For other requests under KVKK Art. 11: destek@burada.app.
7. Children
The App is not for people under 18. Accounts found to belong to someone under 18 are deleted together with their data.
8. Security
Data is encrypted in transit (HTTPS). Instagram access tokens are stored encrypted. Profile photos are not public; they are shown only through time-limited signed links. Sessions are protected with short-lived keys.
9. Changes
When we update this policy we increase its version number and announce significant changes in the App.
10. Contact
Burada App (Buğrahan Murat Taşlıçay), Kütahya Merkez, 43000 Kütahya, Türkiye, e-mail: destek@burada.app