Privacy policy

turquosian.com is operated as an independent editorial project; the operator is the data controller for the processing described on this page, within the meaning of Article 4(7) of the GDPR and Article 3 of the KVKK. For every question, request, or objection concerning your data — including requests to identify the controller for a legal claim — write to contact@turquosian.com. That mailbox is read by the people who run the site, not by a support vendor, and it is the single channel through which every right on this page can be exercised.

The trip you build in the planner — cities, places, days, optional dates, overnight areas, transport choices, pace, interests, checklist ticks — is saved in your browser's local storage, on your device only. It is not sent to us while you plan. Clearing your browser data clears it.

We also keep the previous version for undo and, when an older or damaged plan needs conversion, a recovery copy on the same device. Clearing a trip leaves undo, recovery copies and your preparation checklist available; clearing this site's browser data removes them all.

Nothing about this requires an account, and the site has none.

A PDF without email delivery is generated on your device and does not upload your itinerary. We store personal data in exactly two cases, both started by you:

• Sharing a trip. Creating a share link uploads that trip's itinerary, including any dates and overnight areas you chose, so the link works for the people you send it to. Your preparation checklist and interest selections are excluded from new shared copies. The link is unlisted and excluded from search engines. Legal basis: performance of the service you requested (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)). Deleted automatically 90 days after you create it (any email stored on it goes with it), or sooner if you ask us to remove it.
• Requesting the PDF with email delivery. Entering an email address is optional; when you do, it is stored so we can send you a single trip-preparation email. There is no mailing list behind it, and the address is never sold, rented, or shared. Legal basis: your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)), which you may withdraw at any time by asking us to delete the address. The address is kept in a separate record until you ask us to delete it, even after the shared itinerary it was sent for has expired.

To have a shared itinerary or a stored email removed, write to contact@turquosian.com.

Like every website, our hosting infrastructure processes technical connection data — your IP address and the request it carries — for the seconds it takes to deliver the page and in short-lived operational logs kept for security and abuse prevention. We do not use this data to identify or profile visitors. Legal basis: legitimate interest in running a secure service (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).

Some outbound booking links may earn Turquosian a commission from the partner. It does not change what you pay them — see the affiliate disclosure. When you use one, we count the click — which link, from which part of the site, and when. No name, no email, no IP address, no device fingerprint is attached to that count. It tells us which recommendations are useful; the first-party count cannot tell us who you are. If you accept analytics, we also send a separate click event to Google Analytics. Google may associate it with that visit through the analytics cookies described below.

We use Google Analytics 4 to count visits and see which guides and planning actions are useful. When you accept, we also count when a visitor starts a trip, reaches a two-city or paced single-city plan, successfully shares it, downloads a PDF or clicks a labelled affiliate link. We send no trip contents, email or account ID in these event payloads; Google may associate them with your consented analytics visit. It runs on the basis of your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)). The first time you arrive, a banner asks you to accept or reject analytics; both choices are equally easy, and you can change yours at any time from “Cookie settings” in the footer.

• If you reject, or have not chosen yet, analytics storage is denied and no analytics cookie is set. Google's Consent Mode may still receive limited, cookieless signals — such as the page address, the referrer and the browser type — which cannot be linked to a cookie identifier.
• If you accept, Google Analytics sets the cookies _ga and _ga_<stream id> in your browser to recognise a returning visit. Event-level data is kept in our Google Analytics property for up to 14 months. Withdrawing consent deletes these cookies.
• Advertising features are not used. Ad storage, ad personalisation and Google signals stay denied whatever you choose, and the site runs no third-party ad trackers.

Google acts on our behalf as a processor; data may be processed outside the EU and Türkiye under the provider's Standard Contractual Clauses. Apart from the analytics cookies above — which exist only if you accept — the browser storage the site uses is the local storage described earlier and the record of your cookie choice, all of which stay on your device.

Stored data lives in our database hosted by Supabase in the European Union (eu-central region). The site itself is served by Vercel, whose global network may route your connection through servers outside the EU or Türkiye; both providers process data solely on our instructions, under data-processing agreements incorporating the European Commission's Standard Contractual Clauses for any transfer outside the EEA. Transactional email, when configured, is delivered by Resend under the same conditions. None of them may use your data for their own purposes.

Under the GDPR (Articles 15–21) and the KVKK (Article 11), you can ask us at any time:

• whether we hold any data about you, and for a copy of it (access);
• to correct it if it is wrong (rectification);
• to delete it (erasure — this covers shared itineraries and stored emails);
• to stop or restrict a given use of it (objection and restriction);
• to receive it in a portable format (portability);
• to withdraw a consent you gave earlier, with effect for the future.

Write to contact@turquosian.com; we answer within thirty days, as both laws require. No request costs anything. If you believe we have handled your data unlawfully, you also have the right to complain to a supervisory authority — in Türkiye, the Personal Data Protection Board (KVKK Kurulu); in the EU/EEA, the data protection authority of your country.

Turquosian is written for adult, independent travellers and is not directed at children. We do not knowingly collect data from anyone under sixteen; the two cases where the site stores personal data at all both require a deliberate adult action. If you believe a child's data has reached us, write to us and it will be deleted.

When our practices change, this page changes in the same release and the date at the top moves. Questions, corrections, or deletion requests: reach us via the contact page. We answer from a small team, usually within a few days.