Privacy Policy

1. Who we are

This policy explains, in plain language, how the data of visitors to geospys.com and users of the GeoSpy AI applications are handled. The statutory disclosure required by Law No. 6698 — purposes, legal grounds, retention periods, transfers abroad, your rights and how to apply — is set out in the Personal Data Disclosure Notice, which should be read together with this policy.

Trade name

Meriç Değirmencioğlu

Status

Sole proprietor (natural person, registered for tax)

Brand

GeoSpy AI

Website

geospys.com

Tax office

Akhisar Vergi Dairesi

Tax identification number

2731091902

Registered address

Hacı İshak Mahallesi, 150. Sokak No: 52 Daire: 8, Akhisar / Manisa

Telephone

0541 945 92 87

Email

meric1357@icloud.com

Payments and refunds

meric1357@icloud.com

Data protection requests

meric1357@icloud.com

Contractual notices

meric1357@icloud.com

2. What we collect

• Account data: your name and email address, when you sign in with Google.
• Usage data: which analyses you ran and when; the rounds, guesses and scores in the game.
• Abuse-prevention data: your IP address and a device fingerprint, recorded when you use the free analysis and when you play the game.
• Link interaction data: when you click a link to our iOS app, the fact of the click is recorded (which link, when, your IP address and device fingerprint), so that we can measure how useful the promotion is.
• Traffic data: every page you open on geospys.com is counted by the site itself, together with your IP address, and the steps of a purchase and your response to the app offer are recorded too — see section 6.
• Payment data: when you make a purchase, the order and payment records, and for a subscription its renewal payments and status — see section 7. The card number, expiry date and security code never reach us.
• Records of paid use: for an account with a subscription, the date, time, IP address and device fingerprint of each photo analysis, and the date, time, IP address, browser information and approximate country of each Street View game session, together with the evidence of each order — see section 7.

A device fingerprint is not a MAC address or a hardware serial number. Browsers do not make those available to websites and we do not attempt to obtain them. It is a one-way digest computed from characteristics your browser already reports: screen dimensions, graphics renderer, processor and memory class, platform and time zone. It cannot be reversed and is not used to track you across other sites.

3. What happens to a photograph

Uploaded photographs are not stored. They are held in memory for the duration of a single request and discarded when the response is returned.

A photograph you upload is sent over TLS to geospys.com, where the server forwards it to the AI provider and returns only the estimated location. It is never written to disk, never written to a log and never stored in a database.

The same applies to photographs sent from our iOS applications. The apps used to send the photograph straight to the AI provider from the handset; they now send it to geospys.com first, which makes this site a link in the chain — which is exactly why it is written here.

Photographs are not used to train any model, are not shared with any third party beyond the AI provider named above, and are not retained for any other purpose.

4. The free-usage limit, IP addresses and device fingerprints

The website includes one free photo location analysis per Google account — once, not once a day. So that the limit means something, your IP address and a device fingerprint are stored alongside your account when the free analysis is used. The legal ground is the legitimate interest in preventing abuse of a free service (Article 5/2-f of Law No. 6698).

The data are retained for as long as the limit needs to be enforced — that is, for as long as the account exists — and are deleted when the account is deleted.

The Seller reserves the right to convert free use into a paid package or a paid subscription at certain times; during such periods no free analysis is given on the website and no new record of this kind is made.

If you would rather this were not recorded, you can simply not use the free web analysis; the iOS app is available instead.

5. The game

When you play the location game, the rounds you were shown, the guesses you made and their scores are stored, together with your IP address, the device fingerprint described above and a signed random identifier held in the gs_play cookie.

Each round loads a Street View panorama out of a finite free monthly allowance, so these signals exist to enforce a daily limit — without them one visitor could exhaust the allowance for everyone. Game data are not linked to any photograph you analyse and are not used for advertising or profiling.

For an account with a subscription, game sessions are also kept as records of paid use, for the purpose and the period described in section 7.

6. Site traffic and checkout statistics

The site counts its own page views, separately from Google Analytics, so that the two can be compared. When a page opens, the site’s own server records: the address of the page (without its query string); the time; the site you arrived from (its domain name only, and only for the first page you open); your IP address; the user-agent string your browser sends, and the device type, operating system and browser read from it; the approximate location your connection reveals to our hosting provider (country, region, city); and the network your IP address belongs to — for example your internet service provider — together with whether it is a data-centre or VPN network.

The network is found by looking your IP address up in a public table of internet address ranges, published by iptoasn.com and kept in the site’s own database. Your address is not sent to any other company for this.

No cookie is set for this counting, nothing is stored on your device, and the records are not linked to your account. The visits of the site’s own administrators are not counted.

The legal ground is the legitimate interest in knowing how the site is used and in telling real visitors from automated traffic (Article 5/2-f of Law No. 6698). The IP address, the user-agent string, the city and the region are deleted after 90 days; what remains — page, time, country, device type, browser and network — is kept as a count and does not identify anyone on its own.

Separately from that count, the site’s own server records the following steps, so that we can see where buyers leave the checkout and whether the app offer helps:

• the checkout page being opened, and the pay button being pressed;
• the app-offer window being shown to you, its App Store link being clicked, and the window being closed.

For each of these, the type of event, the time, the page, your country, the device type, your IP address and browser information are recorded, together with your account id if you are signed in. Unlike the page count above, these records are therefore linked to your account when you are signed in.

No cookie is used for this. To decide when the offer window may be shown, only timestamps are kept in your browser’s local storage; they are not sent to any server and are listed in the Cookie Policy.

The legal ground is the legitimate interest in knowing where buyers drop out and whether the app offer helps (Article 5/2-f of Law No. 6698). The IP address, the browser information and the link to your account are deleted after 90 days — the account link at once if you delete the account; what remains is a count that identifies nobody.

7. Payments and payment disputes

When you make a purchase, an order record is kept: the order number, the plan, the amount and currency, the date and time, the status of the payment, the bank’s authorisation code and reference number, the last four digits of your card, and your email address and IP address. For a subscription, each renewal payment the bank takes (its amount, date, authorisation code and reference number), the status of the subscription and the date on which it is cancelled or ends are recorded too. These records are kept to perform the contract and prove it and to meet accounting and tax obligations (Article 5/2-c and 5/2-ç of Law No. 6698). They are retained for three years under Article 20 of the Distance Contracts Regulation, or for longer where tax and commercial legislation requires it.

You type your card details into the card form on the checkout page, but they are sent from your browser directly to the payment system of Türkiye Garanti Bankası A.Ş. (Garanti BBVA): they never pass through this site’s servers and are never stored here. The bank that issued your card confirms the first payment with 3D Secure. So that the renewal payments can be taken, Garanti BBVA keeps the card on its recurring-payment record; we do not. From the bank we receive only the result (approved or declined), the authorisation code, the bank reference number and the last four digits of the card.

With the payment, the bank receives from us the order number, the amount, your email address and your IP address. Garanti BBVA is in Türkiye, so this is not a transfer abroad.

The use of a subscription is recorded as well: the date, time, IP address and device fingerprint of each photo analysis, and the date, time, IP address, browser information (user agent) and approximate country (derived from the IP address) of each Street View game session. The photograph itself is not part of these records; it is never stored (section 3). Together with the order evidence — the time of the order, the amount, the 3D Secure result, your IP address at the time of the order, and the time and text version of your approvals — these records are used to decide refund requests (including whether the service has been used since the payment concerned) and to answer payment disputes (chargebacks). In such a case they may be sent to Garanti BBVA, the bank that processed the payment, and through it to the card scheme concerned.

The legal ground is that the processing is necessary for the establishment, exercise or protection of a right (Article 5/2-e of Law No. 6698) and, where it concerns the performance of the contract, Article 5/2-c. The records are kept for as long as the payment concerned can be disputed under card-scheme rules, counted from that payment. If you delete your account, a summary of each subscription’s use — the number of uses, the first and last use, and the list of uses with their date, time and IP address — is kept with the subscription record for the same purpose and the same period.

8. Third-party providers

The service uses the following providers. All of them except the bank are located outside Türkiye; the legal framework for those transfers is set out in the Personal Data Disclosure Notice.

• Google (OAuth 2.0) — signing in to an account.
• Google AI (Gemini) — image analysis. Receives the photograph for the duration of the analysis and returns a location estimate.
• Vercel — hosting. Photographs pass through Vercel serverless functions in transit and are not persisted.
• Supabase — the site’s database (servers in Frankfurt, Germany). Account records, abuse-prevention data, traffic and checkout statistics and order records are stored there.
• iCloud Mail (Apple Inc., United States) — our e-mail service. Messages you send to our addresses are received there; the order confirmation with the contract texts is sent from there after a purchase, and so are the renewal, cancellation and end notices of a subscription.
• Google Maps Platform — Street View panoramas, on the game page only.
• OpenStreetMap and Esri — the world map you drop your guess on, in the game; OpenStreetMap also draws the map in the browser extension’s panel.
• Google Analytics and Meta Pixel — measurement of site traffic. These are covered in the Cookie Policy.
• Türkiye Garanti Bankası A.Ş. (Garanti BBVA) — card payments: the first payment and its 3D Secure verification, and the renewal payments of a subscription; in a refund request or payment dispute, also the records of paid use. Located in Türkiye; see section 7.

9. Security

All data transmission uses TLS. Access to the database is restricted to the server functions of the application. Photographs, being the most sensitive item processed, are never persisted at all — the strongest protection available for them.

10. Your rights

You may ask what data are held about you, ask for them to be corrected or deleted, and delete your account. Applications under Article 11 of Law No. 6698, and the procedure and time limits for them, are set out in the Personal Data Disclosure Notice.

Questions about privacy can be sent to meric1357@icloud.com.

11. The GeoSpy browser extension

The GeoSpy – Photo Location Finder extension for Google Chrome does one thing: when you choose a photo — by right-clicking an image on a web page and selecting “Find where this photo was taken”, or by choosing, dropping or pasting a file into its panel — it sends that one photo to geospys.com for the same analysis as the website and shows the estimated location. It does nothing on a page until you ask it to.

What leaves your browser is only the photo you chose (converted to JPEG when it is in another format), the GPS coordinates stored in the photo if it has any, and a random identifier created when the extension is installed. Your geospys.com sign-in goes along with the request, as it does on the website; the extension does not read or store it. The photo is then handled exactly as described in section 3: it is not stored. The site records that the analysis was requested through the extension, alongside the usage data described in section 2.

The extension does not collect your browsing history, the addresses of the pages you visit or any other content of a page. To obtain the photo you chose, it may read that image from the page or, where the site does not allow that, take a picture of the visible part of the tab and keep only the area of that image; nothing else from the page is kept or sent.

The map in the extension’s panel is displayed by OpenStreetMap, which receives the estimated coordinates in order to draw it. The “Open in Google Maps” button opens Google Maps with the coordinates only when you press it.

The extension contains no advertising or analytics code, and it does not sell data or transfer it to anyone. The use of information received through the extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.