1. Scope
This Privacy Policy explains how personal data is used on the Dump website, mobile apps, television app and related services.
For users in Türkiye, the KVKK Privacy Notice also applies.
2. Data We May Collect
Account Information
- username,
- e-mail,
- phone,
- date of birth/age,
- profile information.
User Content
- dumps,
- routes and stops,
- photos,
- videos,
- audio,
- text,
- notes,
- price information,
- comments,
- routines.
Location Information
Depending on the features the user chooses, the following may be processed:
- the location added to a dump,
- the selected place,
- the device's approximate or precise location.
Social Relationship Data
- followers,
- accounts followed,
- close friends,
- blocks,
- likes,
- saves,
- collections,
- comments,
- shares,
- collaborations.
Messages
Messages and attachments sent between users.
Device and Security Data
- IP,
- device type,
- operating system,
- app version,
- session records,
- push token,
- error logs,
- security logs.
Subscription Information
- Premium plan,
- purchase ID,
- renewal,
- cancellation,
- AI credits,
- boost allowance.
Payments are processed by the App Store or Google Play; Dump does not hold full card details.
AI Data
The prompt sent to an AI feature, the necessary context and the generated response.
Personalization Data
Category and preference scores derived from likes, saves, follows and other interactions.
Verification Information
Limited verification data needed for the blue check or age verification.
Television Sessions
- paired device,
- temporary session token,
- session time,
- device security records.
3. Purposes of Use
Data may be processed to:
- create the account,
- create and share dumps,
- provide route/map services,
- apply visibility preferences,
- offer template and copy features,
- create collaborative dumps,
- provide messaging,
- run routines and reminders,
- generate personalized recommendations,
- provide AI features,
- manage Premium and boost transactions,
- ensure security,
- prevent abuse,
- provide support,
- meet legal obligations.
4. Special Categories of Personal Data
Dump is not designed to collect special categories of personal data.
Users should not write health, religion, political opinion, sex life, biometric data or other special categories of personal data into:
- dumps,
- profiles,
- routines,
- messages,
- AI prompts;
an exception may apply only where a Dump feature is explicitly designed for such data and an appropriate legal basis is in place.
Dump does not use such data to build advertising or personalization profiles.
A user having shared a special category of personal data publicly does not mean that the data may be processed for any purpose.
5. Sensitive Inferences
Dump's personalization algorithms are not designed to make inferences about:
- religion,
- political opinion,
- health,
- sex life,
- ethnic origin,
- biometric or genetic characteristics.
These categories are not used for advertising or personalization targeting.
6. Location
Dump processes only the location needed for the feature the user asks for.
If precise location is used, the user's operating system permission is requested.
Dump does not track location continuously in the background.
A location the user adds to a dump of their own will may be seen by the people within the visibility they choose.
7. Media Metadata
To protect user privacy, Dump may remove unnecessary location and device metadata from uploaded photos as far as technically possible.
The same principle applies to video and audio files.
Users are informed about metadata that cannot technically be removed.
8. Artificial Intelligence
When an AI feature is used, the necessary data may be shared with Google (Gemini API). AI features work only after the user gives the AI permission in Settings > Privacy; the permission can be turned off in the same place.
- Provider: Google LLC (Gemini API)
- Country/region: United States
- Retention: processed to generate the response; the provider may keep records for a limited period it sets to detect abuse.
- Used for model training: No
If user inputs are ever to be used for model training, that use is separated from the core AI service and separate permission is obtained where required.
In addition, public content, comments and public profile information (username, first name and surname, biography, profile photo) are processed with Google (Gemini API) to detect content contrary to law and the Community Guidelines, to classify content and for semantic search. This processing does not depend on the AI permission; the automated tools do not remove content, and content they flag is assessed by authorized staff. Personal notes and dumps that are not public are not sent for this purpose.
9. Translation
When a user asks for public content to be translated, the related text may be shared with Google (Cloud Translation).
Content that is not public is not transferred to a third-party translation system.
10. Message Privacy
Private messages are not open to users in general.
Authorized Dump staff may access the necessary messages only in limited cases such as:
- reports,
- security incidents,
- serious threats,
- child safety,
- fraud,
- legal requests.
11. Personalization
To generate personalized recommendations, Dump may build an “interest profile” or similar mathematical scores from user interactions.
Where possible, users are offered an option to limit personalization.
12. Third-Party Service Providers
| Function | Provider | Data | Region |
|---|---|---|---|
| Hosting | Oracle Cloud Infrastructure | Account/content | Germany |
| Media storage and CDN | Amazon Web Services (S3, CloudFront) | Content/technical data | Germany; global delivery network |
| Network security and content delivery | Cloudflare | IP address, request and browser information (dumpapp.io, lets.dumpapp.io, API and short link traffic) | United States; global network |
| AI | Google (Gemini API) | AI inputs (with permission); public content, comments and public profile information for moderation, classification and semantic search | United States |
| Translation | Google (Cloud Translation) | Text of public content | United States |
| Maps | Mapbox | Location/technical data; step locations for route calculation | United States |
| Place data | Dump (own servers, Foursquare open place data) | Search query (not sent to Foursquare) | Germany |
| E-mail, SMS, push and in-app notification infrastructure | Notifike (Milvasoft's own service) | E-mail address, phone, push token, notification content | Germany |
| Notifications | Google (Firebase Cloud Messaging) | Push token, notification content | United States |
| Subscriptions | RevenueCat; Apple App Store, Google Play | Subscription ID | United States |
| Error monitoring | Sentry | Technical logs | EU |
| SMS | Verimor (through Notifike) | Phone, verification code | Türkiye |
| Analytics (with consent) | Google (Firebase Analytics) | Analytics data | United States |
| Google (Workspace) | E-mail address and content (sent and incoming e-mail) | United States | |
| Internal team alerts | Crewhall (Milvasoft's own service) | User ID and username, preview of reports and support requests, subscription events | Germany |
| Short links | Ashorty (Milvasoft's own service) | Shared link, invite code; IP address and browser information of people who click | Germany |
| Sign-in with an account | Google, Apple | Authentication data | United States |
| App updates | Expo | IP, device and app version | United States |
Only providers actually in use are listed.
13. International Transfers
Regular transfers of personal data abroad rely on an applicable transfer mechanism under Article 9 of the KVKK.
Regular transfers to countries without an adequacy decision use the standard contracts announced by the Board, and the contracts are notified to the Authority within five business days of signature. Details are in the KVKK Privacy Notice.
14. Sale of Data
Dump does not sell users' personal data to third parties for data trading.
15. Retention
| Data | Period |
|---|---|
| Active account | As long as the account exists |
| Deleted account | Deleted or anonymized immediately once deletion is confirmed; session records are kept for 1 year, terms acceptance and consent records for 1 year after deletion |
| Backups | 14 days |
| Security logs | 1 year (traffic and session records under Law No. 5651) |
| Messages | Account/conversation lifetime + necessary legal exceptions |
| Support records | Until the account is deleted |
| Closed reports and moderation notices | 2 years |
| Content notices and counter-notices | 2 years from the decision |
| Push tokens | Deleted when the device has not been used for 90 days |
| Data export file | 7 days after it is prepared; immediately when the account is deleted |
| Analytics | In-app view and impression records 90 days; Firebase / Google Analytics data 14 months |
| Verification documents | No identity document is collected; if one is requested, at most 30 days after verification |
| TV session logs | Pairing code 10 minutes; TV session records 1 year after the session ends |
16. Security
Dump uses appropriate measures such as:
- access control,
- encryption,
- secure connections,
- logging,
- backups,
- access restriction,
- security testing.
17. Automated Decisions
Dump's recommendation and ranking systems may personalize the content experience.
If a decision producing legal or similarly significant effects is made about a user based solely on automated processing, the rights arising from the law apply separately.
18. User Rights
Users in Türkiye may exercise their rights under Article 11 of the KVKK through the channels in the KVKK Privacy Notice.