Last updated: 26 September 2026

Privacy Policy

This policy explains how we process personal data, in line with Turkey's Personal Data Protection Law No. 6698 (KVKK) and, for users in the EU, the GDPR. Data controller: the operator of Dark Location.

Using it without an account

You can browse the map, the cases and the timeline without an account. In that case, the cases you save and read are kept only on your device (browser storage) and never sent to our server.

What we process

  • Account: email address, a one-way hash of your password (never the password itself), an optional display name, language and app settings.
  • Usage: the list of cases you saved and read.
  • Contributions: memorial notes you write, ribbons/roses you leave, error reports and case suggestions you send (optionally with your email).
  • Sessions: your browser's user-agent and the session lifetime for devices you're signed in on.
  • Device identifier: a random ID used to prevent repeat ribbons/roses from the same device when you're not signed in.
  • Assistant: a daily question counter. Your questions and the answers are not stored on our server.

Why, and on what legal basis

To create your account, keep you signed in, sync your saved cases across devices and send password-reset links (performance of a contract).

To prevent abuse, spam and attacks we use your IP address for short-lived rate limiting; it is not written to our database (legitimate interest).

To review error reports and removal requests and reply to you (legitimate interest).

The AI assistant and international transfer

When you ask the assistant a question, the question and the relevant case record are sent to our AI provider (Anthropic, USA) to generate the answer. This is an international transfer and only happens when you choose to use the assistant.

Please don't type personal information about yourself or others into the assistant. Every other part of the app works without it.

Cookies

We use no advertising or tracking cookies. Only cookies needed for the service to work:

  • dm_session — your sign-in session (60 days).
  • dm_did — a random device ID to prevent repeat votes (400 days).
  • dm_locale — your language preference (1 year).

Who we share it with

We don't sell your data or share it for advertising. Only the providers we rely on to run the service (hosting, email delivery, Anthropic for the assistant) process what they need. Data may be disclosed to authorities where the law requires it.

How long we keep it

  • Account data: until you delete your account. You can delete it yourself from the Profile screen in the app; your saved cases, reading history and notes are deleted with it.
  • Sessions: 60 days or until you sign out. Resetting your password signs you out everywhere.
  • Password-reset links: valid for 1 hour, single use.
  • Error reports and suggestions: until they're reviewed, at most 2 years.

Your rights

You can ask whether we process your data, request a copy, correction or deletion, learn who it was shared with, and object to processing.

Write to [email protected]; we reply within 30 days. You can also complain to your data protection authority (in Turkey, the KVKK Board).

People named in cases

Cases in the archive are compiled from public sources (court rulings, official statements and established press). If you are, or are close to, someone named in a case, you can ask for the record to be corrected or removed via "Report an error" on the case page or by email. Requests from victims' relatives take priority.

Age limit

The service is for users aged 18 and over. We delete accounts we find belong to someone under 18.