TRGet the app

Privacy Policy

Last updated: 13 October 2026

This policy explains which personal data is processed when you use the Sightlore mobile app and the sightlore.app website, why it is processed and what rights you have. It is based on the Turkish Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR).

1. Data controller

The data controller is the individual who founded Sightlore: Murat Türkay, Mersin, Türkiye.

Contact: [email protected]

2. What data do we process?

Without an account (guest)

  • Device identifier: a randomly generated or device-specific identifier and the day's usage count, used to apply the daily Lorescope discovery limit.
  • Location: to show nearby places and Lorescope directions while the app is open.
  • Daily limit for natural voice: if you listen without an account and a story's audio is being prepared for the first time, a one-way hash of your IP address is kept with a daily counter to prevent abuse. Your IP address itself is not stored.

With an account

  • Account details: email address and password (stored on the server in a form that cannot be reversed). If you sign in with Google, the name and email Google shares. If you sign in with Apple, the name and email Apple shares (or Apple's relay address if you choose to hide your email).
  • Profile (optional): nickname, full name, profile photo, bio, music taste, interests. Profile photos and bios are for people aged 18 and over, so we ask for your date of birth once; it is never shown to others. When "Show my identity" is off, other users only see your nickname and avatar.
  • Game data: points, level, badges, spins and their results, coupons, weekly challenges, route progress.
  • Visits: which place you were at and when, when you say "I'm here" or check in at a route stop, plus the mood, place tags and message you choose. The server checks your location to confirm you are there at that moment but does not store your GPS coordinates. The check-in disappears from the map after 3 hours; the visit record stays in your account for points and your travel map.
  • Content: reviews, replies, likes, photos and place suggestions you submit (including the location you submit with a suggestion), who you follow and block, your reports, your saved trip plans.
  • Follows and private account: your followers, the people you follow and pending follow requests. If "Private account" is on, your follower lists are visible only to followers you approved.
  • Notification inbox: notifications you receive (e.g. new follower, reply to your review, like, approval of your contribution) are kept in the in-app list for as long as you have an account.
  • Saved places: the places you save. Only you can see this list.
  • Explore your city and passport: places you mark as "I've been here" from before you used the app, stories you listened to past the halfway point, story questions you answered correctly (gold stamps), your city badges and the monthly goal you set. We use these to show your city progress, passport and year in review, and to keep places you've visited out of your suggestions.
  • Memory book: photos and notes you add to places you've visited. They are kept in private storage and only you can see them; long-press to delete them at any time.
  • Exploring with friends: if "My travel map is public" is on, your followers can see how much of a city you've visited (as a percentage); turn it off and they can't. When you accept an "Explore together" invite, the number of places you've visited in that city is shown to the person you share the goal with; leaving the goal ends this. Only the number of places is shared, never your visit times or location.
  • Feedback: the message you send from the app, the screen you were on, the app version and your device model.

If you allow it

  • Background location and notifications: to let you know when you are near a place with a story. Nearby places are looked up on the server; your location is not stored. Notifications are created on your phone.
  • Tour mode: when you turn on tour mode for a route, its unvisited stops are added to your phone's region monitoring. Your phone itself detects when you approach a stop and shows the notification; your location is not sent to us for this. When you arrive, the server checks your current location to mark the stop but does not store it. Tour mode switches off when the route is finished or after 3 hours without movement.
  • Push notifications: to send notifications to your phone we store its push token, app language and time zone (no notifications between 22:00 and 08:00). You choose which notifications you get in Settings → Notification types. When your account is signed in on a new phone, your other phones are told, for security.
  • Approximate area for discovery notifications: to tell you about events nearby and new routes in your area, if you allowed location and discovery notifications are on, your location is stored rounded to about 10 km (never your exact location). It is deleted when you turn discovery notifications off.
  • Usage analytics: which screens and features are used, anonymously and only if you consent, to improve the app. No location is derived from your IP address. You can turn it off at any time in Settings.
  • Camera and photos: in Lorescope the camera image is processed only on your phone; it is not recorded or sent to us. We only access the photos you choose to upload.

Kept only on your phone

  • Routes you download for offline use (stories, audio, photos) and preferences such as narration speed and appearance are stored on your phone and not sent to us. The monthly goal reminder is also scheduled on your phone. You can delete downloads in Settings → Downloaded routes.

3. Why do we process it? (purpose and legal basis)

  • Providing the app, managing your account, calculating points and rewards, running community features: performance of a contract (KVKK Art. 5/2-c, GDPR Art. 6(1)(b)).
  • Preventing fake content, cheating, spam and abuse; content moderation; security: legitimate interests (KVKK Art. 5/2-f, GDPR Art. 6(1)(f)).
  • Usage analytics, background location and notifications: consent (KVKK Art. 5/1, GDPR Art. 6(1)(a)). You can withdraw your consent at any time.
  • Legal obligations (for example purchase records, official requests): legal obligation (KVKK Art. 5/2-ç, GDPR Art. 6(1)(c)).

4. Content moderation

Submitted photos and new place suggestions are never published until a member of our team approves them. Profile photos and bios are checked automatically with Anthropic's Claude AI model before they are published: suitable ones are published, unsuitable ones are rejected and you are shown the reason, and uncertain ones go to our team. Only the photo or text in question is sent for this check. Place reviews are published instantly; content reported by three different users is hidden automatically and reviewed by our team.

5. Who do we share data with?

We do not sell your data or share it with third parties for advertising. We use these providers to run the service:

  • Supabase (database, file storage, sign-in): servers in Frankfurt, Germany (EU).
  • Anthropic (profile photo and bio moderation): USA.
  • Microsoft Azure (natural-voice narration of stories): EU servers. Only the story text is sent, no personal data. The prepared audio files are stored on Cloudflare R2.
  • Resend (account confirmation and password reset emails): only your email address and the email content.
  • PostHog (anonymous analytics, only with your consent): EU servers.
  • Sentry (app crash and error reports): EU servers (Germany). A report contains the error, app version, device model and the screen where it happened; no email, name or IP address is sent.
  • Expo, Apple and Google (delivering push notifications to your phone): push token and notification text.
  • OpenStreetMap Nominatim (searching cities / countries / addresses on the map; only the search text and language are sent) and OSRM / FOSSGIS (start and destination coordinates for directions; no account data is sent).
  • Google and Apple (only if you sign in with those accounts).
  • Apple Maps (map imagery on iPhone and in-app directions; start and destination coordinates are sent, no account data) and OSRM / OpenStreetMap (start and stop coordinates for drawing roads in the trip planner; no account data is sent).
  • Apple App Store and Google Play (Pro purchases; we never see your payment details).
  • Cloudflare (serving and protecting the website).

Other users can see your nickname, avatar, public reviews, approved contributions, badges, leaderboard position and "I'm here" check-ins. When you redeem a coupon at a partner business, the business only sees the coupon code and whether it is valid.

Transfers to providers outside Türkiye are made in line with KVKK Art. 9 and the GDPR rules on international transfers, using appropriate safeguards (standard contractual clauses) or your explicit consent.

6. How long do we keep it?

  • Approximate area: while discovery notifications are on; deleted when you turn them off.
  • Push tokens: deleted when you sign out on that phone or delete your account.
  • Account and game data: for as long as your account is open.
  • An "I'm here" check-in is visible on the map for 3 hours; the visit record is kept for the life of your account.
  • Photos and notes in your memory book: until you delete them or delete your account.
  • Rejected contributions and report records: for a reasonable period, to prevent abuse.
  • If you delete your account, your data is deleted or anonymised within 30 days at the latest. See the Delete account page for details.

7. Your rights

Under KVKK Art. 11 and the GDPR you have the right to know whether your data is processed, to access it, to ask for it to be corrected or deleted, to object to processing, to receive your data in a portable format and to withdraw your consent. You can send requests to the contact address above; we reply within 30 days at the latest. You can also complain to the Turkish Personal Data Protection Authority or to the data protection authority in your country (for example the ICO in the United Kingdom).

8. Children

Sightlore is not directed at children under 13 and we do not knowingly collect data from them. Profile photos and bios are for people aged 18 and over.

9. Website

sightlore.app itself does not use cookies and does not track visitors. Place photos on the city pages are loaded directly from Wikimedia Commons servers; Wikimedia may set a technical cookie under its own privacy policy. The site is served by Cloudflare, which processes IP addresses for security and to operate the service. The "cities near you" section on the home page uses the approximate, city-level location that Cloudflare estimates from your IP address, only to order the cards at that moment; it is not stored.

Contact forms (Business and Support): the name, email and message you send, plus, depending on the form, the business name, city, (optional) phone number or topic are used only to get back to you. They are not stored in a database; they are delivered to our team's mailbox through our email provider Resend and kept there until the conversation ends or you ask us to delete them. To stop robots from abusing the form we use Cloudflare Turnstile (an "are you human" check), which processes browser and device signals for that purpose and not for advertising.

10. Security

Connections are encrypted. Each user can only access their own private data; points and rewards are calculated on the server, not on the phone. Unapproved photos are kept in private storage that cannot be opened from outside.

11. Changes

We may update this policy. We announce important changes in the app. The current version is always on this page.

Last updated: 11 October 2026.