KVKK · GDPR

Privacy & Cookie Policy

This text is compiled from the Turkish KVKK Disclosure Communiqué, the KVKK Cookie Guide and GDPR Art. 13. It is not binding until the data controller’s identity/contact details and final legal approval are completed (draft).

1. Data Controller

This notice is provided under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”) and Article 13 of the GDPR.
Data controller: Saints Atlas (pilot). Legal name, address, registered e-mail and, where applicable, representative/contact details will be added to this section before launch.

2. Personal Data Processed

Identity/contact: name-surname, e-mail.
Account & usage: role, membership tier, visit and route records, preferences.
Security/logs: IP address, browser (user-agent), session and cookie data.
Anonymous usage measurement (only with EXPLICIT CONSENT): what is measured (section viewed, session summary, conversion event, the "was it useful" answer), what is not stored (identity, device ID, IP) and how long it is kept is written in the "measurement" row of the processing register below — this text cannot drift from it. Groups smaller than 20 are never shown on any dashboard or exported.

3. Purposes of Processing

Membership and account management, authentication and authorisation.
Providing and personalising the service (visits/routes, language/theme preferences).
Information security, abuse prevention and compliance with legal obligations.

4. Legal Bases

KVKK Art. 5 / GDPR Art. 6: formation/performance of a contract (account), the controller’s legitimate interest (security), legal obligation.
Non-essential (analytics/marketing) cookies and related processing only with EXPLICIT CONSENT (opt-in).

5. Transfers

When you use AI features (Heart Journal healing route, AI guide), the text you send is transmitted to our AI service provider (Anthropic, USA) for analysis; it is not stored on Evliyalar Atlası servers. The Heart Journal analysis runs only with your explicit consent.
Maps are provided by Mapbox (USA). On the web, a map embedded in a page does not load until you choose “Load map”; your choice is remembered on this device only and can be withdrawn under “Map permission on this device” at the end of this page. On the map page, the lineage map and the route planner the map is the page itself and loads when opened. Once loaded, your IP address, browser/device details and the area viewed go to Mapbox, and Mapbox stores an anonymous ID on your device to count usage (billing). Performance and telemetry events are switched off on the web and in the mobile app; usage counting cannot be switched off under Mapbox’s terms.
The service providers your data may reach outside our own server are listed by name below, under “Sub-processors and international transfers” (processing register). The legal basis for international transfers (KVKK Art. 9 / GDPR Chapter V) will be added once legal counsel approves it.

6. Retention

Personal data is retained for as long as required by the purpose of processing and by law; at the end of that period it is deleted, destroyed or anonymised.
The retention period of each activity is written in the processing register below. Defined periods are applied automatically every night (e.g. the Guide Circle transcript 90 days, the editorial workspace channel 30 days); for those marked "Not set" no period has been decided yet and that data is not deleted today.

7. Your Rights (KVKK Art. 11 / GDPR Arts. 15–22)

Access and information; rectification; erasure/destruction; objection to processing; data portability; objection to automated decisions.
Requests are handled on the My Account → My Data screen: the list of what is kept on the server, downloading your data, deleting the account, withdrawing consents and KVKK requests. A request is answered within 30 days at the latest (KVKK Art. 13); the screen shows the days left. The formal written or KEP route will be added to the Imprint page once the data controller details are settled.
The right to lodge a complaint with the Turkish Personal Data Protection Board (KVKK) / the competent supervisory authority (GDPR) is reserved.

8. Cookie Policy

Essential cookies: technically necessary for session/security; no consent is required (legitimate interest/contract).
Stability (crash) logs — mobile: if the app closes unexpectedly we record the error message, technical stack trace, COARSE section name, platform and app version. They are identifier-free: user ID, device ID, session ID and location are NOT sent, the IP is NOT stored, and the content you read or text you write is not sent; two records cannot be linked to the same person. This is not analytics and is never used for marketing — it exists to keep the service working, which is why it is ON by default. It can be turned off at any time in mobile Settings > “Crash reports”.
Functional cookies: remember preferences such as language/theme.
Analytics/performance and marketing cookies: only with EXPLICIT CONSENT; OFF by default (opt-in).
Non-essential cookies/tracking are not loaded until consent is given. The consent record (date, choice) is stored and can be withdrawn at any time.

9. Special-Category Data — Devotional Lens (On Your Device Only)

The optional "Devotional Lens" feature stores your fiqh (madhhab) preference and spiritual-path INTERESTS ONLY ON YOUR DEVICE (in your browser or your phone’s secure storage). Under KVKK art.6 / GDPR art.9 this is special-category data; it is NOT sent to our server or to the AI provider.
These preferences are processed as content preferences, not identity declarations; nothing is hidden — only ordering/tone adapts. Community/organisation membership is never asked for or stored.
Preferences are not shared with third parties and are not used for profiling/advertising. They can be deleted in one tap from account settings; since they live on the device, deletion happens on that device. Copies held on the server before October 2026 have been deleted.

Sub-processors and international transfers

Service providers your data may reach outside our own server. “Off” ones are not in use today; if switched on, they are added to this list first.

Anthropic PBC
USA · On
Data sent: AI Talebe chat messages; Heart Journal text with explicit consent
When: Only when you use these features; the text is not stored on our server.
Resend, Inc.
USA · On
Data sent: Email address, name, email content (verification, password reset, notifications)
When: When an email is sent to you.
Mapbox, Inc.
USA · On
Data sent: IP address, browser/device information, the map area viewed, an anonymous ID stored on the device to count usage (performance/telemetry events off)
When: Web: an embedded map only after “Load map” is chosen (the choice is remembered on the device); the map page, lineage map and route planner when opened. Mobile: when a map screen is opened.
GitHub, Inc. (the-quran-project.github.io)
USA · On
Data sent: IP address and browser information (Qur'an text and audio files are loaded from here)
When: When the Qur'an is read or listened to in the library.
Internet Archive (iiif.archive.org)
USA · On
Data sent: IP address and browser information (work page images are loaded from here)
When: When a page image of a work is opened.
Google LLC (Google ile giriş)
USA · Off
Data sent: Google account ID, email, name
When: Only if you choose Google sign-in (not configured today, not in use).
Apple Inc. (Apple ile giriş)
USA · Off
Data sent: Apple ID, email (can be hidden), name
When: Only if you choose Sign in with Apple (not configured today, not in use).
OpenAI (yedek embedding sağlayıcısı)
USA · Off
Data sent: Published content text (not personal data)
When: Not in use (local model active).
ElevenLabs (seslendirme)
USA · Off
Data sent: Published content text (not personal data)
When: Not in use (no key configured).
Google LLC (Firebase Cloud Messaging)
USA · Off
Data sent: Device notification token and notification text
When: Not in use (FCM_SERVICE_ACCOUNT not configured; notifications are scheduled on the device).
iyzico (ödeme)
Türkiye · Off
Data sent: Payment and billing details
When: Not in use (payments are off).

Processing register

Membership, sign-in and account management
Data sent: Name, email, password hash, role, language
Recipient: Resend, Inc.
Explicit consent: Not required · Legal basis (proposed): KVKK m.5/2-c · GDPR 6(1)(b)
Retention: Until the account is deleted; on deletion personal data is removed and editorial trails are anonymised
Account security and abuse prevention
Data sent: IP address, browser information, sign-in times
Recipient: —
Explicit consent: Not required · Legal basis (proposed): KVKK m.5/2-f · GDPR 6(1)(f)
Retention: 730 days (2 years); then the IP address and browser details are deleted, the action record stays
Measuring how the product is used without tracking people
Data sent: Section viewed (coarse area), language, country, hour, platform; session summary (duration, number of sections); conversion event (directions opened, route started, visit marked — day, language and platform only; a click on an accommodation's page, phone, website, booking portal or directions — additionally only the FACILITY's city, not your location); the "was it useful" answer (yes/no — the place it was about is not recorded) — no IP or identity stored; groups smaller than 20 are not shown on the dashboard
Recipient: —
Explicit consent: Required · Legal basis (proposed): Açık rıza (çerez bandı) · KVKK m.5/1 · GDPR 6(1)(a)
Retention: Indefinitely as aggregate counts (cannot be linked to a person)
Seeing which content draws interest from which country without tracking people (content and translation priorities)
Data sent: Which content was viewed (a saint, place, event or work — by its permanent identifier), the visitor's country (derived from the IP address; the IP is not stored), language, day, platform — daily totals only; never linked to a person, session or device; groups smaller than 20 are not shown on the dashboard; the visitor's religious or sectarian leaning is not inferred
Recipient: —
Explicit consent: Required · Legal basis (proposed): Açık rıza (çerez bandı) · KVKK m.5/1 · GDPR 6(1)(a)
Retention: Daily totals for 396 days (13 months); then rolled up into monthly totals (cannot be linked to a person)
Seeing which saints and places people look for but cannot find in the atlas, to prioritise new content
Data sent: Search terms that found nothing, country (from the IP address; the IP is not stored), language, day, platform — daily totals only; terms shaped like personal details (email, phone, address, long numbers) are never counted; a term's text becomes visible only once the same term has been searched 20 times (before that only an encrypted key is kept); never linked to a person, session or device
Recipient: —
Explicit consent: Required · Legal basis (proposed): Açık rıza (çerez bandı) · KVKK m.5/1 · GDPR 6(1)(a)
Retention: Daily totals for 396 days (13 months); a term not searched for 396 days is deleted
Producing a sourced answer to your question
Data sent: Messages you write to the AI Talebe
Recipient: Anthropic PBC
Explicit consent: Required · Legal basis (proposed): Açık rıza (sunucuda kayıtlı, sürümlü) · KVKK m.5/1 · m.9 için hukuk görüşü bekleniyor
Retention: Not stored on our server
Suggesting a visit route according to your mood
Data sent: Heart Journal entries (encrypted on the device); the text if analysis is requested
Recipient: Anthropic PBC
Explicit consent: Required · Legal basis (proposed): Açık rıza · KVKK m.5/1 · m.9 için hukuk görüşü bekleniyor
Retention: The journal stays on the device; analysis text is not stored on our server
Ordering content on the device (no view is hidden)
Data sent: Fiqh preference and Sufi order interests (special category, KVKK art. 6)
Recipient: —
Explicit consent: Not required · Legal basis (proposed): İşleme yok — veri yalnız cihazda (sunucuya ve YZ sağlayıcısına gönderilmez)
Retention: On your device only, until you delete it; server copies from before October 2026 were deleted
Contributing to the atlas and community sharing
Data sent: Suggestion and correction texts, source, optional name; shared prayers and replies
Recipient: —
Explicit consent: Not required · Legal basis (proposed): KVKK m.5/2-c · GDPR 6(1)(b)
Retention: Until you delete it or your account is deleted
Keeping the app working (mobile; can be turned off in settings)
Data sent: App crash record: error text, app version, platform — no identity or IP
Recipient: —
Explicit consent: Not required · Legal basis (proposed): KVKK m.5/2-f · GDPR 6(1)(f)
Retention: 90 days
Introducing the board on the “How we review” page
Data sent: Review board member's name, title, institution
Recipient: —
Explicit consent: Required · Legal basis (proposed): Açık rıza (ayrı) · KVKK m.5/1
Retention: While consent and board membership last
Live captions and translation, excerpt suggestions from the session (speech is converted to text on our server; audio is not stored; text goes to Anthropic for translation)
Data sent: In the Guide Circle: the text transcript of the guide's speech (captions), the guide's name, session title, place and duration
Recipient: Anthropic PBC
Explicit consent: Not required · Legal basis (proposed): KVKK m.5/2-c · GDPR 6(1)(b)
Retention: 90 days; then the transcript is deleted and the raw location is removed from the session statistics
Editorial collaboration; message text goes to Anthropic when a translation is requested
Data sent: Messages written in the editorial workspace channel and the author's name (team members only)
Recipient: Anthropic PBC
Explicit consent: Not required · Legal basis (proposed): KVKK m.5/2-c · GDPR 6(1)(b)
Retention: Workspace channel messages 30 days; record threads stay with the record as an editorial trail
Fulfilling your rights under KVKK Art. 11 and tracking the 30-day reply period (Art. 13)
Data sent: Your KVKK request: its type, the text you wrote, our reply and the dates
Recipient: —
Explicit consent: Not required · Legal basis (proposed): KVKK m.5/2-ç · GDPR 6(1)(c)
Retention: 730 days (2 years) after the reply; the request is deleted when your account is deleted

The legal-basis column is a proposal; legal counsel has not yet approved it. The basis for international transfers (KVKK Art. 9 / GDPR Chapter V) will be added once approved.