Privacy and cookies

In short

Talebottle has no accounts, no names and no e-mail addresses. No one, not even the site admin, can see who wrote your story. Below we explain exactly what we process and why.

Who runs this site

This site is operated by Sedat Honiç. For any privacy question or request: contact@talebottle.com

What we process

• The text of the story you share, its type (problem or memory), its language and date. Details that could identify someone, such as names, phone numbers and addresses, are hidden automatically before publishing.
• A random anonymous ID created in your browser (a cookie). Only an irreversible encrypted trace of it is stored in our database. We use it so we never show you the same story twice, to apply the daily sharing limit (at most 3 a day, with a story to read only for the first, reset every midnight), and to show you your My Stories page. For the daily limit, the times you shared (not the stories themselves) are kept for 2 days; deleting a story does not reset this count.
• Which stories you read, in which language, and the ready-made support notes you leave for the writer (such as "I understand you" or "You're not alone"). A story's writer only sees counts, notes and languages, never who read it or left a note.
• Whether you allow your story to be narrated anonymously on YouTube (off by default).
• To be able to block people who break the rules, an irreversible encrypted trace of the IP address you share from is kept with your story for 7 days and then deleted automatically. It can't be turned back into an IP address and is used for nothing else.
• When you link another device, a single-use code valid for 10 minutes. It is deleted once used or expired. To limit wrong guesses, part of an encrypted trace of the IP address a wrong code came from is kept for 1 day.
• Reports you send.
• To prevent spam, an encrypted fingerprint of the text that tells us whether the same text is being sent over and over in a short time.
• When you share a story, Turkish Law No. 5651 requires us to keep your IP address together with which story it belongs to. Both are locked. See "Legal sharing record" below.
• Visitor numbers: Vercel's cookie-free counter counts, in aggregate, how often each page is opened and from which country and device type. It uses no cookies and keeps no ID that identifies you.

What we don't process

• We don't ask for an account, name, e-mail or phone number.
• We don't record your IP address when you visit or read stories. We don't collect location or device information.
• We don't use advertising or tracking cookies.
• The journey card is downloaded to or shared from your device. It doesn't include your story's text, and creating it collects no new information.

Note: the infrastructure providers the site runs on may process IP addresses in their own temporary logs for security and technical operation.

How data is collected and the legal basis

Data is collected electronically, by automated or partly automated means, through the fields you fill in on the site (story, report, note, preferences) and the cookies in your browser. The legal bases under Turkey's data protection law (KVKK Articles 5 and 6) and, where it applies, the GDPR are:

• Providing the service (KVKK 5/2-c; GDPR 6(1)(b)): publishing and translating your story, showing you stories, the My stories page and device linking.
• Legal obligation (KVKK 5/2-ç; GDPR 6(1)(c)): the legal sharing record required by Turkish Law No. 5651 and handling notices of illegal content.
• Legitimate interest (KVKK 5/2-f; GDPR 6(1)(f)): preventing spam and abuse, including the duplicate-text check, the daily sharing limit and the 7-day IP trace used to block people who break the rules.
• Legitimate interest (KVKK 5/2-f; GDPR 6(1)(f)): cookie-free, aggregate visitor counting to understand how the site is used. To object, write to the contact address.
• Consent (KVKK 5/1; GDPR 6(1)(a)): narration of your story on YouTube. It is optional and can be withdrawn at any time.
• If you share special-category information about yourself in your story, such as health details, it is processed only to publish and translate your story, based on your own choice to share it (explicit consent, KVKK 6; GDPR 9(2)(a)). Details that could identify you are hidden before publishing; even so, we recommend not writing such details in an identifiable way.

Service providers we use

The site relies on the following providers, so data is transferred to servers outside Turkey:

• Vercel: hosting the site (company in the USA, server processing in Singapore). The cookie-free visitor counter is also Vercel's.
• Supabase: the database where stories are stored (server in Singapore).
• Anthropic: AI content checks and translation. The story text is sent for this purpose (USA).
• Cloudflare: bot check when sharing (Turnstile).

Cookies

How long we keep data

• Stories are kept until you or the site admin delete them.
• The IP trace of a share is kept for 7 days, device-linking codes for 10 minutes. If a writer is blocked, the block record is deleted when it expires (at most 30 days).
• Security counters (such as failed login attempts) are deleted automatically after at most 12 months.
• Legal sharing records are deleted automatically after 1 year. If you delete your story earlier, the story is deleted immediately, but the locked record remains for the legal period.

Legal sharing record

• Turkish Law No. 5651 requires sites that publish content shared by users to keep certain traffic information for at least 1 and at most 2 years. We keep it for 1 year.
• So only at the moment you share a story, your IP address and which story it belongs to are recorded. Visiting, reading or reacting is not recorded.
• This information is locked the moment it is recorded. The key that unlocks it is not stored on the site's server, so no one, including the site admin, can routinely see these records.
• A record is unlocked only upon a written request from a competent authority such as a court or prosecutor, and only for the story concerned.
• It is used for no other purpose and is deleted automatically after 1 year.

Your rights

You can permanently delete your story at any time from the My Stories page. Its translations, read records and reactions are deleted with it.

For any other request under the GDPR or Turkey's data protection law (KVKK), write to contact@talebottle.com. Because we don't know who anyone is, we can only verify that a story is yours through the anonymous ID in this browser.