Privacy, in plain language

• No advertising, no profiling for advertising, no sale of personal data to third parties.
• Private is the default. A photo becomes public only when the user explicitly publishes it.
• Group content is end-to-end encrypted on the device. DropLine's servers cannot open these photos, and neither can this website.
• Photos are re-encoded before upload and EXIF metadata is stripped; no hidden location data the user did not choose remains in the file.

• Account: display name, e-mail address or phone number, optional public profile handle.
• Content: uploaded photos and videos, captions, likes, and comments.
• Location: the coordinates of a drop, taken from the photo's metadata, a point selected on the map, or device location where permitted.
• Technical: IP address, device type, app version, session and error logs, and the public part of device encryption keys.
• Subscription: Premium state and the store purchase record. Card details never reach DropLine.

KVKK Article 5 applies in Türkiye and GDPR Article 6 in the European Union. Most data is processed to perform the contract (KVKK 5(2)(c), GDPR 6(1)(b)): there is no map without an account and no drop without a location. Security logs and abuse detection rest on legitimate interests (KVKK 5(2)(f), GDPR 6(1)(f)). Push tokens are processed on explicit consent only, withdrawable from device settings. Publicly published content is data made public by the data subject themselves (KVKK 5(2)(d)).

DropLine's infrastructure suppliers are listed individually below; no transfer is made to any party outside that list. Information is given to public authorities and judicial bodies only upon a valid legal request and strictly within its scope.

All infrastructure used is located outside Türkiye. For Türkiye, transfers rely on the standard contract published by the Personal Data Protection Board (KVKK 9(2)(c)), notified to the Board within five business days of signature. For the European Union, transfers rely on the European Commission's Standard Contractual Clauses and, where necessary, supplementary measures. For end-to-end encrypted group content, the provider abroad sees only encrypted bytes.

• Account and content: for the life of the account; at most 30 days after a deletion request.
• Backups: up to 90 days, for disaster recovery only.
• Security logs: 12 months.
• Reports and moderation records: 2 years.
• Invoice and subscription records: 10 years, as required by financial legislation.

You have rights of access, rectification, erasure, restriction, objection, and data portability. If you are resident in Türkiye, your rights under KVKK Article 11 and the application procedure are set out in detail in the KVKK notice; if you are resident in the European Union, GDPR Articles 15-22 apply. Requests may be sent to the privacy address below and are concluded within 30 days at the latest.

You can delete your account directly from within the app. You also retain the right to lodge a complaint with the Personal Data Protection Board in Türkiye, or with the supervisory authority of your country of residence in the European Union.

The service is not directed at persons under 13. If data belonging to someone under that age is found to have been processed, the account and data are deleted without delay.

When this policy changes, the last-updated date on this page is revised. Material changes that widen the purpose or scope of processing are additionally announced inside the app before they take effect.