Late Lamp

Privacy Policy and Personal Data Notice

“Whereabouts”

Update Date: 3 October 2026

1. Objective

Efe Onur Özcandan, an individual established in the Republic of Türkiye and publishing under the trade name Late Lamp (“Late Lamp”, “we”, “us” or the “Data Controller”), aims to process the personal data of the users of the Whereabouts mobile application (“Whereabouts” or the “Application”) in accordance with the general principles of privacy and the provisions of the applicable data protection legislation, in particular the Law on the Protection of Personal Data No. 6698 (“PDP Law”) and the secondary legislation issued thereunder. In addition to the PDP Law, this Privacy Policy also sets out the additional rights of individuals where the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the UK GDPR or the California Consumer Privacy Act (“CCPA”) is applicable.

Your personal data, which is obtained by Late Lamp through your use of the Application, through the application stores or by any other means, may be processed by Late Lamp as Data Controller:

in connection with the purposes of processing set out in this Privacy Policy and limited to what is necessary for those purposes, in a limited and proportionate manner,
in an accurate and, where necessary, up-to-date manner,
and may be recorded, stored, preserved, reorganized and transferred to the institutions authorized to request such personal data by law, and may be transferred to and shared with third parties within the country or abroad under the conditions stipulated by the legislation and, where necessary, upon your explicit consent, and may otherwise be processed by the means listed in and subject to the procedures set forth in the legislation.

This Privacy Policy is adopted for the continuance and improvement of the activities carried out by Late Lamp in line with the principles set forth in the PDP Law and the GDPR.

This Privacy Policy describes which data we collect, how we intend to use, store, protect and share the data we collect, how you can object to or withdraw your consent for the processing of such data, and how you can access, correct and delete such data.

Capitalized terms used in this Privacy Policy shall have the meanings specified in the Terms and Conditions unless defined separately in this Privacy Policy.

Nature of the Application. Whereabouts is a single-player logic puzzle game. The Application does not offer user accounts or registration and does not request your name, surname, e-mail address, telephone number, contacts, photographs or location permission. Two features go beyond the puzzles themselves and are described separately in Section 2: the daily case, whose world board ranks players by solve time under a detective name of their choosing and therefore uses an anonymous player identity and our own server, and the beta programme, whose pre-release versions ask testers for their name and e-mail address. Apart from the detective name and the beta sign-in, the Application contains no facility for entering or transmitting text, images or other user content. Accordingly, the categories of personal data set out in Section 2 are limited to technical, usage and transaction data generated automatically by your device and by the application stores, to the daily case data described there, and to the details you provide if you choose to write to us or to join the beta programme.

2. Collection of Personal Data and Method

Late Lamp may process your personal data for the purposes specified in this Privacy Policy.

The personal data of users collected and used by Late Lamp are, in particular, as follows: a random installation identifier generated by the Application, the device model, the operating system and its version, the Application version, the device language, time zone and screen size; the Internet Protocol address (“IP Address”) of your device; in-game events (such as a case being started or solved) and their attributes; visual recordings of the Application’s screens during a session; where you allow it, the advertising identifier of your device and whether your installation followed an advertisement of ours; the country your device is in when the Application is first launched; if you play the daily case, an anonymous player identifier, the detective name you choose or are given, the country set on your device and the outcome, time and number of mistakes of each attempt; if you take part in the beta programme, your name, your e-mail address and the version of the Application you are testing; your order information if you make an in-app purchase; and your e-mail address, name (if given) and the contents of your message if you contact us.

Late Lamp offers paid products within the Application, namely the Bottomless Cup subscription and gold packs. All such purchases are processed by the Apple App Store or Google Play (together, the “App Stores”). Your payment details, such as card or bank information, will not be stored or collected by Late Lamp. Such information is provided directly to the App Stores and the use of such personal information is subject to the privacy policy of the relevant App Store.

Data Categories and Data Types

Data Category	Data Types
Process Security	A random installation identifier generated by the Application at first launch (this is not the advertising identifier of your device); device model and manufacturer; operating system and version; Application version and build number; device language; time zone; screen size; the date and time of each event; and the IP Address of your device. The IP Address is used at the moment an event is received to derive an approximate location at country or city level and is discarded immediately thereafter; it is not stored together with the event.
Usage Data	In-game events such as “case started”, “case solved”, “tool used”, “shop opened” and “purchase screen viewed”, together with their attributes such as the level number, the board size, the time spent on a case and its outcome; Application opens and closes; and the variant of a feature assigned to your installation in a test (A/B test).
Session Recordings	A visual recording of how the Application’s screens appear and are touched during a session, used to observe where players get stuck. The only text that can be typed in the Application is the detective name of the daily case (and, in beta versions, the beta sign-in), so a recording may show the name you type there; the recording never reaches anything you type outside the Application. Recordings are deleted 30 (thirty) days after they are made.
Attribution Data	Only where you allow it (Section 2, “Advertising identifiers and ad measurement”): the advertising identifier of your device (Apple IDFA or Google Advertising ID); a random installation identifier generated by the measurement software; the installation and launches of the Application; a small number of milestone events (the tutorial completed, certain levels reached, the subscription screen viewed); and, once purchases are validated, purchase events (a subscription started, trialled or renewed, or a gold pack bought) with the amount paid and the currency, without any card details. Each batch also carries basic information about the device (model, operating system and version, language, time zone, mobile carrier and screen size). This data is sent to Meta Platforms so that installations can be matched to advertisements shown on Facebook or Instagram. On iOS, none of this data is sent unless you also grant Apple’s tracking permission; if you do, our purchase provider RevenueCat also records the IDFA, the identifier for vendor (a random identifier Apple gives our apps on your device) and the IP Address of your device, and forwards them to Meta Platforms with the purchase events. If the measurement software itself crashes, it may send Meta a crash report about its own code (the error and basic device information). Separately, on iOS and while ad measurement is on, RevenueCat collects Apple’s AdServices attribution token, from which Apple tells RevenueCat whether the installation followed one of our Apple Ads (App Store search) advertisements and which campaign, ad group and keyword it came from; this is Apple’s own measurement, involves no advertising identifier and needs no tracking permission. While ad measurement is on and you also allow analytics, the Application records once where your installation came from and keeps it with your Usage Data at our analytics provider PostHog: on iOS, the answer Apple gives to that same token (whether the installation followed one of our Apple Ads advertisements and, if so, the numeric identifiers of the campaign, ad group, keyword and ad); on Android, the Google Play install referrer (the tracking parameters of the store link that led to the installation, for example an advertising network, a campaign or one of our own links, such as a link in a video we posted). It contains no advertising identifier and, on iOS, needs no tracking permission.
Region (not stored)	At the first launch the Application asks our own server at latelamp.com which country and region your IP Address belongs to, so that it knows which privacy rules apply and whether to show you the consent screen. The answer (the country code) is kept on your device; the request is not logged and the IP Address is not stored. If the lookup does not answer, the Application does not guess your country: analytics, session recordings and ad measurement stay off, and no consent screen is shown, until a later attempt succeeds.
Daily Case Data	Only if you open the daily case: an anonymous player identifier created for your installation through Firebase Authentication (a random user id and a sign-in token, both kept on your device; no e-mail address, password or telephone number is involved); the detective name you type in the Application (2 to 16 characters) or, if you leave it blank, a name generated from the identifier (such as “Brisk Stoat”); the country set in the regional settings of your device, as a two-letter code; and, for each daily board you start, the day and difficulty tier, the time at which you started, whether you solved the board, your solve time and your number of mistakes. Your detective name, your country (shown as a flag) and your time or the word FAILED appear on the world board, where every player of the Application can see them among the day’s top 100 (one hundred) rows; your own rank is shown to you. The IP Address of each request to our server is used to limit the rate of requests and is kept in the request logs of our hosting provider for a short period (Section 2, “Daily case and the world board”).
Beta Programme Data	Only if you install a pre-release (beta) version of the Application, which is available by invitation through Apple’s TestFlight or Google Play’s testing tracks: the name and e-mail address you enter on the first screen of the beta version, the platform, version and build number of the Application you are testing, and the dates on which your installation was first and last seen. In beta versions the Usage Data and Session Recordings described above are recorded regardless of your country and are filed under your name and e-mail address, so that we can follow up on what you report; the consent screen is not shown and the Settings screen carries no privacy switches. Ad measurement never runs in beta versions.
Customer Transaction	The in-app product purchased, the date and time of the purchase, the price displayed, the transaction identifier issued by the App Store and the status of the subscription (for example active, in trial, cancelled or expired). Where you allow analytics, the random installation identifier used by our analytics provider is also recorded with your purchase, so that a renewal, a cancellation or a refund can be matched to the same installation; the same identifier is thereby held by both RevenueCat and PostHog. Card or bank details are never received by Late Lamp.
Contact Information	Your e-mail address, your name if you provide it, and the contents of your message, only if you contact us at support@latelamp.com.
Game Progress (device only)	Solved cases, current level, gold, tools, coffee, settings (sound, music, vibration, reminders, language), the tutorial cards you have seen, your record of daily cases played and the anonymous player identity of the daily case. This data is stored solely on your device, is not transmitted to Late Lamp except as described under Daily Case Data, and is deleted when you delete the Application. It is listed here for transparency.

We may collect the above-mentioned data directly from your mobile device through the software components embedded in the Application, from the App Stores when you make a purchase, and from you when you contact us, for the purposes of compliance with legal obligations, enhancing our services, administering your use of the Application, as well as enabling you to enjoy and easily navigate the Application.

Cookies. The Application is not a website and does not embed a web browser; therefore it does not use cookies. Our website at latelamp.com does not set cookies either.

Advertising identifiers and ad measurement. The Application does not display advertisements. We do, however, advertise Whereabouts on Facebook and Instagram, and the Application can tell Meta Platforms whether an installation followed one of those advertisements (“ad measurement” or attribution). Whether it does depends on where you are and on what you choose:

Where the law requires your consent — the European Economic Area, the United Kingdom, Quebec and most other countries — the Application shows a consent sheet at the first launch, over the first case. You can accept both purposes (“Sounds good”), decline both (“Not now”) or tap “Customize” for two separate switches: Analytics (the Usage Data and Session Recordings described above) and Ad measurement (the Attribution Data described above), both off until you turn them on. Declining is as easy as accepting, and putting the sheet aside records nothing. Nothing covered by a switch leaves your device before you answer. You can change either choice at any time in the Settings screen of the Application.
In the United States, Canada (outside Quebec), Japan, Australia and South Africa, analytics and ad measurement run from the first launch, and the Settings screen of the Application carries an Ad measurement switch with which you can opt out at any time.
On iOS, before any advertising identifier is read, the Application asks for your permission under Apple’s App Tracking Transparency framework. If you deny it, the ad measurement software is never started and nothing is sent to Meta, exactly as if you had declined ad measurement; the Application only registers the installation with Apple’s SKAdNetwork framework, which involves no identifier and delivers aggregate, anonymous reports. If you decline ad measurement on the consent screen, the measurement software is never started; the Application only registers the installation with SKAdNetwork itself, which involves no identifier and no data about you.
On Android, the Google Advertising ID and the Google Play install referrer are read only while ad measurement is on.
In Türkiye, analytics, session recordings and ad measurement are switched off altogether: the Application does not ask, collects no Usage Data, Session Recordings or Attribution Data, never reads an advertising identifier, never starts the measurement software, and the Settings screen carries no switches. On iOS the installation is registered with SKAdNetwork only, which involves no identifier. The KVKK notice describes what remains for users in Türkiye.

Two requests are made before you answer the consent screen, neither of which stores anything about you: the region lookup described in the table above, and a request to our analytics provider for the Application’s remote configuration (for example the price of gold packs). The configuration request carries a random identifier that is generated for that launch only and is neither stored on your device nor by the provider; it creates no record of you.

Daily case and the world board

Once you have progressed past the opening levels, the Application offers a daily case: three boards a day (easy, medium and hard), the same for every player, each of which can be attempted once. Results are ranked by solve time on a world board shared by all players on iOS and Android. The day changes at 00:00 UTC. The daily case is the only part of the Application that talks to a server of our own, and it works as follows:

Anonymous player identity. The first time you start a daily board, the Application signs your installation up as an anonymous user of Firebase Authentication, a service of Google LLC, and receives a random user identifier together with a sign-in token. No account is created in your name: no e-mail address, password or telephone number is involved, and neither Late Lamp nor Google can link the identifier to you as a person. The identifier and the token are kept on your device and are lost when you delete the Application; a new installation receives a new identifier and starts with an empty record. Google processes the identifier and the IP Address of the sign-in request on our behalf.
Detective name. When you first open the DAILY tab, the Application asks you for a detective name of 2 to 16 characters, or offers you a generated one. The name is public: it is shown on the world board to every player. Please do not use your real name or anything that identifies you or another person. Names are checked against a list of offensive words on your device and again on our server; a name that fails the check is refused. Late Lamp may also change or remove a name that breaks the Terms and Conditions. The name is sent with each attempt and stored with your player record; rows filed before you change your name keep the earlier name.
Our server. The attempts, results and player records described in the table above are stored by our own server, which runs on Google Cloud (Cloud Run and Firestore) in the United States, region us-central1 (Section 5). Our server records the IP Address of each request in order to limit the number of requests per caller and to detect abuse; these request logs are kept by the hosting provider for at most 30 (thirty) days. The board itself is generated on your device from the date; the server only receives the outcome, the time and the number of mistakes that the Application reports.
Everywhere, not covered by the switches. The world board is the service you ask for when you press START on a daily board, so it works in every country, including Türkiye (see the KVKK notice), and is independent of the Analytics and Ad measurement switches. If you would rather not have a record on the world board, do not start a daily board; a board played while your device is offline is played unranked and nothing is sent.
Sharing a result. The SHARE button on a solved daily case opens the share sheet of your device with a short text (the tier, your time and a link to our website). The sharing itself is handled by your device and by the application you choose; nothing is sent to Late Lamp.
Deletion. To have your player record and your rows removed from the world board, write to us with your detective name and the day and tier you played (Section 6). Deleting the Application removes the identity from your device but does not remove rows already filed on the world board.

Beta programme

Before a version of the Application is released, Late Lamp may invite a small number of players to test it through Apple’s TestFlight or Google Play’s testing tracks (the “beta programme”). Taking part is voluntary and by invitation only; the released Application never asks for any of the following.

Sign-in. A beta version asks for your name and e-mail address on its first screen and cannot be played until they are entered. They are stored on your device, sent to our server together with the platform, version and build number of the Application, and kept in a tester roster hosted on Google Cloud in the United States (Section 5). We use the roster only to know who holds a pre-release version, to ask testers questions about the build and to tell them when a build is withdrawn; never for marketing.
Named analytics. In a beta version the Usage Data and Session Recordings described above are recorded regardless of the country you are in, and your e-mail address is used as the identifier under which our analytics provider files your events and recordings, with your name attached as a property. This is what lets us match what you report to what the Application did. The consent screen is not shown in beta versions and the Settings screen has no privacy switches; ad measurement never runs in them.
Leaving. You can leave the beta programme at any time by deleting the beta version and, on iOS, by stopping testing in TestFlight; write to us if you also want your roster entry and your named analytics data deleted (Section 6).

General Principles Regarding Personal Data Processing

In accordance with this Privacy Policy, personal data are processed by Late Lamp as Data Controller in line with the basic principles named here: (i) being in accordance with the law and good faith, (ii) being accurate and, where necessary, up-to-date, (iii) being processed for specific, explicit and legitimate purposes, (iv) being limited to the purpose for which they are processed and data minimization, and (v) being stored for the period stipulated in the relevant legislation or required for the purpose for which they are processed.

3. Purposes of Processing Personal Data and Legal Reasons

Your personal data will be processed via automatic means for the purposes stated below, in accordance with the applicable legislation and Articles 5 and 6 of the PDP Law, and Article 6 of the GDPR where it is applicable, where it is expressly permitted by the laws, where it is necessary for the establishment or performance of a contract, where it is necessary for compliance with a legal obligation, or where it is necessary for the legitimate interests of Late Lamp provided that your fundamental rights and freedoms are protected.

a) Purposes of Processing Personal Data

In accordance with this text, your personal data is processed for the following purposes in accordance with the above general conditions:

Process Security

operation of the Application, including the delivery of remote configuration and updates
execution of information security processes
detection and prevention of fraud, cheating and abuse
execution/auditing of business activities
providing information to authorized persons, institutions and organizations

Usage Data, Session Recordings

operation and improvement of the Application, for example understanding which cases are too difficult, where the tutorials fail and which features are used
measuring the effect of changes to the Application (A/B tests)
correction of technical errors and defects
conducting activities to ensure business continuity
execution/auditing of business activities

Attribution Data

measuring whether installations of the Application follow our advertisements on Facebook and Instagram, and how those players go on to play, so that we can decide where to advertise and how much to spend
letting Meta Platforms report the results of our advertising campaigns to us in aggregate form
comparing how players who came from each of our Apple Ads campaigns, other advertisements or our own links go on to play with players who found the Application by themselves, using the source of the installation kept with your Usage Data

Daily Case Data

operation of the daily case: issuing one attempt per player and per board, filing the result, ranking players on the world board and showing you your own rank
detection and prevention of cheating, duplicate attempts and abuse of our server, including rate limiting by IP Address
keeping the world board free of offensive or misleading names

Beta Programme Data

running the beta programme: knowing who holds a pre-release version, matching bug reports, events and recordings to the tester who made them, asking testers questions about the build and informing them when a build is withdrawn
correction of technical errors and defects before release

Customer Transaction

execution of goods/services sales processes, including the delivery of the purchased product and the restoration of purchases on a new device
execution of agreement processes
conducting after-sales support services for goods/services
execution of finance and accounting processes
execution of activities in compliance with legislation

Contact Information

execution of communication activities
conducting after-sales support services and following up requests and complaints
execution of activities in compliance with legislation and protection of persons’ rights, privacy and safety
conducting storage and archive activities

Should a new purpose of processing become necessary, for example because the Application gains a feature, we will announce it by revising this Privacy Policy (Section 7) and, where the applicable law requires it, request your consent.

b) Legal Reasons

Process Security

The law explicitly stipulates the process by which we process your personal data
It is necessary to process your personal data, provided that we establish a contractual relationship with you, or that it is directly related to our performance obligation arising from this contract
Processing is necessary for our legitimate interests, provided that your fundamental rights and freedoms are not harmed

Usage Data, Session Recordings

Your consent, given through the Analytics switch of the consent screen, wherever the Application shows that screen (Article 5/1 of the PDP Law; Article 6(1)(a) of the GDPR and the applicable rules on the storage of and access to information on your device). You may withdraw it at any time in the Settings screen of the Application (Section 6).
In the United States, Canada (outside Quebec), Japan, Australia and South Africa: processing is necessary for our legitimate interests in understanding how the Application is played so that we can fix and improve it, provided that your fundamental rights and freedoms are not harmed. We balance this interest against your privacy by collecting no names or contact details (outside the beta programme), by discarding the IP Address, by keeping session recordings for a short period and by allowing you to object at any time (Section 6).

In Türkiye, Usage Data, Session Recordings and Attribution Data are not processed at all, so no legal basis is relied on for them; the only exception is a beta version, in which Usage Data and Session Recordings are processed on the basis described under Beta Programme Data below.

Daily Case Data

It is necessary to process your personal data in order to provide the service you request when you start a daily board: the attempt, the result and the ranking on the world board cannot exist without it (Article 5/2-c of the PDP Law; Article 6(1)(b) of the GDPR)
Processing is necessary for our legitimate interests in keeping the world board fair and our server available, provided that your fundamental rights and freedoms are not harmed (rate limiting, abuse detection, name moderation)

Beta Programme Data

It is necessary to process your personal data in order to run the beta test you take part in when you accept the invitation and sign in on the first screen of the beta version (Article 5/2-c of the PDP Law; Article 6(1)(b) of the GDPR)
For the named Usage Data and Session Recordings of a beta version, and for their transfer abroad where the PDP Law applies: your consent, which you give by signing in on the first screen of the beta version after being informed by this Privacy Policy and by the invitation (Article 5/1 and Article 9 of the PDP Law; Article 6(1)(a) of the GDPR). You may withdraw it at any time by leaving the beta programme (Section 2, “Beta programme”).

Attribution Data

Your consent, given through the Ad measurement switch of the consent screen and, on iOS, for the data sent to Meta Platforms, through Apple’s tracking permission, wherever the Application shows the consent screen (Article 5/1 of the PDP Law; Article 6(1)(a) of the GDPR). You may withdraw it at any time in the Settings screen of the Application (Section 6).
In the United States, Canada (outside Quebec), Japan, Australia and South Africa: processing is necessary for our legitimate interest in measuring the advertising we pay for, with the Ad measurement switch in Settings as your way to opt out at any time; on iOS, additionally, Apple’s tracking permission for the data sent to Meta Platforms.

Customer Transaction

It is necessary to process your personal data, provided that we establish a contractual relationship with you, or that it is directly related to our performance obligation arising from this contract
Conditions that are necessary in order to fulfil our legal obligations, in particular under the tax and accounting legislation
We have to process data in order to establish a right for you, to exercise and protect this right

Contact Information

It is necessary to process your personal data in order to respond to your request, as directly related to the establishment or performance of a contract
Processing is necessary for our legitimate interests, provided that your fundamental rights and freedoms are not harmed
We have to process data in order to establish a right for you, to exercise and protect this right

We do not process special categories of personal data. We do not use personal data for marketing communications, for profiling for advertising purposes, or for automated decision-making producing legal or similarly significant effects concerning you. We do not sell personal data. Where the CCPA applies, the transmission of the advertising identifier and of Attribution Data to Meta Platforms for ad measurement may qualify as “sharing” personal information for cross-context behavioral advertising; you can opt out of it at any time through the Ad measurement switch in the Settings screen of the Application (Section 6). We do not use the data for any other advertising purpose and we do not “sell” personal information.

Third-Party Websites and Applications

The Application and our website may contain links to other websites or applications, such as the App Stores, the privacy policies of our service providers and the support pages of Apple and Google, whose content is not controlled by Late Lamp. These linked websites or applications may contain terms and conditions other than the Late Lamp texts. Late Lamp cannot be held responsible for the use or disclosure of information that these websites or applications may process. Likewise, Late Lamp shall not have any responsibility for any links from other sites or applications provided to the Application.

We collect information by fair and lawful means, and we let you know why we are collecting it and how it will be used through this Privacy Policy.

Reminders (Local Notifications)

If you permit it, the Application may schedule local reminders on your device, for example when your coffee has brewed back. These reminders are created on your device; no notification server is involved and no push token is collected by Late Lamp. You can always stop such reminders through the Settings screen of the Application or through the notification settings of your device.

Retention of Personal Data

Your data will be stored for the duration specified in the applicable legislation or for a reasonable time until the purpose of processing ceases to exist, or during the legal periods of limitation. In particular:

Session Recordings are deleted 30 (thirty) days after they are recorded.
Usage Data and Process Security data are kept for as long as we need them to understand how the Application is played across its versions, and for a maximum of 7 (seven) years, which is the retention limit of our analytics provider. You may request the earlier deletion of the record relating to your installation (Section 6).
Daily Case Data (your player record and the rows on the world board) is deleted automatically 12 (twelve) months after it was written: the rows of a daily board twelve months after that day, your player record twelve months after the last daily case you played. It is deleted sooner at your request (Section 6). The request logs of our server that contain the IP Address are kept for at most 30 (thirty) days.
Beta Programme Data is kept until the beta programme ends and in any case no longer than 12 (twelve) months after your last use of a beta version, or until you ask for its deletion, whichever comes first.
Customer Transaction data is kept for as long as you may need to restore a purchase and for the periods stipulated in the applicable tax and accounting legislation.
Contact Information is kept for as long as necessary to resolve your request and for the applicable period of limitation thereafter.
Game Progress remains on your device until you delete the Application.

Late Lamp may continue to store your personal data even after the expiry of the purpose of its use, provided that it is required by other laws.

Technical and Administrative Measures

Late Lamp stores the personal data it processes in accordance with the relevant legislation for the periods stipulated in the relevant legislation or required for the purpose of processing. Late Lamp undertakes to take all necessary technical and administrative measures and to take due care to ensure the confidentiality, integrity and security of personal data. In this context, it takes the necessary measures to prevent the unlawful processing of personal data, unauthorized access to data, and the unlawful disclosure, modification or destruction of data. Accordingly, Late Lamp takes the following technical and administrative measures regarding the personal data it processes:

Data minimization. The Application has no accounts; outside the beta programme it collects no names, contact details or precise location, and the daily case knows you only by a random identifier and a detective name of your choosing; the IP Address is discarded upon receipt by our analytics provider and kept only briefly in the request logs of our own server; the installation identifier is random and cannot be linked to you by Late Lamp; the advertising identifier is read only with your permission and only while ad measurement is on.
Encryption. All data transmitted by the Application to our service providers is transmitted over encrypted connections (TLS). Our service providers store the data on encrypted infrastructure.
Service providers. Personal data is processed only by established service providers (Section 5) that maintain their own information security programmes and certifications and that are bound by data processing agreements.
Access control. Access to the systems of our service providers is limited to the persons who need it for the purposes stated in this Privacy Policy and is protected by strong passwords and two-factor authentication.
Retention limits. Session recordings are deleted automatically after 30 (thirty) days; other retention periods are set out above.
Breach notification. In the event that personal data is damaged as a result of attacks on the Application or on the systems of Late Lamp or its service providers, despite the necessary information security measures having been taken, or personal data is obtained by unauthorized third parties, Late Lamp notifies this situation to the relevant data protection authority and, where required, to the users without undue delay and takes the necessary measures.

4. Age Limitation

Whereabouts has a fictional murder-mystery theme and is not directed at children. We do not permit the use of the Application by children under the age of 13 (thirteen), or under the age of digital consent applicable in your country if higher. We do not knowingly collect or process personal data from anyone under the age of 13. If you learn that someone under the age of 13 has provided us with personal data, please contact us at support@latelamp.com and we will delete it. Users under the age of 18 (eighteen) must have the permission of their parents or legal guardians to use the Application and to make purchases within it.

5. Transferring Personal Data to Third Parties

The procedures and principles to be applied for the transfer of personal data are regulated in Articles 8 and 9 of the PDP Law, and the personal data of users may be transferred to third parties within the country or abroad, since we use servers and cloud systems located abroad.

Your personal data may be transferred abroad for the following reasons:

Operation of the Application and correction of technical errors and defects
Measurement and improvement of the Application (analytics and session recordings)
Measurement of our advertising campaigns (attribution)
Validation of purchases and restoration of purchases across devices
Operation of the daily case and its world board (anonymous sign-in, storage of attempts, results and player records)
Running the beta programme (tester roster, named analytics)
Conducting storage and archive activities
Conducting after-sales support services for goods/services

Late Lamp transfers your personal data only to the following service providers, which are embedded into or connected to the Application, for the following purposes:

Recipient	Purpose	Location	Privacy Policy
PostHog, Inc.	Product analytics, session recordings, feature flags and A/B tests (Process Security, Usage Data, Session Recordings, Customer Transaction; while ad measurement is on, the source of the installation described under Attribution Data; in beta versions also the tester’s name and e-mail address as the identifier of the record)	United States	posthog.com/privacy
RevenueCat, Inc.	Validation of in-app purchases and synchronization of your entitlements across devices (Customer Transaction, installation identifier); forwarding of purchase events (subscriptions and gold packs, with the amount paid and the currency) to Meta Platforms for ad measurement, only while ad measurement is on; on iOS, while ad measurement is on, collection of Apple’s AdServices attribution token and, with your tracking permission, of the IDFA, identifier for vendor and IP Address	United States	revenuecat.com/privacy
Meta Platforms, Inc. (for users in the European Economic Area, the United Kingdom and Switzerland: Meta Platforms Ireland Limited)	Matching installations and in-app events to our advertisements on Facebook and Instagram (Attribution Data, including crash reports of its measurement software), only where you allow ad measurement. Meta also processes this data for its own purposes as an independent controller, as described in its policy.	United States (Ireland)	facebook.com/privacy/policy
Late Lamp (our own server on latelamp.com, hosted by Vercel Inc.)	The region lookup at the first launch (IP Address to country, not stored)	United States	vercel.com/legal/privacy-policy
Apple Inc.	Distribution of the Application, in-app purchases and subscriptions on iOS (Customer Transaction); attribution of installations to our Apple Ads campaigns through the AdServices framework, only while ad measurement is on	United States	apple.com/legal/privacy
Google LLC	Distribution of the Application and in-app purchases on Android (Customer Transaction); Firebase Authentication, which issues the anonymous player identifier of the daily case; Google Cloud (Cloud Run and Firestore, region us-central1), which hosts our own server and database holding Daily Case Data and Beta Programme Data as our processor; on Android, while ad measurement is on, the Google Play install referrer (Attribution Data)	United States	policies.google.com/privacy

Late Lamp may also share personal data with authorized public institutions and organizations for the purpose of the execution of activities in compliance with legislation, the monitoring and execution of legal affairs, and informing authorized persons, institutions and organizations, where required by law, and to the extent necessary to protect the rights, property and safety of Late Lamp, the users of the Application or the public.

Where the GDPR or the UK GDPR applies, transfers to the above recipients are carried out on the basis of an adequacy decision (including certification under the EU-US Data Privacy Framework where available) or of appropriate safeguards such as the Standard Contractual Clauses adopted by the European Commission or the UK International Data Transfer Agreement. Where the PDP Law applies, transfers abroad are carried out in accordance with Article 9 of the PDP Law; you may object to such transfers or request the deletion of your data as described in Section 6.

6. Your Rights as the Data Subject

Pursuant to Article 11 of the PDP Law, you may request the following regarding your personal data by applying to Late Lamp:

Learn whether or not your personal data have been processed;
Request information as to whether your personal data have been processed;
Learn the purpose of the processing of personal data and whether the data are used in accordance with their purpose;
Know the third parties in the country or abroad to whom your personal data have been transferred;
Request the correction of your personal data in case they have been processed incompletely or inaccurately, and request the notification of the transactions made under this scope to the third parties to whom personal data have been transferred;
Request the deletion, destruction or anonymization of your personal data if the reasons for the processing have disappeared, and request the notification of the transactions made under this scope to the third parties to whom personal data have been transferred;
Object to the occurrence of any result that is to your detriment by means of the analysis of personal data exclusively through automated systems;
Request compensation for the damages in case you incur damages due to the unlawful processing of your personal data.

Where the GDPR or the UK GDPR is applicable, data subjects have the following rights:

Right of access – To learn whether personal data is being processed and, if so, to access your personal data and the information regarding the processing of your personal data;
Right to rectification – To request the correction of information that you believe is inaccurate or the completion of information that you believe is incomplete by Late Lamp;
Right to erasure – To request the deletion of personal data under the conditions stipulated in the GDPR;
Right to restriction of processing – To request the restriction of the processing of personal data under the conditions stipulated in the GDPR;
Right to object – To object to the processing of personal data based on our legitimate interests, including the Usage Data and Session Recordings described in Section 2, under the conditions stipulated in the GDPR;
Right to data portability – To request that the data collected by Late Lamp be transferred to you or directly to another organization under certain conditions;
Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you;
Right to withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing based on consent before its withdrawal.

Where the CCPA is applicable, California residents have the right to know what personal information is collected, used, shared or sold; the right to delete personal information; the right to correct inaccurate personal information; and the right not to be discriminated against for exercising these rights. We do not sell personal information. The only “sharing” under the CCPA is the ad measurement described in Section 2; you can opt out of it by switching Ad measurement off in the Settings screen of the Application (“Do Not Sell or Share My Personal Information”), and we honour that choice from the moment you make it.

In addition, you may at any time (i) switch Analytics and Ad measurement on or off in the Settings screen of the Application (where the consent screen was shown, both switches; elsewhere, the Ad measurement switch) — switching one off stops the corresponding transmission immediately, though it does not delete what was sent before; (ii) on iOS, change the tracking permission under Settings › Privacy & Security › Tracking, and on Android reset or delete your advertising ID in your device’s settings; (iii) stop the local reminders through the Settings screen of the Application or the notification settings of your device; (iv) stop playing the daily case, in which case no further Daily Case Data is created, and ask us to delete the rows already filed; and (v) delete all Game Progress, the anonymous player identity of the daily case and your privacy choices stored on your device by deleting the Application.

In the application containing your explanations about the right you have as the data subject and that you wish to exercise, your request must be explicit and understandable; if you are acting on behalf of someone else, you must be specially authorized in this regard and your authority must be documented. Because the Application has no accounts, Late Lamp holds no name, e-mail address or other identifier that links the analytics or attribution data it processes to you as a person, except in the beta programme. In order to locate the record relating to your installation, we may therefore ask you for details such as the approximate date of installation, the device model and the operating system version; for the daily case, your detective name and the day and tier you played; and for the beta programme, the e-mail address you signed in with. Where we are unable to identify the record relating to you, we will inform you accordingly.

Late Lamp will enable you to file such requests by e-mail to support@latelamp.com or by post to the address stated below, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. In accordance with Article 13 of the PDP Law and Article 12 of the GDPR, Late Lamp will finalize your requests, free of charge, within 30 (thirty) days at the latest, depending on the nature of the request. In case the request is rejected, the reason or reasons for the rejection will be notified in writing or electronically together with their justification.

If you believe that we, or someone to whom we have transferred your data, are violating your rights, you can file a complaint with the data protection authority in your country (in Türkiye, the Personal Data Protection Board; in the European Economic Area, the supervisory authority of your member state; in the United Kingdom, the Information Commissioner’s Office) and with other competent supervisory authorities.

7. Changes to This Privacy Policy

This Privacy Policy may be revised by Late Lamp when deemed necessary, for example when the Application changes what it collects or when a new service provider is added. The revised Privacy Policy will be published at latelamp.com/whereabouts/privacy.html with a new Update Date, and material changes will be announced within the Application. If you continue to access and use the Application after the publication of the revised Privacy Policy, you shall be deemed to have been informed of the changes in this Privacy Policy. Where a change requires your consent under the applicable law, we will request it separately.

8. Contact

Publisher:	Efe Onur Özcandan (individual, doing business as Late Lamp)
Address:	Emek Mah. 15. Cad. Özsun No: 53 İç Kapı No: 2, Çankaya / Ankara, Türkiye
E-mail:	support@latelamp.com
Website:	latelamp.com

Late Lamp Whereabouts Support Privacy Policy Terms and Conditions