Privacy policy
A clear way to ask questions and manage your information.
Last updated: October 5, 2026
Who we are
Dervish is a reading and writing service operated by Mitra Deniz Karataş / Neuralith AI Studio, the data controller. This policy covers the Dervish website and connected mobile versions. Mobile sign-in and reading use the same service. Your session credential is stored in protected device storage; appearance preferences are stored locally.
Information you provide
When you create an account, we process your email address, display name, username, password hash, verification status and account dates. We store the writing, submissions, private notes and saved items you choose to create. Passwords are not stored in plain text. If you choose Google sign-in where available, we receive your verified email, display name and Google account identifier; we do not receive your Google password. On supported iOS versions, Sign in with Apple supplies a verified Apple identifier, your chosen real or relay email address, and your name when you first consent. We do not receive your Apple password. The Apple refresh token is encrypted on our server and used to revoke authorization; it is not used for advertising. Messages you send to support include the details you choose to share.
How we use information
We use account information to sign you in, protect your account and send verification or password-reset emails. Writing and saved items enable reading, publishing and your library. Submitted writing is reviewed by authorised staff. Published writing and its author profile are public; drafts, private notes and bookmarks are protected by account access controls. Book titles and cover images you submit are stored in your own library and reviewed by an administrator. Only approved titles and covers appear in public recommendations, without your account name. You can withdraw them from public recommendations. We remove embedded image metadata when processing covers. Support messages are used to answer your request.
Technical information and cookies
Our hosting and delivery infrastructure processes connection information such as IP addresses, request times and technical errors for delivery and security. A country signal from the delivery service, when available, and your browser language help choose the initial language; we do not request GPS location. Essential session cookies keep you signed in. An optional language-preference cookie is stored if you accept preference cookies. You can change this choice through the cookie controls. We do not use advertising or cross-app tracking SDKs in the current app.
Service providers and disclosure
Our primary server is located in Türkiye. Hosting, network delivery and transactional-email providers process information needed to operate the service; email and delivery services may process data in other countries. Authorised staff may access information needed for support, moderation and security. We may disclose information where legally required. We do not sell personal information or use it for targeted advertising. Contact us for details about the providers and processing locations applicable to your account.
Retention and deletion
Account information and saved content are retained while needed to provide your account. You can request account deletion from the connected app account screen or using the account-deletion page without signing in. We verify ownership before processing a request and explain any information that must be retained for legal obligations or security, its reason and applicable period. Backup copies are retained for up to six months before expiry. Ask us for the retention details that apply to your request.
Your choices and rights
You can edit your name and username in your account settings. Contact us to request access, correction, a copy, deletion or to object to processing, subject to applicable law. Depending on your location, you may also complain to your data protection authority. We may need to verify that a request concerns your own account. Apple users can revoke Apple access from the connected iOS account screen; this signs out local sessions and queues Apple authorization revocation, without deleting the Dervish account. An authenticated deletion request also queues Apple revocation. Never send your password or API keys.
Age and updates
Dervish is intended for people aged 16 and over. Contact us if you believe an account belongs to a younger person. We update this policy when the service or its data practices change and show the revision date on this page.