Privacy Policy

This Privacy Policy explains what personal data we collect when you use the DersTakip mobile app and the derstakip.app website (together, "DersTakip"), why we collect it, who we share it with, and the rights you have. The policy is designed to satisfy the requirements of the EU General Data Protection Regulation (GDPR), the UK GDPR, and Turkey's KVKK Law No. 6698. Turkish users may also refer to our Aydınlatma Metni, which mirrors the same content in the KVKK-required format.

1. Who we are

The data controller for DersTakip is Ataberk Köroğlu, a Turkish sole proprietor (şahıs şirketi).

• Tax ID (VKN): 5860710646
• Registered address: Armağanevler Mah, Ümraniye, Istanbul 34760, Turkey
• Contact: info@derstakip.app

2. What we collect

The categories of personal data we may process:

Cookies and similar technologies on our website are described in the Cookie Policy. The mobile app does not use cookies.

3. Why we process it

We use your personal data to:

• Create your account, verify your identity, and keep your session secure
• Provide core app features — study tracking, daily targets, statistics, streaks
• Offer social features — groups, leagues, stories, leaderboards, messaging
• Power AI-based coaching and content recommendations
• Sell and manage Premium subscriptions and fulfill tax/accounting obligations
• Send engagement notifications (streak reminders, league updates, weekly recap)
• Provide customer support and handle complaints
• Improve the product, debug errors, and measure performance
• Moderate content and prevent abuse
• Comply with legal obligations and respond to lawful requests from authorities

4. Legal basis (GDPR Art. 6)

• Performance of a contract (Art. 6(1)(b)): creating your account, providing the app's core features, processing subscriptions.
• Legal obligation (Art. 6(1)(c)): retaining sale and tax records (10 years under Turkish Tax Procedure Law Art. 253) and responding to lawful requests from authorities.
• Legitimate interests (Art. 6(1)(f)): service security, fraud prevention, product analytics, content moderation, improving AI coaching.
• Consent (Art. 6(1)(a)): marketing notifications, optional third-party integrations, analytics cookies on the website.

5. Service providers we use

We don't run DersTakip alone — for things like sign-in, push notifications, AI chat, and subscription billing we rely on the infrastructure of other companies. This means your data inevitably passes through their systems too. We do not sell your data and we do not share it for marketing purposes;the providers below are operational tools we depend on to run the Service. Each is bound by contractual data-protection obligations and may only process your data for the purposes we instruct.

Beyond these providers, we may share data with authorities when legally required (court orders, regulatory requests, criminal investigations).

6. International transfers

DersTakip's primary servers and file storage are located in Germany (EU). For users inside the EU/EEA, this is intra-EU processing.

However, several sub-processors listed above operate from the United States. When we transfer personal data to a country outside the EU/EEA that has not been deemed "adequate" by the European Commission, we rely on:

• Standard Contractual Clauses (SCCs) provided by the sub-processor under their data processing addendum, or
• Your explicit consent for optional integrations (e.g., Facebook Login), or
• Contractual necessity, where the transfer is required to provide a service you requested (e.g., Apple Sign-In).

7. How long we keep data

8. Security

We apply industry-standard technical and organizational measures:

• TLS encryption for all network traffic
• Passwords are stored by Firebase Authentication using one-way hashing (scrypt + HMAC) on Google Cloud infrastructure; we never see your password
• Role-based access controls; restricted admin access
• Rate limiting, HTTP security headers (helmet), CORS controls
• Content moderation (image and text) on user-generated content
• Weekly backups stored within the EU

9. Children

DersTakip is not directed at children under 13, and we do not knowingly collect personal data from anyone under 13. For users aged 13–18, we recommend that a parent or guardian review this Privacy Policy and the app's features. If we become aware that we have collected personal data from a child under 13 without verified parental consent, we will take steps to remove that data as soon as possible.

10. Your rights

Depending on where you live, you have the following rights regarding your personal data. Under GDPR (Art. 15–22) and KVKK Art. 11:

• Access: request a copy of the personal data we hold about you
• Rectification: ask us to correct inaccurate or incomplete data
• Erasure: ask us to delete your data (subject to legal exceptions such as tax retention)
• Restriction: ask us to limit how we process your data
• Portability: receive your data in a structured, machine-readable format
• Object: object to processing based on legitimate interests, including direct marketing
• Withdraw consent: where processing is based on consent, you may withdraw it at any time
• Lodge a complaint: with the data protection authority of your country

To exercise any of these rights, email us at info@derstakip.app. To delete your account, the fastest path is the Account Removal page.

We respond to requests within 30 days. EU/EEA users may also lodge a complaint with their national supervisory authority. Turkish users may lodge a complaint with the Personal Data Protection Authority (KVKK Kurulu) after first contacting us.

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the latest version. If we make material changes, we will notify registered users by email or in-app notification.

12. Contact

Questions, requests, or complaints? info@derstakip.app