Data Protection Notice (KVKK)

Data controller

Under Law No. 6698 on the Protection of Personal Data (the "Law"), Muhammet Şafak acts as the data controller. Contact: [email protected] — İstanbul, Türkiye

Categories of personal data processed

• Identity: the name you enter at registration.
• Contact: your email address.
• Transaction security: your irreversibly hashed password, session record and "remember me" token; your IP address transiently on sign-in attempts.
• User activity: bookmarks, private notes, collections, lesson progress, quiz answers and scores, flashcard states, review logs, daily study minutes and streak.
• Other: interface language, time zone, daily study goal, account role.

Purposes of processing

• Creating and administering your membership.
• Storing and serving back the content you save and your learning progress.
• Remembering your interface preferences (language, theme, type scale).
• Computing your spaced-repetition schedule.
• Keeping your account secure and preventing abuse.

Legal bases

Your personal data is processed on the following legal bases set out in Article 5 of the Law:

• Art. 5/2-c — Directly related to the conclusion or performance of a contract: creating your account and storing your content and progress.
• Art. 5/2-ç — Compliance with a legal obligation of the data controller.
• Art. 5/2-f — Legitimate interests, provided this does not harm your fundamental rights and freedoms: account security and prevention of abuse and brute-force attacks.

Special categories of data

No special category of personal data within the meaning of Article 6 of the Law is requested or collected. That said, we are aware that, given what this Service is, the mere existence of an account may indicate a religious interest. For that reason your library and learning records are shared with no third party, are visible to you alone by default, and are never published on any public page.

How data is collected

Your personal data is collected electronically and directly from you: through the registration form, the settings page, and the records created automatically as you use the Service. No data is obtained from third-party sources.

Transfers

Your personal data is not transferred to any third party for marketing or comparable purposes. Running the Service involves transfers to exactly two providers:

• Hosting provider: the data is stored on its servers.
• Email provider (Resend): only when you request a password reset, and only your email address and the contents of that message. The provider is based outside Türkiye, so this constitutes a transfer abroad within the meaning of Article 9 of the Law, limited to delivering that message to you.

There is no transfer beyond these. Properly issued requests from legally competent public authorities are reserved.

Retention and erasure

Your personal data is kept for as long as your account exists. When you delete your account, every record attached to it is erased permanently and at the same moment. Server error logs are kept for at most 14 days and password reset tokens are short-lived; both are purged automatically.

Your rights as a data subject (Art. 11)

Under Article 11 of the Law you may apply to the data controller and exercise the following rights:

• To learn whether your personal data is being processed.
• To request information if it has been processed.
• To learn the purpose of processing and whether the data is used accordingly.
• To know the third parties in Türkiye or abroad to whom the data has been transferred.
• To request rectification if the data is incomplete or inaccurate.
• To request erasure or destruction under the conditions of Article 7 of the Law.
• To request that rectification, erasure or destruction be notified to third parties to whom the data was transferred.
• To object to a result reached against you through analysis carried out solely by automated systems.
• To claim compensation for damage suffered because of unlawful processing.

How to apply

You may submit requests concerning your rights to [email protected], following the procedure set out in the Communiqué on the Procedures and Principles of Application to the Data Controller. Your request is answered free of charge as soon as possible and in any event within thirty days; where the process incurs a cost, the fee in the tariff set by the Board may be charged.

Your application must clearly identify you and state your request. For account-related requests, writing from the email address registered to your account speeds things up.

VERBİS

Whether the data controller is obliged to register with the Data Controllers' Registry (VERBİS) is assessed separately against the exemptions and thresholds set out in the decisions of the Personal Data Protection Board.

Changes

This notice may be updated; the current text is always published on this page and the effective date is changed.