Privacy Policy

Last updated: August 31, 2026 · Türkçe sürüm

This Privacy Policy explains what data is collected when you use the Vocadu mobile app ("Vocadu", "the app", "we"), why it is collected, who it is shared with, and what rights you have over your data. Vocadu is a mobile app that helps students preparing for the YDS and YÖKDİL English proficiency exams memorize vocabulary using spaced repetition.

Data controller: Ali Demirci — contact alidemirci2307@gmail.com.

1. Data We Collect

Vocadu has NO email/password sign-up. The first time you open the app, a guest (anonymous) account is created automatically through Supabase Auth; you can optionally "link" this account to Google or Apple to make it permanent. The table below summarizes what kind of data is collected and why.

1.1 Account and identity data

• A randomly generated user ID (UUID) — present from the guest account onward.
• If you link your account with Google or Apple: the name and email address provided by that provider (if any; if you chose Apple's private relay, the relay address the provider generates) and a provider-specific unique identifier.
• In-app profile info: display name, handle, avatar color, target exam (YDS/YÖKDİL) and exam sub-type/date you select (if any).

1.2 Learning and progress data

• Per-word learning state: memory health, spaced-repetition scheduling (FSRS algorithm parameters — difficulty, stability, repetition count), favorite marks.
• Session records: study type (learn/review/flashcards/duel), accuracy, XP earned, best combo, start/end time.
• Progress indicators: streak, daily goal progress, level, total XP, hearts and gems (in-app currency) balance.
• Social features: friend requests, duel/challenge history, league group and ranking results, badge achievements.
• Word issue reports you submit: which word/session, and the reason you reported.

1.3 Device, notification and technical data

• Push notification token (Firebase Cloud Messaging) and your platform (Android/iOS) — needed to deliver notifications.
• App version, device model, operating system version (used for crash reports and forced-update checks).
• Your notification permission status (granted/denied) and language preference (the app's language, not your device language).

1.4 Analytics data

We use Firebase Analytics (Google) to record screen view events (screen_view), interaction events such as forced/soft update screens being shown, and user properties like subscription status, app language, onboarding completion, and notification permission. This data is viewed in aggregate, statistical form in the Google Analytics dashboard and does not directly include your name.

1.5 Crash and error data

Firebase Crashlytics (Google) automatically sends a crash report (stack trace, device model, OS version, and "breadcrumb" logs describing app state leading up to the crash) if the app crashes or an unexpected error occurs. These reports are used solely to diagnose and fix bugs and never contain sensitive data such as passwords or payment details.

1.6 Advertising data

Free-tier users are shown ads via Google AdMob (PRO subscribers never see ads). AdMob may process your advertising identifier (Android Advertising ID / iOS IDFA), general device information, and your interaction with ads (impressions, clicks).

• iOS: App Tracking Transparency (ATT) permission is requested before accessing IDFA; even if you decline, the app works fully — only non-personalized ads are shown.
• EU/UK users: A GDPR-compliant consent form is shown via Google's User Messaging Platform (UMP); the ad SDK is not loaded before consent is obtained.

1.7 Purchase and subscription data

In-app purchases and subscriptions are managed through RevenueCat. RevenueCat processes the purchase receipts relayed by the App Store/Play Store, your subscription/entitlement status (whether PRO is active, which product, when it expires), and an anonymous RevenueCat ID mapped to your app user ID. Your credit card / payment details never reach Vocadu or RevenueCat — payment is processed entirely within Apple's or Google's own infrastructure.

2. Why We Process This Data

• To create your account, keep your session secure, and sync your progress across devices.
• To provide a personalized review schedule (FSRS algorithm) and show your learning statistics.
• To run social/gamification features such as duels, friendships and leagues.
• To send push notifications (streak reminders, duel results, challenge invites, etc.).
• To improve the app by analyzing usage statistics and to detect and fix bugs/crashes.
• To show ads on the free tier and manage ad revenue; to process and verify PRO subscription purchases.
• To comply with legal obligations and prevent abuse (fake accounts, rate-limit violations, etc.).

3. Who We Share Data With

We never sell your data. To operate the app, limited data is shared with the following service providers (acting as data processors):

Data may also be disclosed where necessary to comply with a legal obligation (court order, official request) or to investigate a violation of our terms of service.

4. Data Retention

Your data is retained for as long as your account is active. When you delete your account, your data is permanently erased as described in the "Deleting Your Account and Data" section below. Analytics and crash-report providers (Google) retain data according to their own retention policies, and this data is not stored directly linked to your identity.

5. Deleting Your Account and Data

You can permanently delete your account and all your personal data from within the app via Settings > Delete Account. For the full scope of what is deleted, see our Account Deletion page.

6. Your Rights

Depending on your location, you may have rights such as (under the Turkish Data Protection Law No. 6698 (KVKK) and, where applicable, the GDPR):

• Learn whether your data is being processed and request information about it,
• Learn the purpose of processing and whether it is used accordingly,
• Know the third parties your data is transferred to, domestically or abroad,
• Request correction of incomplete or inaccurate data,
• Request erasure/destruction of your data within the limits of the law,
• Object to a result produced solely by automated analysis that is to your detriment,
• Claim compensation for damages arising from unlawful processing.

To exercise these rights, contact us at alidemirci2307@gmail.com.

7. Children's Privacy

Vocadu is designed for exam-prep (YDS/YÖKDİL) users, generally adults and young adults, and does not knowingly collect data from children under 13. If you believe a child under 13 has provided us with data, please contact us and we will delete it promptly.

8. Data Security

Your data is protected on Supabase's infrastructure with Row Level Security policies, so each user can only access their own data. Sensitive operations such as account deletion are performed server-side (Edge Function) using a service-role key that the client app never has access to. Data in transit is encrypted with HTTPS/TLS.

9. About This Website

The legal-information site you are currently viewing uses no cookies or tracking scripts; it only loads the Nunito typeface from Google Fonts. This policy applies to the mobile app itself.

10. Changes to This Policy

We may update this policy from time to time. Significant changes will be communicated in-app. The current version is always published on this page, with the last-updated date shown at the top.

11. Contact