Privacy Policy

The Linguru mobile application ("the App") is operated by Erhal Olcel (individual developer), acting as data controller. Contact: destek@linguru.com.tr · İstanbul, Türkiye.

This policy is prepared under Turkish Personal Data Protection Law (KVKK No. 6698) and the EU General Data Protection Regulation (GDPR).

The App is designed for users aged 16 and above. Users under 16 may not create an account. If we discover a user is under 16, the account and related data are deleted immediately.

The following data is collected through the App:

• Account information: full name, email, password (stored only as a bcrypt hash), optional phone number, optional profile photo.
• In-app progress: completed challenge days, streak, total points, level (from Cambridge placement test), premium class assignment if any.
• Audio recordings: voice recordings you submit as part of the "Speaking Marathon" feature — stored for evaluation.
• Device and notification info: APNs/FCM push token (used only to deliver notifications), language preference, notification preferences, operating system type.
• Interaction data: read/dismissed notification records, survey answers you submit, feedback messages.

The App does not collect advertising identifiers (IDFA/AAID), does not use third-party analytics or advertising SDKs. Location data is not collected.

• Account creation and authentication — performance of a contract (GDPR Art. 6(1)(b)).
• Delivery of content, progress tracking, points and streak calculation — performance of a contract.
• Sending push notifications — user consent (GDPR Art. 6(1)(a)). Consent can be withdrawn at any time via app settings.
• Evaluation of audio recordings — performance of a contract (premium feature).
• Compliance with legal obligations — GDPR Art. 6(1)(c).
• Product improvement and technical troubleshooting — legitimate interest (GDPR Art. 6(1)(f)).

Your data is shared with the following service providers only to the extent required to deliver the service:

• Apple Push Notification Service (APNs) — iOS push notifications; only the device push token is transmitted.
• Firebase Cloud Messaging (Google LLC) — Android push notifications; only the device push token is transmitted.
• Paratika (Asseco SEE) — payment processing; card details never reach us and are processed entirely within Paratika's infrastructure.
• Hetzner Online GmbH (EU) — server hosting; your data is stored in Germany/Finland data centres.

Only the minimum data required for service delivery is shared. Your data is not sold to third parties and is not shared for marketing purposes.

• Active accounts: until the account is deleted.
• Deleted accounts: after in-app account deletion, all personal data is deleted immediately and permanently.
• Inactive accounts: data is automatically deleted after 3 years of no activity (users are notified via email in advance).
• Payment records: retained for 10 years per Turkish tax law requirements.

Under KVKK Art. 11 and GDPR Art. 15-22 you have the right to:

• Know whether your personal data is being processed
• Access the data and receive a copy
• Request correction of inaccurate or incomplete data
• Request erasure of your data (available in-app: Profile > Delete Account)
• Object to processing
• Data portability (export in JSON format)
• Not be subject to automated decision-making

To exercise these rights, contact us at destek@linguru.com.tr. We respond to requests within 30 days at no cost.

• All communication is encrypted via TLS 1.2+ (HTTPS).
• Passwords are hashed with bcrypt.
• Servers run on regularly patched Linux environments.
• Audio files are stored in access-controlled folders.
• Card details are never stored on our servers.

Your data is hosted in Hetzner data centres located in the European Union (Germany/Finland). For push notification delivery, APNs (Apple, USA) and FCM (Google, USA) are used — these transfers rely on the EU Standard Contractual Clauses (SCC) framework.

This policy may be updated from time to time. Material changes will be communicated via in-app notification. The effective date of the current version appears at the top of this page.

For privacy-related questions or requests: destek@linguru.com.tr.

You retain the right to lodge a complaint with your local data protection authority (Turkish Personal Data Protection Authority for KVKK; relevant supervisory authority in your country for GDPR).