Privacy Policy

1. Information We Collect

2. How We Use Your Information

We use the information we collect to:

• Provide and operate the Service — create and authenticate your account, deliver lessons and exercises, track your progress, calculate scores and league standings, and manage multiplayer features such as Kahoot sessions and duels.
• Personalize your experience — adapt content, explanations, and recommendations to your level, native language, and goals.
• Improve our platform — analyze aggregate usage patterns to fix bugs, improve content quality, and develop new features.
• Support and communicate — respond to your questions, send service-related notices, password resets, and (only with your consent or where permitted by law) periodic e-mails about the Service. You can unsubscribe at any time using the link included in every e-mail.
• Security and fraud prevention — detect misuse, enforce our Terms of Use, and protect the rights and safety of our users and the Service.

We process personal data only for the purposes described above and do not use it for purposes that are incompatible with them.

3. Legal Bases for Processing (GDPR)

Where the EU/UK General Data Protection Regulation applies, we process personal data on the following legal bases:

• Performance of a contract — to provide the account, lessons, and features you request when you register and use the Service.
• Legitimate interests — to secure the Service, prevent fraud, and understand aggregate usage in order to improve the product.
• Consent — for analytics cookies, optional marketing e-mails, and the processing of any data you submit to our AI-assisted content tools, where consent is required.
• Legal obligation — where we must retain or disclose information to comply with the law.

You may withdraw consent at any time without affecting the lawfulness of processing that took place before withdrawal.

4. Sharing of Information

We do not sell, rent, or trade your personal information. We share information only in the following limited circumstances:

• Service providers — trusted third parties that help us operate the Service (hosting, e-mail delivery, analytics, error monitoring, content delivery, payment processing when introduced). These parties are contractually bound to keep your information confidential and to use it only to provide services on our behalf.
• AI content generation — when you use our teacher content studio, the prompts and content you submit may be transmitted to the AI provider to generate drafts. See Section 5.
• Legal and safety — we may disclose information when required by law, to enforce our policies and Terms of Use, or to protect our rights, property, or safety, or the rights, property, or safety of others.
• Classroom contexts — students joining a class under a teacher or institution may have their basic profile and progress visible to that teacher or institution so that learning can be managed and assessed.
• Business transfers — in the event of a merger, acquisition, or sale of assets, user information may be transferred as part of the transaction, subject to this Privacy Policy.

Aggregated, non-personally-identifiable information (for example, total learner counts or anonymized performance statistics) may be used or shared for research and marketing without restriction.

5. AI-Assisted Content Tools

The teacher content studio offers AI-assisted generation of quizzes, worksheets, and exercises. When you use these tools, the text you submit (for example, a topic, source passage, or editing request) is sent to a third-party AI provider (Anthropic) solely to produce the requested content. We instruct our provider not to use your submissions to train its models and not to retain them beyond what is operationally required. We do not use AI generation features to collect personal data about your students beyond the content you explicitly submit.

We are not responsible for the content you choose to publish through these tools; you are responsible for ensuring that any content you create and publish complies with applicable law and the rights of third parties.

6. Cookies and Similar Technologies

We use cookies and local browser storage to make the Service work and to improve your experience. Cookies are small text files stored on your device by your browser.

• Essential cookies and storage — required for authentication, session security, and core functionality (for example, remembering your login state and your consent choices). These cannot be disabled without impairing the Service.
• Preference storage — we store lightweight preferences locally (for example, your selected level or dismissed banners) so the Site remembers them on future visits.
• Analytics — we use PostHog to understand how visitors use the Site (pages visited, time on site, features used) in aggregate. Where required, analytics cookies are only loaded after you accept them.

When you first visit the Site, a cookie-consent banner asks whether you accept optional analytics cookies. You may decline them without losing access to core functionality. You can also control or delete cookies through your browser settings at any time; note that disabling essential cookies may prevent the Service from working correctly.

7. Analytics, Error Monitoring, and Advertising

• Analytics — we use PostHog for product analytics. IP addresses are used only for coarse geo-identification and are not sold.
• Error monitoring — we use Sentry to detect and diagnose technical errors. Sentry receives technical data such as error messages, stack traces, and device/browser information; it does not receive your password or payment data.
• Advertising — we do not currently serve third-party behavioral advertising on the Site. If we introduce remarketing or display advertising in the future, we will update this policy and provide appropriate opt-out mechanisms.

8. Data Security

We take reasonable and appropriate technical and organizational measures to protect your information, including:

• Encryption in transit — all traffic is served over HTTPS (TLS/SSL).
• Hashed credentials — passwords are stored as salted cryptographic hashes; 4-digit student PINs are stored as BCrypt hashes and can be reset.
• Access controls — production database access is limited to authorized personnel, and authentication uses short-lived JWT access tokens with rotating refresh tokens.
• Secure infrastructure — the Service runs on trusted cloud infrastructure (Vercel and Railway), with media served from a Cloudflare R2 CDN and protected by Cloudflare's edge network.

No method of transmission or storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security. If you believe your account has been compromised, contact us immediately.

9. Data Retention and Storage

• Retention — we keep your account data for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Learning history and gamification data are retained while your account exists so that your progress is preserved.
• Hosting and transfers — your personal data is stored on servers operated by our hosting providers. Türkçe Okulu serves learners worldwide, and your data may be transferred to and processed in countries other than your own, including outside the European Economic Area and the United Kingdom. Where such transfers occur, we rely on appropriate safeguards (such as the EU Standard Contractual Clauses) to protect your data.
• Deletion — when you request deletion of your account (see Section 11), we delete or anonymize your personal data within a reasonable period, except where we are required to retain certain records by law.

10. Children's Privacy (COPPA)

The Service is directed to people who are at least 13 years old. We do not knowingly collect personal information from children under 13 without appropriate parental or school consent. Where a school, teacher, or institution manages classroom accounts on behalf of younger learners, it is responsible for obtaining the necessary consent. If we learn that we have collected personal information from a child under 13 without such consent, we will delete that information promptly. If you believe a child under 13 has provided us personal information, please contact us.

11. Your Rights

Subject to applicable law, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data ("right to be forgotten").
• Restriction — ask us to restrict processing in certain circumstances.
• Portability — receive the personal data you provided to us in a structured, machine-readable format.
• Object — object to processing based on legitimate interests, or to receiving marketing communications.
• Withdraw consent — at any time, where processing is based on consent.
• Lodge a complaint — with your local data-protection authority (in the UK, the Information Commissioner's Office) if you believe we have not handled your data lawfully.

California residents — under the California Consumer Privacy Act (CCPA/CPRA) you also have the right to know what personal information we collect, request deletion, and opt out of any "sale" or "sharing" of personal information. We do not sell personal information, and we will not discriminate against you for exercising your rights.

To exercise any of these rights, contact us using the details in Section 13. We will verify your identity before fulfilling requests and will respond within the timeframe required by law (typically 30 days). You can also delete your account and its data from within the Service at any time.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on this page and update the effective date above, and where required we will notify you by e-mail or through the Service. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contacting Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

• Nevai Publishing (Türkçe Okulu)
• 335 Clifton Avenue
• Clifton, NJ 07011
• United States
• E-mail: privacy@turkceokulu.com
• General enquiries: iletisim@nevai.co