Privacy Policy
Last updated: August 29, 2026
This policy explains what BookYol collects, why, and your rights — written to comply with Turkey's KVKK and the GDPR. Plain-language version; a counsel-reviewed version will replace it before paid launch.
1. What we collect
Account data: your email and sign-in identity (Google or magic link — we never see passwords). Learning data: which Stations you complete, streaks, missions, saved Insights, and language preference. Messages: what you send through our forms (contact, student verification, team requests). Technical basics: logs needed to run and secure the service.
2. What we don't collect
No payment card numbers (payments will be processed by a payment provider, who handles card data). No precise location. No contact-list access. No selling of personal data — ever.
3. Why we use it
To run the product (sync your road across devices), to answer your messages, to secure accounts, and — in aggregate, anonymised form — to understand which Stations work so the content improves. Legal bases: contract performance, legitimate interest, and consent where required.
4. Where it lives
Data is stored with Supabase (database and authentication) and served via Vercel. Sign-in via Google is governed by Google's terms. Audio files are pre-generated and contain no personal data. These processors may store data outside Turkey/the EU under standard contractual safeguards.
5. Cookies and local storage
We use essential cookies/local storage for sign-in sessions, language, and progress caching. No third-party advertising cookies. If we add product analytics, it will be privacy-respecting and disclosed here.
6. Retention
Account and learning data are kept while your account exists. Delete your account and we remove personal data within 30 days, except what law requires us to keep (e.g. billing records). Contact messages are kept up to 24 months.
7. Your rights
Under KVKK and GDPR you can access, correct, export, or delete your data, object to processing, and complain to your authority (KVKK Board in Turkey). Write via bookyol.com/contact — we answer within 30 days.
8. Children
BookYol is for ages 16+. We do not knowingly collect data from children under 16; if you believe we have, contact us and we will delete it.
9. Changes and contact
Material changes to this policy are announced in the app or by email before they take effect. Data controller details will be completed here upon incorporation. Contact: bookyol.com/contact.