Okuyo Privacy Policy

Last updated: May 15, 2026

Okuyo is a reading and learning app for children aged 6 and older. This policy explains, in plain language, what data we collect, why we collect it, who we share it with, and what your rights are. Because we serve children, we intentionally keep our data collection footprint as small as possible.

1. Data Controller

The data controller is Dode Yazılım. For any privacy-related questions or requests (deletion, export, correction), contact us at iletisim@dodeyazilim.com.

2. Data We Collect

Account information

Email address
Password (stored only as a secure hash — never as plain text)
Display name — optional

If you sign in with Apple ID, Apple may anonymize your email address (Hide My Email / private relay). In that case the email we receive is an Apple-generated relay address.

Child profiles

Under a parent account, you can create one or more profiles for your child. Each profile stores:

Nickname
Avatar selection
Age range
Reading level

Child profiles are created and managed only by the parent. We do not request personally identifying information (real name, last name, photo, location, phone number) directly from the child.

Learning progress

Completed lessons and activities
Letter, syllable, word, story, and game item keys
Score, correct/incorrect counts, time elapsed

Device information

Platform (iOS / Android) and OS version
Device name/model
Push notification token — this feature is not yet active; it will be used when we ship reminder notifications in the future

Subscription information

Product identifier (e.g. monthly/yearly plan)
Platform (App Store / Google Play)
Subscription start and expiration dates

We never receive your credit card or payment details; all payments go directly through Apple or Google.

Crash and diagnostic data

To keep the app stable we collect anonymous crash reports (stack traces, device model, OS version). IP addresses are stripped; email and other personal data are not included in these reports.

3. Where We Store Data

All user data is hosted on Supabase in the European Union (Frankfurt, Germany — eu-central-1). Data is encrypted in transit (TLS) and at rest (AES-256), in a GDPR/KVKK-compliant infrastructure. Because we serve children, we take special care to keep all data within EU borders.

4. Third-Party Services

We rely on the three services below to operate the app. We use no ad networks, tracking pixels, or marketing analytics tools.

Service	Purpose	Privacy policy
Supabase	Authentication, database (account, profiles, progress)	supabase.com/privacy
RevenueCat	Subscription management and purchase validation	revenuecat.com/privacy
Sentry	Anonymous crash and error reporting (IP scrubbed)	sentry.io/privacy

5. Commitments to Children (COPPA & GDPR-K)

Parental consent is required. A parent/guardian email address (parent_email) is required to create an account. Users under 13 may only use the app under a parent-managed account.
We do not collect data directly from children. All account actions (sign-up, subscription, profile management) are performed by the parent.
No ads. We display no advertising to children, in any form. We do not integrate third-party ad SDKs (AdMob, etc.).
No behavioral profiling. We do not use a child's usage data for marketing, targeting, or personalized advertising; we do not sell it or share it with third parties for such purposes.
Data minimization. We collect only the minimum data required for the app to function.

6. Your Rights (KVKK & GDPR)

Under KVKK (Article 11) and GDPR (Articles 15-22) you have the right to:

Access your data
Request correction of inaccurate data
Request deletion of your data ("right to be forgotten")
Request export of your data in a machine-readable format
Object to processing

You can delete your account directly from the app or by emailing iletisim@dodeyazilim.com. In-app deletion is processed immediately; email requests are completed within 30 days at the latest. Deleting your account also irreversibly removes all child profiles and learning data.

7. Cookies and Tracking

Okuyo is a mobile app and does not use cookies. We do not use web tracking pixels, fingerprinting, or cross-app tracking.

8. Data Retention

Your data is kept while your account is active. When you delete your account, your data becomes immediately inaccessible. Data is removed instantly from the operational database, and is permanently deleted from automated backups within 30 days at the latest. Billing records required by law (via RevenueCat/Apple/Google) are retained for the period mandated by applicable regulations.

9. Changes to This Policy

When we make a material change to this policy, we notify you in-app on launch or by email to your registered address. The "Last updated" date at the top of this page reflects the most recent revision.

10. Contact

For questions, requests, or complaints: iletisim@dodeyazilim.com