Privacy Policy

Introduction

ScolerAI ("we", "our", "us") is an educational application operated under the laws of the Republic of Turkey. We are committed to protecting your privacy and processing your personal data lawfully, fairly and transparently.

This Privacy Policy explains what data we collect, why we collect it, how we use and protect it, with whom we share it, and what rights you have. It applies to all users of ScolerAI on web, Android and iOS.

We process your personal data in accordance with the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where applicable, the EU General Data Protection Regulation ("GDPR"). The data controller is ScolerAI:

Data We Collect

We collect only the data necessary to deliver and improve the educational service:

• Account information: email address, display name and authentication identifiers.
• Age and residence: your month and year of birth (never the day) and your country of residence, used only to apply your country's age rules; and, for learners below their country's age of digital consent, the email address of a parent or guardian.
• Learning preferences: subjects, goals, study habits, language, and other settings you choose to share.
• Study content you create: sessions, AI notes, flashcards, quizzes, courses, podcasts, plans, uploaded files and documents.
• Usage analytics: feature usage, session duration, error/diagnostic logs, device type, OS version, and app version.
• Website visits: anonymous daily counts of visits to scolerai.app — by page, the site you came from, country, device type, browser and language — with nothing that identifies a visitor (see Counting Visits to This Website).
• Voice & audio data (only when you actively use voice features): short audio streams used for speech-to-text and AI responses.
• Purchase information, if you buy a paid plan: which plan you hold, whether it was bought on the website or in the Android app, the dates, whether it renews, and a reference to the order. We do not receive or store your card or other payment details: they are handled by Paddle or Google (see Purchases & Payments).

We do NOT collect special categories of personal data (health, religion, biometric, political opinions, etc.). We do NOT sell your data to anyone, ever. We do NOT use your study content to train third-party AI models.

How We Use Your Data

Your data is used exclusively to:

• Provide, secure and personalize the educational service.
• Generate AI-powered study content tailored to your preferences.
• Track your learning progress and provide insights.
• Sell, deliver and support paid plans, and keep the accounting and tax records the law requires.
• Detect, prevent and respond to abuse, fraud and security incidents.
• Comply with legal obligations under KVKK and other applicable laws.

Legal bases for processing (KVKK Art. 5 / GDPR Art. 6):

• Performance of a contract — providing the service you signed up for.
• Your explicit consent — for AI personalization, voice features, parental-consent flows for minors and any optional analytics.
• Legitimate interests — keeping the service safe, preventing abuse and improving quality.
• Legal obligation — when we are required to retain or disclose data by law.

Personalization, voice and other consent-based features can be turned off at any time in Settings > Privacy & Data, without affecting the core service.

Third-Party AI & Service Providers

To deliver the service we rely on a small number of vetted processors:

• Google Firebase (Authentication, Firestore, Storage, Cloud Functions, Hosting, Crashlytics, Cloud Messaging) — infrastructure and back-end.
• OpenAI, Google (Gemini), Anthropic (Claude) — AI content generation and voice features.
• Apple, Google — push notification delivery on iOS and Android.
• RevenueCat — links a purchase you make to your account, so that your plan is the same on the web and on Android (see Purchases & Payments).

When AI features are used, we send only the minimum data required to fulfil your request — your prompt, the selected study content and non-identifying learning preferences. We NEVER send your name, email, date of birth, school name, parent/guardian email or other directly identifying information to AI providers.

These providers act as data processors under KVKK and GDPR and are bound by contracts (including, where data leaves Turkey or the EEA, Standard Contractual Clauses) that prohibit them from using your data to train their models or for any purpose other than serving your request.

Purchases & Payments

Paid plans (Go and Premium) are sold by Paddle on our website and web app, and by Google Play in our Android app. We do not take or see your payment details.

• Paddle is the merchant of record for website purchases. It receives your name, email address, billing country and postcode and payment details, takes the payment, collects and pays the tax, and issues your receipt. For this, Paddle decides for itself why and how it uses your data and acts as an independent controller under Paddle's privacy policy. When you pay on the web you are taken to a checkout page run by Paddle (or by RevenueCat on Paddle's behalf); cookies set there belong to them and are described in their policies.
• Google Play sells and bills Android purchases under Google's own terms and privacy policy.
• RevenueCat acts for us as a processor. It receives your ScolerAI account identifier (not your name or email address), the product you bought, the store, the dates and whether the plan renews, and tells us which plan you hold (the Android app also sends it technical information such as your IP address, device type and app version), so that a plan bought on the web also works on Android and the other way round. It is bound by a data processing agreement, and we delete your RevenueCat record when you delete your account.

We keep a record of which plan you hold and when it ends on your account, and keep purchase and accounting records for as long as tax and accounting law requires. Our legal bases are performing the contract you make when you buy a plan, and our legal obligations. Deleting your ScolerAI account does not cancel a subscription: cancel it first, as explained in our Terms of Sale. Refunds are covered by our Refund Policy.

Your Rights Under KVKK and GDPR

Under KVKK Article 11 and, where applicable, GDPR Articles 15–22, you have the right to:

• Learn whether we process your personal data and obtain a copy of it (Settings > Privacy & Data > Download My Data).
• Rectify inaccurate or incomplete data (edit your profile at any time).
• Request deletion of your data (Settings > Privacy & Data > Delete My Account).
• Restrict or object to processing (e.g. by disabling AI personalization).
• Data portability — download a ZIP of your data (as JSON) and the files you uploaded (Settings > Privacy & Data > Download My Data). The download link works for 7 days.
• Withdraw any consent you previously gave, at any time, without affecting the lawfulness of past processing.
• Not be subject to fully automated decisions producing legal or similarly significant effects on you.

We respond to verified rights requests within 30 days. If you believe your rights have been violated, you may lodge a complaint with the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu — KVKK Board) at www.kvkk.gov.tr, or with your local supervisory authority in the EEA.

Children's Privacy

ScolerAI is for learners aged 13 and over. It is not offered to anyone under 13: when someone tells us they are under 13, we delete the account and everything we hold about it straight away, without keeping the date of birth they entered.

When you create an account, we ask for your month and year of birth (never the day) and your country of residence. From these we work out whether, under the law of your country, you can agree to the processing of your data yourself. This age of digital consent is between 13 and 18 depending on the country; our Terms of Use list it for every country where ScolerAI is offered.

If you are below that age, we ask for the email address of a parent or legal guardian and keep it with your account. We use it only to contact them about your account and their consent: never for marketing, and it is never sent to AI providers. We may ask them by email to confirm their consent; if they decline or withdraw it, we close the account and delete its data.

Parents or guardians can write to us at info@scolerai.app at any time to:

• Review the data we hold about their child.
• Withdraw their consent, which closes the child's account.
• Request an export or the full deletion of the child's account and data.

If we learn that an account was created in breach of these rules, we will suspend it and delete its data.

Data Security

We apply technical and organizational measures appropriate to the risk:

• All data in transit is protected with TLS / HTTPS.
• Data at rest in Firebase Firestore and Storage is encrypted by Google's infrastructure.
• Authentication is handled by Firebase Auth with industry-standard credential hashing.
• Access to production data is restricted to a minimum number of authorized personnel and is logged.
• Firestore security rules enforce strict per-user isolation — your data is stored under your own user identifier and is not accessible to other users.

No system is 100% secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the KVKK Board within 72 hours and inform affected users without undue delay, in line with KVKK Article 12 and GDPR Articles 33–34.

Data Retention

We keep your data only as long as needed for the purposes set out in this Policy:

• Account, profile and study content — kept while your account is active.
• Aggregated/anonymized analytics — may be retained indefinitely as they no longer identify you.
• Diagnostic and security logs — typically kept for up to 12 months.
• Voice/audio streams — processed in real time and not stored beyond what is needed to return the AI response.
• Messages sent through the website's contact form — deleted automatically 12 months after they arrive (see below).
• Purchase records — Paddle and Google keep the records of a sale for as long as tax and accounting law requires; the record of your plan on your ScolerAI account is deleted with the account, and so is your RevenueCat record.

When you delete your account, your personal data and study content are removed from our active systems promptly, and from backups within 30 days, except where we are required by law to retain certain records (e.g. accounting or fraud-prevention obligations).

The Contact Form on This Website

When you write to us through the contact form at scolerai.app/contact, we receive your name, your email address, the topic you choose, your message and the language the page was shown in. We use them only to read and answer your message. Our legal basis is our legitimate interest in replying to people who contact us (GDPR Article 6(1)(f)); when your message is a request about your personal data, it is our legal obligation to answer it (GDPR Article 6(1)(c)).

Messages are stored in Google Firebase (Cloud Firestore) and read only by ScolerAI administrators. They are not linked to a ScolerAI account, are never used to train AI models, and are deleted automatically 12 months after they arrive. Write to info@scolerai.app if you would like a message deleted sooner.

To protect the form from automated spam, each message is checked with Firebase App Check and Google reCAPTCHA Enterprise (see Cookies & Local Storage below), and the number of messages that can be sent is limited. For that limit we keep a scrambled code made from your IP address and one made from your email address (a salted hash, from which neither address can be read back) for two days.

Counting Visits to This Website

So that we know how many people visit scolerai.app and how they found it, each page of this website sends one short, anonymous report to our own server when it loads. The report contains only: the page's address on this site (for example /pricing); the name of the website you came from, if your browser shares it (for example instagram.com — never the address of the page you were on); the campaign tags in the link you followed, if it has any (utm_source, utm_medium, utm_campaign); the name — never the value — of an advertising click parameter in that link (for example fbclid); whether you came from the ScolerAI app; and your browser's preferred language.

From the request itself our server works out your country (from your IP address), whether you are using a phone, a tablet or a computer, and which browser you use. It then adds one to that day's totals — for example “7 visits from Instagram, 5 from Türkiye, 6 on phones” — and keeps nothing else. Your IP address is used for the country lookup and, held briefly in the server's memory as a scrambled code (a salted hash), to stop one address from flooding the counters; it is never written down. No cookie is set, nothing is stored on your device, no identifier is created, and the reports are not linked to each other, to you or to a ScolerAI account: we can count visits, but not people. The totals are kept in Google Firebase (Cloud Firestore) on our behalf, are seen only by ScolerAI administrators, are not shared with anyone and are not used for advertising. Because they identify no one, we may keep them indefinitely.

Our legal basis is our legitimate interest in knowing how many people visit our website and where they come from (GDPR Article 6(1)(f); KVKK Article 5(2)(f)). This is separate from Google Analytics, which we use only with your consent (see Cookies & Local Storage below).

Turning it off. If you would rather your visits were not counted, use the switch below. It remembers your choice in your browser's local storage (scolerai_visit_counter_optout), and nothing is sent from that browser after that. If your browser sends a Global Privacy Control or Do Not Track signal, your visits are never counted.

International Data Transfers

Some of our processors and service providers (Firebase, OpenAI, Google, Anthropic, Apple, RevenueCat, Paddle) operate servers located outside Turkey, including in the European Economic Area and the United States. When your data is transferred abroad, we rely on legal safeguards required by KVKK Article 9 and GDPR Chapter V, including:

• Standard Contractual Clauses approved by the European Commission.
• Provider commitments not to use your content for model training.
• Strict purpose limitation in our contracts with each processor.

For users in Turkey, transfers abroad take place only where the conditions of KVKK Article 9 are met, including your explicit consent for transfers requiring it.

Cookies & Local Storage

On this website (scolerai.app)

Strictly necessary storage — always on. The website cannot work, or be kept safe from abuse, without these. They are not used to track you and are never used for advertising:

• scolerai_analytics_consent (browser local storage) — remembers whether you accepted or declined Google Analytics, with the date and the version of the question, so we do not ask you on every page. We ask again after 13 months.
• scolerLang (browser local storage) — the site language, only if you chose one with the language switcher.
• scolerai_visit_counter_optout (browser local storage) — set only if you turn off the visit counter (see Counting Visits to This Website above), so that it stays off.
• betaDismissed (browser session storage, cleared when you close the tab) — remembers that you closed the beta banner on the product tour page. scolerShots (browser local storage) is set only when one of our own review links is opened, to show screenshots instead of drawings; an ordinary visit never sets it.
• Abuse protection for the study coach on the home page and the contact form — Firebase App Check with Google reCAPTCHA Enterprise checks that requests to the coach and the contact form come from this website and not from an automated script. It keeps short-lived security tokens in your browser (local storage and IndexedDB), and reCAPTCHA may set its own cookies; they are used only for security. The coach conversation itself, and the random conversation identifier sent with it, are held in the page's memory only: nothing about the conversation is stored in your browser, and both are gone when you reload or close the page.
• The Firebase libraries that run parts of the site may keep a small technical record in your browser's IndexedDB. On the product tour page, the Firebase sign-in library may create an empty sign-in store; this website does not offer sign-in, so it holds no account information.

Content you choose to load. The film on the home page is not loaded until you press play. It then loads from YouTube's privacy-enhanced mode (youtube-nocookie.com), and YouTube (Google) may store data in your browser under its own privacy policy once the video plays.

Google Analytics — only with your consent. We would like to use Google Analytics 4 to understand how the website is used: which pages are visited and for how long, how visitors reached the site, their approximate location (country and city, derived by Google from the IP address, which Google Analytics does not log or store), device, browser and screen type, and which buttons are used — for example opening the launch list, starting a coach conversation, playing the film or switching between study formats. It never receives the text you type into the coach or the launch list.

It is off until you choose Accept in the banner. Before that, the Google Analytics script is not loaded, no analytics cookie is set and nothing is sent to Google — and anything you do before accepting is not sent later. If you accept, Google Analytics sets the first-party cookies _ga and _ga_<ID> on scolerai.app for up to 13 months and sends the usage data described above to Google. We have switched off Google signals and ad personalization, every advertising consent signal is sent as denied, and we do not use Google Analytics for advertising. Google keeps the event data for the retention period set in our Google Analytics account, at most 14 months.

The provider is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for visitors in the European Economic Area and Switzerland, and Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) elsewhere. Data may be processed in the United States; see Google's privacy policy at policies.google.com/privacy. We rely on your consent, which you can withdraw at any time.

Changing your mind. Use the “Cookie settings” link at the bottom of any page of this website — or this button: Cookie settings — and choose Decline. Analytics stops at once and we delete the _ga cookies from your browser. Declining changes nothing else on the site. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a standing Decline: the banner is not shown and Google Analytics is never loaded.

In the ScolerAI app

On the web version of the app (app.scolerai.app) we use strictly necessary cookies and browser local storage to keep you signed in, remember your preferences (theme, language, AI provider) and protect against abuse. The app does not use Google Analytics, and it sets no advertising or cross-site tracking cookies.

On mobile, we use the equivalent platform mechanism (SharedPreferences) to store the same kind of local settings on your device.

You can clear cookies and local storage at any time from your browser or device settings; doing so will sign you out and reset local preferences.

Governing Law & Supervisory Authority

This Privacy Policy is governed by the laws of the Republic of Turkey, in particular the Turkish Personal Data Protection Law No. 6698 (KVKK) and its secondary legislation.

The competent supervisory authority is the Personal Data Protection Authority of Turkey (Kişisel Verileri Koruma Kurumu — "KVKK Board"). Users in the European Economic Area also retain the right to lodge a complaint with their local supervisory authority under the GDPR.

Any dispute relating to the processing of your personal data shall be subject to the exclusive jurisdiction of the courts and enforcement offices of Istanbul (Çağlayan / Istanbul Mahkemeleri ve İcra Daireleri), Turkey, without prejudice to your statutory rights as a consumer.

Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our service or in applicable law. When we make material changes, we will notify you in advance through the application and, where required, ask for renewed consent before the changes take effect.

The "last updated" date at the bottom of this page (in the application) indicates the most recent revision. Your continued use of ScolerAI after the changes take effect means you accept the updated Policy.

Contact Us

For any privacy-related question, data subject request, parental-consent matter, or to report a possible data breach, you can contact us at:

info@scolerai.app

We aim to respond to all verified requests within 30 days. To help us serve you faster, please include the email address associated with your ScolerAI account and a clear description of your request.