Privacy Policy

Study Bug is made and run by Alp Kumbasar, an individual developer based in Türkiye. In this policy, "we", "us" and "our" mean Alp Kumbasar. We are the data controller for the personal data described here, as defined by Turkish Law No. 6698 on the Protection of Personal Data (KVKK) and, where they apply, the EU General Data Protection Regulation (GDPR) and the UK GDPR.

This policy explains what we collect when you use the Study Bug app and website, why, who helps us process it, how long we keep it and the choices you have. It is also our notice under KVKK article 10. We have not appointed a data protection officer, because the law does not require one for a service like this, so write to us directly about anything here.

We do not ask you to sign up with an email address, phone number or password. When you first open the app, Firebase gives your install a random ID (Firebase calls this anonymous sign-in). The ID does not contain your name, but it is unique to your install and links everything below together, so we treat it, and the data linked to it, as personal data.

The app collects most of this automatically while you use it; your name and setup answers come from what you type or pick. Crash and diagnostic data and usage data are the exception: the app collects them only if you agree to share usage analytics. We do not collect your precise location, contacts, photos, microphone or camera, and we do not use the advertising identifier (IDFA). We never put the name you type into analytics or crash reports.

• To run the app: build your daily board, schedule flashcard reviews, track mistakes, work out mastery and the score range, and keep your streak.
• To back up your progress and restore it on the same account.
• To keep your Amber balance and purchases correct, and to handle restores and refunds.
• With your consent, to find and fix crashes and bugs.
• With your consent, to understand which parts of the app help people study, for example where new users stop during setup, so we can improve it.
• To keep the website online and secure.
• To answer you when you write to us, and to meet legal obligations.

We do not sell or rent your personal data, share it for advertising, show ads or use it to make decisions that have legal or similarly significant effects on you.

Under KVKK article 5 and GDPR article 6 we rely on these bases:

• Performance of our agreement with you (the Terms of Use): your install ID, name, setup answers, study activity, preferences, purchases and Amber. You need to give us these to use Study Bug, because the app is built on them.
• Your consent: crash and diagnostic data, and usage data. The app asks the first time you open it, before it sends any, and saying no is as easy as saying yes. Nothing is sent unless you say yes, saying no changes nothing else in the app, and you can withdraw your consent at any time in Settings.
• Our legitimate interest in keeping the website stable and secure: website request logs.
• Legal obligations, such as keeping records the law asks us to keep and answering your requests.

We use a small number of service providers who process data for us under their own data processing terms. We only choose providers whose terms protect your data at least as well as this policy does.

• Google LLC and its affiliates, through Firebase: Authentication (install ID), Cloud Firestore (progress backup and study content), Crashlytics (crash reports) and Google Analytics for Firebase (usage statistics).
• Google Cloud Run: our own small server, which keeps your Amber balance and its history, records your purchases and carries out account deletion.
• RevenueCat, Inc.: records your purchases and subscription status under your install ID, so they can be checked, restored and refunded.
• Apple Inc.: App Store downloads, payments, subscriptions and refunds.
• Vercel Inc.: hosts the Study Bug website.
• Google, through Gmail: receives the emails you send us.

We may also disclose data if the law requires it, to protect the rights and safety of users or others, or as part of a transfer of Study Bug to a new owner, who would have to honour this policy.

Our providers store and process data outside Türkiye: Google in the United States and the European Union, and RevenueCat, Apple and Vercel mainly in the United States. Sending your data to them is a transfer abroad.

For users in Türkiye, transfers abroad are governed by KVKK article 9, and we make them only on a basis that article allows. For users in the European Economic Area and the United Kingdom, our providers rely on the EU and UK standard contractual clauses or the EU-US Data Privacy Framework. You can ask us which safeguard applies to any provider.

• Individual answers in your study history: deleted automatically once they are 400 days old, usually within a day. Your totals, such as XP and mastery, stay while your account exists.
• Install ID, profile, setup answers, progress, purchases and Amber: while your account exists. Delete your account and they go.
• Crash reports: kept by Crashlytics for 90 days.
• Usage data: kept by Google Analytics for 14 months, then deleted.
• Emails to us: until your question is resolved, then for up to two years in case it comes back.
• Website request logs: kept by Vercel only as long as it needs them to deliver and protect the site.
• Data kept only on your device: until you reset progress, delete the app or clear its data.

Deleting the app removes the data on your device but not the backup in our Firebase project. To delete that as well, delete your account in the app (see Deleting your account) or write to us. Deleted data can stay in our providers' encrypted backups for up to 180 days before it is overwritten.

Study Bug is made for students preparing for the SAT®, who are usually 13 to 18. It is not intended for children under 13, and we do not knowingly collect personal data from them. If we learn that a child under 13 is using the app, we delete their data. If you believe this has happened, write to us.

If you are under 18, please use Study Bug with the permission of a parent or guardian and read this policy with them. A parent or guardian can contact us on your behalf about any request below.

Crash reports and usage statistics stay off unless you choose to share them, and we never use any of your data for advertising.

Under KVKK article 11 you have the right to:

• Learn whether we process your personal data, and ask for information about it.
• Learn why we process it and whether it is used for that purpose.
• Know who it is transferred to, in Türkiye and abroad.
• Ask us to correct it if it is incomplete or wrong.
• Ask us to delete or destroy it under the conditions of KVKK article 7.
• Ask that corrections and deletions are passed on to those we transferred it to.
• Object to a result against you that comes solely from automated analysis.
• Claim compensation if you suffer damage from unlawful processing.

If you are in the European Economic Area or the United Kingdom, you also have the GDPR rights of access, correction, deletion, restriction and portability, and the right to withdraw consent at any time without affecting what happened before.

Withdrawing consent: switch off Share usage analytics in Settings and this device stops sending crash and usage data straight away. What was sent before stays until it expires (see How long we keep it), or delete your account to remove it sooner.

Your right to object: where we rely on legitimate interests (website request logs), you can object at any time on grounds relating to your situation.

Wherever you live, we honour access, correction and deletion requests from every user. To use your rights, write to kumbasarabidinalp@gmail.com. Because your account has no email address, tell us the name you use in the app and, if you can, the date you installed it, so we can find your data. We reply within 30 days and free of charge.

If you are not happy with our answer, you can complain to the Turkish Personal Data Protection Authority (KVKK) after writing to us first, to the data protection authority where you live in the EU, or to the Information Commissioner's Office in the UK.

• Share usage analytics: the app asks the first time you open it, and it stays off unless you say yes. It covers both usage data and crash reports. Change your answer any time in Settings, Privacy and legal. The answer belongs to this device, so a new install asks again.
• Reset progress (Settings): deletes your study progress on this device and starts over. Amber you bought is kept.
• Delete account (Settings): deletes your account and everything we keep about you.
• Your name: change it or clear it any time in Settings.
• Notifications: Study Bug only reminds you if you turn reminders on.

Settings, Delete account erases your account straight away. We delete your progress, answers, saved items, Amber balance and its history from our Firebase project, your purchase record at RevenueCat and your Firebase install ID, and then the data on your device. We also ask Google Analytics to delete the usage data of this install, and we delete the ID that crash reports are filed under, which removes them within 180 days.

Deleting your account does not cancel a subscription. Apple keeps billing it until you cancel it in your Apple account settings; the delete screen links there. We cannot refund Amber; refunds for purchases are handled by Apple.

The website tells you about Study Bug and hosts this policy and the Terms of Use. It sets no cookies, uses no analytics or advertising tools, stores nothing in your browser and loads nothing from other companies' servers: even the fonts are served by the site itself. That is why it has no cookie banner.

Like every website, it is delivered by a host. Vercel Inc. receives your IP address, browser details, the page you asked for and the time, and keeps them briefly to deliver the site and protect it from abuse. Our legal basis is our legitimate interest in running a secure website.

If you email us from a link on the website, your email app sends the message to our Gmail inbox, so Google processes it as our email provider.

Data travels to our providers over encrypted connections. Our database rules let each install read and write only its own progress and reject changes that do not match the expected shape, and only our server can change an Amber balance. No system is perfectly secure, so we cannot promise that data will never be exposed. If a breach affects you, we will tell the authorities as the law requires, and tell you in the app and on the website, because we have no other way to reach you.

We do not track you across other companies' apps or websites, and we do not let anyone else do so through Study Bug or its website. There is nothing for a Do Not Track or Global Privacy Control signal to switch off, so we do not change anything when your browser sends one.

When we change this policy we update the version and effective date above and list the change in the version history on the website. If a change matters to how your data is used, we tell you in the app at least 14 days before it takes effect.

Questions, requests or complaints about privacy: kumbasarabidinalp@gmail.com. Data controller: Alp Kumbasar, Türkiye.

Bu metin, 6698 sayılı Kişisel Verilerin Korunması Kanunu'nun 10. maddesi uyarınca hazırlanmış özet aydınlatma metnidir. Ayrıntılar yukarıdaki İngilizce Gizlilik Politikası'nda yer alır.

Veri sorumlusu: Alp Kumbasar, Türkiye. İletişim: kumbasarabidinalp@gmail.com.

İşlenen veriler: uygulama kurulumuna atanan rastgele kimlik, seçtiğiniz ad, kurulum sırasında verdiğiniz yanıtlar (hedef puan, sınav tarihi, günlük çalışma süresi gibi), çalışma etkinliğiniz, tercihleriniz, satın alma kayıtlarınız ve Amber bakiyeniz, çökme ve tanılama verileri, kullanım istatistikleri, bize gönderdiğiniz e-postalar ve web sitesinin sunucu kayıtları.

Amaçlar ve hukuki sebepler: verileriniz, Kullanım Koşulları kapsamındaki hizmeti sunmak (KVKK m. 5/2-c, sözleşmenin ifası), web sitesini güvenli ve kararlı tutmak (m. 5/2-f, meşru menfaat) ve hukuki yükümlülüklerimizi yerine getirmek (m. 5/2-ç) amaçlarıyla işlenir. Çökme ve tanılama verileri ile kullanım istatistikleri yalnızca açık rızanızla (m. 5/1) toplanır: uygulamayı ilk açtığınızda sorarız ve evet demezseniz hiçbiri gönderilmez. Rızanızı Ayarlar'dan istediğiniz zaman geri alabilirsiniz.

Toplama yöntemi: veriler, uygulamayı ve web sitesini kullanırken otomatik yollarla ve sizin girdiğiniz bilgilerden, elektronik ortamda toplanır.

Aktarım: verileriniz hizmet sağlayıcılarımız Google (Firebase, Google Cloud ve Gmail), RevenueCat, Apple ve Vercel ile paylaşılır. Bu şirketler verileri ağırlıklı olarak ABD'de ve Avrupa Birliği'nde işlediğinden bu bir yurt dışına aktarımdır ve KVKK'nın 9. maddesinde öngörülen şartlara uygun olarak yapılır.

Haklarınız: KVKK'nın 11. maddesi uyarınca kişisel verilerinizin işlenip işlenmediğini öğrenme, bilgi talep etme, işlenme amacını ve amacına uygun kullanılıp kullanılmadığını öğrenme, aktarıldığı kişileri bilme, düzeltilmesini veya silinmesini isteme, bu işlemlerin aktarılan kişilere bildirilmesini isteme, yalnızca otomatik sistemlerle yapılan analiz sonucu aleyhinize bir sonuca itiraz etme ve zarara uğramanız halinde zararın giderilmesini talep etme haklarına sahipsiniz. Başvurularınızı kumbasarabidinalp@gmail.com adresine iletebilirsiniz; en geç 30 gün içinde ücretsiz yanıt veririz. Yanıtımızdan memnun kalmazsanız Kişisel Verileri Koruma Kurulu'na şikâyette bulunabilirsiniz.