Dahicik Privacy Policy

TASLAK — yayından önce bir avukat tarafından kontrol edilmelidir. (DRAFT — must be reviewed by a lawyer before publication.)

Bracketed text is a placeholder, shared with the Turkish version. Sentences marked [YAYINDAN ÖNCE DOĞRULANACAK] (verify before publication) describe a feature that is not built yet; confirm it exists before publishing or change the sentence. Items marked [AVUKAT TARAFINDAN BELİRLENECEK] (to be decided by a lawyer) await a legal decision.

Effective date: [YÜRÜRLÜK TARİHİ]

This policy tells parents what data the BİLSEM Dahicik app ("Dahicik") processes, why, and for how long. Dahicik is a tablet app that prepares children from preschool to grade 3 for the BİLSEM screening in Turkey with visual reasoning puzzles. The Turkish version is the governing text; this is a translation. The app's interface is in Turkish, so menu names are given in Turkish with an English gloss.

In short

• The app does not ask you or your child for a name, e-mail, phone number, photos, voice recordings or location.
• Our server stores a random account ID, the avatar your child picked, their grade and their practice records in the app. Infrastructure logs may keep IP addresses for a limited time.
• No ads. No third-party analytics or tracking tools. [YAYINDAN ÖNCE DOĞRULANACAK]
• You can download your data and delete all of it from inside the app. [YAYINDAN ÖNCE DOĞRULANACAK]

1. Who we are

The party responsible for your data (data controller):

• Name: [ŞİRKET UNVANI]
• Address: [ADRES]
• MERSİS / tax no.: [MERSİS / VERGİ NO]
• Registered e-mail (KEP): [KEP ADRESİ]
• E-mail: [E-POSTA]

2. What we process, and what we do not

Stored on our server

Kept only on your device

• The nickname you give your child. It is never sent to the server.
• The account key, held in the device's secure storage (iOS Keychain, Android Keystore).
• App settings.

Narration audio ships inside the app. The app does not contact any speech service while running.

If you apply to us

If you apply in writing or by KEP, we process the name, Turkish ID number, address and contact details you give in the application; if you e-mail us, your e-mail address. We use them only to answer your request.

What the app does not process

• Your or your child's name, e-mail, phone number, address or date of birth.
• Photos, videos or voice recordings. The app does not ask for microphone, camera or location permission.
• Contacts, advertising ID or device hardware identifiers.
• Card or payment details. Apple and Google process payments.
• There is no chat, messaging, leaderboard or any feature that shows your child to other users.

Technical logs

When the app connects to our server, your device's IP address necessarily reaches the server. We do not store IP addresses in our database. The hosting infrastructure's security and access logs may keep IP addresses for [KAYIT SAKLAMA SÜRESİ].

If you allowed it in your device settings, Apple and Google may send us crash and performance reports for the app in a form that does not identify you.

3. Why we process data, and legal bases

[AVUKAT TARAFINDAN BELİRLENECEK — including whether explicit consent is required] The legal bases below are this draft's working assumption. The child is not a party to the contract between the parent and us; the parent is the child's legal representative. The rows based on contract require a terms of use document, which has not been written yet.

Using the app creates a service relationship between you, as the parent, and us. Your child's data is processed as part of this service, which you use as your child's legal representative. The legal bases are in Article 5 of Turkey's Law No. 6698 on the Protection of Personal Data (KVKK).

Question selection and skill estimation are automated. They only decide how hard the next question is and what the report estimates; they have no legal or similarly significant effect on your child.

We do not use data for advertising, marketing or selling profiles.

[AVUKAT TARAFINDAN BELİRLENECEK] The league is on by default, through a switch in Veli Alanı (decision 0006). If its basis is to be explicit consent, a switch that starts on may not count as explicit consent; it would then have to start off.

4. How long we keep data

• Account and child data: Until the account is deleted. When you delete the account or a child profile, the related data is removed from our server immediately and permanently.
• Unused accounts: Accounts not used for [HAREKETSİZLİK SÜRESİ] are deleted automatically with all their data. [YAYINDAN ÖNCE DOĞRULANACAK]
• Backups: Deleted data leaves the backups within [YEDEK SAKLAMA SÜRESİ] at the latest.
• Technical logs: [KAYIT SAKLAMA SÜRESİ].
• Correspondence about requests: [BAŞVURU KAYDI SAKLAMA SÜRESİ].

After deletion, only aggregate question statistics remain: how many times a question was answered, how many times correctly, and its difficulty value. These cannot be linked to any child.

5. Who we share data with

We do not sell data or share it with advertisers or data brokers.

• Hosting provider: [BARINDIRMA SAĞLAYICISI VE ÜLKESİ]. Runs our servers and processes data only on our instructions, as a data processor.
• Apple and Google: Distribute the app and handle purchases through their stores. They process payments; we never see your card details. To verify a purchase, we send the purchase information the store issued back to that store's verification service. [YAYINDAN ÖNCE DOĞRULANACAK] The stores' own privacy policies also apply.
• Children in the same league group: If you let your child into the league, up to 20 children in the group see your child only by that week's league alias, avatar and the week's points. The nickname you gave, the grade, accuracy, streak and past weeks are never shown, and no account or learner ID appears in any response. When you turn the league off in Veli Alanı, your child leaves that week's list at once.
• Competent public authorities: Only where the law requires it.

Transfers abroad

[AVUKAT TARAFINDAN BELİRLENECEK]

• Hosting: If the hosting provider is outside Turkey, your data is transferred abroad. In that case the transfer will follow Article 9 of the KVKK: the standard contract published by the Personal Data Protection Board will be signed with the provider and notified to the Personal Data Protection Authority within 5 business days of signing.
• Purchase verification: For verification, purchase information is sent to Apple's and Google's servers, which may be outside Turkey. The basis for this transfer under Article 9 of the KVKK will be determined by a lawyer.

6. Children's privacy

Dahicik is designed for children, to be used under a parent's supervision.

• The parent creates the account and the child profile. No personal information is asked from the child.
• The nickname stays on the device. The server only knows which avatar was picked. The alias shown in the league (e.g. "Mavi Kedi") is made on the server, changes every week and has nothing to do with the nickname you gave.
• There are no ads, chat or messaging. The only comparison with other children is the weekly league, which needs the parent's leave: children cannot tap each other's rows or send each other messages or reactions, and the child gets no notifications. There are no third-party analytics or tracking tools. [YAYINDAN ÖNCE DOĞRULANACAK]
• Purchases, settings, data download and deletion, and links that leave the app sit behind a parental gate: an adult-level step a child cannot pass alone. [YAYINDAN ÖNCE DOĞRULANACAK]

7. Your rights and how to use them

Under Article 11 of the KVKK you have these rights for yourself and your child: to learn whether data is processed and request information about it; to learn the purpose of processing and whether data is used accordingly; to know the third parties data is transferred to; to have incomplete or wrong data corrected, to have data erased or destroyed, and to have those third parties notified; to object to an outcome against you that results solely from automated analysis; and to claim compensation for damage caused by unlawful processing.

1. In the app (primary route): Open Veli Alanı (Parent Area), pass the parental gate, tap Ayarlar (Settings). [YAYINDAN ÖNCE DOĞRULANACAK]

• Verilerimi indir (Download my data): Gives you a file containing the account ID and creation time; each child profile's avatar, grade and creation time; each session's start and end time and app version; for each answer, a reference to the question, the option chosen, whether it was correct, the response time and when it was given; and the league setting and your child's league weeks (week, league, alias, joining time). Nothing about other children is in the file.
• Çocuk profilini sil (Delete child profile): Deletes one child and all their history.
• Tüm verileri sil (Delete all data): Deletes the account and everything linked to it.
• Hesap kimliği (Account ID): Shows the ID to quote when you write to us.

The downloaded file does not contain derived data (mistake types, ability estimates, per-question estimate values) or questions that were shown but not answered. These are stored on our server; you can request them through route 2.

2. In writing or by KEP: To [ADRES] or [KEP ADRESİ]. Under the Communiqué on the Procedures and Principles of Applications to the Data Controller, an application must include your name and surname (and signature if written), Turkish ID number (for foreigners, nationality and passport number), address for notifications, e-mail and phone if any, and your request. Add your account ID so we can find your data. We use these details only to answer your request.

3. By e-mail (deletion only): If you cannot reach the app, write to [E-POSTA] to ask for your account to be deleted, and include your account ID. Accounts are anonymous, so we cannot recognise you by anything else. We may ask for additional information to verify that the account is yours. For any other request, use route 1 or 2.

Your request is resolved as quickly as its nature allows and within 30 days at the latest, free of charge. If the action requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged (KVKK Art. 13). If you are not satisfied with our answer, you can complain to the Personal Data Protection Board.

8. Deleting data

See Deleting Your Data for the steps (Turkish).

Uninstalling the app does not delete the data on our server. Use Tüm verileri sil (Delete all data) in the app first. Your account ID is shown when you first set up the app and is always visible in Veli Alanı [YAYINDAN ÖNCE DOĞRULANACAK]; we recommend noting it down. If you already uninstalled the app, e-mail us your account ID. Without the account ID, the account is deleted automatically after [HAREKETSİZLİK SÜRESİ].

9. Security

• The connection between the app and the server is encrypted (HTTPS). [YAYINDAN ÖNCE DOĞRULANACAK]
• Only a hash of the account key is stored. A copy of the database does not yield a working key.
• Every request except account creation is authenticated with the account key. One account cannot see or change another account's data.
• The server holds no child names, e-mail addresses or phone numbers, so a breach cannot expose them.

If a data breach occurs, we notify the Board as the KVKK requires and announce it in the app and on our website.

10. Changes

We may update this policy. We announce significant changes in the app's Veli Alanı before they take effect. The current version is always on this page; the effective date at the top shows the latest change.

11. Contact

[ŞİRKET UNVANI] · [ADRES] · [E-POSTA] · [KEP ADRESİ]

For the detailed notice on personal data, see the KVKK Information Notice (Turkish).