KVKK disclosure — SoruX

1. Data controller

Your personal data is processed by Mustafa Evleksiz ('SoruX') as data controller within the scope described below.

2. Categories of personal data processed

SoruX processes the following categories:

• Identity and contact: email, display name, Apple/Google Sign-In identifiers.
• Profile: avatar, class level, target exam (TYT/AYT/KPSS, etc.).
• Learning data: solve history, correct/wrong counts, per-topic ELO scores.
• AI prompts and generated content: subject + topic + difficulty metadata only — no PII in the prompt payload.
• Financial: subscription/purchase status (Apple/Google receipts; no card numbers).
• Push notifications: FCM token.
• Classroom mode (if used): class membership, assignment history.
• Diagnostics: crash and error logs.
• Local device data: preferences, session, offline cache.
• Optional avatar photo: used only as profile picture; no biometric analysis.

3. Processing purposes

Your data is processed to:

• Provide the core service — generate, validate and personalise YKS questions.
• Maintain account, profile and subscription.
• Detect errors, prevent abuse (rate-limiting) and improve performance.
• Send transactional notifications and study reminders.
• Fulfil legal obligations.

4. Legal bases (KVKK Art. 5 and 6)

Processing is based on:

• Art. 5/2-c: necessary for the establishment or performance of a contract (service delivery).
• Art. 5/2-ç: necessary for compliance with a legal obligation.
• Art. 5/2-f: legitimate interest (security, error detection, improvement).
• Art. 5/1 (explicit consent): for analytics, notifications, optional avatar upload and, where required, international transfers.

5. Special-category data notice

SoruX does not process special-category data under KVKK Art. 6 (no health, biometric, or religious data). Uploaded avatar photos are used only as profile images; no facial recognition or biometric analysis is performed and they are not used for AI model training.

6. Transfers (KVKK Art. 8 and 9)

Your data may be transferred to the following service providers, most located outside Turkey (including the United States). International transfers rely on your explicit consent and/or appropriate safeguards:

• Google Firebase — backend, auth, sync, notifications, crash reporting — outside Turkey.
• Google (Vertex AI / Gemini API) — question generation and validation — outside Turkey.
• Apple (Sign in with Apple, StoreKit) — auth, iOS subscription billing — outside Turkey.
• Google (Sign in with Google) — auth — outside Turkey.
• Google Play Billing — Android subscription billing — outside Turkey.
• RevenueCat — subscription orchestration — outside Turkey.
• Upstash (Redis REST) — caching and rate-limiting — outside Turkey.
• Replicate — optional avatar image generation — outside Turkey.

7. Collection method

Your personal data is collected electronically — via in-app forms, sign-in providers, AI interactions, and automated event logs.

8. Data subject rights (KVKK Art. 11)

Under Art. 11 you have the right to learn whether your data is processed, request information, know its purpose and whether it is used in accordance with that purpose, learn the third parties it is shared with, request correction of incomplete or wrong data, request deletion or destruction when the conditions are met, request that these be notified to recipients, object to automated decisions, and seek compensation for damages.

9. How to apply

Two ways to exercise your rights:

• In-app: Settings → Account → Delete account (account + cloud data); Settings → Privacy → Delete all device data (local).
• Email: mustafa@mustafaevleksiz.com — under the Communiqué on Application Procedures and Principles to the Data Controller.

10. Response time

Applications are answered within 30 days at the latest.