KVKK Privacy Notice
This is an English translation. In case of any conflict, the Turkish version prevails.
Last updated: October 31, 2026
Version: 2.0
This notice was prepared under Article 10 of Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu, "KVKK" or the "Law") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform (Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ). It is meant to inform people who use the BlueGrays mobile apps and bluegrays.com, website visitors and people who send us notices. This notice is not a contract and does not need your approval. It's enough that you read and understand it.
1. Data controller
- Data controller: Yunus Emre EKE (an individual; the developer and operator of BlueGrays)
- Address: Beylikdüzü, Istanbul *****
- Email: [email protected]
- Phone: *****
Because we are based in Türkiye, no representative has been appointed.
2. What data do we process, for what purpose and on what legal basis?
The legal bases are the conditions in Article 5 of the Law. In the table, they're shown in short form as follows:
- Contract (Art. 5(2)(c)): The data is needed for your BlueGrays membership and purchases.
- Legal obligation (Art. 5(2)(ç)): Our obligations under the law. For example, keeping traffic data under Law No. 5651 (the Turkish Internet Law) or keeping records under consumer legislation.
- Expressly provided for by law (Art. 5(2)(a)).
- Establishing a right (Art. 5(2)(e)): Establishing, exercising or protecting a right.
- Legitimate interest (Art. 5(2)(f)): Our legitimate interest, provided it doesn't harm your fundamental rights and freedoms.
- Made public (Art. 5(2)(d)): The data has been made public by you yourself.
- Explicit consent (Art. 5(1)): Only for the optional processing indicated below. It's obtained separately and can be withdrawn at any time.
| Data category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Identity and contact | First name, last name, username, email address. With Sign in with Apple, the name and email Apple shares (or Apple's private relay address). | Opening your account, signing you in, contacting you, recognizing your account. | Contract |
| Account and security | An irreversible hash of your password (the password itself isn't stored), sign-in method (email, Google, Apple) and provider ID, email verification status, session information, and which version of which document you accepted or read, and when. | Protecting your account, proving consents. | Contract; legal obligation; establishing a right |
| Profile and preferences | Profile photo (if you upload one), app language, time zone, notification preferences, league visibility preference, question language and Workshop preferences. | Providing the service according to your preferences. | Contract |
| Usage and learning | Inventory, favorites, ratings, completed projects, guide progress, badges, saved tool results, project requests, announcement views, your answers to Daily Questions, XP, level and streak. | Providing projects, Workshop matching, badges, levels and the weekly league. | Contract |
| Community | Forum posts, comments, replies, photos and code you share, likes, user projects you submit, your reports (reason and description), users you've blocked, moderation records (removed content, reason and date). | Providing the forum and project sharing, moderating content, resolving reports, protecting the community. | Contract; legitimate interest; legal obligation (5651, 5846); establishing a right. For public posts, also made public. |
| Support and notices | Support requests, messages and attachments. Content and copyright notices: first name, last name, email, link to the content, reason, description (also collected from non-members). Requests from parents. | Resolving your requests and notices. | Contract; legal obligation; establishing a right |
| Subscription and purchases | Premium status, product and period, start and end dates, store transaction ID, RevenueCat user ID, when personal offers were assigned and when they expire, paywall events (views and dismissals), Educator Pack and code records. Your card details never reach us; the payment is collected by the App Store or Google Play. | Running purchases and subscriptions, activating Premium, managing codes, making personal offers, keeping purchase records as proof. | Contract; legal obligation (Distance Contracts Regulation (Mesafeli Sözleşmeler Yönetmeliği), Art. 20); legitimate interest (paywall events and offers) |
| Device and transaction security (traffic data) | IP address, country derived from the IP address, browser or device information (User-Agent), platform (iOS, Android, web), app version, type and time of the action (sign-up, sign-in, failed sign-in, password and email change, posting content, uploading files). | Keeping things secure, preventing abuse, finding bugs, keeping traffic data under Law No. 5651, offering the right language and country settings for the content. | Expressly provided for by law and legal obligation (5651 Art. 5(3)); legitimate interest |
| Notifications | Your device's notification address (FCM token), notifications sent to you and whether they were read. | Sending service notifications such as account messages, support replies, badges, guides and (if you turned them on) question reminders. | Contract |
| Promotional messages | Email address, notification address, consent record (date, channel, source). | Sending campaigns, discounts and new feature announcements. | Explicit consent (via the Commercial Electronic Message Consent; optional) |
| User source | On Android, Google Play's install referrer information (utm source and campaign, click time). On iOS, Apple's ad attribution information, which contains no personal data (AdServices). Your answer to the "How did you hear about us?" survey (optional). | Measuring which channel you found BlueGrays through and spending the promotion budget wisely. | Legitimate interest |
| App analytics and error reports | Firebase Analytics events and screen views, app installation ID, device model, operating system, language, approximate location derived from the IP address (country or city level). Crashlytics crash reports and Performance measurements. | Understanding how the app is used, fixing bugs and slowdowns. | Legitimate interest |
| Ad measurement (mobile) | Your device's advertising ID (the Android advertising ID; on iOS, IDFA only if you grant "Tracking" permission), Meta SDK app events (install, open). | Measuring how many installs BlueGrays' promotional ads on Meta, Google and Apple lead to. | Explicit consent; on iOS, also Apple's tracking permission |
| Web cookies | Strictly necessary cookies (session, language, your cookie choice). Analytics cookies (Google Analytics 4, via Google Tag Manager). Marketing cookies (Google Ads, Meta Pixel). | Running the site; visit statistics; ad measurement. | Strictly necessary cookies: contract and legitimate interest. Analytics and marketing: explicit consent (cookie preferences) |
| Camera and photos | Only the photo you take or pick, when you do so. We don't access your whole gallery. | Uploading profile, forum, project and support images. | Contract |
| Deleted account record | User number, email address, username, deletion date. | Matching the traffic data we must keep even after an account is deleted to the right person. It has no other function in the app. | Legal obligation (5651); establishing a right |
Data we don't process: GPS location, date of birth or age, your contacts, card details, and special categories of personal data such as health or biometric data.
Personal offers and automated processing: When you close the paywall a certain number of times, the system may automatically assign you a time-limited discount offer. Your level, badges and league rank are also calculated automatically based on your answers. None of this produces legal consequences against you. Still, you have the right to object to an outcome against you that results exclusively from automated analysis (Art. 11(1)(g) of the Law).
3. How do we collect data?
- From you, electronically and by automated means: Sign-up and profile forms, forum, support and notice forms, and the actions you take in the app and on the website.
- From your device, by automated means: Software development kits in the app (Firebase, Meta SDK, RevenueCat), cookies and similar technologies on the website, and server logs.
- From third parties: From Google and Apple when you sign in with them. For purchases, from the App Store and Google Play through RevenueCat. On Android, install referrer information from Google Play. On iOS, ad attribution information from Apple. We process this data after informing you with this notice at first contact or within a reasonable time after obtaining it.
4. Who do we transfer data to and why?
We transfer your data only to the recipients below, for the purposes above and under the conditions in Article 8 of the Law. We don't sell your data.
| Recipient | Location | Data transferred | Purpose |
|---|---|---|---|
| Amazon Web Services (database and storage) | Germany (Frankfurt) | All account and usage data (hosting) | Hosting the database |
| Cloudflare, Inc. | US (global network) | Website and app traffic (IP address, country), files you upload (R2 storage), bluegrays.app link redirection | Content delivery, security, file storage |
| App and web server hosting providers | API server: Amazon Web Services, Germany (Frankfurt). Website and admin panel: Hosting Dünyam Bilişim Teknolojileri Tic. Ltd. Şti., Türkiye | Traffic and account data | Running the service |
| Google (Firebase Analytics, Crashlytics, Performance, Cloud Messaging; Google Analytics 4; Google Tag Manager; Google Ads; Sign in with Google; YouTube; Google Play) | US | Analytics and error data, notification address and notification content, Android advertising ID (with your consent), web analytics and marketing cookie data (with your consent), Google sign-in information, connection data YouTube receives when you play a video | Analytics, debugging, sending notifications, ad measurement, sign-in, purchases |
| Apple (Sign in with Apple, App Store, AdServices) | US, Ireland | Sign-in information, purchase records, ad attribution information | Sign-in, purchases, attribution |
| Meta Platforms (Meta SDK, Meta Pixel) | Ireland, US | App events and advertising ID (with your consent; on iOS, only if you've granted tracking permission), web marketing cookie data (only if you allow marketing cookies) | Measuring promotional ads |
| RevenueCat, Inc. | US | User number, email address, first and last name, country, sign-up method and date, user source and survey answer, number of paywall views, Premium type, app language, store purchase records | Managing subscriptions, verifying purchases, revenue and conversion analysis |
| Twilio SendGrid | US | Email address, name, email content | Sending verification, password reset and (if you've consented) promotional emails |
| Slack Technologies | US | First name, last name, username and email on new sign-ups and sign-ins. The first part of a support request. The text of reports and content notices. User project submissions. Educator Pack purchases (first name, last name, username, pack, amount). Security and error alerts. | Letting our team see requests, reports and events in time (internal notifications) |
| DeepL SE | Germany | The app's own texts (agreements, project and component texts, notification texts), titles and descriptions of published user projects, and search terms you enter in languages other than Turkish. Your identity information isn't sent. | Automatic translation |
| Educator | Wherever the educator who issued the code is located | When you redeem an educator's code: your first name, last name, username, email address and profile photo | Letting the educator manage the codes they've distributed and their students |
| Other users and the public | Worldwide | Your forum posts, username and profile photo (other members in the app can also see your first and last name); your username, level and XP in the league (you can turn off visibility); your published projects | Providing community features |
| Authorized public institutions and courts | Türkiye | The data requested | Fulfilling legal obligations |
| Advisers such as lawyers and accountants | Türkiye | The data needed | Handling legal and financial matters, protecting rights |
5. Transfers abroad
Some of the service providers above process your data outside Türkiye (mainly in the US, Ireland and Germany). Since these transfers are a regular part of the service, they're made under Article 9 of the Law:
- Based on an adequacy decision of the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), if there is one,
- Otherwise, based on the standard contract published by the Board. Standard contracts are notified to the Board within 5 business days after they're signed.
The consent you give for ad measurement and cookies is not the basis for transfers abroad. Those consents cover only the processing itself.
6. How long do we keep data?
| Data | Period |
|---|---|
| Account, profile, usage, learning and community data | As long as your account is open. When you permanently delete your account, it's deleted or anonymized right away. When you delete a piece of content yourself, it's deleted right away. |
| Frozen account | Until you sign in again or choose permanent deletion. |
| Transaction and traffic logs (IP, device, version, action type and time) | Up to 2 years, then deleted automatically. They stay for this period even if the account is deleted (the 1 to 2 year range in Art. 5(3) of Law No. 5651). |
| Deleted account record | 2 years from the deletion date, then deleted automatically. |
| Moderation records (removed content, reason, date) and reports | 2 years. If there's a legal dispute, until it's resolved. |
| Purchase and subscription records | At least 3 years, with the direct link to you removed (Distance Contracts Regulation Art. 20). If tax legislation requires a different period, that period. When your account is deleted, the email and name in these records are cleared. |
| Support requests and content notices | Until your account is deleted. Notices from non-members: 2 years after they're resolved. |
| Promotional consent records | 3 years after consent is withdrawn (Regulation on Commercial Communications and Commercial Electronic Messages (Ticari İletişim ve Ticari Elektronik İletiler Hakkında Yönetmelik), Art. 13). |
| App analytics (Firebase, Google Analytics) | The period set in the Google Analytics data retention setting, up to 14 months. Crash reports up to 90 days. |
| Slack notifications | Up to 1 year, then deleted automatically. |
| Web cookies | The periods in the Cookie Policy. Your cookie choice: 6 months. |
| Subscriber record at RevenueCat | When you delete your account, your subscriber record at RevenueCat is deleted too. |
Data whose retention period has expired is deleted, destroyed or anonymized.
7. Children
BlueGrays has no age limit, and students use it too. We don't ask for age. We process children's data only as far as needed for the service. We don't use children's data to build marketing profiles. We recommend not sharing information such as full name, school, address and phone number on the forum.
Parents and legal guardians can ask for information about their children's data and request that it be corrected or deleted. We may ask for reasonable proof of guardianship.
8. Security
We take these measures to protect your data:
- Passwords are stored irreversibly (bcrypt).
- Connections are encrypted with TLS.
- Sessions are managed with signed, versioned keys.
- Access to the admin panel is restricted. Failed admin sign-ins and admin sign-ins from a new IP address trigger alerts. Whenever an admin views user data, it's logged.
If there's a data breach, we notify the Board within 72 hours at the latest and inform the people affected as soon as possible (Art. 12(5) of the Law).
9. Your rights (Art. 11 of the Law)
By applying to us, you can use these rights:
- To find out whether your personal data is processed,
- If it has been processed, to request information about it,
- To find out the purpose of the processing and whether the data is used in line with that purpose,
- To know the third parties in Türkiye or abroad to whom it has been transferred,
- To ask for it to be corrected if it's incomplete or inaccurate,
- To ask for it to be deleted or destroyed under the conditions in Article 7 of the Law,
- To ask for correction, deletion and destruction to be notified to the third parties to whom the data was transferred,
- To object to an outcome against you that results exclusively from analysis by automated systems,
- To claim compensation if you suffer damage because of unlawful processing.
You can also do these things yourself in the app:
- Edit your profile information,
- Turn off league visibility and question reminders,
- Withdraw your promotional consent and your ad measurement consent,
- Change your "Cookie preferences" on the web,
- Freeze or permanently delete your account (Profile > Security > Delete Account).
10. How can you apply?
You can send your application in line with the Communiqué on the Procedures and Principles of Application to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ) in any of these ways:
- By email to [email protected] from the email address registered with BlueGrays. Write "KVKK Application" in the subject line.
- With a secure electronic signature or mobile signature, to [email protected].
- With a petition bearing your handwritten signature, delivered by hand to the postal address above or sent through a notary.
- In the app under Profile > Support. Choose "KVKK application" as the request type.
Your application must include: your first and last name, your signature if you apply in writing, your Turkish ID number (if you're a foreign national, your nationality and your passport or ID number), your address or email address for notifications, and your request. Writing from the email address registered with BlueGrays makes it easier for us to verify your identity. If you write through another channel, we may ask for additional information to verify your identity. If a parent applies on behalf of their child, we may ask for information showing guardianship.
We resolve your application free of charge within 30 days at the latest. If the process involves an additional cost, a fee may be charged according to the tariff set by the Board (Art. 13 of the Law). If your application is rejected, you find the reply insufficient, or you don't get a reply in time, you can file a complaint with the Personal Data Protection Board within 30 days of learning of the reply, and in any case within 60 days of your application date (Art. 14 of the Law).
11. Changes
We update this notice as our data processing activities or the legislation change. Before we start processing data for a new purpose, we'll inform you separately. The current notice is always available in the app under Profile > Preferences > Agreements and at bluegrays.com/en/legal/kvkk.