Privacy Policy

The data controller is KEYLEARN TEKNOLOJİ VE YAZILIM İTHALAT VE İHRACAT A.Ş.("KeyLearn" or the "Company"), located at Merkez Mevkii, Merkez Küme Evler No: 152/1, Door No: 2, Tokatlı Village, Safranbolu / Karabük 78600, Türkiye. You can reach us at admin@keylearn.net.

We process only the following data:

Parent (account holder) data:

• Name
• Email address
• Password (stored only as an irreversible bcrypt hash — we never store your password in plain text)
• Last sign-in time

Child profile data (all entered and managed by the parent):

• Name (only the name the parent enters)
• Grade level and year of birth
• Quiz statistics (correct/incorrect answer counts)
• KeyCoin balance and transactions
• Daily screen-time budget and usage

Device data:

• Platform (iOS)
• Device name
• Device token and — once notifications launch — push notification token
• Device lock status

Data we do NOT collect:

• No email address, phone number, location, or photos are collected from children. Child accounts have no email.
• No government IDs, payment/card details, biometric data, or health data.
• No third-party analytics or advertising SDKs; no behavioral tracking.

• Creating parent and child accounts, authentication, and account security
• Calculating the screen-time budget, tracking usage, and operating device lock/unlock features
• Serving quiz questions appropriate to the child's grade level and tracking progress (correct/incorrect, KeyCoin)
• Showing parents summaries of their child's usage and progress
• Securing the Service, fixing errors, and responding to support requests
• Complying with legal obligations

We process personal data under Article 5 of the KVKK on the grounds that processing is (i) necessary for the establishment or performance of a contract (account and Service functionality), (ii) necessary for compliance with our legal obligations, and (iii) necessary for our legitimate interests (service security), provided your fundamental rights are not harmed. Under the GDPR, the corresponding bases are Article 6(1)(b), (c), and (f). Child profile data is entered directly by the parent holding parental authority, with their full knowledge and consent.

• Only a parent or legal guardian can create a KeyLearn account; children cannot sign up on their own.
• Child profiles have no email address, and no contact information is ever requested from the child.
• All child data (name, grade, year of birth) is entered by the parent, which serves as verifiable parental consent within the meaning of COPPA.
• We show no advertising to children, and child data is never used for marketing or shared with third parties.
• Parents can delete a child profile and all associated data at any time in the app or by contacting admin@keylearn.net.

App-blocking features run on Apple's Family Controls / Screen Time framework. By Apple's design, the selection of restricted apps and the app list are processed only on the device; they are never sent to our servers and we cannot see them. Our servers receive only the device's overall lock status and the screen-time budget/usage.

• Your personal data is stored on Company-managed servers located in Türkiye and is not transferred abroad.
• We never sell, rent, or share your personal data with third parties for marketing.
• Data may be disclosed only to competent public authorities upon a lawful, duly issued request under applicable law.

We retain personal data for as long as your account is active and as required by the purposes above. When you delete your account, personal data belonging to your account and child profiles is deleted or irreversibly anonymized within 30 days, subject to statutory retention obligations. Copies in backups are purged within the normal backup cycle, at most 90 days.

• Passwords are stored only as irreversible bcrypt hashes; no plain-text passwords are kept.
• All communication between the app and our servers is encrypted with TLS (HTTPS).
• Server access is restricted through authorization and access-control mechanisms.
• Data is backed up regularly and systems are kept up to date with security patches.

Under Article 11 of the KVKK you have the right to:

• Learn whether your personal data is processed and request information about it
• Learn the purpose of processing and whether data is used in line with that purpose
• Know the third parties to whom data is transferred domestically
• Request correction of incomplete or inaccurate data
• Request erasure or destruction of data under Article 7 of the KVKK
• Request that corrections, erasures, and destructions be notified to third parties who received the data
• Object to a result arising against you from analysis of data exclusively by automated systems
• Claim compensation for damages caused by unlawful processing

If you reside in the European Union, you may also exercise your GDPR rights of access, rectification, erasure, restriction of processing, and data portability. Send any request to admin@keylearn.net; we respond free of charge within 30 days at the latest.

Changes to this policy will be published on this page with an updated "Last updated" date. Material changes will additionally be announced through in-app notice or the email address on file. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

For any privacy questions, requests, or complaints: admin@keylearn.net