Privacy Policy

This Privacy Policy explains how EdLib (“we”, “us”) collects, uses, shares and protects personal data when you use our mobile application, admin dashboard and related services (the “Service”). We process personal data in accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, where applicable, the EU General Data Protection Regulation (“GDPR”).

Who we are

The data controller is EdLib, Y.Pazarci Mah. 4036 Sok. No:1 Manavgat/Antalya/TURKEY 07600. For any privacy question or request, contact us at arda3105ozcan@gmail.com.

Data we collect

• Account data — name, email address and a hashed password. If you sign in with Google or Apple, we receive the account identifier, email address and name those services return; we never receive your Google or Apple password.
• Profile data — optional city, district, school type and education level.
• Student records created by teachers — student names and the attendance, assignments, reading logs, notes and progress a teacher records. This includes personal data about children.
• Content — posts, comments, quizzes and files uploaded to the Service.
• Technical data — IP address, device and app version, and server logs needed to operate, debug and secure the Service.

We do not collect precise location, contacts, or advertising identifiers, and the Service contains no third-party advertising or analytics trackers.

Why we process it, and on what legal basis

• To provide the Service — performance of our contract with you (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• To authenticate you and keep accounts secure, and to review and approve new teacher accounts — our legitimate interest in preventing unauthorised access to children’s data (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).
• To answer support requests — legitimate interest, or your consent where you supply extra information.
• To meet legal obligations — compliance with law (KVKK Art. 5/2-a; GDPR Art. 6(1)(c)).

We do not use personal data for advertising, profiling, or automated decision-making that produces legal effects.

Children’s data

EdLib is designed to be used by teachers and by students invited by their teacher. Student records are entered and controlled by the teacher, or the school they work for, as part of their educational duties; in respect of that data the teacher or school acts as controller and we act as processor on their instructions.

Teachers are responsible for having a valid legal basis — such as school authorisation or parental consent — before recording student information. Students join only through a code or card issued by their teacher; there is no public sign-up for students. We do not knowingly collect data directly from children outside this teacher-mediated flow, we never use children’s data for advertising or profiling, and we do not sell it. A parent or guardian may contact us, or the student’s teacher or school, to access or delete a student’s data.

Sharing and service providers

We do not sell personal data and do not share it for advertising. We share it only with providers that help us run the Service, under contracts requiring them to protect it and process it solely on our instructions:

• Cloud hosting and managed database, for running the Service.
• Cloudflare R2, for storing uploaded files and images.
• Resend, for sending transactional email such as password resets.
• Google and Apple, where you choose to sign in with those services.

We may also disclose data where required by law, or to establish, exercise or defend legal claims.

International transfers

Our providers may process data outside your country, including outside Türkiye and the EEA. Where that happens we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the transfer conditions in KVKK Art. 9.

Security

Passwords are stored only as salted hashes, never in readable form. Data is encrypted in transit using HTTPS. Access to production systems is restricted to authorised personnel, sessions use short-lived tokens that can be revoked, and sign-in endpoints are rate-limited against brute-force attempts. No system is perfectly secure, but we work to protect your data using measures appropriate to its sensitivity.

Retention

We keep personal data for as long as your account is active. When you delete your account, access is blocked immediately and the data is permanently erased within 30 days, except where we must retain something to meet a legal obligation or to establish or defend a legal claim. Routine backups are overwritten on our standard backup cycle.

Deleting your account

You can delete your account and its data at any time in the app: teachers via Settings → Delete account, students via Profile → Delete account. Deletion signs you out immediately, blocks any further sign-in, and schedules your data for permanent removal. If you cannot access the app, see our account deletion page.

Your rights

Subject to applicable law, you may request access to your personal data, correction of inaccurate data, erasure, restriction of or objection to processing, and a portable copy of the data you provided. Where we rely on consent, you may withdraw it at any time. Under KVKK Art. 11 you may also ask whether your data is processed, learn the purpose, and request that third parties we shared it with be notified of any correction or erasure.

To exercise any of these rights, contact arda3105ozcan@gmail.com. We respond within the periods set by applicable law — no later than 30 days under KVKK, and one month under GDPR. You also have the right to lodge a complaint with your supervisory authority: in Türkiye, the Personal Data Protection Authority (KVKK); in the EEA, your national data protection authority.

Changes

We may update this policy from time to time. The date above always shows the current version, and we will communicate material changes in the app or by other appropriate means before they take effect.