This Privacy Policy explains how Alesta Medya ("we", "us") collects, uses, shares, stores and deletes personal data through the Görevde Yüksel: GYS Hazırlık mobile application (Google Play package com.alestamedya.merlineonline, also available on the App Store) and the website gorevdeyuksel.net (together, the "Service"). Görevde Yüksel helps Turkish public employees prepare for in-service promotion and title change exams.
1. Who we are and how to contact us
- Data controller / developer: Alesta Medya (Google Play developer account “Alesta Medya”)
- App: Görevde Yüksel: GYS Hazırlık
- Website: https://gorevdeyuksel.net
- Privacy contact: bilgi@gorevdeyuksel.net
2. Data we collect
We only collect the data needed to provide the Service:
- Account data: name, email address and password (stored only as a one-way bcrypt hash). If you sign in with Google, the name, email address and Google account ID that Google shares with us.
- Profile photo (optional): only a photo you choose from your device gallery. The app accesses the gallery only at that moment and with your permission.
- Study and exam data: selected institution and title, questions you answer and your answers, practice exam results, spaced-repetition (Leitner) boxes, notes, favorites, study time, statistics and duel results.
- Purchase data: the Premium product purchased, date, amount, Google Play / App Store order ID and purchase token; for card payments on the website, the order ID, amount and status reported by the payment provider. We never see or store your card details.
- Device and technical data: IP address, device model, operating system and app version, push notification token, screens opened in the app, and error/crash logs.
- Communications: messages you send us through the support form or by email; your email address if you subscribe to our newsletter.
We do not access your location, contacts, microphone, camera, SMS, call logs or other files on your device, and we do not ask for your phone number.
3. How we use your data
- To create and secure your account and keep you signed in;
- To provide personalized questions, topics, practice exams and review schedules for your selected institution, and to calculate your progress statistics;
- To verify purchases and unlock Premium access on your account;
- To send notifications you allow (study reminders, duel invitations, exam announcements);
- To detect and fix errors, keep the Service secure and prevent abuse;
- To answer support requests and meet our legal obligations.
We do not sell your data, do not use it for advertising or ad profiling, and the app shows no third-party ads.
4. Sharing with third parties
Data is shared only with the following service providers, and only as far as each function requires:
- Google Play Billing / Apple App Store: processing and verifying in-app purchases.
- Google Sign-In: only if you choose to sign in with Google.
- Firebase Cloud Messaging, Apple Push Notification service and Expo push service: delivering notifications to your device (push token and notification content).
- Sentry: error and crash monitoring (device/app version and error details).
- Creem (creem.io): card payments on the website only; card details are processed directly on Creem’s checkout page.
- Paddle (paddle.com): card payments on the website only; card details are processed directly in Paddle’s checkout.
- Public authorities: only when required by law.
Other users can see only your display name, your profile photo (if any) and your scores in duels and leaderboards. Your email address is never shared with other users.
5. Data security
All traffic between the app and our servers is encrypted with HTTPS (TLS). Passwords are hashed with bcrypt and never stored in plain text. Access to servers and databases is restricted to authorized personnel.
6. Data retention
We keep your data while your account is active. When you delete your account, your account data, profile photo, study and exam data and notification tokens are permanently deleted. Purchase/invoice records that we must keep by law are retained for the legally required period. Error logs are deleted automatically within 90 days.
7. Deleting your account and data
You can delete your account and all associated data at any time:
- In the app: Profile → Hesap ayarları (Account settings) → Hesabı sil (Delete account);
- On the website: from the account settings page;
- Without access to the app: follow the steps at https://gorevdeyuksel.net/hesap-silme or email bilgi@gorevdeyuksel.net from your registered email address.
8. Your rights
Under the Turkish Personal Data Protection Law No. 6698 (KVKK, Article 11) and, where applicable, the GDPR, you may ask whether your data is processed, request a copy, correction or deletion of your data, object to processing, and withdraw your consent to notifications at any time. You can turn off notifications in your device settings or in the app. We respond to requests within 30 days.
9. Cookies and local storage
The website uses only strictly necessary cookies to keep you signed in and for security (CSRF protection). We do not use advertising or tracking cookies. Preferences such as theme and font size are stored only on your device (localStorage / AsyncStorage).
10. Children’s privacy
The Service is intended for adults working in public institutions and is not directed to children under 18. If we learn that we have collected data from a person under 18, we will delete it.
11. Changes to this policy
When we update this policy, we publish the new version on this page with a new effective date and announce important changes in the app or by email.