Privacy Policy

1. Introduction

This policy explains how your personal data is collected, used, shared and protected when you use the Stuvori mobile application and the stuvori.comwebsite (together, the "Service"), operated by Stuvori ("we", "the Stuvori team").

This policy is aligned with the Turkish Personal Data Protection Law No. 6698 (KVKK), the EU General Data Protection Regulation (GDPR) and the Apple App Store / Google Play Store developer policies.

Data controller: Stuvori · Istanbul, Türkiye · Email: privacy@stuvori.com

2. Data We Collect

2.1 Account information

• Email address (required) — for account creation, sign-in and security notices
• Password (stored as a cryptographic hash, never in plain text)
• Display name and profile picture (optional)
• Google ID / Apple ID (when social sign-in is used; no profile data other than the email address is taken)

2.2 Study and performance data

• Pomodoro sessions (start/end time, duration)
• Atlas sessions (exam, subject, topic, answers, accuracy, duration)
• Goals and progress data
• Wrong answer history (for the wrong-answer notebook)
• Study streak and XP history
• Exam countdowns and review schedule

2.3 AI conversation data

• Messages you send to the AI assistants (academic coaching, study planning, stress management and so on)
• AI responses and generated content (Atlas lesson cards, quiz questions, PDF summaries)
• The question photo you upload for photo solve and the document you upload for PDF analysis — processed only to generate an answer, not stored by us
• Your consent to sending data to the AI features (which text, and when)
• This data is used to provide a personalised learning experience; it is never sold to third parties

2.4 Device and technical data

• Device type, operating system version (iOS/Android)
• Push notification tokens (only for Stuvori notifications)
• IP address (for security checks and suspicious sign-in detection)
• Anonymous usage statistics (crash reports, performance metrics)
• Advertising identifier (for ad delivery on the free plan; and, if you allow tracking on iOS, for ad measurement — see section 5)

2.5 Subscription data

• Subscription status (Free / Pro)
• Purchase date and expiry date
• Purchase identifier provided by the App Store / Google Play
• We do not collect your credit card or payment details directly — all payments are processed by Apple and Google

2.6 Social data

• Users you follow and users who follow you
• Your position on the leaderboard
• Badges you have earned and season progress
• Chat messages you write in study rooms, and the room name and description you create
• Users you have blocked and reports you have submitted (the reason and your note; if you reported an AI response, the text of that response)

3. How We Use Data

• Providing the service: creating your account, tracking your study data, generating AI responses
• Personalisation: offering suggestions based on your study habits, stress level and goals
• Improvement: improving the app and fixing errors using anonymous usage data
• Communication: important security notices, subscription status changes, push notifications (can be turned off in settings)
• Security: detecting suspicious sign-ins and fraudulent pomodoro sessions, preventing abuse
• Legal obligations: responding to KVKK and other legal requests

4. Data Sharing — Third-Party Services

We never sell your data. Data is shared with the following service providers only where it is necessary for the app to function:

Data is sent to the AI providers (DeepSeek, OpenAI) with the explicit consent you give inside the app the first time you use the feature. If you do not consent, these features send no data.

Where legally required (a court order or prosecutor's request), data may be shared with the competent authorities.

5. Advertising

Ads are shown on some screens of the free version of the app. Ads are served through Google AdMob.

• Ads are non-personalised by default. No interest profile is built to select ads.
• On iOS we request App Tracking Transparency permission. It has a single purpose: measuring which ad brought you to Stuvori. If you allow it, your advertising identifier (IDFA) is shared with our ad providers for that measurement only. If you decline, the app works exactly the same and no feature is withheld; measurement falls back to Apple's SKAdNetwork, which is aggregated. You can change your choice later under iOS Settings → Privacy & Security → Tracking.
• Even if you allow it, ads are still not personalised. The permission is used for measurement, not for selecting ads.
• Even for non-personalised ads, AdMob may process limited technical data (advertising identifier, IP address, device and app information) for ad delivery, frequency capping and fraud prevention.
• We do not place ads inside the study flow: no ads are shown while you are answering questions, reading a lesson, in a duel, while the pomodoro timer is running, on the payment screen or during sign-up.
• The number of ads per day is limited.
• Pro subscribers see no ads on any screen.

Rewarded ads (optional): you may choose to watch a short video ad to earn Gold, the in-app currency. This is entirely up to you; if you do not watch, no feature of the app is withheld. Because you start the ad yourself, this option is also available to Pro subscribers. Gold cannot be bought with real money and cannot be converted into money.

You can read how Google processes advertising data on the Google Privacy & Terms page.

6. Data Retention

• Active accounts: for as long as your account exists
• Deleted accounts: after your deletion request all data — including study records, AI conversations, study room messages, and block and report records — is permanently deleted. Only the following remains, and none of it can be used to recover your email address or identity: an irreversible digest of your email address (to stop a free trial from being claimed again with a new account, and to keep honouring a request not to receive emails) and which account a store purchase belongs to (to stop the same payment from being used a second time on another account)
• Crash reports: 90 days
• Security logs: 90 days
• Payment and invoice records: for subscription payments the seller is Apple or Google; they issue the invoice and keep it under their own legal obligations. Stuvori does not hold payment or invoice details.

7. Your KVKK / GDPR Rights

You have the following rights regarding your personal data:

• Right of access: to learn which of your data is processed
• Right to rectification: to correct inaccurate or incomplete data (in-app profile settings)
• Right to erasure: to delete your account and all your data (app → Profile → Delete Account)
• Right to object: to object to certain processing activities
• Data portability: to request a copy of your data
• Right to complain: to apply to the Turkish Personal Data Protection Authority (KVKK)

To exercise these rights, write to privacy@stuvori.com. We respond to requests within 30 days.

8. Children's Privacy

Stuvori does not target children under 13. Parental consent is recommended for users aged 13 to 18. If we learn that a user under 13 has provided data, we take steps to delete that data immediately. Please let us know at privacy@stuvori.com.

9. Security

• Passwords are hashed with bcrypt
• All connections are encrypted with HTTPS / TLS
• JWT-based session management
• OTP verification when a suspicious sign-in is detected
• The database is protected by authentication and network restrictions
• Rate limiting prevents API abuse

10. Cookies (Website)

The stuvori.com website uses strictly necessary cookies only:

• Strictly necessary cookies: site functionality (session, language preference)
• Preference cookies: to remember your cookie consent choice (12 months)

We use no third-party analytics, advertising or tracking cookies on the stuvori.com website. For ads in the mobile app, see section 5. For details see the Cookie Policy.

11. International Data Transfers

Our servers are hosted in Türkiye. Some third-party services (DeepSeek, OpenAI, Meta, Expo, Firebase, Google AdMob, Sentry) may transfer your data to their servers in the EU, the USA or Asia. Such transfers are made only to the extent necessary to provide the service, within the framework of Article 9 of the Turkish Personal Data Protection Law No. 6698 (KVKK).

12. Changes to This Policy

When we update this policy we change the "Last updated" date. For significant changes we send a notice to your registered email address.

13. Contact

Data controller: Stuvori
Address: Istanbul, Türkiye
Email: privacy@stuvori.com
Support: support@stuvori.com