Privacy notice

About this notice

This notice explains which personal data the Vokelo App mobile game for iOS and its server process, why, who receives it, how long we keep it and which choices and rights you have. It is written to meet the information duties of the Turkish Personal Data Protection Law No. 6698 (KVKK, article 10) and the EU General Data Protection Regulation (GDPR, articles 13 and 14).

Vokelo is a vocabulary-learning and word-game app. You can play as a guest without registering. An email address is needed only if you choose to link an account. We do not sell personal data and we do not use it for purposes other than those described here.

We collect data electronically, automatically, through the app and our server: from you, from your device and from the providers named below. For each purpose we give the legal basis, GDPR first and KVKK second. “Contract” means providing the game you asked to use. “Legitimate interests” means our interest in running a safe, working and sustainable app, which we weigh against your rights and freedoms.

This page itself uses no cookies, advertising or analytics scripts.

Who is responsible?

The data controller (KVKK: veri sorumlusu) is Oğuzhan Altay, an individual publisher who operates the app under the brand Vokelo App. For every privacy question or request, write to support@vokelo.app.

Do not send passwords, verification codes or payment card details in support messages.

Your player profile and progress

What: when you first open the app we create a guest player. The app generates a random player ID and a random device key. The key is kept in the iOS Keychain on your device and our server stores only a hash of it. We also store your username (chosen by you or generated by the app), your progress (rounds played, answers and mistakes, study list, experience points, badges, streaks, daily challenge and Mahjong results, daily play allowances), your coin balance and coin history, and your time zone so that daily limits reset correctly.

Why and legal basis: to provide the game, keep and synchronize your progress, apply daily limits and prevent abuse. Contract (GDPR art. 6(1)(b); KVKK art. 5/2-c). Preventing abuse is also our legitimate interest (GDPR art. 6(1)(f); KVKK art. 5/2-f).

Source: you and your device. The app does not ask for your name, age, address or phone number. Without these data the game cannot work.

Optional account link (email)

What: if you link an account, we process your email address and short-lived verification codes so that you can sign in again on another device or after reinstalling. A code is valid for 10 minutes and is stored only as a keyed hash. We send the email through Resend. To limit how many codes can be requested, we also keep a keyed hash of the address together with the send time. That hash is not your email address, but it is still personal data.

Why and legal basis: to verify and restore your account. Contract (GDPR art. 6(1)(b); KVKK art. 5/2-c). Linking an account is optional.

Friends, rooms, duels and reports

What: if you play with others we process friend requests, friendships, blocks, room invitations and room codes, match records (questions, answers, scores and result) and reports about usernames. You find a friend only by typing an exact username. A room can be shared as a code or a link; the public invitation web page shows only the code and no player information. The app has no free-text chat.

Why and legal basis: to run social play. Contract (GDPR art. 6(1)(b); KVKK art. 5/2-c). Blocks, reports and rate limits also serve our legitimate interest in preventing abuse (GDPR art. 6(1)(f); KVKK art. 5/2-f). You can block a player or report an inappropriate username in the app.

Public visibility

Other players of the app can see your username: when searching for an exact name, in friend lists, rooms and match screens, in the weekly standings (top 100: username, points and number of matches) and in the daily Mahjong ranking (rank, username, help actions used, wrong matches, shuffles and time). These screens are available only inside the app; there is no public web page of rankings.

Choose a username that does not reveal your real name or contact details. Your email address, purchases, coins and detailed progress are never shown to other players. Closed accounts disappear from the rankings. Opponents of a shared match keep the result of that match, but your name is no longer shown.

Purchases and coins

What: you can buy a one-time No Ads product and packs of coins through the Apple App Store. Apple handles the payment and tells us the result; we never receive your card, Apple ID or billing details. For coin packs our server checks the transaction with Apple’s App Store Server API and credits the coins once per transaction. We store the transaction ID, product, store environment, your player ID and a digest of the proof, together with the coin ledger entry. We also pass your random player ID to Apple as the account token of the purchase. The No Ads product is checked on your device; “Restore purchases” may send Apple’s signed transaction record to our server.

Why and legal basis: to deliver and restore what you bought. Contract (GDPR art. 6(1)(b); KVKK art. 5/2-c). Keeping purchase and coin records after an account is closed rests on our legal obligations (GDPR art. 6(1)(c); KVKK art. 5/2-ç) and on our interest in handling disputes, refunds and fraud (GDPR art. 6(1)(f); KVKK art. 5/2-e and 5/2-f).

Advertising and tracking

What: the free app shows ads from Google AdMob: a banner on the home screen, a full-screen ad between some rounds and optional videos you can watch for a reward, such as an extra play. The No Ads purchase removes banner and between-round ads; reward videos stay optional. When an ad is requested, Google receives technical data such as your IP address (from which it estimates an approximate location), device and app information, your interaction with ads and, if you allowed tracking, your device’s advertising identifier. Google may read or store identifiers on your device. We do not give Google your player ID, username, email address or progress.

Reward videos: when you finish one, Google’s server tells our server that the reward was earned. That message carries a random one-time ID, not your player ID.

Your choices: at first start, a Google consent message (shown where required, for example in the EEA, the UK and some US states) lets you accept or refuse personalised ads. On iOS you may then see an explanation and Apple’s tracking permission dialog. With your permission, Google may combine your advertising identifier with data from other companies’ apps and websites to personalise and measure ads; this is the “tracking” iOS asks you to approve. If you refuse or do not allow tracking, ads you see are not personalised (or may be limited) and Google does not receive your advertising identifier. You can change your choices at any time in the app under Settings > Other > Ad privacy, and in iOS Settings > Privacy & Security > Tracking.

Legal basis: your consent for personalised ads, for use of the advertising identifier and where the law requires consent to store or read information on your device (GDPR art. 6(1)(a); KVKK art. 5/1, explicit consent). You can withdraw consent at any time as described above; withdrawal does not affect earlier processing. Basic ad delivery, frequency limits, measurement and fraud prevention are based on legitimate interests (GDPR art. 6(1)(f); KVKK art. 5/2-f) where the law allows this without consent. Google acts as an independent controller for its advertising processing; see Google’s privacy policy. Where US state laws require it, Google’s message also offers an opt-out of the sale or sharing of data for advertising. We do not sell personal data ourselves.

Analytics

What: we record usage events so that we can find problems and improve the lessons. They fall into these categories: (1) app usage and gameplay interactions, such as the app being opened, rounds, matches, campaign levels, Mahjong boards, the daily set and study sessions starting or finishing, hints used, practice-bot offers and their results, and settings actions such as unlocking all modes, with simple counts and outcomes (for example number of mistakes, hints used, time taken, passed or not); (2) onboarding and placement: the steps you view and the choices and results from there (language pair, level, difficulty, goals, daily minutes and the placement test result); (3) the shop and purchase flow: opening the shop, and starting, completing or failing a purchase, together with the product (for example a coin pack) but never a price, a receipt or a transaction ID; (4) rewarded ads: that a reward video was started and that its reward was credited; and (5) once we run product tests, which variant you were shown.

Every event is stored with your random player ID, the time our server received it, the app version and build number, the interface language of the app, your language pair and the platform; inside a campaign level it also carries the chapter and the level type. Events contain only numbers, yes/no values and fixed labels: no free text, no username, no email address, no IP address, no device identifier and no advertising identifier. They stay on our own server and are not given to an analytics company. While you are offline the app keeps up to 500 events for up to 14 days on your device before sending them.

Retention: analytics events are deleted 90 days after our server received them. Closing your account deletes your events earlier.

Why and legal basis: to maintain and improve the app. Legitimate interests (GDPR art. 6(1)(f); KVKK art. 5/2-f). The app has no analytics on/off switch. You can object by writing to us.

Crash reports, server logs and security monitoring

App errors: when an unexpected error occurs, the app sends a filtered report to Sentry (EU data region, Germany). It contains the type of error, positions in our own code, the app version and build, the operating system and the platform. It is filtered on your device so that it contains no username, email address, player ID, screenshot or trail of your actions. Sentry may infer an approximate location from the connection. Sentry keeps reports for up to 90 days.

Server errors: our server sends a similarly filtered report (error type and code positions, no user data) to a separate Sentry project.

Server logs: our hosting provider Heroku records each request to our server (time, method, request path, response status, size and the IP address of the connection). These logs are forwarded to Datadog (US region), kept for up to 15 days and used to detect outages, abuse and attacks. A request path can contain a room invitation code. Our own application code does not write usernames, emails, tokens or answers to its logs. Our server also uses your IP address in memory to limit request rates; it does not save it in the database.

Legal basis: legitimate interests in the security and reliability of the service (GDPR art. 6(1)(f); KVKK art. 5/2-f).

Device features

Storage on your device: the app stores your settings, a copy of your progress, queued analytics events, downloaded content and audio files and your ad choices on the device. Deleting the app removes them from the device but does not close your account on the server (see Closing your account).

Reminders: if you turn on practice reminders, iOS asks for permission and the reminders are scheduled on your device as local notifications. They do not come from our server.

Pronunciation: the app plays pronunciation from audio files that it downloads as audio packs (see Content and audio downloads) and, when no audio file is available, speaks the word with the speech voices built into iOS. Neither way sends the text to us or to a third-party speech service. The app also checks which keyboards are installed so that it can offer the keyboard of the language you practise; this stays on the device.

Sharing: when you share a room code, a link or a daily result, the text goes through the iOS share sheet to the app you choose, and that app’s provider handles it under its own terms. The app opens Vokelo invitation links. It does not use your camera, microphone, photos, contacts or location.

Content and audio downloads

What: the app downloads lesson content and audio files (data only: word lists, course layout and recordings, no program code) as signed packs from Microsoft Azure Blob Storage, hosted in an EU region (Sweden). Some of these requests, for example the small file that says which content version is current, may also go to our own server, where the server logs described under Crash reports, server logs and security monitoring apply.

Like any web request, a download shows the storage host your device’s IP address (from which an approximate location can be inferred) and request metadata such as the time, the requested file, its size and standard connection details. The request contains no account data: no player ID, username, email address, device key or advertising identifier. We do not use these request data to identify you.

Microsoft acts as our processor for this hosting, on our instructions and under its data processing terms. Why and legal basis: to deliver the content and audio you use and to keep downloads secure and efficient. Contract (GDPR art. 6(1)(b); KVKK art. 5/2-c) and legitimate interests (GDPR art. 6(1)(f); KVKK art. 5/2-f).

Who receives your data

Service providers acting on our instructions: Heroku (Salesforce), hosting and database, EU region (Dublin, Ireland); Datadog, log monitoring, US region; Sentry, error monitoring, EU region (Germany); Microsoft (Azure Blob Storage), hosting of downloadable content and audio files, EU region (Sweden); Resend, verification emails, sending region Ireland; Name.com and Google (Gmail), which forward and receive mail sent to support@vokelo.app.

Independent recipients responsible for their own processing: Apple (App Store payments and purchase verification) and Google (AdMob advertising and its consent message). Other players see what is described under Public visibility. Authorities receive data only when the law requires it.

Data also reaches us from Apple (purchase results), from Google (reward confirmations) and from other players (friend requests, matches and username reports). We do not sell personal data and do not give it to data brokers or for other companies’ marketing.

Transfers abroad

Our database is in the EU (Ireland). Some providers, or their support teams, are in or process data in other countries, in particular the United States (for example Datadog logs, Google, Heroku/Salesforce, Microsoft and Resend). Apple and Google process data worldwide under their own terms.

For transfers out of Turkey we rely on the mechanisms of KVKK article 9 as amended in 2024: an adequacy decision of the Personal Data Protection Board, appropriate safeguards such as the Board’s standard contract, or, for incidental transfers, your explicit consent. For transfers out of the EEA we rely on adequacy decisions (such as the EU-US Data Privacy Framework for certified providers) or on the EU standard contractual clauses in the providers’ data processing terms (GDPR art. 46). You can ask us which mechanism applies to which provider.

Children and age

Vokelo is intended for people aged 13 and over. It is not designed for children and is not in the App Store Kids category. The app does not ask for your age and cannot verify it. We do not knowingly collect personal data from children under 13. If you believe a child under 13 uses the app, write to us and we will close the account.

If you are below the age at which you may agree to data processing yourself (in the EU between 13 and 16 depending on the country; in Turkey a parent or legal representative should agree for anyone under 18), please use the app only with their agreement and keep personalised ads off. Ads use Google’s Teen content rating with sensitive ad categories blocked, and are not directed at children.

How long we keep data

Account data (profile, progress, friends, results, play allowances and email link): kept while your account exists and deleted when you close it. We do not currently delete inactive accounts automatically.

Analytics events: deleted 90 days after our server received them (or earlier when you close your account).

Verification codes are valid for 10 minutes. Expired code records and the hashed send-limit records are removed by a maintenance routine we run from time to time (target: within 24 hours after expiry); code records are also deleted when you close your account.

Records that remain after an account is closed (see Closing your account) are kept for as long as needed for accounting, tax, fraud prevention and the handling of disputes, and as the law requires. We do not use them for anything else.

Monitoring and provider copies: Datadog logs up to 15 days; Sentry reports up to 90 days; Resend delivery logs for a short period set by Resend; technical request data of content downloads at the storage host for the period set by Microsoft’s service terms; database backups at our hosting provider until they expire under the hosting plan; support correspondence for as long as needed to answer you and to document how a request was handled.

Closing your account

You can close your account at any time in the app: Profile > Account > Close account. This also works for guest players. An active match is forfeited first. Signing out or deleting the app does not close the account.

Deleted: your email link and verification records, progress and study list, results, achievements, streak and daily records, Mahjong attempts, friends, requests, blocks and reports you filed, weekly points and ranking entries, analytics events, coin balance, play allowances and matchmaking data. Local copies on your device are cleared.

Kept: a minimal user record (ID, creation and closing time, with the username removed); the hashed device keys marked as revoked and a closure receipt, which stop the old session from being used again; the coin ledger; purchase, refund and reward-video records needed to prevent double credit; and shared match records that other players may keep, in which your name is no longer shown. These records can still be linked to your random player ID, so they are not anonymous. They are kept only for the purposes under How long we keep data.

Not deleted automatically: copies at our providers (Sentry, Datadog, Resend, hosting backups and the support mailbox), which expire as described above. Purchases made with Apple are managed in your Apple ID settings; closing the account does not cancel or refund them. To ask for earlier deletion of a provider copy, write to us.

Your rights and how to use them

Under KVKK article 11 you can ask whether we process your data; request information about it; learn its purpose and whether it is used accordingly; learn the third parties in Turkey or abroad that receive it; request correction; request erasure or destruction under article 7; request that these actions be notified to third parties; object to an unfavourable result arising from analysis exclusively by automated systems; and claim compensation for loss caused by unlawful processing.

Under the GDPR you have the right of access, rectification, erasure, restriction, portability and objection (including to processing based on legitimate interests), and the right to withdraw consent at any time (articles 7 and 15 to 21).

How: write to support@vokelo.app from the email address linked to your account or, as a guest, tell us your username and roughly when you started playing so that we can find your account. We may ask for information needed to confirm that the request concerns your account. We answer within 30 days (KVKK art. 13; GDPR art. 12). Requests are free of charge unless they are manifestly excessive.

Complaints: you may complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) or, if you are in the EEA, to the data protection authority of your country. We do not take decisions with legal or similarly significant effect solely by automated means.

Security

The app and our server communicate over HTTPS. The device key stays in the iOS Keychain and the server stores only its hash; verification codes are stored only as keyed hashes; the database role used by the server has no general permission to delete records, only narrow routines such as account closure. No system is perfectly secure. If a breach is likely to put your rights at risk, we will notify you and the competent authority as the law requires (KVKK art. 12; GDPR arts. 33 and 34).

Changes

We update this notice when the app or our practices change. The version and date are shown at the top. When a change is significant we will say so in the app or on this page.