Privacy Policy.

• Account data. Your email address and a password (stored only as a secure hash by our authentication provider), plus the display name and avatar you choose in the app.
• Google sign-in (optional). If you sign in with Google, we receive your name, email address and profile picture from Google. We never see your Google password.
• Learning data. Your progress (completed lessons and scenarios, XP, streak, level), flashcard review schedule, recorded mistakes and app settings — this is the heart of the Service and what syncs between your devices.
• Messages. If you use the contact form or email us: your name, email address, topic and message content.
• Technical data. Our infrastructure providers automatically process basic technical logs (IP address, browser type, timestamps) to deliver the site securely and prevent abuse. We do not run advertising or cross-site tracking.

• To provide the Service — authenticate you, save and sync your learning progress, personalise review scheduling (legal basis: performance of our contract with you).
• To communicate — transactional emails such as email confirmation and password reset, replies to your messages (legal basis: contract / legitimate interest).
• To keep the Service safe — security, abuse and fraud prevention, debugging (legal basis: legitimate interest).
• To improve the Service with anonymised statistics — we may aggregate and irreversibly anonymise learning data (for example “X% of learners find this lesson hard”) to improve the curriculum and describe the Service; such statistics can never identify you and are no longer personal data (legal basis: legitimate interest).
• To send occasional product updates — we may email you about meaningful new features. You can opt out of these at any time via the unsubscribe link; essential service emails (confirmation, password reset, billing, important changes) are always sent (legal basis: legitimate interest / consent where required).
• To meet legal obligations — for example tax and accounting rules for paid plans (legal basis: legal obligation).

We do not use your personal data for third-party advertising, we do not sell or rent it, and we do not use it to train third-party AI models.

We keep this minimal and functional — there are no advertising or third-party analytics cookies:

• Authentication (essential). Our sign-in provider stores a session token in your browser so you stay logged in.
• Local app storage (essential). The app keeps your learning progress and settings in your browser’s local storage so it works fast and offline-tolerant; when you are signed in, this is mirrored to your account.

Because we only use storage that is strictly necessary for the Service to function, there is no cookie-consent banner to click through. If we ever add optional analytics or marketing cookies, we will ask for your consent first.

We share personal data only with the service providers that run our infrastructure, under data-processing agreements, and only as needed:

• Supabase — database and authentication (your account and learning data).
• Vercel — website hosting and delivery.
• Cloudflare — domain, DNS and email routing.
• Resend — sending transactional emails (confirmation, password reset, contact-form delivery).
• Google — only if you choose Google sign-in.

These providers may process data in the European Union and other countries where they operate. Where data leaves your jurisdiction, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses and equivalent mechanisms. We may also disclose data where the law requires it (for example a valid court order), where necessary to enforce our Terms, to detect or prevent fraud and abuse, or to protect the rights, property and safety of Lale, our users or the public — and as part of a merger, acquisition or sale of assets (with notice to you).

• Account and learning data — for as long as your account exists. If you delete your account, we delete or irreversibly anonymise this data within 30 days, except where law requires longer retention (e.g. billing records).
• Contact messages — kept in our support inbox for as long as needed to help you and keep a record of the conversation.
• Technical logs — kept for short periods by our providers for security and operations.

All traffic is encrypted in transit (HTTPS/TLS). Passwords are hashed, never stored in plain text. Database access is protected by row-level security so each account can only ever read and write its own data. No method of storage or transmission is 100% secure, but we design conservatively: we collect little, and what we collect is locked down.

Depending on where you live (including under KVKK in Türkiye, GDPR in the EU/UK, and laws like the CCPA in California), you have the right to:

• know whether we process your data, and request a copy of it (access & portability);
• correct inaccurate data (the app lets you edit your profile directly);
• request deletion of your account and data;
• object to or ask us to restrict certain processing;
• withdraw consent where processing is based on consent;
• complain to your supervisory authority — in Türkiye the Personal Data Protection Authority (KVKK Kurumu), in the EU your national data-protection authority.

For clarity (including within the meaning of the California Consumer Privacy Act): we do not sell your personal data, and we do not share it for cross-context behavioural advertising — so there is nothing to opt out of on that front.

To exercise any of these, email info@laleturkishlearning.com from the address linked to your account. We respond within the statutory deadlines (30 days under KVKK, one month under GDPR). You can also reset your learning progress at any time from Settings inside the app.

The Service is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has created an account, contact us and we will delete it. Users under 18 should use Lale with a parent or guardian’s consent, as set out in the Terms of Service.

We will update this policy as the Service evolves (for example when we launch payments or mobile apps). For material changes we will give notice by email or in the app before they take effect. The “Last updated” date above always shows the current version.

Privacy questions, requests or concerns: info@laleturkishlearning.com — or use our contact page. We read every message.