Privacy Policy.

• Account data. Your email address and a password (stored only as a secure hash by our authentication provider), plus the display name, avatar and app language you choose.
• Sign in with Apple (optional). If you sign in with Apple, we receive a stable Apple user identifier, your email address (or, if you choose “Hide My Email”, an Apple relay address that forwards to you) and, on the very first sign-in only, the name you share. We never see your Apple ID password.
• Google sign-in (optional). If you sign in with Google, we receive your name, email address and profile picture from Google. We never see your Google password.
• Learning data. Your progress (completed lessons and scenarios, XP, streak, level), flashcard review schedule, recorded mistakes, exam results, certificates you earn and app settings — this is the heart of the Service and what syncs between your devices.
• Purchase data. If you buy a plan or gold: the product, plan status, order dates and the transaction identifiers our payment providers give us. We never receive or store your card or bank details. Website purchases are processed by Paddle as merchant of record; in-app purchases are processed by the Apple App Store or Google Play and their status is relayed to your account through RevenueCat.
• League and social features. Your display name, avatar and weekly XP are shown to other learners in your league group and on game leaderboards. Nothing else about you is visible to other users.
• Messages. If you use the contact form or email us: your name, email address, topic and message content.
• Crash reports and error logs. When the app or website hits an error, a technical report is sent to our error-monitoring provider (Sentry): the error message and code location, app and operating-system version, device type, and a technical identifier for the session. Reports are not used to profile you.
• Website analytics. The website uses Vercel’s privacy-friendly analytics: aggregated page views, country and device type, with no cookies, no persistent identifiers and no cross-site tracking. The mobile apps carry no analytics SDK.
• Technical data. Our infrastructure providers automatically process basic technical logs (IP address, browser or device type, timestamps) to deliver the Service securely and prevent abuse. The apps also send their platform and version when they check for content updates.

What stays on your device. The apps can use your microphone for speaking exercises: speech recognition runs on your phone, and no audio is recorded, stored or uploaded. Lesson reminders are scheduled locally on your device; we hold no push-notification tokens. Lessons you download for offline use are stored on your device and removed when you delete the app or your account. We never access your contacts, photos, location or calendar.

• To provide the Service — authenticate you, save and sync your learning progress, personalise review scheduling, deliver what you bought and issue certificates (legal basis: performance of our contract with you).
• To communicate — transactional emails such as purchase receipts, password reset and replies to your messages (legal basis: contract / legitimate interest).
• To keep the Service safe and working — security, abuse and fraud prevention, and fixing crashes and bugs from the error reports described above (legal basis: legitimate interest).
• To improve the Service with anonymised statistics — we may aggregate and irreversibly anonymise learning and usage data (for example “X% of learners find this lesson hard”) to improve the curriculum and describe the Service; such statistics can never identify you and are no longer personal data (legal basis: legitimate interest).
• To send occasional product updates — we may email you about meaningful new features. You can opt out at any time via the unsubscribe link; essential service emails (receipts, password reset, important changes) are always sent (legal basis: legitimate interest / consent where required).
• To meet legal obligations — for example tax and accounting rules for paid plans (legal basis: legal obligation).

We do not use your personal data for third-party advertising, we do not sell or rent it, we do not use it to train third-party AI models, and we make no decisions about you by automated means that have legal or similarly significant effects.

We keep this minimal and functional — there are no advertising cookies and no third-party tracking:

• Authentication (essential). Our sign-in provider stores a session token in your browser or app so you stay logged in.
• Local app storage (essential). The website and apps keep your learning progress, settings and downloaded lessons on your device so they work fast and offline; when you are signed in, this is mirrored to your account.
• Analytics (cookieless). Vercel Analytics on the website counts visits without setting cookies or identifying visitors.

Because we only use storage that is strictly necessary for the Service to function, there is no cookie-consent banner to click through. If we ever add optional analytics or marketing cookies, we will ask for your consent first.

We share personal data only with the service providers that run our infrastructure, under data-processing agreements, and only as needed:

• Supabase — database and authentication (your account and learning data; hosted in the EU, Frankfurt).
• Vercel — website hosting, delivery and cookieless analytics.
• Cloudflare — domain, DNS and email routing.
• Resend — sending transactional emails (receipts, password reset, contact-form delivery).
• Paddle — payment processing for website purchases, as our merchant of record (billing details and transaction status).
• Apple — App Store purchases and, if you choose it, Sign in with Apple.
• Google — Google Play purchases and, if you choose it, Google sign-in.
• RevenueCat — verifying in-app purchases with the stores and relaying their status to your account (store transaction ids and product ids, keyed by your account id; never card details).
• Sentry — error and crash monitoring for the website and apps.
• Expo (EAS) — delivery of app content updates; receives only the platform and app version of the device asking for an update.

These providers may process data in the European Union, the United States and other countries where they operate. Where data leaves your jurisdiction, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses, the EU–US Data Privacy Framework where the provider is certified, and equivalent mechanisms (and, under KVKK, on the safeguards and consent it requires). We may also disclose data where the law requires it (for example a valid court order), where necessary to enforce our Terms, to detect or prevent fraud and abuse, or to protect the rights, property and safety of Lale, our users or the public — and as part of a merger, acquisition or sale of assets (with notice to you).

• Account and learning data — for as long as your account exists. If you delete your account, we delete or irreversibly anonymise this data within 30 days (encrypted backups may hold it up to 30 days longer before they are overwritten), except where law requires longer retention.
• Purchase records — kept by us and our payment providers for as long as tax and accounting law requires (typically up to 10 years), even after account deletion; they no longer link to a usable account.
• Contact messages — kept in our support inbox for as long as needed to help you and keep a record of the conversation.
• Crash reports — retained by our error-monitoring provider for up to 90 days.
• Technical logs — kept for short periods by our providers for security and operations.

All traffic is encrypted in transit (HTTPS/TLS). Passwords are hashed, never stored in plain text. Database access is protected by row-level security so each account can only ever read and write its own data; payment and plan changes are written only by verified webhooks from our payment providers. No method of storage or transmission is 100% secure, but we design conservatively: we collect little, and what we collect is locked down.

Depending on where you live (including under KVKK in Türkiye, GDPR in the EU/UK, and laws like the CCPA in California), you have the right to:

• know whether we process your data, and request a copy of it (access & portability);
• correct inaccurate data (the app lets you edit your profile directly);
• request deletion of your account and data (see Section 8);
• object to or ask us to restrict certain processing;
• withdraw consent where processing is based on consent;
• complain to your supervisory authority — in Türkiye the Personal Data Protection Authority (KVKK Kurumu), in the EU your national data-protection authority, in the UK the ICO.

For clarity (including within the meaning of the California Consumer Privacy Act): we do not sell your personal data, and we do not share it for cross-context behavioural advertising — so there is nothing to opt out of on that front.

To exercise any of these, email info@laleturkishlearning.com from the address linked to your account. We respond within the statutory deadlines (30 days under KVKK, one month under GDPR). You can also reset your learning progress at any time from Settings inside the app.

You can delete your account yourself, at any time, from Settings → Delete account in the app or on the website, or by emailing us from your account address. Step-by-step instructions are on our account deletion page. Deletion removes your sign-in, learning data, flashcards, mistakes, league history and settings immediately.

Subscriptions. Deleting your account cancels a subscription bought on our website. It does not cancel a subscription bought through the Apple App Store or Google Play — the store bills those, not us — so cancel it in your App Store or Google Play subscription settings first, or it will keep renewing.

The Service is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has created an account, contact us and we will delete it. Users under 18 should use Lale with a parent or guardian’s consent, as set out in the Terms of Service.

We will update this policy as the Service evolves. For material changes we will give notice by email or in the app before they take effect. The “Last updated” date above always shows the current version.

Privacy questions, requests or concerns: info@laleturkishlearning.com — or use our contact page. We read every message.