Dil Koçu Privacy Policy

Last updated: 21 October 2026

This policy explains what personal data Dil Koçu uses when you use the app or the web version at https://dilkocu.enestavlu.com, why, and what your rights are. It is the information notice required by Article 13 of the EU General Data Protection Regulation (GDPR) and Article 10 of Türkiye's Personal Data Protection Law No. 6698 (KVKK).

In short

• You only need an e-mail address to sign in. There are no passwords.
• What you write and say is sent to AI providers so the app can give you feedback. These providers are in the United States.
• I don't keep your voice recordings on my servers. A recording is turned into text and then discarded.
• No ads, no tracking, no analytics tools. I don't sell your data.
• You can delete your account in one step, in the app or on the web.

1. Who is responsible for your data

I build and sell Dil Koçu on my own, as an individual, not as a company.

• Controller: Enes Tavlu, Türkiye
• E-mail: [email protected]
• Web: https://dilkocu.enestavlu.com

Where this policy says "I", it means the controller.

2. What data I use and why

Account

• What: your e-mail address, your account number (a random ID), when you joined, your plan and when it ends. If you like, a name you want the coach to call you.
• Why: to create your account, send you the sign-in code and unlock the features of your plan.
• Legal basis: performing our contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).

To sign in, you get a 6-digit code by e-mail. No password is stored. There is no Google or Apple sign-in.

Learning data

• What: the goal and exam you pick (for example IELTS), your target score and date, your study times, your interests, your level and level estimates, your lesson answers and scores, the texts you write, the transcripts of your spoken answers, your word memory (which word to review when), your daily study time, reading results, your streak, your points and your time zone.
• Why: to build your personal lessons every night, find your weak spots, show your progress and send the reminder at the right time.
• Legal basis: performing our contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).

Coach chat and live talk

• What: what you type in "Ask the coach" (Koça sor); in live talk, the transcript of what you say and the coach's replies.
• Why: so the coach can answer you and correct your mistakes.
• Legal basis: performing our contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).

"Ask the coach" chats are not stored on my server. Live talk transcripts are kept for 7 days, then only a short summary stays (see section 6).

Your voice

The app uses the microphone in speaking practice and live talk. It only listens after you start a recording.

• Your voice goes to the coach server and from there to a speech-to-text provider (Groq, or DeepInfra if Groq is down).
• I don't keep voice recordings on my servers. They are discarded once they are turned into text.
• In speaking practice, the recording stays in your device's temporary folder so you can play it back. It is deleted when you finish the lesson, and after 7 days at the latest.
• I don't create a voiceprint or any other biometric data from your voice.
• Legal basis: performing our contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).

Safety records

The coach checks every message with automatic rules. It hides phone numbers, e-mail addresses, national ID numbers, IBANs and street addresses before anything reaches an AI model or gets stored. If you mention self-harm, or that someone is hurting you, the lesson stops and the app shows emergency numbers.

• What: a short record that a rule was triggered: your account, the type of rule (for example "personal data" or "self-harm"), the feature and the time. What you wrote or said is never part of this record.
• Why: to keep the app safe and stop misuse.
• Legal basis: legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).

Problem reports

• What: the message you write in "Report a problem" (Sorun bildir) and the area you pick. The app adds the names of the last five screens you opened, the ID of the open lesson, the app version, platform, theme and text size. Your lesson answers are not added.
• Why: to find and fix the problem.
• Legal basis: performing our contract and legitimate interests (GDPR Art. 6(1)(b) and (f); KVKK Art. 5(2)(c) and (f)).

Technical and cost records

• What: for every AI call, the feature, the model, the amount used and the cost; your usage counters (for example how many minutes you talked this month). These records hold nothing you wrote or said.
• Error records: the type of error, where in the code it happened, app version, operating system and device model. They are not linked to your account.
• Server logs: the time and address of each request and technical connection details.
• Why: to apply plan limits, control costs, fix bugs and prevent abuse.
• Legal basis: performing our contract and legitimate interests (GDPR Art. 6(1)(b) and (f); KVKK Art. 5(2)(c) and (f)).

Weekly league (optional)

If you join the league, the other learners in your group see the first word of your name and your points for the week. If you didn't enter a name, they see "Öğrenci" (learner). You can leave at any time. If you don't join, nobody sees you.

• Legal basis: performing our contract; joining is your choice (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).

Payments

Subscriptions are sold only through Google Play and the App Store. Your card details never reach me. What I receive: the purchase token or transaction ID, the product, the purchase and expiry times, and whether the subscription will renew.

• Why: to verify your subscription and unlock your plan.
• Legal basis: performing our contract and legal obligations such as tax (GDPR Art. 6(1)(b) and (c); KVKK Art. 5(2)(c) and (ç)).

Google and Apple process the payment themselves, under their own privacy policies.

On your device

• Your settings (theme, sounds, text size), your sign-in session, records waiting to be sent and some progress data are stored on your device.
• The daily reminder is scheduled on your device. There is no push server. You pick the time and can turn it off.
• The web version uses no advertising or tracking cookies. It keeps your sign-in session in the browser's local storage.
• The web version downloads its drawing engine (CanvasKit) and some fonts from Google's servers (gstatic.com). This sends your browser's IP address to Google.

3. How AI is used

The coach in Dil Koçu is an AI. To give you feedback, I send your text and the transcript of your voice to AI providers:

• OpenAI: builds lessons, scores writing and speaking, answers as the coach, and screens texts for safety.
• Groq: turns your voice into text; backup model in live talk.
• DeepInfra: creates the coach's voice; backup speech-to-text.
• Anthropic: backup model when the others are down.

What these providers get: your question or answer, your level, your goal, your weak topics, your recent wrong sentences and your interests. I don't send your e-mail address, your name or your account number. Phone numbers, e-mail addresses, ID numbers, IBANs and street addresses are hidden before sending.

Under these providers' business API terms, data sent through their APIs is not used to train their models by default. Providers may keep it for a limited time (up to 30 days for most) for security and abuse checks. Requests to OpenAI are sent with OpenAI's response storage turned off.

Scores and level estimates are produced automatically. They are there to help you learn and have no legal or similarly significant effect on you. If you disagree with a result, write to me.

4. Who I share data with

I don't sell your data or use it for advertising. I use the service providers below to run Dil Koçu. They process data on my behalf and on my instructions.

The coach server currently runs on a computer I own in Türkiye. It may move to a rented server in the EU later. If it does, I will update this policy.

Beyond that:

• Google (Google Play) and Apple (App Store) process payments as independent controllers.
• If you join the weekly league, learners in your group see the first word of your name and your points.
• I disclose data to authorities only where the law requires it.

5. International transfers

Your data is processed outside your country: the database is in the EU, the coach server is in Türkiye, and the AI providers and the e-mail service are in the United States.

• GDPR: I'm the controller and I'm based in Türkiye, which has no EU adequacy decision. For transfers to the United States I rely on the EU-US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses where it isn't.
• KVKK: transfers out of Türkiye rely on the safeguards in KVKK Article 9, in particular the standard contracts published by the Turkish Personal Data Protection Board.

Write to me if you'd like a copy of these safeguards.

6. How long I keep data

I keep data only as long as it's needed. A clean-up runs every night and deletes what has passed its time.

• Account, profile, level estimate and word memory: as long as your account exists.
• Lessons built for you: 28 days. Then each lesson becomes a short weekly summary (title, score, a few weak topics and words) and the lesson itself is deleted. Summaries are kept for one year.
• Lesson answers and scores: 90 days after your level estimate has taken them into account, one year at most.
• Study time, points and streak: daily study time 120 days; point records 120 days (your point total stays); streak days 180 days; daily goals 60 days; league groups 8 weeks.
• Live talk transcripts: 7 days. After that only a short summary stays (how long you talked, how many turns and words). The summary is deleted after one year.
• Voice recordings: not stored on the server. On your device, a speaking practice recording is deleted when you finish the lesson, once it has been scored, and after 7 days at the latest.
• Safety records: linked to your account for 30 days if they are about self-harm or someone hurting you, and for 90 days otherwise. Then the link to you is removed. The rest (type of rule, feature, time) is deleted after one year.
• "Ask the coach" chats: not stored on the server. A question the content library can't answer may be kept as a content gap: with personal details hidden, at most 200 characters, and not linked to your name or account. It is deleted 180 days after the gap is closed.
• Problem reports: deleted 90 days after they are marked fixed, and one year after you sent them at the latest.
• Error records: 60 days, not linked to your account.
• Night lesson job progress records: 30 days in the database, 14 days on the coach server.
• Cost records: hold no content. Detailed records are kept for this month and last month, then only daily and monthly totals remain. Usage counters are kept for up to 13 months. When you delete your account, your totals and counters are deleted and the detailed records stay without any link to you.
• Store purchase records: the store's order number, plan, dates and status. They hold no card or payment details. When you delete your account, the link to you is removed. The record stays so you can restore your subscription into a new account with the same store account, and so one subscription is never granted twice.
• Server logs and night reports: hold only your account number, never your name or e-mail address. Night reports are deleted after 45 days. Logs have a size limit and old entries are removed. Once your account is deleted they can't be linked to you.
• Sign-in e-mails: Resend and Supabase keep delivery and sign-in records for their own security periods.
• Store records: Google and Apple keep their own records under their own rules.

7. Your rights

Under GDPR Articles 15–22 you have the right to:

• access your data and get a copy,
• have it corrected,
• have it deleted,
• restrict how it's used,
• get it in a portable format (JSON),
• object to uses based on legitimate interests,
• not be subject to a decision based solely on automated processing that significantly affects you.

Under KVKK Article 11 you can also ask whether your data is processed, for what purpose, and to whom it was transferred in Türkiye or abroad; ask that corrections and deletions are passed on to those recipients; object to a result against you that comes only from automated analysis; and claim compensation for damage caused by unlawful processing.

How to ask: write to [email protected] from the e-mail address on your account. I may ask for more information to confirm it's you. I'll reply free of charge within 30 days.

Complaints: you can complain to the data protection authority where you live, for example UODO in Poland or the Garante per la protezione dei dati personali in Italy. In Türkiye, you can apply to the Personal Data Protection Board (https://www.kvkk.gov.tr).

8. Deleting your account

• In the app: Ben (Me) → Ayarlar (Settings) → Hesap (Account) → "Hesabımı sil" (Delete my account).
• On the web: https://dilkocu.enestavlu.com/delete-account/

Deleting your account removes your account, all your learning records and your files at once. This can't be undone. Cost records, which hold no content, and store purchase records stay without any link to you.

Deleting your account does not cancel your subscription. Cancel it in the subscriptions section of Google Play or the App Store.

9. Minimum age

Dil Koçu is for people aged 16 and over. It is not made for children. If you are under 16, please don't use Dil Koçu.

If I learn that someone under 16 has an account, I will delete the account and its data. A parent who notices this can write to [email protected]. If you are 16 or 17, talk to a parent before buying a subscription.

10. Security

• All connections between the app and the servers are encrypted (HTTPS/TLS).
• In the database, each learner can only see their own records.
• Secret keys stay on the server and are never inside the app.
• I access your data only when it's needed to run the service or fix a problem.
• If there is a data breach, I will notify the authorities and, where required, you within the legal deadline.

11. Ads and tracking

I don't use ads, advertising IDs, analytics or tracking tools. I don't follow what you do in other apps or on other websites. I don't sell your data to anyone.

12. Changes

I may update this policy from time to time. I'll announce important changes in the app or by e-mail. The current version is always at https://dilkocu.enestavlu.com/privacy/

13. Contact

Questions, requests or complaints: [email protected]

Terms of use: https://dilkocu.enestavlu.com/terms/