Privacy Policy

1. Who We Are

BuddyWolfy ("we", "our", "us") is a language learning platform operated as a sole proprietorship by Ahmet Can Turan, based in Türkiye. For the purposes of the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK), we act as the data controller of your personal data.

Contact for any privacy-related matter: [email protected].

2. Scope

This Privacy Policy describes how we collect, use, disclose, and safeguard your personal data when you use the BuddyWolfy website at buddywolfy.com, the BuddyWolfy mobile apps for iOS and Android, the BuddyWolfy browser extension, and any related services (collectively, the "Service"). For additional information specific to the browser extension, see our Extension Privacy Policy.

3. Information We Collect

3.1 Account Information

• Email address
• Username — by default, the part of your email address before the "@" (or, if you use Sign in with Apple, usually the first name Apple shares on your first sign-in). Your username is shown to other users (see Section 4). You can change it in your account settings on the website.
• Password, if your account has one (stored only as a salted hash; we never see it in plain text)
• If you sign in with Google: your email address, profile picture URL, and Google account ID. We do not store your name.
• If you sign in with Apple: your email address and your Apple user identifier. The email address may be a private relay address if you chose to hide your email. Apple shares your name only on your first sign-in; we use it only to create your username. We also keep, encrypted, a token Apple issues for our app, so that we can revoke our access to your Apple ID when you delete your account.
• The sign-in methods linked to your account (email and password, Google, or Apple) and when each was linked
• The time and IP address of your last sign-in
• Records of your consent to our Terms of Service and this Privacy Policy and, if you opt in, to marketing emails — each with the time and policy version

3.2 Learning Data

• Vocabulary groups, words, and question boxes you create
• Texts you add — for example, for deep-scan analysis — and the readings we create from them (sentences, translations, audio, and practice questions)
• Quiz results, study progress, points, and learning statistics
• Daily-challenge comments you post and comments you like. Your comments are shown to other users together with your username.
• Problem reports you send us (your message, the item it concerns, and your platform and app version)
• Notifications we send you within the Service
• Feature-usage counters (how many times you have used features that have plan limits)
• AI usage records — the AI feature used, the model, the amount of processing (tokens), and, for word and phrase lookups, the word or phrase sent for processing
• Native, target, and interface language preferences
• Notification preferences in the mobile app (see Section 3.5)

3.3 Billing Information

We do not collect or store your full payment card details. Card processing is handled by our payment provider, Lemon Squeezy (see Section 6). We receive and store only:

• Subscription status and plan, renewal, trial-end, and end dates, and whether the subscription is cancelled
• The last four digits and brand of the card used (for receipt display)
• An invoice/order ID issued by Lemon Squeezy
• Your Lemon Squeezy customer, subscription, product, and variant IDs
• Links to your Lemon Squeezy customer portal and update-payment-method page, so you can manage your subscription
• Records of the payment notifications (webhooks) Lemon Squeezy sends us — the event type and the ID of the item concerned — deleted after 30 days

3.4 Technical Data

• IP address (for security, fraud prevention, and rate limiting). We keep the IP address of your last sign-in with your account (see Section 3.1). For rate limiting, request counters linked to your IP address are kept for at most one minute, or for 3 days if you exceed a limit.
• Browser type, device type, and operating system (from request headers)
• Server logs of requests made to the Service (for diagnostics and abuse prevention)

3.5 Mobile App

If you use the BuddyWolfy app for iOS or Android, the following also applies:

• On our servers — when you are signed in and allow notifications, the app registers your device's Expo push token together with its platform (iOS or Android), your native language, your time zone, and your notification preferences, so we can send notifications in your language at a suitable time. This record is deleted when you sign out of the app, or automatically 90 days after the device last checked in with our servers.
• On your device — the app keeps your sign-in token and basic account details in the system's secure storage (Keychain on iOS, Keystore on Android), and stores copies of your words, groups, readings, and study progress so they load quickly and work offline. Cards you save from Discover are kept only on your device.
• The app does not use an advertising identifier and contains no analytics or crash-reporting SDK.

4. How We Use Your Information & Lawful Bases (GDPR)

Under the GDPR, we may only process your personal data when we have a lawful basis. The table below explains why we process your data and on which basis.

5. AI Processing

To generate definitions, translations, pronunciation audio, example sentences, memory stories, and deep-scan analyses, we send the relevant text you submit (and only that text — not your account or payment data) to one or more of the following AI providers:

• OpenAI, L.L.C. (United States) — under OpenAI's API data-processing addendum, which states that API inputs and outputs are not used to train their models.
• Google Cloud (Google LLC) — Cloud Translation API, to translate text you submit, and Cloud Text-to-Speech, to generate pronunciation audio. These are the only Google services to which we send your text directly.
• OpenRouter, Inc. (United States) — a routing service through which we use models from Anthropic (Claude), Google (Gemini), Mistral AI, Deep Cogito, and OpenAI. We reach Anthropic's Claude and Google's Gemini models only through OpenRouter, not directly.

These providers act as our processors and use your text to return a response. OpenAI and Google Cloud state that they do not use data sent through their APIs to train their models by default; OpenAI may keep it for up to 30 days to detect abuse. The models we use through OpenRouter are run by different providers, each under its own data policy, so we cannot guarantee that each of them deletes your text right away or never uses it for training. Do not submit information through deep scan or other AI features that you do not want sent to a third-party provider.

6. Payment Processing

Paid subscriptions are processed by Lemon Squeezy (Lemon Squeezy LLC), who acts as the Merchant of Record. Lemon Squeezy collects your payment method, billing address, and tax information directly and is independently responsible for that processing. See Lemon Squeezy's Privacy Policy.

We receive only the limited billing information described in Section 3.3, which we use to manage your subscription, generate receipts, and meet our tax and accounting obligations.

7. Data Sharing

We do not sell your personal data. We share limited data only with the following recipients. Our service providers process it on our behalf under written agreements that require them to protect it; sign-in providers, Google (for analytics and advertising measurement, if you consent) and YouTube handle it under their own terms and privacy policies:

• Hosting provider — Contabo, which hosts the servers that run the Service and our database.
• Cloudflare — the CDN and proxy through which all traffic to our website and API passes; storage of media, static files, and encrypted database backups on Cloudflare R2; and routing of email sent to our addresses.
• AI service providers — OpenAI; OpenRouter, through which we also use models from Anthropic, Google (Gemini), Mistral AI, and Deep Cogito; and Google Cloud Translation and Text-to-Speech, as described in Section 5.
• Payment provider — Lemon Squeezy, as described in Section 6.
• Email delivery provider — Amazon Web Services (Amazon SES, in the EU Frankfurt region), to send transactional emails (account verification, password reset, subscription notices) and, with your consent, marketing emails.
• Push notification services — Expo, Google Firebase Cloud Messaging (Android), and Apple Push Notification service (iOS), to deliver notifications to the mobile app. They receive your device's push token and the notification text, which can include the title of a text you added.
• Sign-in providers — Google and Apple, when you choose Sign in with Google or Sign in with Apple (see Section 3.1).
• Google Analytics and Google Ads (Google) — only if you accept analytics cookies (see Section 11): details of your visit, such as the pages you view, your device and browser, and an approximate location derived from your IP address, and — if you sign up after clicking one of our ads — a conversion event.
• YouTube (Google) — the thumbnail of the demo video on our site loads from Google's servers when you open a page that shows it, so Google receives your IP address and browser information. The video itself loads only when you click play.
• Authorities — when required by a valid legal request (e.g., a court order or law enforcement request that meets applicable legal standards).

We do not show ads on the Service. Apart from Google Analytics and Google Ads conversion measurement, which run only with your consent, we use no advertising or tracking services.

8. International Data Transfers

Our primary servers are located in the European Union. However, some of our processors are based in the United States: Cloudflare, Google, Apple, Expo, Amazon Web Services, OpenRouter and our other AI providers (Section 5), and our payment provider (Section 6). When we transfer data outside the EU/EEA or Türkiye, we rely on:

• The EU–U.S. Data Privacy Framework, where the recipient is certified, or
• Standard Contractual Clauses approved by the European Commission, together with appropriate supplementary measures.

9. Data Retention

• Account and learning data — kept while your account is active. You can delete your account in your account settings on the website, in the mobile app (Profile → Delete account), or by emailing [email protected] from your account's email address. Your account is closed and signed out on all devices at once, any active subscription is cancelled, and, if you signed in with Apple, we revoke our access to your Apple ID. We permanently erase your account and learning data 7 days after your request, and in any case within 30 days. We keep only: references to your Lemon Squeezy order and subscription (no card data) as billing records; AI usage counts, with your identity and the words you looked up removed; and problem reports you sent, with your identity and message removed.
• Notifications — deleted automatically 30 days after they are created.
• Mobile push tokens — deleted when you sign out of the app, or automatically 90 days after the device last checked in with our servers.
• Payment webhook records — deleted automatically after 30 days.
• Billing records and invoices — kept for up to 10 years to comply with tax and accounting law in Türkiye and the EU.
• Server and security logs — kept for up to 90 days, except where a longer period is required to investigate a security incident.
• Marketing consent records — kept while consent is in effect and for 3 years after withdrawal, as evidence of compliance.
• Backups — may persist for up to 35 days after deletion of the live data.

10. Your Rights

Depending on where you live, you have the following rights over your personal data:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your account and your personal data — you can do this yourself in your account settings or the mobile app (see Section 9)
• Receive a copy of your data in a portable format
• Object to or restrict certain processing
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with a supervisory authority

To exercise any of these rights, email [email protected]. We respond within 30 days. EU/EEA residents may complain to their national data-protection authority; residents of Türkiye may complain to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu — KVKK).

11. Cookies and Browser Storage

11.1 Cookies

We use the cookies below. Most are strictly necessary or functional for the Service to operate. The Google Analytics and Google Ads cookies are set only if you accept them in our cookie banner. You can change your choice at any time with the "Cookie settings" link at the bottom of our pages; if you withdraw consent, we delete those cookies.

• __Secure-authjs.session-token — keeps you signed in. HTTP-only and secure. Expires after 365 days.
• __Host-authjs.csrf-token — protects sign-in and sign-out requests against cross-site request forgery. HTTP-only and secure. Deleted when you close your browser.
• __Secure-authjs.callback-url — remembers which page to return to after you sign in. HTTP-only and secure. Deleted when you close your browser.
• __Secure-authjs.state, __Secure-authjs.nonce, __Secure-authjs.pkce.code_verifier — set only while you sign in with Google or Apple, to verify the response from the sign-in provider. HTTP-only and secure. Expire after 15 minutes.
• bw-session-hint — contains only the value "1" and tells our home page that you are probably signed in, so it can take you straight to your dashboard. It is not HTTP-only, so the page's scripts can read it. Removed when you sign out; otherwise expires after 1 year.
• payload-theme — stores your light/dark theme preference. Expires after 1 year.
• NEXT_LOCALE — stores your interface language preference. Expires after 1 year, or after 180 days when set at sign-in or onboarding.
• TARGET_LANGUAGE — stores the language you are learning. Expires after 1 year, or after 180 days when set at sign-in or onboarding.
• NATIVE_LANGUAGE — stores your native language. Expires after 1 year, or after 180 days when set at sign-in or onboarding.
• bw-consent — remembers whether you accepted or rejected analytics cookies. Expires after 1 year.
• _ga, _ga_* — Google Analytics, only with your consent: tell visits from different browsers apart so we can measure traffic. Expire after up to 2 years.
• _gcl_* — Google Ads, only with your consent: measure sign-ups that follow a click on one of our ads. Expire after up to 90 days.

The demo video on our site is embedded from YouTube in its privacy-enhanced mode (youtube-nocookie.com) and loads only when you click play. While it plays, YouTube may store data in your browser under Google's privacy policy.

11.2 Browser Storage (localStorage and sessionStorage)

We use your browser's local storage and session storage to remember your progress in interactive features and to keep the site working smoothly. This data is stored only on your device and is never transmitted to our servers.

• listening-practice-progress-{id} — saves your position in a listening practice session in the Reading feature so you can resume where you left off. Automatically expires after 3 days.
• qb-study-{groupId} — saves the remaining questions in a question box study session so you can resume after closing the page. Cleared automatically when the session is completed.
• dailyChallengeLikedComments, dailyChallengeUserComments — keep a local copy of the daily-challenge comments you have liked or posted (the comment text, the author's username, and the language), so your likes and new comments show up immediately. Entries older than one day are removed the next time you open the daily challenges.
• __chunkReloadCount, __chunkReloadAt (session storage) — count and time automatic page reloads, used to recover when a page fails to load after we release an update, without reloading endlessly. Deleted when you close the tab.

You can clear these cookies and storage entries at any time through your browser settings. Doing so may sign you out and reset your preferences.

12. Data Security

We use technical and organisational measures to protect your data, including HTTPS for all connections from your browser and our apps, password hashing, HTTP-only and secure session cookies, and encrypted backups. No system is 100% secure; if we become aware of a personal data breach affecting you, we will notify you and the relevant authorities within the time limits required by law (72 hours under GDPR).

13. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us at [email protected] and we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the new version on this page, update the "Last updated" date, and — where required by law — notify you by email or in the Service.

15. Contact

Data controller: Ahmet Can Turan, Türkiye. For any privacy question or to exercise your rights, contact [email protected].

Annex A — KVKK Aydınlatma Metni (Türkiye Kullanıcıları İçin)

Bu metin, 6698 sayılı Kişisel Verilerin Korunması Kanunu ("KVKK") kapsamında veri sorumlusu sıfatıyla, BuddyWolfy tarafından işlenen kişisel verileriniz hakkında sizi bilgilendirmek amacıyla hazırlanmıştır.

Veri Sorumlusu

Veri sorumlusu, BuddyWolfy hizmetini şahıs olarak işleten Ahmet Can Turan'dır (Türkiye). İletişim: [email protected].

İşlenen Kişisel Veriler

• Kimlik ve iletişim bilgisi: e-posta, kullanıcı adı; Google ile girişte profil fotoğrafı bağlantısı ve Google hesap kimliği; Apple ile girişte Apple kullanıcı tanımlayıcısı.
• Hesap güvenliği bilgisi: şifre özeti (hash), oturum bilgileri, IP adresi, son girişin zamanı ve IP adresi, hesabınıza bağlı giriş yöntemleri.
• Hukuki işlem bilgisi: Kullanım Şartları, Gizlilik Politikası ve pazarlama iznine ilişkin onay kayıtları (zaman ve politika sürümüyle birlikte).
• Kullanım bilgisi: oluşturduğunuz kelime grupları ve soru kutuları, eklediğiniz metinler ve bunlardan oluşturulan okumalar, Günlük Görevler yorumları ve beğenileri, sorun bildirimleri, bildirimler, özellik kullanım sayaçları, yapay zekâ kullanım kayıtları, puanlar ve çalışma istatistikleri.
• Tercih bilgisi: ana dil, hedef dil, arayüz dili, tema seçimi, bildirim tercihleri.
• Mobil cihaz bilgisi: push bildirim anahtarı (token), platform (iOS veya Android), saat dilimi.
• Ödeme/abonelik bilgisi: abonelik durumu, plan, kart markası ve son 4 hane (kart numarasının tamamı tarafımıza iletilmez), sipariş numarası, Lemon Squeezy müşteri, abonelik, ürün ve varyant kimlikleri, müşteri portalı bağlantıları, ödeme bildirimi (webhook) kayıtları.

İşleme Amaçları

• Hesabınızın oluşturulması ve yönetilmesi.
• Dil öğrenme hizmetinin sunulması (kelime listeleri, quizler, deep scan, yapay zekâ destekli içerikler).
• Aboneliğinizin yönetilmesi, ödemelerin alınması, fatura düzenlenmesi.
• Sistemin güvenliğinin sağlanması, kötüye kullanımın önlenmesi.
• Yasal yükümlülüklerin (vergi, muhasebe vb.) yerine getirilmesi.
• Açık rızanız varsa, ürün güncellemesi ve pazarlama içerikli e-posta gönderilmesi.
• Mobil uygulamada anlık (push) bildirim gönderilmesi.
• Liderlik tablosunun ve Günlük Görevler yorumlarının diğer kullanıcılara gösterilmesi.
• Açık rızanız varsa, Google Analytics ve Google Ads ile site trafiğinin ve reklam kampanyalarımızın sonuçlarının ölçülmesi.

Hukuki Sebepler (KVKK m. 5–6)

• Sözleşmenin kurulması ve ifası için veri işlemenin gerekli olması (m. 5/2-c).
• Veri sorumlusunun hukuki yükümlülüğünü yerine getirmesi (m. 5/2-ç).
• İlgili kişinin temel hak ve özgürlüklerine zarar vermemek kaydıyla, veri sorumlusunun meşru menfaati (m. 5/2-f) — güvenlik, kötüye kullanımın önlenmesi ve liderlik tablosu için.
• Pazarlama amaçlı işleme, yeni okuma bildirimleri ile Google Analytics ve Google Ads çerezleri için açık rıza (m. 5/1).

Aktarım

Kişisel verileriniz, hizmetin sunulabilmesi için aşağıdaki kategorilerdeki taraflara aktarılabilir:

• Sunucu barındırma sağlayıcısı: Contabo.
• Cloudflare (ABD): CDN ve vekil sunucu (proxy); medya, statik dosyalar ve şifreli veritabanı yedeklerinin depolanması (Cloudflare R2); e-posta yönlendirme.
• Yapay zekâ sağlayıcıları (ABD): OpenAI; Anthropic, Google (Gemini), Mistral AI ve Deep Cogito modellerine eriştiğimiz OpenRouter; Google Cloud Translation ve Text-to-Speech.
• Ödeme sağlayıcısı: Lemon Squeezy (ABD).
• E-posta gönderim sağlayıcısı: Amazon Web Services — Amazon SES (AB, Frankfurt bölgesi).
• Anlık bildirim hizmetleri: Expo, Google Firebase Cloud Messaging, Apple Push Notification service.
• Giriş sağlayıcıları: Google ve Apple.
• Google Analytics ve Google Ads (Google, ABD): yalnızca analiz çerezlerine onay verirseniz, ziyaretinize ilişkin bilgiler.
• YouTube (Google): tanıtım videosunun küçük resmi yüklenirken IP adresiniz ve tarayıcı bilgileriniz; videoyu oynatırsanız YouTube'un gelişmiş gizlilik modu kapsamındaki veriler.
• Yetkili kamu kurum ve kuruluşları, yasal bir talep olduğunda.

Yurt dışına yapılacak aktarımlar, KVKK m. 9 kapsamında, Kurul tarafından öngörülen güvenceler veya açık rıza temelinde gerçekleştirilir.

Toplama Yöntemi

Verileriniz; kayıt formları, hesap ayarları, web sitesi, mobil uygulamalar ve tarayıcı eklentisi üzerinden hizmet kullanımı sırasındaki etkileşimleriniz, çerezler ve sunucu logları aracılığıyla elektronik ortamda toplanır.

Haklarınız (KVKK m. 11)

KVKK m. 11 kapsamında; kişisel verilerinizin işlenip işlenmediğini öğrenme, işlenmişse buna ilişkin bilgi talep etme, işlenme amacını ve amacına uygun kullanılıp kullanılmadığını öğrenme, yurt içinde veya yurt dışında aktarıldığı üçüncü kişileri bilme, eksik veya yanlış işlenmişse düzeltilmesini isteme, KVKK'da öngörülen şartlar çerçevesinde silinmesini veya yok edilmesini isteme, düzeltme/silme/yok etme işlemlerinin aktarıldığı üçüncü kişilere bildirilmesini isteme, münhasıran otomatik sistemlerle analiz edilmesi sonucu aleyhinize bir sonuç ortaya çıkmasına itiraz etme ve kanuna aykırı işleme nedeniyle uğradığınız zararın giderilmesini talep etme haklarına sahipsiniz.

Başvurularınızı [email protected] adresine iletebilirsiniz. Talebiniz, niteliğine göre en geç 30 gün içinde sonuçlandırılır. Şikayetlerinizi Kişisel Verileri Koruma Kurumu'na (kvkk.gov.tr) iletme hakkınız saklıdır.