Corvus Lingua Corvus Lingua

Privacy Policy

Version 2026-09-19 · Effective from the date the app is first published on Google Play.

This policy explains what personal data the Corvus Lingua mobile application collects, why it is collected, who it is shared with, and how you can have it deleted. It covers the app and this website.

1. Who is responsible for your data

Uğur Karagül
Kızılırmak Cad. 39/9, Kocatepe Mh.
06420 Çankaya / Ankara, Türkiye
corvuslingua@gmail.com

Under Turkish Law No. 6698 on the Protection of Personal Data (KVKK) this is the data controller (veri sorumlusu). For users in the European Economic Area (EEA) and the United Kingdom, the same party acts as controller under the General Data Protection Regulation (GDPR).

2. What we collect

Account data

Your email address, and an authentication identifier created when you register. If you choose to fill them in, your display name and phone number. A password is never stored in readable form; authentication is handled securely by our infrastructure provider.

Learning data

The articles you open, your reading and practice progress, saved vocabulary and review items, the study programme and academic field you select, and your chosen support language. This is the data that makes the app work: without it, your progress cannot be restored between sessions or devices.

Subscription data

Your subscription status, paid-through dates, an account-linked purchase identifier, and any account freeze date, scheduled resume date and preserved service-time balance. This identifier is pseudonymous, not anonymous. We also process your account email address and limited delivery records for automatic-resume notifications. Payments are processed by Google Play or the App Store; we do not process or store your card number or banking credentials.

Technical data

Device and app version information, request logs, and crash and error reports, used to keep the service running, diagnose faults, and detect abuse such as automated bulk generation.

A crash report carries the error and its technical trace, the screen it happened on, the app version, the operating system version, the device model, and — once you are signed in — your account identifier, so that one person hitting the same fault repeatedly can be told apart from many people hitting it once. It carries no IP address, no request headers, and no recording of your screen or of what you typed.

We respect your attention and privacy: we do not use advertising identifiers, we do not run third-party advertising or tracking SDKs, and we do not sell personal data.

3. Why we process it, and on what legal basis

  • To provide the service — creating your account, generating and delivering study material, saving your progress. Necessary for performance of our contract with you.
  • To operate subscriptions and account freezing — verifying entitlement, restoring purchases, preserving unused service time and progress during your chosen break, automatically resuming access, and sending the associated service email. Necessary for performance of our contract; these messages are not marketing emails.
  • To keep the service secure and affordable — enforcing fair-use quotas, detecting scraping and abuse, investigating faults. Our legitimate interest in a service that is not degraded or drained by automated misuse.
  • To meet legal obligations — where retention or disclosure is required by statutory law.

4. Who processes data on our behalf

We use the following infrastructure and payment providers. Infrastructure processors handle data under our instructions; app stores also process transaction data under their own terms and privacy policies:

  • Supabase — authentication, database and server functions. Securely stores your account, learning and subscription records.
  • Resend — delivers automatic account-resume emails using your account email address and the associated resume and service-expiry dates. We do not send your reading history or study answers to this provider.
  • Google Cloud (Vertex AI) — generates the reading and grammar analysis material from open-access article text.
  • RevenueCat — manages subscription entitlement and receives purchase events from Google Play and the App Store.
  • Sentry — receives the crash and error reports described above so that faults can be diagnosed. Reports are deleted automatically after 90 days.
  • Expo (EAS Update) — serves corrected versions of the application's program code. Each request carries an identifier created when the app is first installed on a device. It is not derived from your hardware, is not an advertising identifier, is not linked to your account, and is gone when the app is uninstalled.
  • Google Play and Apple App Store — process purchases under the applicable store terms and privacy policies.
  • Hostinger — hosts this website. This site sets no cookies and runs no tracking scripts.

5. How article material is generated

When study material is produced for an article, the article's text is sent to Google Cloud's Vertex AI service. The result is stored in a shared cache keyed only to the article and the generation settings — it contains no user identifier and is not linked to the person who triggered it. Anyone who later opens the same article receives the same cached material. Your personal notes, progress and review history are never sent to the model.

6. International transfers

Our infrastructure providers operate servers outside Türkiye, including within the European Union, the United States and Australia — our database and server functions currently run in Sydney, Australia. Where data is transferred out of the EEA or the UK, it is covered by the European Commission's Standard Contractual Clauses (SCCs) in our agreements with those providers. Transfers abroad from Türkiye are made on the basis of your explicit consent given at registration, in line with KVKK Article 9, until an adequacy decision or a filed undertaking applies.

7. How long we keep it

  • Account and learning data: kept while needed to provide your account and learning history. During a 7, 30 or 90-day freeze, we retain that data and your unused paid-time balance. Your account resumes automatically at the scheduled date; you may resume early or request permanent deletion instead. Limited resume-email delivery records in our database are retained for up to 30 days and removed sooner when your account is permanently deleted. The copied recipient address is cleared after the email provider accepts the message.
  • After a deletion request: the ordinary in-app flow disables the account and schedules deletion after a 14-day recovery window. This is a product recovery period, not a universal statutory retention requirement. We handle applicable erasure requests without undue delay and within the relevant legal deadlines. Only records still required on a valid legal basis may be retained beyond deletion.
  • Minimal free-access abuse prevention: after deletion, a pseudonymous identity fingerprint and limited free-access dates may be kept for 12 months to prevent repeated free claims. This is not your learning history and is still treated as personal data. The retention period is not extended by repeat attempts.
  • Technical logs: kept for a short operational period, normally not more than 90 days.
  • Generated article material: retained indefinitely in the shared cache, because it contains no personal data and is not attributable to any user.

8. Deleting your account

You can delete your account from inside the app at any time: Profile → Edit personal information → Delete account. You will be asked to confirm twice, because the action is scheduled and not immediate.

Your account is then locked and held for 14 days. If you change your mind within that window, write to corvuslingua@gmail.com from the address on the account and we will restore it. After 14 days the erasure is permanent and cannot be reversed.

If you no longer have the app installed, you can submit a deletion request online or by email — see full details on Delete your account.

9. Your rights

Under KVKK Article 11 you may ask whether your data is being processed, request information about how it is used, request correction of inaccurate data, request erasure, ask us to notify third parties of any correction or erasure, object to a decision produced solely by automated analysis, and claim compensation for damage caused by unlawful processing.

If the GDPR applies to you, you additionally have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time without affecting processing already carried out.

Write to corvuslingua@gmail.com to exercise any of these rights. We respond within 30 days. If you are not satisfied, you may lodge a complaint with the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) or, in the EEA or UK, with your local supervisory data protection authority.

10. Children

Corvus Lingua is designed for university-level and adult learners and is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has registered, contact us and the account and associated records will be removed promptly.

11. Changes to this policy

If we change how data is processed, we will publish an updated version here with a new version date. Where the change is material, we will notify you in the app before it takes effect. The version date at the top of this page always reflects the policy currently in force.