1 Data Controller
The Sorceva application is an educational platform developed and operated by Muhammet Fatih Ünal, trading as Poyralgo. For questions regarding the processing of your personal data:
- Email: [email protected]
- Website: https://sorceva.poyralgo.com
2 Data Collected
Our app collects the following personal data:
- Identity Information: First name, last name and email address (at registration)
- Exam Information: Target exam type, exam date and preferences
- Performance Data: Questions answered, correct/incorrect ratios, study durations, topic-based statistics
- Gamification Data: XP, level, streak, streak freeze tokens, weekly XP, league ranking
- Social Data: Username, friendship connections and friend requests sent/received
- Moderation Data: User reports you submit and your account's moderation status
- Prediction Data: Estimated exam score and ranking predictions based on your performance
- Mission & Mock Exam Data: Daily missions, mock exam results and history
- Activity Data: Daily study heatmap, login history
- Technical Data: Device type, OS version, app version, crash reports
- Push Notification Token: Device token for push notifications (only if permission is granted)
- Payment Information: Subscription status and history; card details are never stored by us.
3 Purposes of Processing
Collected data is processed solely for the following purposes:
- To provide the app's core functions and generate personalised question recommendations
- To analyse user performance and identify weak topics
- To support motivation through XP, levels, streaks and the league system
- To personalise daily missions
- To provide weekly league rankings and a competitive experience
- To send exam countdown and study reminder notifications
- To manage subscriptions and payment transactions
- To maintain app security and resolve technical issues
- To fulfil legal obligations
4 Legal Basis
Your data is processed on the following legal grounds:
- Performance of contract: Data required for account creation and service provision
- Legitimate interest: Improving app performance and security; functional notifications (streak reminders, exam countdown)
- Explicit consent: Marketing notifications, optional analytics data and website early access email list
- Legal obligation: Requests from competent authorities and payment records
5 Data Sharing
Your personal data will never be sold, rented, or shared with third parties for advertising purposes. Data is shared only with the following service providers:
- Supabase Inc. — Database and authentication (Japan/Tokyo, GDPR compliant)
- Anthropic PBC — AI question generation (USA — no personal identity data sent)
- Apple Inc. (planned) — iOS app distribution and subscription management (USA, GDPR compliant)
- RevenueCat Inc. — Subscription & purchase-state management (USA, GDPR compliant — only a user identifier and purchase info)
- Cloudflare Inc. — Website hosting and CDN (USA/EU, GDPR compliant)
- Expo / Expo Push Notifications — Notification infrastructure (USA — notification token only)
- Google Play / Firebase — App delivery, subscription management, security and platform functionality (USA, GDPR compliant)
Sharing with official authorities may occur when legally required.
5A International Data Transfers
Personal data may be processed on servers located outside Turkey. By using the service, you accept this transfer.
Your data is processed in Japan (Supabase) and the United States (Anthropic, Expo, Google, RevenueCat, Apple — planned).
5B Google Play Compliance
The application may use Google Play and Google Firebase infrastructure for application delivery, subscription management, notifications, security and platform functionality.
Google's privacy policy: policies.google.com/privacy
5C Information Visible to Other Users
When you use social features, the following profile information may be visible to other users:
- Your username and the avatar automatically generated from the first letter of your name
- Your level/league, XP, study streak, number of questions completed and average accuracy
- Optionally, your estimated exam score
Your email address, payment information and other sensitive data are never shared with other users.
Privacy Controls (Profile → Settings → Privacy)
- Turning off "Discoverable in search" hides your profile from user search.
- Turning off "Show statistics" hides your accuracy from other users.
- Turning off "Show predicted score" hides your estimated score.
- Turning off "Allow friend requests" prevents other users from sending you friend requests.
5D Reporting and Moderation
When you report a user, the report reason, any details you add, and the identity of the reported account are sent to our administrators for review.
Administrators may remove inappropriate usernames and suspend or ban accounts that violate the rules.
6 Retention Periods
- Account and profile data: For as long as the account is active
- Performance, gamification and activity data: Retained with the account
- Payment records: 10 years as required by law (Turkish Commercial Code)
- Crash and error logs: 90 days
- Website early access email list: Until app launch or until the user withdraws consent
- Push notification token: When notification permission is revoked or account is deleted
When you delete your account, all your personal data is immediately and permanently deleted. Only payment records subject to legal retention obligations continue to be kept.
7 Data Security
- All communications are protected with TLS/HTTPS encryption
- Passwords are stored as bcrypt hashes and never held in plain text
- Database access is restricted by Row Level Security (RLS) policies
- AI and payment API keys are kept solely in server-side Edge Functions
- Administrative operations are protected by separate security layers requiring authorisation
8 Your Rights under KVKK
Under Article 11 of KVKK No. 6698, you have the following rights:
- To learn whether your data is being processed
- To request information about processed data
- To learn the purpose of processing and whether data is used accordingly
- To request correction of incomplete or inaccurate data
- To request deletion or destruction of data
- To object to a result arising against you through automated systems
- To claim compensation for damages arising from unlawful processing
To exercise these rights: [email protected] — Requests will be responded to within 30 days at the latest.
9 Children's Privacy
Sorceva is an educational app. Users under the age of 18 are advised to use the app under the supervision of a parent or legal guardian.
If a parent or guardian wishes to request the deletion of their child's personal data, they may contact us at [email protected].
10 Cookies and Tracking
Our mobile app does not use traditional cookies. Anonymous usage statistics may be collected to improve app performance. This data is never associated with personally identifiable information.
Our website (poyralgo.com) may use essential cookies set by Cloudflare infrastructure for technical functionality and security. These cookies do not contain personal data, are not used for marketing purposes, and are not shared with third parties. We do not use Google Analytics or similar third-party tracking tools.
11 Policy Changes
This policy may be updated from time to time. When significant changes are made, you will be notified via in-app notification and/or email.
12 Contact
- Email: [email protected] (Subject: KVKK Request)
- Website: https://sorceva.poyralgo.com
Requests will be responded to within 30 days at the latest.