1. Scope and controller
KulakApp is a mobile application for musical-listening exercises. Its official website is kulak.app. Firebase-provided web.app domains may be used for technical testing only; they are not official application, store, support, or privacy addresses.
The developer responsible for the KulakApp service is Melih Zengin. The sole privacy and support contact is kulakappdestek@gmail.com.
2. Data we may process
| Category | Examples | Purpose |
|---|---|---|
| Account | Email address, user ID, and Apple/Google or other sign-in-provider information | Authentication, account security, and access |
| Exercise and use | Exercise progress, answers, scores, streak/badge status, and daily quota | Progress and application functionality |
| Subscription | Product, entitlement, status, renewal, and store transaction identifiers | Verify and restore premium access |
| Notifications | Push token, permission, and technical delivery information | Send permitted notifications |
| Advertising and consent | Consent choice, advertising-identifier availability, ad interaction, and technical device data | Ad delivery, measurement, fraud prevention, and consent management |
| Technical/security | App version, device/OS, IP address, and service logs | Security, troubleshooting, and abuse prevention |
Data is not collected for a feature that is not enabled in the relevant app version. Store and SDK disclosures should remain aligned with the published build.
3. Why we use data
- Create and secure your account and allow sign-in;
- provide exercise progress, scores, quotas, badges, and related features;
- verify subscription entitlements through RevenueCat and the relevant store;
- send notifications when you have allowed them;
- support free access with ads, apply consent choices, and measure ad performance;
- protect the service, troubleshoot problems, prevent abuse, and comply with law.
We do not sell personal data. Data may be processed by the providers below only as needed to operate their services.
4. Systems and service providers
- Google Firebase: Firebase Authentication for accounts and sessions; Cloud Firestore for account/progress data; Cloud Storage for relevant application files; and Firebase Cloud Messaging for notification delivery.
- RevenueCat: verification and restoration of subscription entitlements and purchase status across stores/devices.
- Apple App Store and Google Play: distribution, payment, subscription, refund, and store transaction records under their own terms.
- Google AdMob: advertising delivery and measurement. Advertising partners may vary by region and consent choice.
- Google UMP/CMP: collecting and applying advertising consent and privacy choices where appropriate.
These providers may process data in different countries under their own terms and privacy notices. Firebase processing locations vary by service.
5. Advertising, tracking, and consent
KulakApp may show AdMob ads to support free access. In the EEA, UK, Switzerland, and other regions where required, Google UMP/CMP may present choices concerning advertising and personalization. Users can revisit available privacy options.
On iOS, processing that requires tracking permission is subject to the user’s App Tracking Transparency choice. Refusing permission does not block core exercises, but may affect ad personalization. Limited or non-personalized advertising may be served when consent is refused or personalization is unavailable, subject to law and provider settings.
5.2. Rating web pages
You may optionally rate tools, articles and home pages from 1 to 5. Each rating belongs only to its own page; it is not combined with your mobile app account or app-store ratings. The Turkish and English editions have separate ratings. You can use the site without rating any page.
When you submit, your browser creates a random management key in local storage. It lets you change or remove your rating in the same browser. No name, email address or account is requested. The server stores a keyed hash of the management key, the page identifier, the score and the time of the last change. The random key and network hashes are pseudonymous identifiers, not a claim of fully anonymous data.
To reduce abuse, the connection's IP address is processed during the request. An hourly, keyed network hash is used to limit request counts. Raw IP addresses are not stored in the rating tables. Network-limit records have a two-hour validity period and expired records are removed by scheduled daily maintenance. Delayed maintenance can delay removal. Hosting access and security logs are separate from these rating tables.
A rating stops contributing to the average 365 days after its last submission or update; expired vote rows are removed during maintenance. “Remove my rating” removes your vote from the active vote table. The management key may remain in your browser to support later submissions and distinguish repeated requests; you can delete it by clearing this site's browser data. Clearing browser data alone does not remove the server-side vote and can prevent you from managing the old vote. Because ratings are not linked to an account, we cannot automatically identify your vote from your email address. Contact support if you have difficulty; do not post your management key publicly.
Only the aggregate average and count are shown to visitors and search engines. The rating module does not send your rating or management key to Google Analytics; existing Analytics and advertising choices remain separate. Cached totals may take time to refresh. Backups follow their normal retention cycles; this explanation does not mean that backup copies are erased immediately.
6. Microphone and Voice Repeat Exercise
The microphone is used only after permission is granted, to analyze the pitch of your voice in Voice Repeat Exercise and provide exercise feedback. Microphone permission can be withdrawn in operating-system settings.
The signal may be processed temporarily for pitch analysis. The purpose is not to record speech content, build a voice profile, or make the audio available for later playback. Screen recording, operating-system functions, or third-party device features are outside KulakApp’s control.
7. Retention and account deletion
Account and exercise data is retained while the account is active and as needed to provide the service. Delete your account through Profile → Delete My Account → Confirm. If you cannot access the app, email a request from the account’s registered email address to kulakappdestek@gmail.com.
Deletion is intended to remove the KulakApp account and associated app data from active systems. Limited records required for security, fraud prevention, accounting, or law; normal provider-backup cycles; and App Store/Google Play purchase records may remain subject to applicable retention periods. Deleting the account may not cancel a store subscription; manage subscriptions separately in store settings.
See Account and Data Deletion for the full procedure.
8. Children
KulakApp is not directed to children under 13 and does not intend to knowingly collect personal data from children under 13. Contact us if you believe such data has been processed. Local law may require a higher age for valid digital consent.
9. Your choices and rights
Depending on applicable law, you may have rights to access, correct, delete, restrict, or object to processing and to withdraw consent. We may need to verify identity and account ownership securely. Never email your password, authentication code, or payment-card information.
10. Security and policy changes
We use reasonable technical and organizational safeguards, but no online or storage method can guarantee absolute security. We may update this policy as app features or legal requirements change. We will revise the effective date for material updates and provide in-app notice when appropriate.
Contact
Privacy or data request: kulakappdestek@gmail.com