Privacy Policy

1. Data controller

The controller of the personal data covered by this policy, within the meaning of Turkish Law no. 6698 on the Protection of Personal Data (KVKK) and the European Union General Data Protection Regulation (GDPR), is the person identified below: they decide what data is processed for what purpose, how long it is kept and which providers it goes to. The policy covers the Lernomi web app (www.lernomi.app) and the Android app.

Data controller

Samet Atila

Postal address

Emil-Figge-Str. 9, Zimmer 421, 44227 Dortmund, Almanya

Representative in Türkiye (KVKK)

Musa Atila, Akpınar Mah. Akpınar Merkez Küme Evler No:6, Tufanbeyli, Adana, Türkiye

KVKK requests (Türkiye)

kvkk@lernomi.app

GDPR / UK GDPR requests

gdpr@lernomi.app

Support

support@lernomi.app

The app is published in the app stores and the subscription revenue is collected by a different person. The publisher processes no personal data except on the controller's instructions; for the order, subscription and review data they access through the Play Console they act as a processor, and a processing agreement between us covers this (Art. 28 GDPR, Art. 12 KVKK).

Publisher and processor

Musa Atila

Postal address

Akpınar Mah. Akpınar Merkez Küme Evler No:6, Tufanbeyli, Adana, Türkiye

Tax office

Tufanbeyli Vergi Dairesi

Our servers run on Netcup GmbH, Germany (EU); the data is stored there. The controller is not established in Türkiye; for applications made from Türkiye and for correspondence with the Turkish authority, the representative identified above has been designated. Designating a representative does not remove the controller's own responsibility.

Collection method and legal ground (KVKK Art. 10): Data is collected electronically, by automated or partly automated means, through registration and settings forms, in-app interactions and the microphone; the legal ground for each item is given in the table in section 3.

2. Which law applies to whom

• Users in Türkiye: KVKK and its secondary legislation (Communiqué on the Obligation to Inform, Communiqué on Applications to the Data Controller, rules on transfers abroad).
• Users in the EU/EEA: because the controller is established in Germany, the GDPR applies by virtue of Art. 3(1) GDPR, together with German data protection law (BDSG); in the United Kingdom, the UK GDPR and the Data Protection Act 2018 also apply. The legal grounds in this policy are mapped to Art. 6 GDPR. As the controller is established within the Union, no separate EU representative under Art. 27 GDPR is required.
• Other countries: rights under local data protection law are reserved (section 10). We do not sell your personal data and do not share it for behavioural advertising.

3. What data we process and why

What we do not collect: location, contacts, calendar, photos, advertising identifier, device identifier, crash reports, special categories of personal data. Lernomi shows no ads, contains no third-party analytics or tracking SDK, and sells no data.

4. Microphone and audio recordings

In walk mode you hear a prompt in your own language and say the target-language word. While the screen is on, recognition is performed by the device's own speech recognition service. Whether that service processes the audio on the device or sends it to the operating system provider's servers (Google or Apple) depends on the device, the language and the device settings, and is governed by that provider's own terms; this path does not go through our server. While the screen is off or the phone is in your pocket, audio is sent to our server as a 16 kHz mono recording and passed to one of the speech recognition providers listed below. The audio file is not stored on our server or at the provider; only the recognised text, the expected word and the clip length are written to the usage record.

• The microphone opens only when you start walk mode; a persistent notification is shown and you can stop it from the app.
• While the screen is off, recording runs through the background mechanism the operating system provides for this: a microphone-type foreground service on Android. The system microphone indicator stays on.
• On first use a consent screen explains this processing; the mode does not start without your consent. If you decline, the microphone is never used and the rest of the app works.
• Profanity is masked in the recognition result.

Explicit consent text (microphone)

When you press "I agree, start" in the app you give the following declaration: "I give my explicit consent to my microphone recordings in walk mode being transferred to the Lernomi server and to the speech recognition providers listed in section 6 of this policy, some of which are located abroad, for the purpose of transcribing the word I said; and to the recording being deleted as soon as the operation finishes. I know that I can withdraw this consent at any time under Settings › Privacy."

4a. Social features and visibility

• Your display name is visible to all users on the weekly leaderboard; if you do not want to appear there, you can leave your display name empty (you then appear as "Learner").
• Your social profile (username, bio, level, streak) is public by default; under Settings › Social you can set it to "friends only" or "private", and turn off friend requests and appearing in suggestions.
• The activity feed (round completion, streak milestone) is visible only to your friends; it is turned off with "show my activity".
• When you block a user, neither side sees the other; when you report someone, the record is reviewed by a human. Block and report records are not shown to the other party.
• Lernomi has no private messaging; interaction happens only through reactions, nudges and shared quests.

4b. Automated decision-making and profiling

The spaced repetition schedule, the content of the daily round, the level suggestion and the weekly leaderboard are computed automatically from your learning data. These are part of how the product works; they do not profile you comprehensively and produce no legal or similarly significant effect for you (there is no decision within the scope of Art. 22 GDPR). You can change the suggested level yourself at any time.

5. Texts processed by AI

Your speaking practice (roleplay), writing tasks and exam answers are sent to language model providers in order to generate feedback. What is sent is only the text you wrote or said and the scenario of the lesson; your name and e-mail are not sent. The providers operate under API terms and data processing agreements in which they undertake not to use the data for model training. The app states clearly that AI characters are not real people (transparency under Art. 50 of the EU AI Act). Answers can contain mistakes; you can send them to us with the "Report" button under each answer, and reports are reviewed by a human. Lernomi makes no decision about you that is based solely on automated processing and produces a legal effect.

6. Service providers that receive data, and transfers abroad

The providers below work only for the stated purpose and only with the data that task requires; none of them may use the data for their own purposes. Our servers are in Germany. The safeguard used for transfers from Türkiye to the EU and from the EU to the USA/United Kingdom is in the last column: the standard contract published by the Turkish Board under KVKK Art. 9, and standard contractual clauses or an adequacy decision under Chapter V GDPR.

Data is transferred to public authorities only where there is a legal obligation or a request from a competent authority, and only within the scope of that request.

7. Cookies and local storage

On the web only the strictly necessary session cookie is used (to remember that you are signed in, for 30 days); for that reason there is no cookie consent banner. We use no marketing or tracking cookies. Browser and app local storage holds things like theme, sound and notification preferences, avatar choice and an unfinished lesson; these never leave your device.

8. Product analytics and switching them off

To understand which features are used, Lernomi writes short usage events to its own server (e.g. "round completed"). What such an event may contain is tightly bounded:

• Event names come from a closed, predefined list.
• Each event may carry a technical label of at most 32 characters (such as "single:artikel" or "level:B1").
• The label accepts only letters, digits, underscore, colon and hyphen, and cannot consist of digits alone. It therefore cannot hold an e-mail address, a link or a phone number.
• Nothing else is sent as free text, and the events go to no third party.

You can switch this off with the "Send usage data" toggle under Settings › Privacy. This is the right to object under KVKK and Art. 21 GDPR. Once it is off, only the records strictly necessary for the service are kept.

8a. Commercial electronic messages

We send you only service-related messages: e-mail verification, password reset, account and security notices, and the reminders you allowed. We send no commercial electronic messages within the meaning of Turkish Law no. 6563; if we ever want to send marketing messages, we will obtain your separate consent through the Turkish Message Management System (İYS) and every message will carry an opt-out.

9. Retention periods

• Account and learning data: as long as the account exists; when the account is deleted, all of it is deleted.
• Speaking practice logs (the sentence you said and the model's reply): 30 days, then deleted automatically.
• Audio recordings: not kept.
• Session records (IP, device description): for the life of the session, at most 30 days.
• Financial records (subscription invoices): the period required by the Turkish Commercial Code and the Tax Procedure Law (10 years), and only to the extent Google Play passes them to us.
• Correspondence about rights requests: 2 years after the request closes.
• Server backups: deleted data drops out of the backups within 30 days at the latest; backups are used only for disaster recovery, and a deleted account is never restored from a backup.

10. Your rights

Under KVKK Art. 11 and Art. 15-22 GDPR you may ask to:

• learn whether your data is processed, request information about it and receive a copy in a machine-readable format (access and portability),
• correct incomplete or inaccurate data (you can change your name and preferences yourself in Settings),
• have your data erased or destroyed (the account deletion route in section 11),
• restrict processing and object to processing based on legitimate interest (the analytics toggle),
• withdraw your explicit consent (the microphone consent; withdrawal does not affect the lawfulness of earlier processing),
• request that corrections and erasure be notified to third parties to whom the data was transferred,
• claim compensation if you suffer damage.

Making a request: write to gdpr@lernomi.app for requests under the GDPR or UK GDPR, or to kvkk@lernomi.app for requests under Turkish data protection law (KVKK); writing from the e-mail address on your account is enough to verify your identity. In Türkiye, under the Communiqué on the Procedures for Applications to the Data Controller, you may also apply in writing with a wet signature, with a qualified electronic signature, or from the e-mail address registered on your account. We resolve requests free of charge within 30 days at the latest; under the GDPR this period may be extended by two months where necessary, and you will be told.

Complaints: in Türkiye to the Personal Data Protection Board (kvkk.gov.tr). In the EU the controller's competent supervisory authority is, by place of establishment, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW). Under Art. 77 GDPR you may also complain to the authority in your own country. In the United Kingdom, the ICO. We would ask you to write to us first; we can resolve most requests directly.

11. Deleting your account and your data

You can delete your account in two ways: in the app under Profile › Settings › Account › Delete account, or on the web at www.lernomi.app/account/delete. At the moment of deletion your account, your progress, your texts, your speaking logs, your usage events and your social traces (friendships, reactions) are permanently deleted; this cannot be undone. Financial records subject to a statutory retention obligation are kept in anonymised form. If you have a store subscription, you need to cancel it separately in the store you bought it from.

12. Children

Lernomi is not designed for people under 18 and does not knowingly collect data from them; the terms of use limit account creation to people aged 18 and over (see terms, clause 3). The content is aimed at adult learners and at Goethe/telc exam preparation; because the app contains open-ended AI conversation and user interaction, it is not suitable for a child audience. If we discover that someone under 18 has created an account, we delete the account and the data; parents can write to gdpr@lernomi.app.

13. Security

All connections are encrypted with HTTPS. Passwords are stored as irreversible hashes. Access to the server is limited to keys; sign-in attempts are rate limited. Destructive operations such as account deletion require a password or a fresh session. In the event of a breach affecting personal data we notify the authorities (in Türkiye the Board within 72 hours) under KVKK and Art. 33-34 GDPR, and we inform you.

14. Changes

When we change this policy, the effective date and version on this page are updated; for a change that broadens the purposes of processing we inform you in the app and, where necessary, ask for consent again. Questions: gdpr@lernomi.app.

Version history

The last two versions. What binds is the text itself; this list only shows what changed.