Privacy and personal data

Under Turkey's Personal Data Protection Law No. 6698 (KVKK), the data controller is Kuazara. [TO BE COMPLETED BY OWNER: Company name, MERSIS number and full address will be added before publication.]

For any question about this notice: destek@kuazara.com

We only collect the data needed to provide the learning experience:

• Account details: first name, last name, email address, username, account type (student, educator) and an irreversible hash of your password. We never store the password itself.
• Optional details for teachers: school and subject.
• Learning data: the lessons you complete, your quiz answers, your progress, and the points and badges you earn.
• Technical data: cookies that keep you logged in, and short-lived IP address records used to prevent abuse (for example, to limit repeated failed login attempts). Session and device records are described under Account security.
• One-to-one lessons, community and the Workshop: if you use these features, the data processed is described under One-to-one lessons, Community and Workshop.
• Progress sharing link (optional): if a student creates a read-only link in Settings, whoever opens it sees, without logging in, only the name the student chose and a summary of the last 30 days (active days, lessons completed, number and average of quizzes, mastery levels, streak); no email, surname, school, class or teacher information is shown. We do not store the link itself (only an irreversible hash); it is valid for at most 90 days and the student can turn it off at any time; closed link records are deleted after 90 days.
• Correspondence: if you email us or fill in the contact form, your name, email address, the topic you chose and what you wrote. The moment you give explicit consent on the form is also recorded.

We do not access device data such as location, contacts, photos or the microphone. If you sign in with a passkey, the fingerprint, face or PIN check happens on your device; biometric data never reaches us.

• To create your account. Once email sending is switched on, to verify your email address with the 6-digit code we send to it (we do not send email at the moment, so accounts are opened without email verification).
• To save your learning progress, let you continue where you left off and suggest a suitable topic.
• If you are in a teacher's class, so that your teacher can see assignment and progress status for that class.
• To keep the platform secure and fix errors.
• To run one-to-one lessons and the community, and to review reports.
• To protect your account and alert you to suspicious sign-ins.
• To answer your questions.

We process data on the following grounds under Article 5 of the KVKK: it is necessary for the formation and performance of a contract (opening your account and providing the service), to fulfil our legal obligations, and our legitimate interest (security and abuse prevention), provided it does not harm your fundamental rights and freedoms. If any processing falls outside these, we will ask for your explicit consent separately.

We collect your personal data electronically and by automated means, from what you enter in the sign-up, sign-in, lesson, one-to-one lesson, community, Workshop and contact forms, and from the records created while you use the platform (progress, session and security records). If a teacher opened a class account for you, your name and username come from what the teacher entered. We do not collect data from other sources (for example by buying data or from social networks).

We use cookies that are strictly necessary for your session. They are set as httpOnly, which means code running on the page cannot read them. The login token is valid for about 15 minutes and the token that renews your session for 7 days; both are deleted when you log out.

Apart from these, we only store the choices you make (day or night view, text size, language, your cookie choice, the intro windows you closed) in your own browser; they are not sent to us. We do not use advertising cookies, ad networks or third-party tracking tools.

To see which pages are read and how often, we use a cookieless page counter that keeps no personal data: when a page opens, only its path (e.g. /blog; query strings and ids are removed) is added to that day's count. Your IP address, account, browser or device is not recorded by this counter and nothing is written to your browser, so it does not depend on cookie consent.

The name, purpose and duration of every cookie and browser entry are listed in the Cookie Policy. You can change your choice at any time with the “Cookie settings” link in the footer of every page.

We do not sell your personal data, we do not share it with anyone for advertising, and we show no ads on the platform.

To run the service we work with providers for things like hosting and sending email; these providers process data only on our behalf and on our instructions:

• Vercel (serving the website) and Render (application server and database).
• Anthropic Claude API (AI). Your account details (name, email, school) are not sent to the AI; emails and phone numbers in what you write are hidden. Don’t write personal details about yourself:
  • Preparing and checking the quick facts and mini questions on the site: no user data is sent.
  • Educators’ quiz-draft tool: only the topic, level, difficulty and number of questions are sent.
  • The “I’m stuck” hint helper a student opens on a lesson page: the lesson title and part of its content, the question the student writes and the last few messages of the conversation are sent. Emails and phone numbers in the text are hidden before sending; other details a student types themselves (such as a name or school) are not, so the panel asks students not to write personal details. We don’t store the messages; we only keep a daily usage count. Teachers can turn the helper off for their class.
  • The “Why is it wrong?” explanation in the mistakes notebook: the question, its options, the option the student chose and the correct option are sent. The explanation is stored without being linked to the student, so it can be reused for the same mistake.
• Email sending: we do not send email at the moment and do not work with a provider for this. When verification and password reset emails are switched on, the provider will be named here. [TO BE COMPLETED BY OWNER: email provider]

The video call of a one-to-one lesson takes place outside the platform, in a Google Meet, Zoom, Microsoft Teams, Jitsi or Whereby meeting opened by the educator with their own account. Kuazara does not send your data to these providers, does not join the call and does not record it; when you join, that provider's own privacy terms apply.

Vercel, Render and Anthropic are companies based in the United States, so personal data is transferred outside Turkey. [TO BE COMPLETED BY OWNER: the regions where data is hosted (Render and Vercel region settings) and the legal basis for the transfer under Article 9 of the KVKK (e.g. standard contract notified to the Board).]

Data may be shared with the competent authorities where required by law.

If you take or give one-to-one lessons, the following data is processed:

• Lesson record: the parties, date and time, length and subject area of the lesson; the topic and note written by the learner; request, confirmation, decline, cancellation (including late cancellation) and attendance markers; the educator's note after the lesson.
• Educator details: public name, title and photo; subject areas, availability calendar and time zone; meeting link; the time they accepted the code of conduct and its version.
• Feedback: the 1–5 rating and comment the learner gives after the lesson. Only admins see it; the educator only sees the overall average and distribution once there are at least three ratings.
• Reports: the reason and note of a report. The reporter's identity is never shown to the other party.

The educator sees the learner only by first name and last-name initial (e.g. “Ayşe D.”); username, email, school or age are never shown to the educator. The meeting link is shown to the learner only for a confirmed lesson, from 30 minutes before the start until the end of the lesson. There is no messaging on the platform, and contact details are not accepted in topics and notes.

Purpose: to plan and run the lesson, send notifications to both sides, review abuse and reports, and suspend an educator's offering where necessary. Legal ground: formation and performance of a contract (KVKK Art. 5(2)(c)); legitimate interest (5(2)(f)) and the establishment, exercise or protection of a right (5(2)(e)) for safety, report and audit records.

Retention: lesson records, reports and feedback are kept for as long as your account is open. If your account is deleted, your future lessons are cancelled; your topics and notes, educator notes, links and feedback comments are deleted; the lesson rows remain without any link to your identity (anonymised). [TO BE COMPLETED BY OWNER: Exact retention periods for these records will be added before publication.]

If you open a community profile or share a work, the following data is processed:

• Profile: nickname, profile address, role label (approved educator or team), the rewards you choose, an approved short bio, your badges and the journeys you have completed. Profiles are private by default; you choose to make yours public.
• Works: the numbers you share from a simulation, a title and an optional short description; the number of appreciations it receives. No photos or free-form images are uploaded.
• Appreciations and reports: which works you appreciate; if you report something, the reason and note. Only admins see who made a report.
• Moderation: decisions to put a work under review or hide it, hide a profile, or suspend someone from the community temporarily or permanently. Admin actions are written to the audit log with IDs and status codes only; texts such as work titles or report notes are not written to that log.

Your real name, school, age and location are never shown in the community; your name, username or contact details are not accepted in your nickname or profile address. The gallery, works and profiles are closed to search engines.

Purpose: to show the content you choose to share, keep the community safe and review reports. Legal ground: performance of the service you request (5(2)(c)); legitimate interest (5(2)(f)) for moderation and audit records.

Retention: you can delete your works at any time (their appreciations are deleted too). If your account is deleted, your works are hidden, the appreciations you gave are deleted and your profile is cleared. Report records, the audit log and hidden work records are kept as moderation history. [TO BE COMPLETED BY OWNER: Exact retention periods and the disposal method for these records will be added before publication.]

If you build a circuit, Arduino or experiment project in the Workshop, the following data is processed:

• Project: the project name, an optional description, the project type and its content: the parts and wires in the circuit, the Arduino code or blocks, and the experiment settings (what is measured, sweep and duration). The simulation runs in your browser; measurement results are not stored. No photos or files are uploaded.
• Sharing: who can see the project (“Only me” or “My class”), the class you share it with and, if the project was copied from someone else’s, which project it was copied from.
• Assignment submissions: a copy of the project (name and content) as it was when you submitted it, the time of submission and the short note the teacher writes on the submission.
• Moderation: a project being put under review or hidden, and the reason.

Who can see it? By default a project is visible only to you. If you choose “My class”, the teacher and students in that class can see the project and make their own copy of it; your name is not shown to them, only your community nickname if you have one. Platform-wide sharing (with all users) is not available at the moment. The teacher who set the assignment sees the copy you submit together with your name. Admins can access projects when needed to keep the platform safe.

Protection: the project name, description and code are automatically checked for contact details such as phone numbers, email addresses and street addresses, and for inappropriate words. In a project shared with your class, the name and description are also checked for your real first or last name. A project that is caught by any of these checks is not shown to others and is put under review; only you can see it. The class teacher can hide a project shared with the class. Do not write personal information in your projects.

Purpose: to save your projects, share them with the people you choose, let the teacher see and assess assignments, and keep the Workshop safe. Legal ground: performance of the service you request (5(2)(c)); legitimate interest (5(2)(f)) for checks, moderation and submission records.

Retention: your projects are kept until you delete them or your account is deleted. A copy you submit for an assignment is the teacher’s class record: even if you delete your project, it stays with the teacher until the assignment or the class is deleted. If your account is deleted, the name, description and content of your projects are deleted and the projects can no longer be opened by anyone; submitted copies stay with the teacher until the assignment or the class is deleted, but anonymously rather than under your name, because your name, username and email are deleted.

To protect your account, the following data is processed:

• Sessions: for the session on each device, when it was opened and last seen, only the family name of the browser and operating system (e.g. Chrome, Windows; no version or device model), only a prefix of the IP address (the first three parts for IPv4, the first 48 bits for IPv6; the full IP address is not kept in this record), whether the session was opened with two-step sign-in, and why it was closed. Session tokens are stored as irreversible hashes, not in plain form.
• Known devices: an irreversible hash derived from the browser family, operating system and IP prefix. It is used only for the “new sign-in from a new device” alert.
• Security notifications: in-app notifications for events such as a sign-in from a new device, a password change, two-step verification being turned on or off, or sessions being closed. A new-device notification includes the browser and operating system name and the IP prefix (e.g. 203.0.113.x); notifications are stored separately from session records.
• Two-step verification (optional; required for admins): the authenticator app's secret key (encrypted) and the number of wrong code attempts.
• Passkey (optional): the public key created by your device, the key ID, signature counter, the name you give it, when it was created and last used, whether the key is backed up, the type or model of the authenticator (the AAGUID, which shows which password manager or security key it is) and how it connects (the device itself, USB, NFC, Bluetooth or a phone). The private key never leaves your device; your biometric data never reaches us.

Purpose: to prevent unauthorised access to your account, alert you to suspicious activity, and let you see and close your sessions. Legal ground: performance of a contract (5(2)(c)), our duty to ensure data security (5(2)(ç), KVKK Art. 12) and legitimate interest (5(2)(f)).

Retention: a session ends if it is not used for 7 days. The record of a closed or expired session is deleted 90 days after it was closed or expired. This happens through an automatic clean-up that runs at regular intervals, without waiting for you to sign in. Two-step verification and passkey records are kept until you turn them off or delete them, and known-device hashes for as long as your account is open. IP records kept to limit abuse are short-lived. [TO BE COMPLETED BY OWNER: Exact periods for known-device hashes, security notifications and abuse records will be added before publication.]

Kuazara is open to students from 5th grade upwards; some of our users are under 18. We ask users under 18 to sign up together with a parent or guardian. We process only the data needed to provide the service about children; we show no ads, build no advertising profiles and do not sell data.

Teachers can create student accounts for their classes. These accounts work with a username instead of an email address, and the student sets their own password on first login. In this case the teacher enters the student's name; a last name is not required, and teachers may use a nickname or initials instead of a real name. No email address or Turkish ID number is requested for these accounts.

One-to-one lessons and the community are also open to users under 18, and no separate parental consent is collected for these features. That is why protection comes from the design of the product:

• There is no chat, direct messaging or commenting between users. The only texts in a one-to-one lesson are the short topic and note the learner adds to the lesson and the educator's note after it; they are tied to the lesson record, cannot be replied to and cannot contain contact details.
• In the community only a nickname is shown; real name, school, age and location are not. Profiles are private by default, new users' first works are reviewed before publication, and the gallery and profiles are closed to search engines.
• In a one-to-one lesson the educator sees the learner only by first name and last-name initial. Educators are approved by an admin and accept a code of conduct; contact details are not accepted in lesson notes, the meeting link is visible only around the lesson time, and turning on the camera is never required. We recommend that an adult knows about the lesson.
• Every lesson and every public item can be reported; admins review reports.

A parent or guardian can exercise the rights below on behalf of their child and ask for the account to be deleted. It is enough to write to destek@kuazara.com; we may ask for additional information to verify the link between the request and the child's account.

We keep account details and learning data for as long as your account is open. When you ask for your account to be deleted, we delete or anonymise your data, except for records we are legally required to keep. Retention for one-to-one lessons, the community, the Workshop and account security is described in those sections. [TO BE COMPLETED BY OWNER: Exact retention periods will be added before publication.]

Under Article 11 of the KVKK, you may request to:

• learn whether your personal data is processed and how,
• learn the purpose of processing and whether it is used in line with that purpose,
• know the third parties to whom it is transferred in Turkey or abroad,
• have it corrected if it is incomplete or inaccurate,
• have it deleted or destroyed, and have the parties it was transferred to notified of this,
• object to an outcome against you that results from analysis by automated systems,
• claim compensation if you suffer damage because of unlawful processing.

You can send your request to destek@kuazara.com from your registered email address, or in writing. [TO BE COMPLETED BY OWNER: postal address for written requests and, if any, KEP address.] We reply within 30 days at the latest. For other questions, see the contact page.