Privacy Policy

When you register an account, we collect your email address, display name, and authentication identifiers through Google Firebase Authentication. If you authenticate using Google Sign-In, Firebase receives your basic profile information (such as your public avatar and verified email address). We use this information solely to identify your account, secure your sessions, and communicate vital service updates.

To power our spaced repetition system (SM-2 algorithm), curriculum tracks, and practice drills, we store learning metrics. This includes review schedules, ease factors, repetition counts, interval histories, quiz scores, daily streak records, custom vocabulary decks, and personal grammar notes you create.

When you set up your account, you can tell us how much Turkish you know, where you want to start and, if you choose, why you are learning. We use these answers to set your starting level, pick your first words and suggest a tutor conversation.

When you submit questions or conversational prompts to the AI Tutor, your input is sent to OpenAI for real-time contextual evaluation and grammatical feedback. Your prompts are not used to train OpenAI models or ours. OpenAI retains API inputs and outputs for a limited period (currently up to 30 days) solely for abuse and misuse monitoring, after which they are deleted. We save each tutor conversation to your account (your messages, the tutor’s replies, and corrections) so you can resume and review it, and it is kept until your account is deleted. When you listen to Turkish pronunciation audio, the text is processed through Google Cloud Text-to-Speech (Chirp 3: HD).

We collect essential technical telemetry necessary to operate and secure the platform. This includes your IP address, browser type, operating system, preferred interface locale (English, Arabic or Russian), referring URLs, session timestamps, and client error logs.

When you purchase a paid subscription, your payment is processed by Lemon Squeezy, our Merchant of Record, which is PCI-DSS compliant. Dilsever does not store, collect, or have access to full card numbers or banking credentials. Lemon Squeezy notifies us when your subscription changes. Those notifications include your name, email address, and card brand and last four digits, which we discard: we keep only your subscription and customer identifiers, plan, status, and renewal and end dates.

Purpose: User authentication, cloud database storage (Firestore), and secure media hosting. Data is hosted in secure Google Cloud data centers with encryption at rest and in transit.

Purpose: Next.js edge application hosting, global content delivery network (CDN), serverless compute execution, and privacy-preserving web analytics.

Purpose: Powering the interactive AI Tutor, contextual sentence generation, and morphological grammar explanations. API inputs and outputs are not used for model training, and are retained by OpenAI for a limited abuse-monitoring window (currently up to 30 days) before deletion.

Purpose: High-fidelity Turkish speech synthesis via Google Cloud Text-to-Speech (Neural Chirp 3: HD models).

Purpose: Payment processing, subscription lifecycle management, sales tax and VAT calculation, and automated invoice delivery. Lemon Squeezy acts as the Merchant of Record for all Dilsever purchases, which means it is the seller of record on your receipt and is responsible for collecting and remitting applicable taxes. Lemon Squeezy collects your payment and billing details on its own checkout page and is responsible for them as the seller, under its own privacy policy at lemonsqueezy.com/privacy.

Purpose: Delivery of transactional authentication emails, verification links, and password reset notifications. These are currently sent by Google Firebase Authentication. If we move transactional email to a dedicated provider, this policy will be updated to name it before the change takes effect.

Purpose: Delivery of support and operations messages to a private staff channel. When you submit our contact form, or a cancellation or withdrawal request on our cancel page, the content of your message, together with the email address you supply, the name and order number on a withdrawal request and, if you are signed in, your account identifier, is delivered to that channel so we can read and answer it. Telegram processes that message in transit and stores it in the channel history. Do not include sensitive personal information in a contact form message.

Purpose: Error monitoring, so we learn when part of Dilsever fails and can fix it. When an error occurs, the report sent to Sentry contains the technical details of the error, your browser and operating system, the page path without its query string, the app version, your approximate country, worked out from your connection, and, if you are signed in, the first eight characters of your account identifier. It contains no name, email address, cookies, form or message text, or AI Tutor conversations, and we configure Sentry not to store IP addresses. Reports are stored in Sentry’s European Union data region.

To exercise any of these rights, or to request permanent deletion of your Dilsever account and all associated study data, please submit a request through our Contact form at /contact or email support@dilsever.com with the subject line "Privacy Data Request". We will verify your identity and process your request within thirty (30) calendar days at no charge.

Sign-in session (IndexedDB, firebaseLocalStorageDb): kept by Google Firebase Authentication so you stay signed in between visits. It holds a session only after you sign in, and signing out clears it.

Firebase heartbeat (IndexedDB, firebase-heartbeat-database): written by the Firebase software library to record the dates it ran and which Firebase components and versions are in use. It holds no personal identifier, and Firebase attaches this summary to the requests the app sends to Google Firebase.

Interface language (localStorage, dilsever.locale): remembers which interface language you chose, so pages open in that language.

Tutor notice (localStorage, dilsever.tutor.helpMeSayCostSeen): remembers that you have seen the note explaining that a translation in the AI Tutor uses an AI request, so the note is not shown again.

Screen hand-offs (sessionStorage, dilsever.deck.session, dilsever.tutor.lastCompletion, dilsever.postAuthPath and dilsever.signupFrom): carry a generated deck, a finished tutor conversation, the page you were heading for before signing in, or the kind of page that sent you to sign up to the next screen. Your browser deletes session storage when you close the tab.

We count page views and two anonymous steps of signing up (opening the Create account form, and creating an account) with Vercel Web Analytics, and measure how quickly pages load on real devices with Vercel Speed Insights. Neither sets a cookie or stores anything in your browser. Web Analytics tells visits apart using a hash of the incoming request, which Vercel discards after 24 hours.

The data is used only for aggregate statistics and is not linked to your account: the page and its route, the referring site, filtered query parameters, approximate location (country, region, and city), browser, operating system, device type, network speed, and page speed measurements. For the sign-up steps it also includes the kind of page you came from (such as a blog post or a lesson) and your interface language, and never your email address or account ID.

If something in the app fails, your browser sends an error report to dilsever.com/monitoring, which passes it on to Sentry (section 4). Sentry sets no cookie, stores nothing in your browser, and makes no recording or replay of your session. Section 4 lists what a report contains.

On phones and in Safari, Firebase Authentication loads a sign-in helper from Google (apis.google.com and our sign-in domain on firebaseapp.com) as soon as a page opens, so that signing in with Google is not blocked when you choose it. In other browsers the helper loads only when you sign in. As with any web request, Google receives your IP address and browser details, and the Google sign-in window follows Google’s own privacy policy.

Payment takes place on a checkout page hosted by Lemon Squeezy, which applies its own privacy and cookie policies there. If you signed in with Google, your profile picture loads from Google servers, and some pronunciation audio and lesson videos load from Google Firebase Storage.

You can clear this storage at any time in your browser settings. Doing so signs you out on that browser and resets your language choice; your account and learning records are not affected. Blocking the analytics scripts does not change how Dilsever works.