Privacy Policy

This policy briefly explains what data we process when you use Attendify+ and how we use it. The data controller is Adil Onur Karahan Şahıs Şirketi. Detailed information is provided in the KVKK Privacy Notice and in the Personal Data Protection and Processing Policy.

Guest use

When you use Attendify+ without creating an account (as a guest), your term, course, attendance, event and note data is stored only on your device; it is not sent to the Company’s servers and the Company cannot access this data. When you delete the app, this data is also deleted and cannot be recovered.

Usage statistics

To measure on how many devices and how often the app is used, the app generates a random installation ID when it is first opened and, each time it is opened, sends to our servers, together with this ID, the date, the number of sessions, the platform (Android/iOS), the app version, the language and whether you were logged in that day (also in guest use). This ID is not linked to your account, your email address, your advertising ID or the device’s hardware ID; your IP address is not stored with this record. When you delete the app, the ID is deleted from the device; the records on the server are deleted after 400 days.

Notifications

If you have created an account and allowed notifications, we store your device’s notification token (Firebase Cloud Messaging), the app language and your like/save notification preference so that we can send notifications to your phone. Notifications are sent when a note you shared is liked or saved, about moderation decisions concerning your posts and about replies to your feedback; the notification text (e.g. the post title and the display name of the person who liked it) is transmitted through Google Firebase Cloud Messaging (USA). The token is deleted when you log out or delete your account. You can turn off notifications in your device settings, and like and save notifications in the app’s notification settings.

Data we process when you create an account

• Account information: email address and password (stored in irreversibly hashed form), email verification and password reset records, first and last name (entered at registration or shared by Google or Apple), optional profile photo.
• Sign in with Google or Apple: if you sign in using one of these methods, we receive the email address verified by the provider, your account ID at the provider and, if shared, your first and last name; your password at the provider never reaches us. With Sign in with Apple, the refresh token issued by Apple is stored in encrypted form so that the authorization at Apple can be revoked when you delete your account.
• School information (optional): university and department; the school email address (an address ending in .edu) that you verify to join a community.
• App data: terms, courses, course schedule (day, time, classroom, instructor name), attendance records by class hour, “other” reasons and their subcategories, absence allowances, exams, homework and meetings, lecture notes and the photos, files and voice notes you attach to notes, Pomodoro focus sessions (start, end and duration).
• Explore and community data: notes you publish on Explore and their attachments, your likes, saves and reports (report reason and optional description), the communities you join, and your likes and votes on community announcements.
• Feedback: the subject, message and images of feedback you send from the app or the web panel, together with the platform, app version and language; if you send it as a guest, your optional contact email; if you send it from the web, browser information.
• Device and security data: IP address, request time and server access logs, session keys.
• Advertising data: in the app, the advertising ID, IP address and device information used by Google AdMob and by Meta Audience Network and Unity Ads, which serve ads through AdMob (also in guest use); on the web panel, the advertising cookies placed on your browser by Google AdSense, together with the IP address and browser information.

We do not access location, contacts or similar data. Since no payments are taken, no card information is processed.

What do we use the data for?

To create your account and verify your email address, to store your data and synchronize it across your devices, to apply the storage limit, to send password reset codes, to provide the Explore, community and Pomodoro leaderboard features, to review posts and reports, to answer your feedback, to ensure security and prevent misuse, to fix errors and to display advertisements.

Photos and files

The camera and gallery are used only when you add a photo to a note, choose a profile photo, add an image to feedback or have your course schedule read from a screenshot, and only after your permission has been obtained. The text in the course schedule image is read on your device; the image is not sent to the server for this purpose. If you have created an account, photos you attach to notes are stored on the server in resized and compressed form; in the process, image metadata such as location is removed. Your profile photo and feedback images are likewise stored resized, with their metadata removed.

Microphone and voice notes

The microphone is used only when you start recording a voice note for a note, after your permission has been obtained, and only for the duration of the recording. The recording is attached to the note on your device as an AAC (m4a) audio file; if you cancel, the file is deleted. If you have created an account, the voice note is synchronized to and stored on the server like other note attachments; in guest use, it remains only on your device. When you delete the voice note or the note, or delete your account, the recording is deleted as well.

Focus lock (Android)

If you turn on restriction mode in Pomodoro, the app reads which app is in the foreground, only on your device and with your “Usage access” permission, to detect whether one of the apps you selected is opened during the focus period. This information and the list of apps on your device are not sent to our servers.

Advertising

The app uses Google AdMob to display advertisements personalized to your interests; by using the app, you are deemed to have accepted this. If you do not want this, you may turn off personalized ads, or reset or delete your advertising ID, in your device settings; in that case, non-personalized ads are shown. AdMob may also serve ads in the app from the Meta Audience Network and Unity Ads networks through mediation; these networks receive your advertising ID and information derived from your IP address and device in order to display and measure ads. If you watch a rewarded ad to the end, you earn ad-free time or a PDF download credit. On the web panel used after logging in, advertisements are displayed through Google AdSense; for this purpose, Google may place cookies on your browser. Visitors from the European Economic Area, the United Kingdom and Switzerland are shown Google’s consent window; you may turn off personalized ads at adssettings.google.com or in your browser’s cookie settings. There are no advertisements on the promotional website (the pages seen without logging in). If you have ad-free time or a premium membership, no advertisements are displayed on the web panel either.

Sharing and storage location

We do not sell your data. Your account data is stored on servers in Türkiye. We share it only with providers necessary to provide the service: for verification and password reset emails, your email address and the code sent are processed through Resend (USA); for advertising, your advertising ID, IP address and device information in the app are processed through Google AdMob (USA) and AdMob’s mediation partners Meta Platforms (Meta Audience Network; USA/Ireland) and Unity Technologies (Unity Ads; USA), and advertising cookies, your IP address and your browser information on the web panel are processed through Google AdSense (USA); and for phone notifications, your notification token and the notification text are processed through Google Firebase Cloud Messaging (USA); if you choose to sign in with Google or Apple, sign-in takes place through Google LLC (USA) or Apple Inc. (USA); these instances of sharing constitute transfers abroad. Where required by law, data may be shared with the competent authorities.

Explore, communities and what other users can see

Notes you publish on Explore of your own accord are visible to everyone (including visitors who are not logged in), together with your display name (your first name and the initial of your last name, e.g. “Ayşe D.”), profile photo, university and department, and with their like and save counts; this information, together with your badges and Explore statistics, also appears on your public profile page and on the Explore leaderboard. When you share a note via a share link, the note can be viewed by anyone who has the link. The Pomodoro leaderboard and the lake of a community you are a member of show your display name, profile photo and focus time; you can hide yourself from the leaderboard. When you join a community, the community’s administrator sees your first name, last name, profile photo, the date you joined and, if you have verified a school email address, only its domain (e.g. ege.edu.tr); for likes and votes you give on community announcements, your display name is visible to those who can see the announcement and your full name to the community administrator. Your email addresses are never shown to other users. You may remove your Explore post and your share link and leave a community at any time; apart from these, your data cannot be viewed by other users.

Explore posts and reports are reviewed by our administrators; posts that violate the rules may be hidden or removed, and you are notified of decisions concerning your posts. A post reported by five different users is automatically hidden until the review is completed. Accounts used in violation of the rules may be suspended.

Retention and deletion

We keep your account data for as long as your account is open. You may delete your account instantly from within the app or request its deletion. Retention periods are set out in the Personal Data Retention and Destruction Policy.

Children

Attendify+ is not intended for children under the age of 13; it does not collect age information and does not knowingly collect personal data from children under the age of 13. If we become aware, or are notified, that data belonging to a child under the age of 13 is being processed, we will delete such data without delay. Users under the age of 18 should use the Platform under the supervision of their parents or guardians.

Contact for your rights and requests

We kindly ask that you write “Data Subject Request under the Law on the Protection of Personal Data” in the subject line of the application envelope or email.

*For applications in person, only the front side of a document proving your identity needs to be presented (with the blood type and religion fields not visible).

Your requests will be concluded free of charge within 30 (thirty) days at the latest. If the process additionally requires a cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.