Legal

Privacy

DRAFT

This text is a working draft. The final version will be published before launch, after legal review.

This policy explains which personal data we collect when you use Eliminary, why we collect it, who we share it with, how long we keep it, and the rights you have over it.

In short: we do not sell your data, we do not use it for advertising, and we use no advertising or tracking cookies. You can download your data from settings (what the file covers is set out below), and you can ask for your account to be deleted at any time.

Text in square brackets marks a legal choice that is not final yet; it will be settled after legal review.

1.Data controller and contact

The data controller for personal data processed in Eliminary is Özgür Cem Kaya [legal title and postal address to be added].

For any question or request about this policy or your data: ozgurcemkaya5@gmail.com

2.The data we collect

We collect only what the product needs in order to work.

Account details: Your email address, your password (stored as a hash, never in plain text), your display name (it does not have to be your real name) and your date of birth. Your date of birth is stored on your profile; it is used for the minimum-age check and, at sign-up, to write your age band (13–17 or 18+) to a usage record.
Sign in with Google: If you sign in with Google, instead of a password we receive your name, your email address and the account identifier Google gives us from your Google account; your Google name is saved as your display name. [Whether the profile photo address is also received will be confirmed.]
Consent records: The version of the Terms of Use you accepted and when; whether you opted in to product news by email (an optional box).
Profile and preferences: Your first and last name if you enter them, the preset avatar you pick, your target exam and exam date, the time you can give to studying, and your theme, language, time zone and notification choices.
Your study data: The answers you give in practice, in the diagnostic and in practice tests; the choices you cross out, the text you highlight, your scratch notes and the questions you flag in tests; your mastery record and its history; your plans and study blocks; study you declare outside Eliminary; your highlights and notes; your saved items; your mistake list; your watch and read progress; your test scores and score projections.
ATLAS: What you write to ATLAS and what ATLAS replies; the structured memory entries ATLAS keeps about you (goal, preference, constraint, skills you struggle with or have advanced in). Health, mood, family and personal events are never written to memory.
Notebook: The notebooks you create, the text you paste into them, your notes and the messages in notebook chat.
Devices and sessions: The type of browser and operating system you sign in with, an approximate city- and country-level location, first and last use times, and a device identifier. Your raw IP address is not kept in the device record. The authentication service, however, keeps your IP address and your browser's user-agent string in its own session record for each session.
Usage records: Event records that measure how the product is used: the event name, its time, the app version and a short event-specific payload. They are linked to your account if you are signed in, and otherwise only to a temporary identifier that lives in that browser tab.
Trying without an account: If you try the diagnostic without an account, your answers stay in your browser and move to your account when you sign up. To limit abuse we keep a keyed hash of your IP address for a short time; the raw IP address is not stored.
Problems you report: If you report an error in a question or a piece of content, the content of your report.

We collect no payment details: Eliminary is free during the beta and the product has no payment step.

We do not ask you for special categories of personal data such as health, religion or biometric data. We recommend that you do not write such information, or other people's personal data, to ATLAS or into your notebook.

3.Why we use your data

To open your account, verify your identity and keep your account secure.
To build your study plan, calculate your mastery and progress, pick what you study next, and produce your test results and score projection.
To generate replies for you in ATLAS and in notebook chat.
To send the emails your account requires (email confirmation, password reset).
To measure the product, find errors and improve it.
To prevent abuse and bot traffic.
To meet legal obligations and answer your requests.

We do not use your data for advertising, we do not sell it, and we do not hand it to third parties for marketing.

Eliminary sends no notifications or marketing email today; your notification choices are only saved to your account. [If product news starts being sent, it will go only to people who gave the separate opt-in, and the opt-in can be withdrawn from every email.]

4.Artificial intelligence: ATLAS and notebook chat

ATLAS and notebook chat use Anthropic's language models. When you write a message, it is sent to Anthropic together with the context needed to answer it (for example your plan, your mastery state, or the relevant passages of your notebook sources).

Even when you do not write a message, a summary of your study is sent to Anthropic in three places: while ATLAS is on, when you open your dashboard, for the day's closing note and the weekly analysis; and when you open the plan setup screen, for the explanation of your plan. What is sent is numbers and names: completed and planned block counts, your study minutes, your mastery changes, your plan's coverage, the number of diagnostic questions and correct answers, and the names of skills, subject areas and tasks. The free text you write is not sent in these calls.

Your text is passed to the model inside a delimited data block, not as instructions; the model's reply is checked on our server before it is shown to you.

We do not use your data to train models. [That Anthropic does not use this data for model training either will be confirmed from the provider agreement and stated here.]

Your score projection, your mastery and your plan are produced by rule-based engines, not by AI. You can turn ATLAS off in settings; your plan and your progress measurement keep working exactly as before.

You can see, correct or delete every entry ATLAS keeps about you, or clear the whole memory, under Settings › ATLAS.

5.Safety signals

Every message you write to ATLAS or in notebook chat goes through a safety screen before a reply is generated. If a message carries a signal such as self-harm, abuse or acute distress, the chat stops and you are shown support resources.

In that case we record only the type of signal, its time and the screen it came from; the text you wrote is not copied into that record and is not written to ATLAS memory. Only authorised staff can access the record.

This screen is not a diagnosis and does not replace emergency help. [Whether this record is special-category data, and its legal basis, will be settled in legal review.]

7.International transfers

Your data is processed outside Türkiye: the database is in Germany. [The countries in which the other providers process your data will be confirmed from the provider agreements and stated here.]

[The legal basis for transfers abroad (KVKK Art. 9: standard contract, undertaking, explicit consent or another route) will be settled in legal review.]

8.How long we keep it

Account, profile and study data: for as long as your account is open.
Device records: a record unused for 90 days is deleted the next time you sign in.
The IP hash from use without an account: for short counting windows.
ATLAS conversations: 24 months.
ATLAS memory: an entry that is not verified for 180 days is deleted.
[Usage events: 13 months.]
[Audit trail: 24 months.]
Deletion requests: processed within 30 days at the latest (below).

[The two periods in square brackets are targets; they become final once the automatic job that deletes usage events and the audit trail is in place.]

9.Deleting your account

You can ask for your account to be deleted from Settings. We do not ask why and it costs nothing; you confirm the request with your password.

The request stays open for 30 days. During that time your account is read-only: you can read and review your content, but new work is not saved.
You can cancel the request from Settings at any point in those 30 days. Once cancelled, your account works as before; nothing of yours is deleted while the request is open.
Deletion requests are processed within 30 days at the latest: at the end of that period your personal data is permanently deleted.
Two things remain after deletion: figures that carry no name and cannot be traced back to you, and the audit trail of staff access to student data. There are no invoices or payment records to keep.

10.Your rights and how to use them

You can exercise most of your rights inside the product, without waiting:

Access and portability: Under Settings › Your data you can download your profile, your answers, your mastery and plan records, your notes, your saved items, your watch and read progress, your ATLAS and notebook records and your scores as a single JSON file. The source texts you paste into a notebook are listed in the file but their content is not included; your device, usage and consent records, your error reports, and ATLAS's closing notes and weekly analyses are not in the file either. Write to us for any data the file does not contain.
Correction: You can change your name, avatar, target exam and preferences on the profile and settings screens.
ATLAS memory: You can correct or delete entries one by one, or clear the whole memory.
Deletion: You can ask for your account to be deleted from Settings.
Sessions: You can see the devices signed in to your account and sign them out one by one or all at once.

For any request you cannot make inside the product, write to ozgurcemkaya5@gmail.com. We answer within 30 days at the latest.

If you are in Türkiye, your rights under Article 11 of the KVKK are listed in the notice below. [If you are in the European Union, your rights under the GDPR also apply; the scope will be settled in legal review.]

11.Cookies and browser storage

We use only the cookies the product needs in order to work. We use no advertising cookies, no third-party tracking cookies and no third-party analytics tools.

Cookies starting with sb-, el_session_only: Remember that you are signed in; if “remember me” is off they end when the browser closes.
el_device_id: Recognises your entry in the device list; 90 days.
ui-lang, ui-theme: Your language and theme choice.
el_tz: Your time zone, so your days are calculated correctly.
el_pending_email: The address your confirmation email went to during sign-up; 30 minutes.
el_recovery: A marker for the password reset step; 15 minutes.
el_notice: A short notice shown when a device is signed out; a few seconds.
el_u13: A marker set after a sign-up attempt that did not meet the age requirement; 30 days.
eliminary_safety_mode: Stays for the browser session once the safety flow has opened.

Your browser's own storage (session storage and IndexedDB) also holds: your answers from a diagnostic taken without an account, the state of your tools during a test, answer drafts that have not been sent yet, and a temporary per-tab identifier for usage events.

The Cloudflare Turnstile widget on the sign-up and sign-in forms, and embedded videos, load from their own domains. [These services' own use of cookies will be confirmed and stated here.]

12.Security

In the database every user's data is separated by row-level access rules: one account cannot read another account's data. Your password is stored as a hash; connections are encrypted.

No system is completely secure. [In the event of a data breach we will inform the relevant authority and the affected users within the statutory time limits.]

13.Age

You must be at least 13 years old to use Eliminary. Sign-up by anyone under 13 is not completed and the information entered is not kept.

[Whether processing the data of users under 18 requires the consent of a parent or guardian, and how it would be obtained, will be settled in legal review.]

14.Changes to this policy

When we update this policy we publish the new version on this page. For an important change we will tell you [by email or inside the product] before it takes effect.

[Effective date to be set.]

KVKK notice

This notice is given by the data controller under Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK). The details are in the privacy policy above; the two are read together. [If the Turkish and English texts differ, the Turkish text prevails.]

1.Data controller

Data controller: Özgür Cem Kaya [legal title, postal address and VERBİS registration, if any, to be added].

Contact: ozgurcemkaya5@gmail.com

2.Personal data processed

Identity: Display name; first and last name if entered; date of birth; the Google account identifier if you sign in with Google.
Contact: Email address.
Account and transaction security: Password hash, session and device records, the session's IP address and browser user-agent string, approximate city- and country-level location, bot verification, and a hash of the IP address for use without an account.
Learning data: Answers, mastery record, study plan, test scores and score projections, highlights, notes, saved items, watch and read progress.
User content: ATLAS and notebook messages, ATLAS memory entries, text pasted into notebooks, content error reports.
Usage data: In-product event records, preference and cookie records.
Consent records: Acceptance of the Terms of Use and the product news opt-in.

3.Purposes of processing

Setting up membership and providing the service.
Preparing a personal study plan, measuring mastery and progress, and producing test results and the score projection.
Providing AI-assisted help (ATLAS, notebook chat).
Keeping accounts secure and preventing abuse and bot traffic.
Measuring the service, fixing errors and improving the service.
Sending the informational emails an account requires.
Meeting legal obligations and answering applications.
[Sending product news to those who gave the separate opt-in.]

4.Method of collection and legal basis

Your personal data is collected electronically and by fully automated means, through the sign-up and profile forms, your Google account if you sign in with Google, the actions you take while using the product, what you write to ATLAS and into your notebook, cookies and server records.

Establishment and performance of a contract (Art. 5/2-c): Account, study data, plan, mastery, tests, ATLAS and the notebook.
Legitimate interest (Art. 5/2-f): Account security, prevention of abuse, measuring and improving the service.
Legal obligation (Art. 5/2-ç): Meeting legal requests and applications.
Explicit consent (Art. 5/1): The email opt-in for product news. You can withdraw it at any time.

[This mapping is a draft. The legal basis of each processing activity, parental or guardian consent for users under 18, and the special-category data assessment (Art. 6) will be finalised in legal review.]

5.Who the data is transferred to, and why

Limited to the purposes above, your personal data is transferred to the following data processors we use: Supabase (database and authentication; Germany), Vercel (hosting), Anthropic (artificial intelligence), Resend (email delivery) and Cloudflare (bot protection and file storage).

Your data is processed abroad (the database is in Germany); the transfer is made under Article 9 of the KVKK. [The other providers' processing locations, the basis of the transfer (standard contract, undertaking, explicit consent or another route) and the duty to notify the Board will be settled.]

Within Türkiye, data may be transferred to competent public authorities only where the law requires it.

6.Your rights under Article 11 of the KVKK

To learn whether your personal data is processed.
To request information about it if it has been processed.
To learn the purpose of the processing and whether the data is used in line with that purpose.
To know the third parties, in Türkiye or abroad, to whom the data is transferred.
To request correction if the data is incomplete or inaccurate.
To request erasure or destruction under the conditions set out in the law.
To request that correction and erasure be notified to the third parties to whom the data was transferred.
To object to a result against you that arises from the data being analysed solely by automated systems.
To claim compensation if you suffer damage because the data was processed unlawfully.

7.How to apply

You can send your requests by email to ozgurcemkaya5@gmail.com [a postal address for written applications and the identity verification method to be added].

Your application is concluded free of charge within 30 days at the latest. [If the request involves a separate cost, the fee in the tariff set by the Board may be charged.]

If you find the answer insufficient, or receive no answer in time, you can lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).