1. Summary
SoruX is an AI-native YKS prep platform — Vertex AI generates curriculum-aligned questions on demand and an ELO engine adjusts difficulty per topic. To run the service we process account, learning, AI prompt, photo, text, and usage data. We never share or sell personal data for marketing or advertising, and we do not use your learning data for AI model training.
2. Data we collect
We collect only what’s needed to run the service:
- Account: email and full/display name (if you sign up via email).
- Apple Sign-In and Google Sign-In identifiers (if you use those).
- Profile: avatar, bio/description, class level, target exam type (TYT/AYT/KPSS, etc.), and privacy setting.
- Learning and performance: solve history (questions solved, time spent, correct/wrong counts), subject performance statistics, per-topic ELO scores, and leaderboard XP.
- Device information: operating system and app version.
- Photos in Photo Solve: photos of questions you capture or upload in the Photo Solve feature (processed temporarily).
- IELTS writing practice: texts you write in IELTS writing practice for evaluation and feedback.
- IELTS speaking practice (optional): the speaking card uses your microphone and speech recognition. Your voice is turned into text by your device's or system's speech recognition (on Android, the system's recognition service); the audio itself is never sent to SoruX or stored. Once you confirm, the transcript is sent to Google Gemini (Vertex AI) for feedback and saved in your account as part of your speaking practice history. It is deleted when you delete your account.
- Question-generation prompts: only subject + topic + difficulty metadata — no personal data in the question-generation prompt payload.
- AI-generated content: questions and solutions stored in a user-scoped pool.
- Usage logs and error reports: in-app events (such as sign-in, solving questions, and Photo Solve) recorded and linked to your account, plus crash and error reports (Firebase Crashlytics) that include your user ID.
- Push notification token (Firebase Cloud Messaging).
- Subscription status and purchase receipts (handled via Apple/Google and RevenueCat; your payment details never reach SoruX).
- Local device data (SharedPreferences/MMKV — session, preferences, offline cache).
- Optional uploaded photo for profile avatar (image_picker; avatar only).
- Classroom/teacher mode (if used): class membership, assignment history, and performance statistics visible to your teacher.
3. How we use your data
Your data powers the core service:
- Provide a personalised learning experience: generate, validate and serve questions tailored to your weak topics, explain solutions, and run Photo Solve, AI Coach, and IELTS writing/speaking feedback.
- Performance analysis and progress tracking: maintain your account, profile, subscription, ELO scores, and subject performance statistics.
- Enable teacher-student interaction within the classroom system and optional public profile/leaderboard features.
- Send transactional notifications and study reminders.
- Improve app quality, detect and fix technical issues, and prevent abuse (rate-limiting); in-app event logs and crash reports are never used for advertising.
- Comply with legal obligations.
4. Legal bases (GDPR)
Performance of a contract (Art. 6(1)(b)), legitimate interests (Art. 6(1)(f)), in-app consent for AI features on first use and consent for analytics/notifications where required (Art. 6(1)(a)), and legal obligations (Art. 6(1)(c)).
5. Who we share data with
Your data is never shared with third parties for marketing. Sub-processors and features share data only as follows:
- Google Firebase (Auth, Firestore, Cloud Functions, Storage, App Check, Cloud Messaging, Crashlytics) — secure storage, backend, authentication, sync, notifications, and crash reporting (including your user ID).
- Google (Vertex AI / Gemini API) — processes text and photos sent to AI features (question generation, Photo Solve, solution explanations, IELTS writing and speaking assessment, and AI Coach, which also receives your name and study statistics, never your email address).
- Teachers (Classroom system) — if you join a class, your teacher can view your subject performance data and assignment progress.
- Other users (Public profile and leaderboards) — the name, photo, and bio on your public profile and your XP on leaderboards may be visible to other users; you can set your profile to private and block or report users at any time.
- Apple (Sign in with Apple) — auth provider.
- Google (Sign in with Google) — auth provider.
- RevenueCat — subscription orchestration over Apple/Google billing (your payment card details never reach SoruX).
- Apple App Store (StoreKit) — iOS subscription billing.
- Google Play Billing — Android subscription billing.
- Upstash (Redis REST) — rate-limiting, question-pool index cache, leaderboard cache (anonymized keys, no PII).
- Replicate — optional on-demand AI avatar image generation (user prompt only).
6. AI features, consent, and your data
AI features run only after you give in-app consent on first use; if you decline, all other non-AI features of the app continue to work. What reaches Google’s Vertex AI / Gemini models depends on the feature you use: when generating a question for a topic, we send only subject, topic, and difficulty metadata (without your email, name, or solve history). However, when you use interactive AI features, the content you submit is sent to Gemini: photos in Photo Solve (processed temporarily), texts in IELTS writing practice, speech transcripts in IELTS speaking practice (after your confirmation; raw audio is processed by your device's speech recognition and never sent to SoruX), questions/text for solution explanations, and your messages, name, and study statistics in AI Coach conversations. Generated questions are stored in your user-scoped pool. Vertex AI’s default policy is not to use API content for model training; we rely on this default.
7. Avatar and Photo Solve photos
If you upload a profile photo, it is used only as your account avatar (visible to other users if your profile is public, unless you make your profile private). Photos taken or selected in Photo Solve are processed temporarily via Google Gemini to solve the question. We do not run face recognition or biometric analysis on any photos, and they are never used for AI model training.
8. Children and education data (COPPA)
SoruX is designed for users aged 13 and over preparing for exams (such as YKS, KPSS, and IELTS). Users under 13 must not use SoruX; if we identify an account belonging to a child under 13, we delete it. Children’s data is subject to special protection. Learning data (solve history, ELO scores, performance statistics) is processed solely to personalise the learning experience and, if the student uses the classroom system, to show progress to their teacher; it is never shared with third parties for marketing or sold. Parents or schools can request account deletion at any time via support.
9. Data retention
How long different data lives:
- Account and learning data, and your IELTS speaking history: kept while your account is active and deleted when you delete your account.
- Photo Solve photos: processed temporarily to provide the solution.
- AI-generated questions: kept in your user-scoped pool while your account is active.
- In-app usage logs and crash/error reports (with user ID): retained to improve the app and fix issues while your account is active or per provider defaults.
- Push notification tokens: rotated by the OS and on sign-out.
10. International transfers
Most providers (Google, RevenueCat, Upstash, Apple, Replicate) process data outside Türkiye, including the United States. Transfers rely on appropriate safeguards (Standard Contractual Clauses) and, where required, your explicit consent.
11. Your rights and account deletion
Under GDPR/KVKK you may request access to your data, correction, deletion, restriction, data portability, and objection, and you can close your account at any time. You can also switch your profile to private or block/report users in-app. To exercise your rights:
- In-app account deletion: Settings → Account → Delete account.
- In-app local data wipe: Settings → Privacy → Delete all device data.
- Email: mustafa@mustafaevleksiz.com (we process within 30 days).
12. Security
We use industry-standard security measures: all data is transmitted with SSL/TLS encryption, sign-in is secured through Firebase Authentication and Firebase App Check, data access is controlled by Firestore Security Rules, AI endpoints are rate-limited, and regular security audits are carried out. No method is 100% secure; we cannot guarantee absolute security.
13. Changes
We may update this policy; material changes will be notified in-app or by updating this page’s date.
14. Contact
For privacy questions: Mustafa Evleksiz — mustafa@mustafaevleksiz.com.