Tensely Privacy Policy

Effective date: 1 August 2026 Data controller: TenseMaster Academy Contact: info@tensemasteracademy.com

This policy explains which personal data the Tensely mobile application (the “App”) processes, for what purpose and how. It is written to meet the requirements of Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the privacy policy requirements of the Apple App Store and Google Play.

1. Personal Data We Process

1.1 Identity and contact

Email address
Name (optional)
The unique user identifier shared by Apple or Google when you sign in with them
Password (stored only as a hash on Supabase; Tensely cannot read it)

1.2 Learning data

Chosen level and target proficiency
Daily study goal in minutes
Completed lessons, exercises attempted and their results
Mastery scores and streak tracking
Error analysis records (patterns in wrong answers)

1.3 Device and technical data

Device type and model
Operating system version
App version
Push notification token (only if you granted permission)

The app contains no crash reporting or analytics tool. If you have opted in, the App Store and Google Play may collect anonymous crash data through their own infrastructure; that data is subject to Apple’s and Google’s own policies and never reaches us tied to your identity.

1.4 Microphone and speech recognition

In speaking exercises we use the microphone so we can show you whether the English sentence you said matches the expected one.

The microphone opens only when you press the record button in a speaking exercise. There is no background listening.
Your speech is transcribed by your operating system’s own speech recognition service (iOS Speech, Android SpeechRecognizer). These services may perform recognition on the device or on Apple’s and Google’s servers; your operating system decides which. That processing is subject to Apple’s and Google’s own privacy policies.
The audio never reaches Tensely’s servers. We neither record nor store it, and the transcribed text is discarded when the exercise ends.
All that reaches Tensely is whether you completed the exercise correctly.
You may refuse the permission. Speaking exercises are then skipped and the rest of the lesson works normally.

1.5 Subscription and payment

Subscription status (active / cancelled / expired)
Subscription type (monthly / yearly)
Purchase dates
Payment details (card number, bank information and the like) are held by Apple and Google. Tensely neither accesses nor stores them.

1.6 What we do not collect

We do not collect any of the following:

Advertising identifiers (IDFA / GAID)
Location data (GPS)
Address book, photos, messages
Camera access
Audio recordings (the microphone is used only for real-time speech recognition — see 1.4)
Health data
Financial information (card details and the like)
Browsing history

2. Purposes of Processing

Your personal data is processed only for the following purposes:

Providing a personalised learning experience and recording your progress
Account creation, sign-in and authentication
Synchronising data across your devices
Sending notifications and reminders (only if you granted permission)
Subscription management
Debugging, security and performance improvement
Responding to support requests
Meeting legal obligations

Your data is not used for advertising, profiling or third-party marketing.

3. Legal Basis (KVKK Art. 5)

Performance of a contract (Art. 5/2/c): managing your account and providing the service
Legal obligation (Art. 5/2/ç): invoicing, financial records, consumer protection legislation
Legitimate interest (Art. 5/2/f): debugging, security, fraud prevention
Explicit consent (Art. 5/1): push notification preferences

4. Data Transfers

Your data is shared with the following service providers, each acting under its own privacy policy:

Provider	Purpose	Region
Supabase (on AWS infrastructure)	Database, authentication	Frankfurt, Germany (EU)
Apple Push Notification Service	iOS notification delivery	Apple infrastructure
Google Firebase Cloud Messaging	Android notification delivery	Google infrastructure
RevenueCat	Subscription validation and management	United States
Apple App Store / Google Play	Payment processing	Apple / Google infrastructure

Where transfers abroad are involved, the safeguards required by KVKK Art. 9 (standard contractual clauses) are in place.

We do not sell your data and we do not share it with advertisers.

5. Retention

Learning records: for as long as the account is active
After a deletion request: all your personal data is deleted or anonymised within 30 days at the latest
Data that must be retained by law (invoices and the like): for the period the legislation requires (5 years under Art. 253 of the Turkish Tax Procedure Law)

6. Your Rights Under KVKK

Under KVKK Art. 11 you have the right to:

Learn whether your personal data is being processed
Request information if it has been processed
Learn the purpose of processing and whether the data is used accordingly
Know the third parties to whom your data has been transferred, at home or abroad
Request correction if your data has been processed incompletely or inaccurately
Request deletion or destruction under the conditions set out in KVKK Art. 7
Object to an adverse outcome reached solely through automated analysis
Claim compensation if you suffer damage due to unlawful processing

To exercise these rights: info@tensemasteracademy.com

We answer requests free of charge within 30 days at the latest.

7. Children’s Privacy

Tensely is an educational app for school-age learners. Parental consent is required for users under 13.

The sign-up screen states that accounts for users under 13 must be created with parental consent
We do not knowingly collect personal data from children without parental consent
Parents may request deletion of their child’s data through the contact address above
The app carries no advertising; no targeted advertising is shown

Account management through Apple Family Sharing is supported.

8. Security

All communication is encrypted over HTTPS/TLS 1.2+
Passwords are hashed with bcrypt and never stored in plain text
Payment details never reach Tensely’s servers (they are processed by Apple and Google)
Personal data is protected by Supabase Row-Level Security policies — each user can reach only their own data
Subscription status is managed server-side (RevenueCat webhook) and cannot be altered by the user

Even so, no method of transmission over the internet can be guaranteed to be perfectly secure. If you become aware of any security incident, please tell us immediately.

9. Changes to This Policy

If we change this policy we will:

Update the effective date
Show an in-app notice for significant changes
Email account holders

Continuing to use the App after a change means you accept the updated policy.

10. Contact

For any question about this policy or your personal data:

TenseMaster Academy Email: info@tensemasteracademy.com

11. Deleting Your Account and Your Data

You can delete your account in two ways.

From inside the app: open Profile → Delete my account in Tensely. Your account is deleted after two confirmation screens.

By email: if you cannot reach the app, send a deletion request to info@tensemasteracademy.com from the email address registered to your account. We complete such requests free of charge within 30 days at the latest.

Deletion removes:

Your account details (email address, name, user identifier)
Your learning records (completed lessons, mastery scores, streak, error analysis)
Your notification preferences and push notification token
Your subscription history is anonymised on Tensely’s side

What is not deleted: invoices and financial records that must be retained for 5 years under Art. 253 of the Turkish Tax Procedure Law, and the purchase records held by Apple and Google. To cancel your subscription you must also use your App Store or Google Play subscription settings — deleting your account does not cancel the subscription by itself.

This policy was originally written in Turkish. In case of any discrepancy, the Turkish version prevails.