Privacy Policy

9.1 Your Rights

If you are located in the EEA or Switzerland, you have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you.
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — request deletion of your data where no legitimate grounds for retention exist.
• Right to restriction of processing — ask us to limit how we use your data in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format. You can export your decks, cards, and study history as JSON directly in the App via Settings → Account → Export My Data.
• Right to object — object to processing based on legitimate interests or for direct marketing.
• Rights related to automated decision-making — we do not make solely automated decisions that produce legal or similarly significant effects.
• Right to withdraw consent — where processing is based on consent (personalised ads, push notifications), you may withdraw at any time without affecting the lawfulness of prior processing.

To exercise any right, email info@zibilyoncode.com with the subject "Privacy Request – Vokado". We will respond within 30 days (extendable to 3 months for complex requests with notice).

9.2 Advertising Consent (IAB TCF)

Before displaying personalised ads to users in the EEA or Switzerland, we present a consent dialog powered by Google's User Messaging Platform (UMP), which is certified under the IAB Europe Transparency and Consent Framework (TCF v2.2).

• You may accept all, reject all, or customise your consent choices per purpose and per vendor.
• Consent is stored locally on your device and transmitted as a TCF consent string to participating vendors.
• You can review or change your choices at any time via Settings → Privacy & Legal → Manage Ad Preferences in the App.
• If you reject personalised ads, you will still see contextual (non-personalised) ads; this does not affect your access to app features.

Advertising vendors and their purposes are listed in the consent dialog. For a full list of IAB TCF registered vendors, see iabeurope.eu/vendor-list.

9.3 Supervisory Authority Complaints

You have the right to lodge a complaint with a supervisory authority:

• EEA users: the data protection authority in your EU member state.
• Swiss users: the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.

We encourage you to contact us first so we can resolve any concern directly.

9.4 United Kingdom

Vokado is not distributed in the United Kingdom app stores and is not made available to UK residents. As we do not direct processing activities at individuals in the UK, UK GDPR does not apply to our processing and no Article 27 UK representative is required. If UK availability changes in the future, this policy will be updated accordingly.

9.5 Legal Bases Summary

10.1 Applicable Laws

We comply with applicable US state privacy laws, including:

• California — CCPA (2018) as amended by CPRA (2020), enforced by the California Privacy Protection Agency (CPPA)
• Colorado — Colorado Privacy Act (CPA, effective July 1 2023)
• Virginia — Consumer Data Protection Act (VCDPA, effective Jan 1 2023)
• Connecticut — Connecticut Data Privacy Act (CTDPA, effective July 1 2023)
• Texas — Texas Data Privacy and Security Act (TDPSA, effective July 1 2024)
• Oregon — Oregon Consumer Privacy Act (OCPA, effective July 1 2024)
• Other enacted state privacy laws as they take effect

10.2 Categories of Personal Information Collected (CCPA)

10.3 Do We "Sell" or "Share" Personal Information?

Under CCPA/CPRA, "selling" includes sharing data for cross-context behavioural advertising. We may share advertising identifiers with Google AdMob for personalised advertising purposes, which may constitute a "sale" or "sharing" under California law.

We do not sell or share the personal information of users who:

• Are under 16 years old.
• Have opted out via the method described in Section 10.4.

We do not sell sensitive personal information.

10.4 Your US Privacy Rights

Depending on your state, you may have some or all of the following rights:

How to Exercise Your Rights

Submit a verifiable consumer request by:

• Email: info@zibilyoncode.com — Subject: "US Privacy Request – Vokado"
• In-app: Settings → Account → Delete Account (for deletion requests)

We will confirm receipt within 10 business days and respond within 45 days (extendable by another 45 days with notice). We will not charge a fee unless the request is manifestly unfounded or excessive.

You may designate an authorised agent to submit requests on your behalf. We will require verification of the agent's authority.

10.5 Opt Out of Sale / Targeted Advertising

To opt out of the sale or sharing of your personal information / targeted advertising:

1. Open Vokado → Settings → Privacy & Legal.
2. Select "Manage Ad Preferences" and deselect personalised advertising.
3. Alternatively, enable "Limit Ad Tracking" or "Opt out of Ads Personalisation" on your device (see Section 7).

Global Privacy Control (GPC): GPC is a web-browser signal; as a native mobile app, Vokado does not receive browser GPC signals. Use the in-app consent settings or device-level controls described above to opt out.

10.6 California "Shine the Light" (Cal. Civ. Code § 1798.83)

California residents may request information about disclosure of personal information to third parties for their direct marketing purposes during the prior calendar year. We do not disclose personal information to third parties for their own direct marketing purposes.

10.7 Appeal Process

If we deny your privacy rights request, you may appeal by emailing info@zibilyoncode.com with the subject "Privacy Rights Appeal – Vokado". We will respond within 45 days. If your appeal is denied, residents of Colorado, Connecticut, Virginia, and Texas may contact their state Attorney General.

11.1 Applicability

Vokado is not established in Türkiye, and Zibilyon Code is not a Turkish-registered legal entity or taxpayer — our controller establishment for GDPR purposes is Poland (EU); see Section 1. Because the App is offered in Turkish and used by residents of Türkiye, we voluntarily extend rights consistent with the Turkish Personal Data Protection Law No. 6698 ("KVKK") to Turkish users, alongside the rights already described in this Policy.

11.2 Your Rights under KVKK Article 11

If you are located in Türkiye, you have the right to:

• Learn whether your personal data is being processed;
• Request information about the processing if your data has been processed;
• Learn the purpose of processing and whether data is used in accordance with that purpose;
• Know the third parties, domestic or foreign, to whom your data is transferred;
• Request correction of incomplete or inaccurate data;
• Request erasure or destruction of data processed in accordance with KVKK and its secondary regulations;
• Request that any correction or erasure be notified to third parties to whom your data was transferred;
• Object to a result that is to your detriment arising from analysis of your data exclusively through automated systems (Vokado does not make such automated decisions — see Section 9.1);
• Claim compensation for damages arising from unlawful processing.

These rights mirror the access, correction, and erasure rights already described in Section 9.1 and can be exercised using the same in-app tools (Settings → Account → Export My Data, Settings → Account → Delete Account) or by emailing info@zibilyoncode.com with the subject line "KVKK Talebi – Vokado". We will respond within 30 days, as required by KVKK Article 13.

11.3 Cross-Border Transfers

As described in Section 5, some data is transferred to processors located outside Türkiye (Google LLC and RevenueCat Inc., USA). Under KVKK Article 9 (as amended by Law No. 7499), such transfers rely on an adequacy decision of the Turkish Personal Data Protection Board, an appropriate safeguard (such as a Board-approved standard contract), or your explicit consent. By creating an account and accepting this Policy, you provide explicit consent to these transfers where required.

11.4 Complaints

We encourage you to contact us first at the address above so we can resolve any concern directly. If unresolved, you may lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurumu) at kvkk.gov.tr.