Pofu is a play-to-learn app for children and adults; languages today, more subjects later. This policy explains what we collect, why, and your rights.
Data controller: Yunus Kızılay (YK Tech Studios), Türkiye. Contact: [email protected].
The app may be used by children. A profile may have an optional nickname and profile photo; a real name is never required, and the photo never leaves the device — it is not uploaded to our servers. Beyond that we do not ask children for personal information such as an address; account linking, purchases, account deletion and links leaving the app sit behind a parental gate (a 4-digit guide PIN set by the adult). Parents can contact us to view, correct or delete their child's data.
We process data on the following legal bases (GDPR art. 6, KVKK art. 5): performance of the contract, to provide your account and the learning experience; legitimate interest, to keep the service secure, fix faults and improve it; and consent for optional e-mail reports and notifications. You can withdraw consent at any time.
We never sell data or share it with advertisers. To run the service we use these processors: Firebase Authentication (sign-in), Firebase Cloud Messaging (notifications), Resend (transactional e-mails), Sentry (crash and diagnostics reports), Microsoft Clarity (usage recordings in adult mode), RevenueCat (subscription status), OpenAI (AI text processing), Microsoft Azure (pronunciation scoring and text-to-speech), LiveKit (voice call relay) and our hosting provider in Europe. Payments are processed by the App Store / Google Play; your payment details never reach us.
Data is stored on our servers in Europe. Processors such as Firebase, Sentry, Microsoft, OpenAI, RevenueCat and LiveKit may process data outside the EU/Türkiye (for example in the US); such transfers rely on legal safeguards such as standard contractual clauses.
Data is kept while your account exists. Delete your account and all learning data permanently from Settings → Delete account, or write to [email protected]. The push token is deleted when you turn notifications off; diagnostics reports are kept for at most 90 days and server logs for at most 12 months.
You may access, correct, export and delete your data and object to processing (GDPR / KVKK). Requests: [email protected] — we respond within 30 days at the latest. You also have the right to lodge a complaint with the Turkish Personal Data Protection Board or, in the EU, with your local data protection authority.
We update the date above when this policy changes and announce material changes in the app.