Privacy Policy

1. What does this policy cover?

This Privacy Policy explains how TestDaş (testdas.com) collects, uses, stores, and shares your personal data. For the disclosure text under Turkish Law No. 6698 on the Protection of Personal Data (KVKK), see also the Privacy Notice (KVKK).

By using the Platform or creating an account, you acknowledge that you have read this policy. The Terms of Use also apply.

2. Data we collect

2.1. Account and identity

• Email address, username, profile image (if any)
• Authentication data (password hashes or basic account information provided via Google OAuth)
• Account role (e.g. user / admin) and credit balance

2.2. App and test data

• Metadata for apps you list (title, package name / store identifier, platform, icon URL, test link, Google Group settings, target testers / duration, status)
• Test records (participation, progress days, status: active / completed / dropped)
• Feedback and rating content

2.3. Proof and security telemetry

• Daily screenshots you upload (stored in Supabase Storage)
• Review status, OCR-extracted text summary / match result (for app name–package verification)
• IP address and User-Agent at request time (multi-account / abuse detection)

2.4. Payment and transaction records

• Credit purchase orders, amount, status; payment provider references (e.g. Iyzico token / payment id)
• Sensitive payment data such as card numbers is not stored on TestDaş servers; it is processed at the payment institution
• Credit movements (earn, spend, block / penalty records)

2.5. Communication and technical logs

• Notification / reminder emails (e.g. daily proof reminder) and email delivery records
• Error, security, and performance logs; cookies / session identifiers

3. Why we use the data

• Account creation, authentication, and session management
• Closed-test matching, quota tracking, and credit accounting
• Verifying daily proofs and preventing fraud / “install-delete” behavior
• Processing payments and invoice / accounting records
• Service notifications, security alerts, and responding to support requests
• Product improvement, statistics (as aggregated / anonymous as possible), and fulfilling legal obligations

4. Legal bases (summary)

Our processing activities rely on contract formation and performance, legitimate interest (security, abuse prevention, service improvement), consent where required, and obligations arising from law. For detailed classification, see the Privacy Notice (KVKK).

5. Sharing and subprocessors

We do not sell your data. Sharing may occur in the following categories to provide the service:

• Infrastructure: Supabase (authentication, database, file storage) — data may be hosted in regions offered by the provider
• Payments: Iyzico or similar authorized payment institutions
• Email: Transactional notifications via Resend or similar processors
• Other users: App information visible in the pool; limited profile / progress information needed to run the test process
• Mandatory authorities: Competent public bodies where required by law

Your email address appearing in the Google ecosystem on Google Group / Play Console is a natural result of your store and group settings; those processes are subject to Google’s own policies.

6. International transfers

Our cloud and SaaS providers’ servers may be outside Türkiye. In that case we act in compliance with KVKK cross-border transfer provisions (appropriate safeguards, contractual commitments, and/or consent where required).

7. Retention periods

• Account data: for the membership period; after closure, for legal obligations and dispute periods
• Proof images and review records: test process plus a reasonable audit / appeal period; then deletion or anonymization
• Payment and accounting records: periods set in applicable financial / commercial legislation
• Security logs (IP, User-Agent): limited period for abuse investigation

8. Security

Access control (RLS), encrypted connections (HTTPS), role-based admin access, and provider security measures are applied. No system is 100% secure; if you notice anything suspicious, write to [email protected].

9. Cookies and similar technologies

Cookies / local storage necessary for session management and security are used. If analytics cookies are used, notice and a preference mechanism will be provided where required.

10. Your rights

Under KVKK Art. 11 you have rights including learning whether your data is processed, requesting information, correction, deletion / destruction, objection, and complaint. You may submit requests via [email protected]. For details, see the Privacy Notice (KVKK).

11. Children

The service is generally aimed at adult users. We do not knowingly collect data from anyone under 18; if we become aware, we will close the relevant account.

12. Changes

We may update this policy. The “Last updated” date at the top of the page applies. Additional notice may be given for material changes.

13. Contact

Privacy questions: [email protected] · testdas.com