Okuma Adası (Reading Island) — Privacy Policy

DRAFT — do not publish before legal review, filling in the bracketed parts and removing the [lawyer: …] notes. Source: okuma-adasi repo docs/legal/privacy-policy-en.md.

Data controller

Gamini Games — [legal name, address, registration/tax no], email: [[email protected]]. In the app: Parent area → Support.

What the app does and does not do

Okuma Adası offers reading practice through games for children aged 6–10 who find reading difficult. The app supports reading; it is not a diagnostic tool or a health service. There are no ads in the app. There is no third-party software that shows ads or tracks behaviour.

What data is processed, and where

Only on this device, encrypted:

Child's nickname, age group, the letter group learned at school, daily time limit — Showing content suited to the child and to the order taught at school
Game attempts: which game and content, correct/with hint/incorrect, number of hints, response time, date — Adapting difficulty to the child, review planning, the parent summary
Reading settings (font, spacing, colours), rewards and island decorations, content the child flagged — Personalisation
A screenshot of the game screen at the moment of flagging (reduced in size; the game screen does not show the child's name) — So the parent can attach it to a support request if they wish. Only on the device, encrypted; deleted when the flag is removed or after 30 days
The device's audio latency measurement — Accurate feedback in the rhythm game
Premium purchase information: product, store transaction ID, purchase and expiry date (payment happens in the store; card details never reach the app) — Keeping Premium active, restoring purchases
Reading-aloud and rapid-naming recordings (the child reading aloud or naming colours/letters aloud; only if the parent separately turns this on; off by default) — So the parent can listen and mark mistakes. Only on the device, encrypted; never sent anywhere; deleted automatically after 90 days; all deleted when the feature is turned off

This data is not sent from the device. A real name is not needed; a nickname is enough.

To the server (gaminigames.net), only if the parent opens a support request:

Request type, the parent's description, messages with the team — Support and fixing bugs/content
Optional email address — Notifications of replies, "fix released" and request access links (the email contains only the request number and a short note; nothing about the child)
Technical context: app version, device model, operating system, last mini-game played, level, related content ID (e.g. the word "kalem") — Reproducing the problem
A random device token (the server keeps only its hash) — So the request can be seen only from this device
If the parent turns the child's flag into a request and does not remove it: the screenshot taken at the moment of flagging (re-encoded on the server, file information such as location removed; seen only by the support team) — Seeing the problem

The child's name, recordings or measurements are never added to a support request. Parents are asked not to write the child's personal information in the description.

Web support page (gaminigames.net/support), only if the parent uses it: A parent who cannot use the app can open a request on this page: game, topic, description and email address (required; follow-up happens by email). To view the request, a one-time link is emailed (valid for 24 hours); when the link is opened, a strictly necessary session cookie, used only for this purpose and lasting 7 days, is set for that request. Only hashes of the link and session are kept on the server and they are deleted when they expire. To limit abuse, IP addresses are not stored; they are only counted briefly in memory. Web requests are kept for the same period as app requests.

To the server, only if the parent turns on "anonymous weekly totals" (off by default):

Once a week, totals per content item: content ID (e.g. the word "kalem"), skill, level, number of attempts, total of correct/with-hint scores (only rows with at least 5 attempts); number of rounds left unfinished per game and level — Finding and fixing content that children find hard
App and content version, week number (e.g. 2026-W42) — Evaluating the data against the right version

Not sent: the child's name or nickname, device or personal identifiers, response times, day and time, recordings. Totals of several children on this device are combined before sending. The server does not store IP addresses for these submissions; to limit abuse it keeps them only in memory for at most 24 hours. Submissions are not stored individually; they are added to the weekly total of all devices and deleted after 26 weeks. The option can be turned off at any time; sending stops when it is off.

Legal basis

The child's game data on the device: explicit parental consent (KVKK art. 5/1) [lawyer: assess art. 6 — could reading-difficulty information count as health data; the app does not ask for diagnosis information].
Support requests: providing the service and answering the request [lawyer: art. 5/2-c / legitimate interest].
Anonymous weekly totals: an option the parent turns on separately (optional consent) [lawyer: assess whether aggregated, non-identifying data is personal data under KVKK].

Transfers

Data is not transferred to third parties or used for advertising. The support server is located at [country/hosting provider] [lawyer: cross-border transfer assessment]. Support emails are sent through our domain's email service provider [websitem.com.tr; country]; the provider processes only the recipient address and the email content (request number, short note) to deliver it [lawyer: data processing agreement].

Progress report (optional)

In the parent area you can create a PDF summary of the last 4 or 8 weeks. It contains the child's nickname, school letter group and in-game measurements; it contains no recordings. The document is created on the device and goes wherever you choose through the share menu; it is not sent to our server. The Turkish Ministry of Education recommends that development files are not shared outside the family, the teacher and the guidance and research centre.

Backup file (optional)

In the parent area you can create a password-protected backup file to move progress to a new device. The file is encrypted with a password you choose and saved wherever you choose through the share menu (email, cloud, computer); it is not sent to our server and we cannot open it. It contains the children's nicknames, settings and game records; reading-aloud recordings are included only if you tick that option. If you forget the password, the backup cannot be opened.

Retention and deletion

Data on the device is kept until the app is deleted, or until "Delete this child's data" or "Withdraw consent and delete all data" is chosen in the parent area. Deletion is immediate and cannot be undone.
Support requests are deleted from the server 12 months after they are closed. You can ask for earlier deletion from the support screen.

Your rights

Under KVKK art. 11: the right to learn whether your data is processed, to request information, correction, deletion, to object, and other rights. Contact: [email] or in-app support.

Statement of explicit consent (the checkbox in the app)

"I have read the privacy notice. I consent to my child's game data being processed on this device for the purposes described above."

Consent can be withdrawn at any time in the parent area; when withdrawn, all app data on the device is deleted.