Privacy Notice
1. Data controller
Demostra is built and operated by an independent developer; there is no company behind it. The data controller is that natural person.
Demostra
Contact: info@demostra.app
This notice is prepared under the EU General Data Protection Regulation (GDPR) and Turkish Personal Data Protection Law No. 6698 (KVKK), to meet the information duties in GDPR Art. 13 and KVKK Art. 10.
This is a privacy notice, not a consent form. The duty to inform depends on no approval; you are not asked to consent in order to read it. Operations that do require consent live in a separate document: Explicit Consent Text. (Board principle decision 2026/347 of 18 February 2026 requires the two to be separate.)
2. Your voice never leaves your device
Your speech is transcribed on your own phone. The audio is never sent to our servers and is not stored anywhere.
The microphone stays off until you tap “Start speaking”. This is deliberate: it prevents the unintended capture of conversations around you.
3. But the transcribed text is sent — and it goes abroad
To write summaries, generate questions and assess your explanation, the TEXT of your speech is sent to our AI provider.
That provider is OpenAI, which processes data in the United States. This means your text is transferred abroad.
Retention: the provider keeps API requests for 30 days for abuse monitoring, then deletes them. Zero Data Retention is available only for certain account types and we do not have it yet.
Model training: under the provider's published policy, inputs sent and outputs received through the API are not used to train its models by default. This is the provider's declared default, not a negotiated term.
The transfer is not only the AI provider
To be honest we list all of it — the app's server and database are also outside Türkiye. So it is not only your explanation: all data tied to your account sits abroad.
| Where | What goes | Why |
|---|---|---|
| AI provider | Explanation text, check-in answers, goal and topic names — without any identifier | To produce the assessment |
| Application server (hosting) | Every request to the app | To run the service |
| Database | Account, goals, check-ins, notes — all data | To store it |
| Email provider | Your email address and verification code | To send codes and password resets |
None of these has a Türkiye region. The same legal basis and the same missing safeguard apply to all of them — the section below covers them together.
Your identity is not sent to the AI provider. The request carries no name, email or user id, and the provider's own end-user identifier field is left empty. This does not remove the transfer in law — we hold the link — but it reduces what a leak would expose to text without identity.
What is sent:
- The speech transcript
- Explanations you write
- Your check-in and reinforcement answers
- The answers you give while setting up a goal
- In the paired-case feature: two users' answers together
The legal basis — and its limit
KVKK Art. 9 was amended by Law 7499 and, as of 1 June 2024, sets a tiered regime: (1) an adequacy decision, (2) failing that, appropriate safeguards, (3) failing that, only incidental cases.
As things stand the Turkish Board has issued no adequacy decision for any country. This transfer rests not on explicit consent but on performance of a contract: assessing your explanation is Demostra's core undertaking, and it cannot be performed without the transfer.
We do not tie the transfer to consent, because the service itself depends on it — and conditioning access to a service on consent renders that consent invalid under KVKK (Board decision 2023/692 of 2 May 2023). Instead we state plainly what happens, and the transfer is accepted as part of the Terms of Service. If you do not accept the Terms, no account is created.
Safeguard status. Article 9 requires an appropriate safeguard for transfers to countries without an adequacy decision. The Board has not issued an adequacy decision for any country to date; the standard-contract route requires the provider's signature, and that signature has not been obtained yet. The transfer currently rests on the legal ground of performance of the contract; there is no additional safeguard. This section is updated when that changes.
If signed, a standard contract is notified to the Board within five business days (Art. 9(4)(c)). You can delete your account at any time: Settings → Delete account.
4. What we store
- Your name and email — for your account
- Speech transcripts and their summaries
- Your goals, topics and study material
- Your check-in and reinforcement answers and their outcomes
- Study durations and focus session records
- Your friend connections and shared study time
- In spaces you join: presence time, proof count, install identifier
Your password is never stored in plain text; it is hashed irreversibly (bcrypt). Password reset codes are also stored as hashes and are single-use.
Purpose and legal basis
Data is processed only to deliver the service itself: planning your goal, generating questions, assessing your explanation and scheduling reviews.
- Performance of a contract — GDPR Art. 6(1)(b), KVKK Art. 5(2)(c): account, goals, check-ins, subscription
- Explicit consent — GDPR Art. 6(1)(a), KVKK Art. 5(1): only sharing dictation corrections (optional, off by default)
- Legal obligation — GDPR Art. 6(1)(c), KVKK Art. 5(2)(a): tax and accounting records
- Legitimate interest — GDPR Art. 6(1)(f), KVKK Art. 5(2)(f): security, abuse prevention, rate limiting
5. What we do not do
- No advertising. No advertising identifier is collected, no ad SDK is present.
- No tracking. Your data is not combined with third-party data for targeted advertising and is not sold to data brokers.
- No analytics SDK. No third-party analytics or crash reporting tool is used.
- No surveillance. Your interruption count in a focus session is tied to no ranking, badge or streak; moderators cannot see an individual's interruption count.
6. Friend and space features
When you connect with a friend, your streak and shared study time become visible to them. Before connecting, what will be shared is listed and your consent is taken.
In paired-case questions, both answers are shown to each other and processed together for comparison.
When you join a space, the time you spent in that session, the number of proofs you produced, your name and your avatar are visible to other members. Not visible: your goals, notes, other spaces, how many times you were interrupted, and your check-in answers. Joining is your own action for each session; a moderator cannot add anyone.
7. How long we keep it
- Account details: while the account is open; deleted permanently after deletion
- Transcripts, check-ins, study records: while the account is open
- History window: 30 days; records outside it are deleted
- Password reset codes: 5 minutes (single-use, stored hashed)
- Subscription and payment records: statutory retention — 10 years under the Turkish Commercial Code and Tax Procedure Law
- Dictation correction contributions: linked to you for 30 days; deleted if consent is withdrawn or the account is deleted
We hold no payment details at all: subscriptions are billed by the Apple App Store and Google Play, and card details never reach us. Details: Refund and Withdrawal Policy.
8. How to exercise your rights
Under GDPR Art. 15–22 and Turkish KVKK Art. 11 you have the right to access, rectify, erase, restrict processing, port your data and object.
- Deletion: in the app, Settings → Delete account. To delete without installing the app: account deletion page.
- Download your data: Settings → My data → “Download my data”. You receive everything in machine-readable JSON.
- Other requests: write to info@demostra.app. Requests are answered within 30 days at the latest (Art. 13 KVKK).
If you consented to sharing dictation corrections, you can withdraw that consent at any time under Settings → Data; withdrawing also deletes the contributions you made in that window.
9. Age limit
Demostra is not designed for people under 16. You declare that you are over 16 when you register. Accounts we learn belong to someone under 16 are closed.
10. Special category data warning
Speech transcripts are free-form. If you talk about health, beliefs or political views, that is recorded too and sent to the AI provider. The app cannot technically prevent this — which is why we recommend not discussing such information.
11. Changes
When this notice changes the date is updated, and material changes are announced in the app.
12. Contact
info@demostra.app · Consent text · Terms of Service · Refund policy · Delete account