Privacy Policy
Last updated: 23 October 2026
This Privacy Policy explains how we collect, use, store and protect personal data in connection with the Bookeley mobile application (the "App") and the website at bookeley.com (the "Site").
Bookeley is designed for children aged 3–12. The account is set up and managed by a parent or legal guardian. We do not knowingly collect personal data directly from children.
1. Data Controller
| Company | Startabas Reklam Ajansı Ticaret Limited Şirketi |
| Address | Reşitpaşa Mah. Mareşal Cad. No: 39/1, Sarıyer, İstanbul 34467, Türkiye |
| Tax ID (VKN) | 7811167140 |
| Trade registry | İstanbul, No. 1148569 |
| Contact | bookeley@startabas.com |
| Phone | +90 542 290 42 85 |
Under the Turkish Personal Data Protection Law No. 6698 ("KVKK") we act as the data controller (veri sorumlusu). Under the EU General Data Protection Regulation ("GDPR") we act as the controller for the data described below.
2. How You Use the App
Bookeley requires no sign-up, no email address and no password. When the App is first opened, Firebase creates an anonymous technical identifier for the device so that the language and age-group preferences can be remembered. On iPhone and iPad you may choose to Sign in with Apple to link this identifier to your Apple Account, so that your subscription, favourites and preferences can be used on your other Apple devices. Sign-in is optional; it is needed only for the optional Friends feature (section 3.5). When you sign in with Apple we do not ask Apple for your name or email address; only the user identifier Apple issues for this App is linked to your account. On Android you may sign in with Google: Google passes your account identifier, email address, name and profile picture address to our sign-in service (Firebase Authentication), which keeps them only to recognise your account. We do not use them to contact you and never show them to other families.
This anonymous identifier and the Apple user identifier are not linked to a name, an email address or any contact detail, and it is not used to identify you or your child as a person.
The initial setup — choosing a language and entering the child's date of birth — is performed by the parent or guardian.
3. Data We Collect
3.1 Device and account data
| Data | Purpose | Legal basis (GDPR) | Legal basis (KVKK) |
|---|---|---|---|
| Anonymous user identifier | Remembering preferences and subscription status without an account | Art. 6(1)(b) — performance of a contract | Art. 5(2)(c) — necessary for a contract |
| Apple user identifier (only if you sign in with Apple) | Recognising your account across devices; using your subscription and preferences on your other Apple devices | Art. 6(1)(b) — performance of a contract | Art. 5(2)(c) — necessary for a contract |
| Account creation date | Technical record keeping | Art. 6(1)(f) — legitimate interest | Art. 5(2)(f) — legitimate interest |
Apart from the Google sign-in details described in section 2 (Android only, if you choose to sign in), we do not collect an email address, a name, a profile photo or a phone number.
3.2 Child profile data
| Data | Purpose | Legal basis (GDPR) | Legal basis (KVKK) |
|---|---|---|---|
| Date of birth | Determining the age group (3–7 or 8–12) so age-appropriate books are shown. Used on the device only; the date is not retained | Art. 6(1)(a) — consent of the holder of parental responsibility (Art. 8) | Art. 5(1) — explicit consent |
| Age group (3–7 / 8–12) | Filtering the library | Art. 6(1)(f) — legitimate interest | Art. 5(2)(f) — legitimate interest |
| Language preference | Displaying content in the chosen language | Art. 6(1)(f) — legitimate interest | Art. 5(2)(f) — legitimate interest |
About the date of birth. We ask for it once, during setup, solely to calculate the age group. The date itself is not stored. It is used on the device to work out which of the two age bands applies, and only that band — 3–7 or 8–12 — is saved. The date is never written to our database, never transmitted to us and never shared. It is not used for advertising or profiling. If you prefer not to provide an exact date, you may enter an approximate one; only the resulting age group affects what the App shows.
3.3 Usage data
| Data | Purpose | Legal basis (GDPR) | Legal basis (KVKK) |
|---|---|---|---|
| Favourite books | Providing the favourites feature | Art. 6(1)(f) — legitimate interest | Art. 5(2)(f) — legitimate interest |
| Whether initial setup has been completed | Showing the right screen on launch | Art. 6(1)(f) — legitimate interest | Art. 5(2)(f) — legitimate interest |
| Books finished and reading dates | Stickers, golden stickers and the reading streak | Art. 6(1)(f) — legitimate interest | Art. 5(2)(f) — legitimate interest |
| Subscription status and purchase history | Determining access rights and restoring purchases | Art. 6(1)(b) | Art. 5(2)(c) |
Why "legitimate interest" for your child's data. The subscription contract is with the parent, not with the child. We therefore process the data about your child's use of the App on the basis of our legitimate interest in providing the reading service that the parent has chosen for the child, limited to what that service needs, with no advertising and no profiling. The parent's account and subscription are processed to perform the contract with the parent.
3.4 Friends (optional)
Friends is off by default. A parent turns it on in Settings, behind the parental gate, after reading a short notice about what is shared. It needs a signed-in parent account. Children can become friends only through a one-time code that the two families' parents exchange; the code expires after 48 hours. There is no search, no public profile and no way to find or contact strangers.
| Data | Who can see it | Retention |
|---|---|---|
| Nickname (chosen from our suggestions; it cannot be typed) | Your child's friends | Until changed or the account is deleted |
| One of 8 preset avatars | Your child's friends | Until changed or the account is deleted |
| Finished books shown as stickers; sticker count | Your child's friends | Until the account is deleted |
| Reading streak | Friends, only if the parents of both families turn on "Share streaks" | Until sharing is turned off or the account is deleted |
| Friend list and blocked friends | Only your account | Until removed or the account is deleted |
| Preset celebrations (one of five fixed messages) and book recommendations (a book from the library) | Sender and receiver | Deleted after 14 days |
| Reports (reason: name, picture or other) | Only us | 12 months |
Children cannot type a nickname; they choose one of our suggested nicknames, so a real name cannot appear. Our server also checks every nickname against a list of inappropriate words. Before choosing, children must accept short friend rules. There is no free-text messaging, no image upload and no public posting. Friends can be removed, blocked or reported at any time; reports are reviewed by us, and we are alerted to new reports by email (Google Gmail). A parent can turn Friends off in Settings at any time.
Legal basis: consent of the holder of parental responsibility (GDPR Art. 6(1)(a) together with Art. 8; KVKK Art. 5(1)). Handling reports and blocks to keep children safe: legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
3.5 Notifications (optional)
If you allow notifications, we store a push token for each device (at most five), the App language, your time-zone offset (not your location) and your notification choices, so that we can send the daily book and friend notifications (new friend, celebration, book recommendation) outside your quiet hours. Reminders about the end of a trial or about not reading for a while are sent only if you turn them on in Settings. Notification texts never contain names, book titles or messages. You can turn notifications off in Settings or in your device settings; the token is removed when all notifications are off or the account is deleted. Legal basis: consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)).
3.6 Invitations
A parent can share an invite code. We store the code, the account it belongs to, the account that redeemed it and when the invited child finished a first book, so that the inviting child receives a sticker and, on iPhone and iPad, the inviting parent receives a one-month App Store offer code after the invited family's first payment. We store no names or contact details. Legal basis: GDPR Art. 6(1)(b); KVKK Art. 5(2)(c).
4. Data We Do Not Collect
- No advertising. The App shows no advertising of any kind and we do not collect advertising identifiers (IDFA / GAID).
- No tracking. We do not track you or your child across apps or websites. The only device-related identifier we store is the push token described in section 3.5, and only if you allow notifications.
- No location data. Only the time-zone offset described in section 3.5.
- No access to your contacts, photos, microphone or camera. Avatars are preset drawings.
- No behavioural analytics. We do not use Google Analytics, Firebase Analytics or any equivalent product that records how users move through the App. The only automatic collection is daily total counts for the subscription screen: the App counts how many times the subscription screen is opened from which button and how many times the purchase button is tapped, per day, platform (iOS/Android) and screen only. These counts contain no user, device or account identifier and cannot be linked to anyone.
- No crash reporting. Crashlytics and comparable crash-log services are not installed.
- No sale or rental of data. We never sell, rent or share personal data with third parties for advertising or marketing purposes.
- No chat. Children cannot send free-text messages or upload content. Children cannot type any text: the nickname in section 3.4 is chosen from suggestions, and friends can exchange only preset celebrations and book recommendations.
- No profiling or automated decision-making that produces legal effects concerning you.
5. Content Production and Artificial Intelligence
Bookeley's stories, illustrations and narration are produced using AI-assisted tools before publication, as part of an editorial process that is entirely separate from users. Every book is reviewed and approved by a person before it appears in the App.
No user data of any kind is sent to any AI service. Every user sees the same published content. AI is used to create the books, not to process information about you or your child.
6. Who We Share Data With
We share data only with the service providers required to operate the service. These providers act as processors on our instructions and may not use the data for their own purposes. Separately, if Friends is turned on, the information listed in section 3.4 is visible to your child's friends; those families are other users, not processors.
| Provider | Purpose | Data location |
|---|---|---|
| Google Firebase (Firestore, Storage, Hosting, Cloud Functions) | Data storage, content delivery, the server-side nickname check and friend notifications | European Union (eur3, europe-west1) |
| Google Firebase (Authentication, Cloud Messaging, App Check) | Sign-in, delivering push notifications, checking that requests come from the genuine App | United States and other Google locations |
| Make (Celonis) | Scheduled automation for the daily book notification and invitation rewards; reads notification choices and invitation records | European Union (EU1 zone) |
| Google Gmail | Alerting us to new reports from the Friends feature | Google locations |
| RevenueCat | Managing subscription status and restoring purchases. Receives the anonymous user identifier and subscription events. | United States |
| Apple App Store / Google Play | Processing subscription payments and offer codes | Determined by the store |
Payments. Subscriptions are sold exclusively through the App Store and Google Play. Your card details never reach us, are never stored by us and are never visible to us. We receive only the fact that a subscription is active and its type.
We may also disclose data where required by law, court order or a lawful request from a competent authority.
7. International Data Transfers
Our Firebase database, file storage and server functions are located in the European Union. Firebase Authentication, Cloud Messaging and App Check, as well as RevenueCat, process data in the United States; Google may also process data in its other locations.
For users in Türkiye: data transferred to these providers is transferred abroad within the meaning of KVKK Art. 9. The transfer is made on the basis of your explicit consent and, where applicable, appropriate safeguards provided by the processor.
For users in the EU/EEA: transfers to Google and RevenueCat in the United States are made under the EU Standard Contractual Clauses or, where applicable, the EU–US Data Privacy Framework.
8. How Long We Keep Data
| Data | Retention period |
|---|---|
| Profile data (age group, language) | For as long as the App remains installed and the profile is not deleted |
| Favourites | Same as above |
| Purchase and transaction records | For the period required by applicable tax and commercial law |
| Books finished, reading dates, stickers and streak | Until the account is deleted |
| Friends data (section 3.4) | See section 3.4; celebrations and recommendations 14 days, reports 12 months |
| Push tokens and notification choices | Until notifications are turned off or the account is deleted |
| Invitation records | Until the account is deleted |
| Anonymous user data with no activity | 12 months from last activity |
When you delete your account, your profile data, favourites and preferences are erased immediately and irreversibly. Only records we are legally required to keep — such as transaction records held for tax purposes — are retained, and solely for that purpose. When an account is deleted, we also remove its identifier from other families' friend lists and block lists, replace it in invitation records with a "deleted" marker, and delete the celebrations and book recommendations it sent. Only reports about the account are kept, for 12 months, to keep children safe; they are never used to restore the account or for advertising.
9. Deleting Your Account
You can delete your account at any time from within the App: Settings → Delete My Account. To prevent accidental deletion by a child, a parental verification step is required. If you signed in with Apple, Apple asks you to confirm during deletion and the App's link to your Apple Account is revoked.
Full step-by-step instructions, and a description of exactly what is deleted and what is retained, are on our Delete Your Account and Data page.
⚠️ Important: deleting your account does not cancel an active subscription. Subscriptions must be cancelled separately from your App Store or Google Play account settings. See our Support page for the steps.
You may also request deletion by writing to bookeley@startabas.com.
10. Data Security
We protect your data with industry-standard measures: encrypted connections (TLS), access controls and database security rules that allow each user to access only their own data. Published book content is publicly readable; personal data is not.
No system can be guaranteed to be perfectly secure. In the event of a personal data breach, we will notify the competent supervisory authority and, where required, affected users within the periods prescribed by law.
11. Your Rights
Under KVKK (Art. 11), you have the right to:
- learn whether your personal data is being processed;
- request information if it has been processed;
- learn the purpose of processing and whether it is used in accordance with that purpose;
- know the third parties to whom data is transferred, in Türkiye or abroad;
- request rectification of incomplete or inaccurate data;
- request erasure or destruction of your data;
- request that rectification, erasure or destruction be notified to third parties to whom the data was transferred;
- object to a result arising from analysis of the data solely by automated systems;
- claim compensation for damage arising from unlawful processing.
Under GDPR, you have the right to:
- access your data (Art. 15);
- rectification (Art. 16);
- erasure — the "right to be forgotten" (Art. 17);
- restriction of processing (Art. 18);
- data portability (Art. 20);
- object to processing (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3));
- lodge a complaint with a supervisory authority.
How to exercise your rights: write to bookeley@startabas.com. We respond within 30 days at the latest. Requests are free of charge; where a request is manifestly unfounded or excessive we may charge a reasonable fee, in accordance with the law.
Supervisory authorities. In Türkiye you may complain to the Personal Data Protection Authority (KVKK Kurumu, kvkk.gov.tr). In the EU you may complain to the supervisory authority of your Member State.
12. Children's Privacy
Bookeley is designed for children aged 3–12 and is set up and managed by a parent or legal guardian.
- Purchases, links out of the App, sharing, Settings and account deletion are behind a parental gate.
- Friends is off by default. A parent turns it on after a notice explaining what is shared, and can turn it off, remove or block friends, report a nickname and delete the account at any time.
- Children cannot send free-text messages or upload content; children cannot type any text, and nicknames are chosen from our suggestions.
- We do not use children's data for advertising, profiling or behavioural targeting, and we do not sell it.
- Apart from the processors in section 6, the only disclosure is the information shown to your child's friends (section 3.4).
Parental rights. A parent may ask us to review the personal information we hold about their child, to correct or delete it, and to stop further collection or use, by writing to bookeley@startabas.com or by post to the address in section 1. To protect your child, we may take reasonable steps to confirm that you are the child's parent or guardian. We respond within 30 days.
United States (COPPA). For users in the United States we collect only a persistent identifier (the anonymous account identifier described in section 3.1) together with the App data in sections 3.2 to 3.5, and only to support the internal operations of the App: keeping the library, favourites, reading progress, stickers and subscription working on the device and across the family's devices, running the optional Friends feature, sending the notifications the parent has turned on, and protecting the security and integrity of the service. A child cannot type a nickname; it is chosen from our suggestions, and friends see only that nickname, a preset avatar, stickers for finished books and, if both parents allow it, the reading streak. There is no free-text communication. The identifier is never used to contact a specific child, for advertising, or to build a profile; it is not shared with anyone except the processors in section 6, which may use it only to provide their service to us. We keep this data only as long as section 8 states and then delete it, and we protect it under a written information security program that we review at least once a year.
The App is designed to meet the requirements of the US Children's Online Privacy Protection Act ("COPPA"), GDPR Art. 8 and the Google Play Families Policy.
If you believe your child has provided us with personal data without your consent, please contact us at bookeley@startabas.com and we will erase it without delay.
13. Cookies and the Website
The main pages of the bookeley.com website use no tracking cookies and contain no analytics or advertising scripts. Only technically necessary storage is used, for remembering your language preference.
Advertising landing page (bookeley.com/tr): On this page, Meta, TikTok and Google measurement cookies are loaded only if you choose "Accept". If you decline, none of them is loaded and the page works the same way; you can change your choice at any time through the "Cookie preferences" link at the bottom of that page.
The same page has an anonymous counter that works regardless of your choice. It records only the name of the event (page opened, store button pressed) and the code of the advertising campaign. No cookie, device identifier, IP address or any other data that could identify you is recorded; the records cannot be linked to a person.
14. Changes to This Policy
We may update this Policy from time to time. When we do, we update the "Last updated" date above. In the event of a material change we will notify you in the App or by email, and where the change requires it, we will seek your consent again.
15. Contact
bookeley@startabas.com · +90 542 290 42 85
Startabas Reklam Ajansı Ticaret Limited Şirketi Reşitpaşa Mah. Mareşal Cad. No: 39/1, Sarıyer, İstanbul, Türkiye