Privacy Policy
Last updated: 29 August 2026
This Privacy Policy explains how we collect, use, store and protect personal data in connection with the Bookeley mobile application (the "App") and the website at bookeley.com (the "Site").
Bookeley is designed for children aged 3–12. The account is set up and managed by a parent or legal guardian. We do not knowingly collect personal data directly from children.
1. Data Controller
| Company | Startabas Reklam Ajansı Ticaret Limited Şirketi |
| Address | Reşitpaşa Mah. Mareşal Cad. No: 39/1, Sarıyer, İstanbul 34467, Türkiye |
| Tax ID (VKN) | 7811167140 |
| Trade registry | İstanbul, No. 1148569 |
| Contact | bookeley@startabas.com |
Under the Turkish Personal Data Protection Law No. 6698 ("KVKK") we act as the data controller (veri sorumlusu). Under the EU General Data Protection Regulation ("GDPR") we act as the controller for the data described below.
2. How You Use the App
Bookeley requires no sign-up, no email address and no password. When the App is first opened, Firebase creates an anonymous technical identifier for the device so that the language and age-group preferences can be remembered. There is no login screen, no social sign-in and no account creation of any kind.
This anonymous identifier is not linked to a name, an email address or any contact detail, and it is not used to identify you or your child as a person.
The initial setup — choosing a language and entering the child's date of birth — is performed by the parent or guardian.
3. Data We Collect
3.1 Device and account data
| Data | Purpose | Legal basis (GDPR) | Legal basis (KVKK) |
|---|---|---|---|
| Anonymous user identifier | Remembering preferences and subscription status without an account | Art. 6(1)(b) — performance of a contract | Art. 5(2)(c) — necessary for a contract |
| Account creation date | Technical record keeping | Art. 6(1)(f) — legitimate interest | Art. 5(2)(f) — legitimate interest |
We do not collect an email address, a name, a profile photo or a phone number.
3.2 Child profile data
| Data | Purpose | Legal basis (GDPR) | Legal basis (KVKK) |
|---|---|---|---|
| Date of birth | Determining the age group (3–7 or 8–12) so age-appropriate books are shown. Used on the device only; the date is not retained | Art. 6(1)(a) — consent of the holder of parental responsibility (Art. 8) | Art. 5(1) — explicit consent |
| Age group (3–7 / 8–12) | Filtering the library | Art. 6(1)(b) | Art. 5(2)(c) |
| Language preference | Displaying content in the chosen language | Art. 6(1)(b) | Art. 5(2)(c) |
About the date of birth. We ask for it once, during setup, solely to calculate the age group. The date itself is not stored. It is used on the device to work out which of the two age bands applies, and only that band — 3–7 or 8–12 — is saved. The date is never written to our database, never transmitted to us and never shared. It is not used for advertising or profiling. If you prefer not to provide an exact date, you may enter an approximate one; only the resulting age group affects what the App shows.
3.3 Usage data
| Data | Purpose | Legal basis (GDPR) | Legal basis (KVKK) |
|---|---|---|---|
| Favourite books | Providing the favourites feature | Art. 6(1)(b) | Art. 5(2)(c) |
| Whether initial setup has been completed | Showing the right screen on launch | Art. 6(1)(b) | Art. 5(2)(c) |
| Subscription status and purchase history | Determining access rights and restoring purchases | Art. 6(1)(b) | Art. 5(2)(c) |
3.4 Technical performance data
The App uses Firebase Performance Monitoring to measure app start time, screen rendering speed and the timing of network requests. This is collected automatically for every user and cannot be switched off within the App.
| Data | Purpose | Legal basis (GDPR) | Legal basis (KVKK) |
|---|---|---|---|
| App start time, screen rendering, network request timing | Diagnosing and improving technical performance | Art. 6(1)(f) — legitimate interest | Art. 5(2)(f) — legitimate interest |
This data is technical. It does not identify you or your child, it is not linked to the profile data above, and it is never used for advertising, profiling or behavioural targeting.
4. Data We Do Not Collect
- No advertising. The App shows no advertising of any kind and we do not collect advertising identifiers (IDFA / GAID).
- No device identifiers. We do not collect device IDs.
- No location data.
- No access to your contacts, photos, microphone or camera.
- No behavioural analytics. We do not use Google Analytics, Firebase Analytics or any equivalent product that records how users move through the App. The only automatic collection is the technical performance measurement described in section 3.4.
- No crash reporting. Crashlytics and comparable crash-log services are not installed.
- No sale or rental of data. We never sell, rent or share personal data with third parties for advertising or marketing purposes.
- No social features. There is no chat, comment or user-to-user communication in the App.
- No profiling or automated decision-making that produces legal effects concerning you.
5. Content Production and Artificial Intelligence
Bookeley's stories, illustrations and narration are produced using AI-assisted tools before publication, as part of an editorial process that is entirely separate from users. Every book is reviewed and approved by a person before it appears in the App.
No user data of any kind is sent to any AI service. Every user sees the same published content. AI is used to create the books, not to process information about you or your child.
6. Who We Share Data With
We share data only with the infrastructure providers required to operate the service. These providers act as processors on our instructions and may not use the data for their own purposes.
| Provider | Purpose | Data location |
|---|---|---|
| Google Firebase (Firestore, Authentication, Storage, Hosting, Performance Monitoring) | Data storage, content delivery, technical performance measurement | European Union (eur3) |
| RevenueCat | Managing subscription status and restoring purchases. Receives the anonymous user identifier and subscription events. | United States |
| Apple App Store / Google Play | Processing subscription payments | Determined by the store |
Payments. Subscriptions are sold exclusively through the App Store and Google Play. Your card details never reach us, are never stored by us and are never visible to us. We receive only the fact that a subscription is active and its type.
We may also disclose data where required by law, court order or a lawful request from a competent authority.
7. International Data Transfers
Our Firebase infrastructure is located in the European Union. Our subscription provider, RevenueCat, processes data in the United States.
For users in Türkiye: data transferred to these providers is transferred abroad within the meaning of KVKK Art. 9. The transfer is made on the basis of your explicit consent and, where applicable, appropriate safeguards provided by the processor.
For users in the EU/EEA: data held in Firebase remains within the EU. Transfers to RevenueCat in the United States are made under the EU Standard Contractual Clauses.
8. How Long We Keep Data
| Data | Retention period |
|---|---|
| Profile data (age group, language) | For as long as the App remains installed and the profile is not deleted |
| Favourites | Same as above |
| Purchase and transaction records | For the period required by applicable tax and commercial law |
| Technical performance data | Retained by Firebase in aggregate form according to its standard retention period |
| Anonymous user data with no activity | 12 months from last activity |
When you delete your account, your profile data, favourites and preferences are erased immediately and irreversibly. Only records we are legally required to keep — such as transaction records held for tax purposes — are retained, and solely for that purpose.
9. Deleting Your Account
You can delete your account at any time from within the App: Settings → Delete My Account. To prevent accidental deletion by a child, a parental verification step is required.
Full step-by-step instructions, and a description of exactly what is deleted and what is retained, are on our Delete Your Account and Data page.
⚠️ Important: deleting your account does not cancel an active subscription. Subscriptions must be cancelled separately from your App Store or Google Play account settings. See our Support page for the steps.
You may also request deletion by writing to bookeley@startabas.com.
10. Data Security
We protect your data with industry-standard measures: encrypted connections (TLS), access controls and database security rules that allow each user to access only their own data. Published book content is publicly readable; personal data is not.
No system can be guaranteed to be perfectly secure. In the event of a personal data breach, we will notify the competent supervisory authority and, where required, affected users within the periods prescribed by law.
11. Your Rights
Under KVKK (Art. 11), you have the right to:
- learn whether your personal data is being processed;
- request information if it has been processed;
- learn the purpose of processing and whether it is used in accordance with that purpose;
- know the third parties to whom data is transferred, in Türkiye or abroad;
- request rectification of incomplete or inaccurate data;
- request erasure or destruction of your data;
- request that rectification, erasure or destruction be notified to third parties to whom the data was transferred;
- object to a result arising from analysis of the data solely by automated systems;
- claim compensation for damage arising from unlawful processing.
Under GDPR, you have the right to:
- access your data (Art. 15);
- rectification (Art. 16);
- erasure — the "right to be forgotten" (Art. 17);
- restriction of processing (Art. 18);
- data portability (Art. 20);
- object to processing (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3));
- lodge a complaint with a supervisory authority.
How to exercise your rights: write to bookeley@startabas.com. We respond within 30 days at the latest. Requests are free of charge; where a request is manifestly unfounded or excessive we may charge a reasonable fee, in accordance with the law.
Supervisory authorities. In Türkiye you may complain to the Personal Data Protection Authority (KVKK Kurumu, kvkk.gov.tr). In the EU you may complain to the supervisory authority of your Member State.
12. Children's Privacy
Bookeley is designed for children but is not directed at children as account holders.
- Initial setup and payment are performed by the parent or guardian.
- Purchases and account deletion are protected by a parental gate that a young child cannot pass unaided.
- Children cannot enter free text, upload content or communicate with other users.
- We do not use children's data for advertising, profiling or behavioural targeting.
The App is built to meet the requirements of the US Children's Online Privacy Protection Act ("COPPA"), GDPR Art. 8 and the Google Play Families Policy.
If you believe your child has provided us with personal data without your consent, please contact us at bookeley@startabas.com and we will erase it without delay.
13. Cookies and the Website
The bookeley.com website uses no tracking cookies and contains no analytics or advertising scripts. Only technically necessary storage is used, for remembering your language preference.
14. Changes to This Policy
We may update this Policy from time to time. When we do, we update the "Last updated" date above. In the event of a material change we will notify you in the App or by email, and where the change requires it, we will seek your consent again.
15. Contact
bookeley@startabas.com
Startabas Reklam Ajansı Ticaret Limited Şirketi Reşitpaşa Mah. Mareşal Cad. No: 39/1, Sarıyer, İstanbul, Türkiye