Privacy Policy

1. Who is responsible

AudioStories is the data controller for the information described here. You can reach us at the contact address at the end of this page for any privacy request.

2. What we collect

We collect the minimum needed to run the app, keep progress in sync and process subscriptions.

• Account data: the email address or provider identifier returned by Apple, Google or Facebook sign-in, and the display name and avatar chosen inside the app.
• Device and session data: a device identifier, device model, operating system version, app version, app language, bundle identifier and a coarse country derived from the connection.
• Usage data: which stories were opened or finished, quiz results, badges and reading streaks — used to show progress inside the app.
• Subscription status: whether a subscription is active and which plan, received from Apple, Google and our subscription provider.
• Support messages: whatever you choose to write to us.

3. What we do not collect

• No voice recordings. Own-voice narration is stored on the device only and is never uploaded.
• No precise location, contacts, photos or microphone access beyond the on-device recording feature you start yourself.
• No behavioural advertising profiles of children.
• No sale or rental of personal data to anyone, for any purpose.

4. Children's data and parental consent

Accounts are created by a parent or guardian, who gives consent on the child's behalf. We do not knowingly ask children for personal information. A profile name is optional and does not need to be a real name.

If you believe a child has provided us with personal data without your consent, contact us and we will delete it.

5. Why we use the data

• To provide the service: show the catalog, play stories, keep progress and badges.
• To operate accounts and sessions, including limiting how many devices share one account.
• To process and restore subscriptions and to prevent abuse of paid features.
• To measure aggregate, anonymous usage so we know which stories work.
• To answer support requests and meet legal obligations.

6. Service providers

We use a small number of processors. They act on our instructions and only receive what they need:

• Supabase — authentication, database and media hosting for the story catalog and account data.
• RevenueCat — subscription state, linked to your account identifier.
• Apple and Google — payment processing and billing for subscriptions.
• Google AdMob (with the UMP consent SDK) — advertising for free accounts only.
• OneSignal — push notifications, if you allow them.

7. Advertising and consent

Ads are shown to free accounts only. All ad requests are tagged as child-directed and restricted to general-audience content ratings, which disables personalised advertising for them.

In regions where consent is required, a consent form is shown before the ad SDK starts. On iOS, the App Tracking Transparency prompt is shown as well. You can change or withdraw your choice at any time from Settings in the app, and measurement only starts after consent.

8. How long data is kept

• Account and progress data: while the account exists.
• Sessions: inactive sessions are revoked automatically after 90 days and deleted after one year.
• Subscription and billing records: as long as required for accounting and legal purposes.
• Support messages: up to two years after the request is resolved.

9. Your rights

Under the KVKK, the GDPR and comparable laws you can ask us to confirm whether we hold data about you, to access or correct it, to delete it, to restrict or object to certain processing, and to receive a copy in a portable format.

Write to the privacy address below and we will respond within the period required by applicable law, and in any case within 30 days. We may need to verify that you are the account holder before acting.

10. Deleting your data

You can request deletion of your account and its data by emailing us from the address linked to the account. Once processed, progress, badges and profile data are removed and cannot be restored. Recordings stored on your device are removed when you delete them or uninstall the app.

11. Security

Data is transmitted over encrypted connections and stored with access controls that restrict content writes to authorised staff. Account data is protected by row-level rules so that one account cannot read another's. No system is perfect, but we work to keep the amount of data at risk as small as possible.

12. International transfers

Our providers may process data outside your country, including outside Türkiye and the European Economic Area. Where that happens we rely on the safeguards offered by those providers, such as standard contractual clauses.

13. Changes to this policy

If this policy changes, the date at the top of the page is updated. Material changes are announced in the app before they take effect.

14. Contact

For any privacy question or request, use the contact address below.