Effective date: 12 July 2026
This Privacy Policy explains what personal data Studel (“Studel”, “we”, “us”) collects when you use the Studel mobile application and related services (together, the “Service”), why we collect it, who we share it with, and what control you have over it.
Studel is operated by Serhan Emre Telatar, an individual developer established in Türkiye (“the Controller”).
| Data controller | Serhan Emre Telatar |
|---|---|
| Address | Maltepe, İstanbul, Türkiye |
| Privacy contact | privacy@studel.app |
| Support contact | support@studel.app |
If you are in the European Economic Area (“EEA”) or the United Kingdom, we process your data as a controller under the General Data Protection Regulation (GDPR). If you are in Türkiye, we process it under the Personal Data Protection Law No. 6698 (KVKK), in which we are the veri sorumlusu (data controller). This policy is written to satisfy both.
Studel is intended for users aged 16 and over. We do not knowingly create accounts for, or collect personal data from, anyone under 16. If you believe a person under 16 has given us personal data, contact us at the privacy address above and we will delete the account and its data.
We collect only what the Service actually needs to function. Everything below corresponds to a real field or record in our systems — we do not collect data “just in case.”
Collected when you register or sign in.
| Data | Source | Notes |
|---|---|---|
| Email address | You, or Apple | Used to identify your account, verify it, and send security emails. |
| Full name | You, or Apple | Shown in your profile. |
| Password | You | We never see or store your password. Authentication is handled by Google Firebase Authentication, which stores it in hashed form. We only pass it through at sign-in. |
| Profile picture (avatar) | You (optional) | Stored as an image file in Google Cloud Storage. |
| Apple user identifier | Apple | Only if you use Sign in with Apple. |
| Email verification status | Us | Whether your address has been confirmed. |
| Account creation and update timestamps | Us |
Sign in with Apple: if you choose to hide your email address, Apple gives us a private relay address (...@privaterelay.appleid.com) instead of your real one. We work with the relay address and never receive your actual email.
This is the heart of the Service, and the most sensitive category of data we hold. It is content you choose to upload or create.
| Data | Notes |
|---|---|
| Courses | Name, colour, icon, semester. |
| Weeks | The structure you organise a course into. |
| Uploaded documents (PDF) | Lecture notes and study material, up to 50 MB per file. Stored as files in Google Cloud Storage. |
| Text extracted from your documents | We extract the text layer from each PDF so it can be sent to the AI model. Stored alongside the document record. |
| Uploaded past exams (PDF) | Past exam papers you upload so Studel can analyse their question style. |
| Analysis of past exams | The question style, format and difficulty profile the AI derives from an exam. |
| Generated quizzes and questions | Quizzes the AI produces from your material. |
| Quiz attempts | Your answers, your score, and how long the attempt took. |
| Questions you ask (“Ask AI”) and the answers | The text of your question, any document attached to it, and the AI's answer. |
Do not upload material you would not want processed by a third-party AI provider. Uploaded documents and their extracted text are sent to OpenAI to generate quizzes, analyse exams, grade open answers, and answer your questions (see §4). Studel is a study tool; it is not designed or suitable for confidential, classified, medical, or otherwise sensitive material, and you should not upload such material.
| Data | Notes |
|---|---|
Plan (free, pro_monthly, pro_annual) | |
| Subscription status and expiry date | |
| App Store receipt | The signed receipt Apple issues for your purchase. We store it and validate it against Apple's servers to confirm your subscription is genuine and current. |
We never receive, process, or store your payment card details. All payments are made to Apple through the App Store's in-app purchase system. We only see the receipt Apple gives us, which confirms that a purchase happened — not how you paid for it.
| Data | Notes |
|---|---|
| Monthly AI usage counters | How many quizzes you generated and questions you asked this calendar month, used to enforce the free-plan allowance. Reset monthly. |
| Data | Purpose | Retention |
|---|---|---|
| IP address | Rate limiting only — to stop one source from flooding the API or brute-forcing logins. It is held in memory by the server process and is not written to your user record or to our database. | Transient; lost when the server process restarts. |
| Server logs | Diagnosing errors and investigating abuse. May include the request path, response status, timing, and (for failed sign-ins) the fact that an attempt failed. | Kept in Google Cloud Logging for a limited period, then deleted automatically. |
| Email verification and password-reset codes | Confirming your address and letting you recover your account. | Verification/reset codes expire after 10 minutes. A password-reset token expires after 15 minutes and can be used once. Codes are burned after 5 wrong attempts. |
To be explicit, Studel does not collect or use:
We do not sell your personal data. We do not share it with data brokers. We do not use it to build advertising profiles. Full stop.
Under the GDPR every processing activity needs a legal basis. Here is ours, and the equivalent KVKK ground.
| What we do | Why | GDPR legal basis | KVKK ground |
|---|---|---|---|
| Create and maintain your account | You cannot use the Service without one | Art. 6(1)(b) — performance of a contract | Art. 5/2(c) — necessary for a contract |
| Store your courses, documents, quizzes and attempts | This is the Service | Art. 6(1)(b) — contract | Art. 5/2(c) — contract |
| Send your document text and questions to the AI provider to generate quizzes, analyse exams, grade answers, and answer questions | The feature you asked for cannot work otherwise | Art. 6(1)(b) — contract | Art. 5/2(c) — contract |
| Verify your email address; let you reset your password | Account security | Art. 6(1)(b) — contract; Art. 6(1)(f) — legitimate interest in securing accounts | Art. 5/2(c); Art. 5/2(f) — legitimate interest |
| Validate your App Store receipt and provision your subscription | To give you what you paid for | Art. 6(1)(b) — contract | Art. 5/2(c) — contract |
| Count monthly AI usage against the free allowance | To enforce plan limits fairly | Art. 6(1)(b) — contract | Art. 5/2(c) — contract |
| Rate-limit by IP; log errors; investigate abuse | Keeping the Service available and secure for everyone | Art. 6(1)(f) — legitimate interest in security and availability | Art. 5/2(f) — legitimate interest |
| Retain records of transactions | Tax and accounting law | Art. 6(1)(c) — legal obligation | Art. 5/2(a) — expressly provided for by law |
Where we rely on legitimate interest, we have weighed our interest against your rights and concluded that the processing is limited, expected, and not overridden by your interests — e.g. rate limiting uses your IP address transiently, in memory, and never links it to your identity.
We use a small number of service providers (“processors” under GDPR, veri işleyen under KVKK). They may process your data only on our instructions, for the purposes below, and not for their own.
What is sent: the text extracted from documents you upload, the past exams you upload, the questions you ask, and your open-ended quiz answers when they are being graded.
What is sent with it: nothing identifying you. We do not send your name, email address, or user ID to OpenAI. The AI provider receives the study content and the instruction, not the student.
OpenAI processes this to return a quiz, an analysis, a grade, or an answer. Under OpenAI's API terms, content submitted through the API is not used to train their models, and is retained by them for a limited period (currently up to 30 days) for abuse monitoring before deletion. OpenAI is based in the United States — see §6 on international transfers.
We currently use the gpt-4o-mini model. We may change models or AI providers; if we move to a provider with materially different data practices, we will update this policy and tell you.
Google provides the ground Studel stands on:
We send your email address and a one-time code to Resend so it can deliver your verification and password-reset emails. Resend does not send you marketing and does not use your address for anything else.
Apple operates the App Store, processes your subscription payment, provides Sign in with Apple, and issues the receipts we validate. Your relationship with Apple is governed by Apple's own privacy policy, not this one. We never see your payment details.
We will also disclose data where we are legally required to — a valid court order, a lawful request from a competent authority — or where it is necessary to establish, exercise or defend legal claims, or to protect the rights and safety of our users. If Studel is ever sold or transferred, your data may transfer with it; you will be told beforehand and given the chance to delete your account first.
That is the complete list. There is nobody else.
Your data is stored on Google's infrastructure in the European Union (europe-west region) — this covers Firestore, Cloud Storage, and the servers running the Service.
Two of our processors are based in the United States: OpenAI and, for parts of its infrastructure and support, Google. This means some of your data — specifically, the study content sent for AI processing — is transferred outside the EEA and outside Türkiye.
These transfers are protected by:
For KVKK purposes, transfers abroad are made on the basis of the mechanisms permitted under Article 9 of the Law, including your explicit consent where required and the standard contracts registered with the Turkish Data Protection Authority where applicable.
If you are not comfortable with your study content being processed in the United States, do not upload documents to Studel — the AI features cannot work without that transfer.
| Data | Retention |
|---|---|
| Account, courses, documents, quizzes, attempts, subscription record | For as long as your account exists. |
| Everything, on account deletion | Deleted — see below. |
| Email verification / password reset codes | 10 minutes. |
| Password reset tokens | 15 minutes, single use. |
| Monthly usage counters | Reset each calendar month. |
| IP addresses | Held in server memory only, for the duration of the rate-limit window. Never persisted to our database. |
| Server logs | A limited period in Google Cloud Logging, then automatically deleted. |
| Transaction records | As long as tax and accounting law requires us to keep them (in Türkiye, generally 10 years), even after you delete your account. These records show that a payment occurred; they do not contain your study content. |
You can delete your account from within the app at any time. It is not a “deactivation” — it is a deletion, and it cascades. When you delete your account we remove:
This is irreversible. We cannot restore a deleted account, and we cannot give you your study material back. Export or keep a copy of anything you care about first.
Backups and logs may retain fragments for a short period after deletion, but these expire automatically and are not accessible to us as user data.
Deleting your account does not cancel your subscription. Subscriptions are billed by Apple and must be cancelled in your App Store settings — see the Terms of Service. Delete the account without cancelling and Apple will keep charging you.
You have the right to:
You have the right to learn whether your data is processed; to request information about it; to learn its purpose and whether it is used accordingly; to know the third parties it is transferred to at home or abroad; to have it corrected if incomplete or inaccurate; to have it erased or destroyed when the grounds for processing disappear; to have corrections and erasures notified to third parties it was transferred to; to object to a result produced solely by automated analysis that works against you; and to claim compensation for damage caused by unlawful processing.
You may apply to us using the contact details at the top of this policy, or through the methods set out in the Communiqué on Application Procedures to the Data Controller.
Complaints: in Türkiye, to the Personal Data Protection Authority (KVKK / Kişisel Verileri Koruma Kurumu, kvkk.gov.tr). In the EEA, to the data protection authority of your country of residence.
Write to us at the privacy address above. We will respond within 30 days (KVKK) or within one month (GDPR, extendable by two further months for complex requests, in which case we will tell you). We do not charge for this, unless a request is manifestly unfounded or repetitive.
We may ask you to verify your identity first — we are not going to hand over one person's study data to someone claiming to be them.
Studel uses AI to generate quizzes, analyse past exams, and grade your open-ended answers. The grade an AI gives your practice answer is not a decision with legal or similarly significant effects on you — it is a study aid, in a practice quiz, that no institution sees. It does not determine your academic record, and nothing in Studel is reported to your school or university.
There is no profiling, and no automated decision-making within the meaning of Article 22 GDPR.
We protect your data with:
No system is perfectly secure, and we will not pretend otherwise. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and, where the risk is high, notify you directly and without undue delay.
We may update this policy as the Service changes. When we do, we will change the “Last updated” date at the top. If a change is material — a new category of data, a new processor, a new purpose — we will tell you in the app or by email before it takes effect, and where the law requires consent, we will ask for it.
Continuing to use Studel after a change takes effect means you accept the updated policy.
Questions, requests, or complaints about your data:
We read every message.