Privacy Policy: MyTA and MyTA Student
Who we are. MyTA (for instructors) and MyTA Student (for students) are provided by Deniz Karlı, İstanbul, Turkey (“we”). Contact: contact@mytaapp.com. We are the data controller. This policy covers both apps and the web dashboard (academy.mytaapp.com).
What we collect
MyTA (instructors)
- Account: name, e-mail address, user name and a password (stored as a hash).
- Your teaching content: classes, class lists with student numbers and section, attendance records and MyTA Passport check-ins, quizzes and polls with their results, messages you send to colleagues.
- An optional profile photo. It is stored on our server and shown to other instructors.
- Push-notification token and device information.
- Subscription and purchase history, handled through the App Store or Google Play and RevenueCat.
- Usage and crash data and app settings, collected with Firebase Analytics, Crashlytics and Remote Config.
MyTA Student (students)
- Account: user name or e-mail address, name and password (hashed); the student number and the classes you join.
- Your attendance records and MyTA Passport stamps: the time and timing measurements recorded when you check in, how the scanner performed (scan time, zoom, phone model), your app's version number, and a key that identifies your phone for Passport.
- Your quiz answers and poll votes; coins, game scores and your avatar choice; friend links you make with classmates.
- Push-notification token (Firebase Cloud Messaging). The student app does not use analytics or crash-reporting services.
Stays on your phone
The student names on class lists an instructor uploads stay on that instructor's phone and are not sent to our server. In MyTA Student, your lecture notes, photos, voice notes, My grades and calendar stay on your phone. Voice notes are turned into text on the phone itself. If you use your phone's backup (iCloud on iPhone, Google backup on Android), these files can be included in that backup, as with any app; they are not sent to us. The web dashboard keeps the class lists you load in your browser on your computer.
Camera, microphone, photos
The camera is used only to read QR codes and, in MyTA Student, to take pictures for your own notes; we do not store camera images on our servers. The microphone and speech recognition (MyTA Student) are used only for voice notes you record. Photos are used to save QR codes and, in MyTA, for the optional profile photo.
Security records
When attendance is recorded, our server keeps the time, the IP address and the browser/app identifier (User-Agent) of the request to detect abuse. We keep IP addresses and User-Agent strings recorded with attendance check-ins and subscription changes only as long as needed to detect and investigate abuse, and delete them when you delete your account where the record is tied to it. We also keep short-lived security counters to stop abuse: after a wrong password (instructor or student), the IP address and the account (as a one-way hash, not anonymous) are kept for 10 to 60 minutes to block guessing, then deleted automatically (the clean-up runs with later failed attempts, so an expired record can stay a little longer); for profile-photo access with the shared app key, an hourly counter keeps a non-reversible fingerprint of the request address (not the address itself) and the photo number for about one day; daily counters hold only a number, no IP address and no account.
We do not collect your location, show advertising, or use your data to track you across other companies' apps or websites.
Why we use it
To provide the service (accounts, classes, attendance, quizzes, polls, messages, subscriptions); to keep it secure and prevent abuse; to find and fix problems and improve the app; to send the notifications you ask for (for example “your attendance was recorded”); and to meet legal obligations. Our legal bases are performance of the contract, our legitimate interests in security and improving the service, your consent where we ask for it (for example notifications), and legal obligations. To improve how accurately MyTA Passport stamps work, we study stamp timing measurements, the app version used for the scan, and the instructor's stamp settings and decisions as an aggregated and de-identified statistical summary that contains no names, numbers, accounts, classes, institutions, exact dates or times, or locations. Instructor settings appear only at role level, never per person, and we use the summary only to tune the stamp thresholds and algorithm, not to rate any instructor or student. Only the authorised developer has access to it, we do not try to link it to anyone, and if we keep a file with row-level data, it is deleted after 90 days. Legal basis: our legitimate interest in improving the service (KVKK Art. 5/2-f, GDPR Art. 6(1)(f)). You can object at any time at contact@mytaapp.com.
Who processes it for us
Google Firebase (push notifications; in MyTA also analytics, crash reports and remote settings), RevenueCat (subscription management), Apple and Google (App Store and Google Play payments and notifications), and our hosting provider (Hostinger; our servers are in the Netherlands (EU) and backups are kept in Lithuania (EU)). Your data is therefore stored outside Turkey, in the EU. These providers act for us; some of them also process data outside Turkey and the EU. On the web dashboard, the first letters of a user name may be drawn by the avatar service ui-avatars.com when a person has no photo. We do not sell personal data. For this analysis we may use an AI service under commercial terms that do not allow training on our data and that keeps inputs for a limited period; it receives only aggregate tables, never row-level data.
How long we keep it, and deleting your account
We keep your data while your account exists. You can delete your account in the app (MyTA: Account › Delete account; MyTA Student: My Account › Edit Account › Delete Account) or on the web at mytaapp.com/deleteAccount.html. When you do, we delete: for instructors, your classes, sessions, attendance, quizzes, polls, messages, network links, profile photo and the account itself; for students, your profile, coins, game scores, Passport phone bindings and approvals, and the account itself. Friend links, stamp receipts and check-in security records are not deleted with the account; a student number an instructor added to a class list stays in that class. Deleting your account does not cancel an App Store or Google Play subscription: cancel it in your store account. The statistical summary of stamp measurements described under “Why we use it” is not linked to your account and holds no name, number or account, so deleting your account does not remove what it already contains. Some information can remain in backups for a short time. Records we are legally required to keep are kept as long as the law requires.
Your rights
You can ask to access, correct or delete your data, object to its processing and withdraw consent where we rely on it. You can object to the statistical use of stamp measurements described above (contact@mytaapp.com); after you object, your data is left out of new summaries, but it cannot be removed from aggregate tables already prepared. To apply your objection we keep your account number (without name or e-mail) on an objection list; you need to object separately for each of your accounts (for example if you have both an instructor and a student account, or if you delete your account and register again). The entry is removed from the list when you withdraw the objection or delete your account; the administrator action log keeps the account number and date for up to 400 days (about 13 months) for security and accountability. Write to contact@mytaapp.com. If you are in Turkey, the EU or the UK you also have the rights under the Turkish KVKK and the GDPR, including the right to complain to your data-protection authority. We do not sell personal information, so there is nothing to opt out of under US state laws such as the CCPA.
Children
The apps are for university students and instructors. They are not directed at children under 13 and we do not knowingly collect their data. If you believe a child gave us data, contact us and we will delete it.
Security
Data is sent over HTTPS. Passwords are stored as hashes. No method of storage or transmission is completely secure.
Changes
We update this page when our practices change and show the date at the top. Material changes are announced in the app or by e-mail.