Privacy Policy
Last updated: 9 September 2026 · Version 1.0
Keşif Kutusu is an educational platform for children. Our approach to privacy can therefore be summed up in a single sentence: collect the least possible data from a child.
1. What we never collect
We do not ask students for:
- E-mail address or phone number
- National ID number
- Address or date of birth
- Photos, audio or video recordings
- Location data
A student joins the platform with only a class code, first name and school number.
2. No ads, no tracking
No advertising is shown on the platform, and no ad networks or behavioural tracking cookies are used. Children’s data is never used, sold or rented for profiling or marketing.
3. Browser storage
We use no advertising cookies. Browser storage (localStorage) is used only where it is needed for the service to work:
| Item | Purpose | Duration |
|---|---|---|
| Session | Keeping you signed in | Until you sign out |
| Language preference | Turkish/English choice | Until you change it |
| Parent access code | Convenience when reopening a report | Until you clear it |
Clearing your browser data removes these items; your account is unaffected.
4. Security measures
- Passwords are irreversible: the student’s 4-digit PIN is hashed with scrypt; neither the teacher nor we can read it.
- IP addresses are never stored raw: only a salted hash is kept.
- Brute-force protection: after 5 wrong password attempts the account is locked for 15 minutes.
- Row-level access control: each teacher can only see their own class’s data; this is enforced at the database level.
- Encrypted connection: all traffic is carried over HTTPS.
- Audit trail: operations on personal data are written to an audit log.
5. Error reports
When something goes wrong we keep a technical record so the problem can be fixed. These records are cleaned automatically before they are sent: a child’s name, school number, e-mail and password-like strings are masked. If cleaning fails, the record is not sent at all.
6. Who sees what
| Role | Can see |
|---|---|
| Student | Only their own progress and badges |
| Teacher | Only the progress of students in their own classes |
| School administrator | Class and section summaries for their own school |
| Parent | Only their own child’s report |
7. Deletion of data
Records are deleted automatically once their retention period expires. For a student who leaves the school, identifying details are deleted and progress data is anonymised by breaking its link to the person. For deletion requests, contact your school or bilgi@kesifkutusu.com.tr.
8. Changes
When this policy is updated, the version number and date change; schools are informed of significant changes.
Questions: bilgi@kesifkutusu.com.tr
Privacy Notice · Terms of Use · Türkçe · Home