Privacy Policy

1. Scope and controller

This policy covers www.nektar.dev, the Nektar mobile app, and connected support, waitlist, learning, community, Scanner and subscription features. Nektar is operated by Ömer Doğan (Nektar).

The Data Processing Notice summarises core processing and legal bases. Neither document is a consent form. A genuinely optional purpose that requires consent is presented as a separate choice.

2. Information we handle

• Account and profile: email, sign-in provider identifier, name, username, birth date, account status, exam and study preferences, and optional profile image or social links.
• Learning and community: answers, scores, progress, saved words, AI prompts and responses, feedback, messages, reports, and content you deliberately publish.
• Scanner: an image you select from the camera or library, the resulting analysis, and Scanner history linked to your account.
• Website forms: waitlist name, email, exam, language, source page, placement and, if allowed, attribution; contact message, optional email and basic device/browser details.
• Technical and commercial data: app version, device and operating system, network and security records, push token, crash data, consent signals, and subscription or purchase status.
• Consent-based site analytics: random visitor and session IDs, pathname only, query-free external referrer, section views, duration, visibility, screen size, browser details and interaction coordinates. The server stores a one-way IP hash rather than the plain IP.
• IELTS Writing and Speaking practice: your Writing response, task and word count; and the transcript generated from a Speaking recording, recording duration, speaking-rate and other assessment metrics. These records are linked to your account.

3. Website analytics, cookies and advertising

Necessary language, region and privacy storage keeps the site working. Google Analytics, Nektar’s first-party site analytics and attribution load only with analytics permission. Meta Pixel and Google AdSense load only with marketing permission. Optional categories are off on the first visit and can be changed from Cookie settings in the footer.

Aggregate content counters operate independently of analytics preferences. They retain only the Istanbul calendar day, a broad content category, and totals for page openings and store-link clicks. These counters use no cookies, visitor IDs or session IDs. IP addresses, device details, full page URLs and referrers are not stored in the counter database. Network requests pass through hosting infrastructure and may be subject to its separate operational/security logs. These counts are separate from person-level behavioral analytics.

Third-party advertising providers, including Google, may use cookies with your permission to serve ads based on earlier visits to this website or other websites. Google’s advertising cookies may allow Google and its partners to personalise ads using those visits. You can turn off personalised advertising in Google Ads Settings and review other advertising providers and their choice tools on the relevant provider pages.

Even when analytics is enabled, full URLs, general query parameters and fragments are not recorded; only allowlisted UTM campaign fields may be retained separately for attribution. This keeps password-recovery tokens and similar sensitive URL parts out of analytics. Optional tracking is disabled on admin, sign-in and password-reset routes.

4. Scanner and AI

When you use Scanner, the selected image may be uploaded to Nektar-controlled storage, sent to an AI provider such as OpenAI or Google Gemini for the analysis you request, and retained in your Scanner history. Camera permission does not provide continuous camera access; only media you select or capture for the feature is processed.

IELTS Writing responses are sent to the configured AI provider (OpenAI, Anthropic or Google Gemini) to generate the requested feedback. IELTS Speaking recordings are sent to Google Gemini for transcription and audio assessment. The content needed to provide these services is transmitted to the provider; provider-side processing and retention are subject to that provider’s terms and settings.

In the Speaking flow, Nektar does not save the raw audio file to its database or file storage. Nektar stores the transcript, evaluation and feedback, duration/speaking metrics, model information, and the audio’s SHA-256 fingerprint and media type. The fingerprint is not the recording itself. Audio is held temporarily in browser memory while you record and submit it.

AI explanations may be incomplete, incorrect or biased. They are educational support, not professional advice or a guaranteed exam result. Nektar does not use stored scans to train its own models. A future model-development purpose would need a documented legal basis and, where required, a separate optional choice.

• Do not upload faces, identity documents, health data, confidential documents or another person’s personal information.
• Do not scan copyrighted exam books or private material you are not allowed to reproduce.

5. Providers, recipients and transfers

Depending on the feature, relevant data may be handled by Supabase for hosting and databases; OpenAI, Anthropic and Google Gemini for AI; Apple and Google for authentication and store services; Microsoft Clarity for app analytics; Google AdMob/AdSense and Meta for ads; Expo for notifications; Adapty for subscriptions; and related infrastructure providers.

Some providers may process data outside Türkiye or your country. Nektar must use the transfer route required by applicable law, such as an adequacy decision, standard contract, binding corporate rules, approved undertaking or another suitable safeguard. Consent is not a blanket substitute where another safeguard is required.

6. Retention, security and deletion

We aim not to retain data longer than needed for the purpose, account continuity, security, disputes, payments and legal records. Account and learning data is generally kept while the account is active. Scanner files and learning history may remain until you delete the item or account or request deletion, unless a documented shorter period applies.

IELTS Writing responses are stored in submission and evaluation records. Speaking transcripts and evaluations are stored in submission and evaluation records. We have not set a separate automatic deletion period for these IELTS records; they may remain linked to your account until account deletion or a verified deletion request is completed. Deleting a Speaking submission may not automatically delete an evaluation/history record already created from it. Contact destek@nektar.dev to request deletion. Backups and AI-provider copies can follow separate technical or legal schedules.

The account-deletion flow removes account data and files under Nektar’s direct control. Store transaction records, short-lived security logs, backups or provider copies can follow separate legal and technical schedules. Access controls and transport protections are used, but no system can promise absolute security.

7. Children and teenagers

Enter the correct birth date. Rules vary by country. In the United States, collecting personal information from a child under 13 can require direct parental notice and verifiable parental consent. In Spain, consent-based processing for a child under 14 requires a parent or legal guardian. EEA and UK rules also call for age-appropriate explanations and high-privacy defaults.

A child ticking a statement for an adult is not verified parental permission. Do not create a younger user’s account or send sensitive information until the required guardian process is complete.

8. Choices and rights

You can change profile visibility, notifications and available app privacy choices in the app, and website cookie choices from the footer. Depending on local law, you may have rights of access, correction, deletion, restriction, portability, objection and complaint, and the right to withdraw consent without affecting earlier lawful processing.

Send requests to destek@nektar.dev. We may verify your identity proportionately before acting. Automated learning recommendations personalise study and do not make decisions with legal or similarly significant effects.

9. Changes

Where advance notice is required, material changes will be shown on the website, in the app or through another appropriate channel before they take effect. The date at the top identifies the current version.