1. Introduction

At Checkta ("we", "our", or the "application"), we place the highest priority on your privacy and data security. In accordance with the European Union General Data Protection Regulation (GDPR), applicable US state privacy laws (such as the California CCPA/CPRA), and the Turkish Personal Data Protection Law No. 6698 (KVKK), this Privacy Policy explains what personal data we collect when you use our application, the purposes for which we process it, with whom we share it, how long we retain it (data retention), and your rights as a data subject.

2. Data Controller

Under the GDPR and KVKK, the "Data Controller" that determines the purposes and means of processing your personal data is the Checkta application. For any inquiries regarding data protection, you may contact us at [email protected].

3. Personal Data We Process and Purposes of Processing

To provide and improve our services, we collect and process the following categories of personal data:

• Identity, Account, and Profile Information: When you register, we collect your first name, last name, email address, and password (stored in encrypted/hashed form). If you sign in with Google or Apple, we receive your basic profile information (name, email, profile picture) from those providers. In addition, optional information you may enter on your profile page—such as middle name, gender, birth date, city, country, hobbies, and about me—as well as the device fingerprint (deviceFingerprint) field defined in the customer record to prevent abuse of Trial Balance allowances (in the current client version, no automatic fingerprint is generated and this field remains empty/unrecorded), are processed to create your account, manage your profile, and maintain security.
• User Content: Content you create, such as text translations, chat messages, community forum posts, and uploaded media files, is processed and stored on our servers to perform the core functions of the service (translation, communication, and sharing).
• Contact Information: When you submit a support ticket or contact us, the email address and message content you share are processed to provide support and manage your requests.
• Error Logs and Call Connection Telemetry: To ensure service reliability and troubleshoot connection issues, browser error logs (page URL, error type, error message, and stack trace) and audio/video call connection telemetry (device type, call ID, and connection state events) are processed; your IP address is temporarily checked in server memory for request rate limiting.
• Phone Number and Friend Discovery: If you register with a phone number or use the friend discovery feature, your phone number is processed to verify your account and match you with people you know.
• Notification Tokens: Your device's push notification token (FCM token) is stored so we can send you instant notifications.
• Purchase Information: When you purchase tokens, payment is processed by Google Play. We do not see or store your payment card details; we only receive the transaction token and order number (orderId) to verify the purchase and maintain statutory accounting records.
• Token Usage and Balance Movement Records: For balance accounting, security, resolving potential billing or token disputes, and establishing or defending legal claims, each time a token movement occurs (text/chat/community translation, punctuation correction, live call block reservation and refund, avatar generation, image transformation, Trial Balance grant, email verification trial credit, trial expiration deduction, and token purchase), we record the date and time of the transaction, the action type, the AI provider and model name used, input/output token counts, the number of tokens deducted or added, the balance before and after the transaction, and the transaction reference ID (chat, session, topic, or payment identifier). The text you translate, your chat messages, audio recordings, and image content are never stored in this token usage ledger. You may request a statement of your token usage history at any time or view it through the in-app history screen when available.
• Security and Technical Logs: Application logs are maintained for service security, debugging, and abuse prevention.
• Audio and Video Calls: Our video and audio call services are conducted using peer-to-peer (P2P) technology. These calls are not stored on our servers, are not recorded, and are not shared with third parties. Real-time audio processing data used for the live subtitle/dubbing service is permanently deleted from our system once translation is completed.

4. Data Transfers and Data Processors

To deliver our services, we work with third-party infrastructure and technology providers acting as "Data Processors". Your data may be transferred to these partners as necessary to provide the service:

• Google (Firebase & Google Cloud): Our primary data processor for application infrastructure, database, authentication, storage, and artificial intelligence (Gemini) services. Your data is stored on Google's high-security servers.
• Amazon Web Services (AWS SES): Account-related emails (password reset, email verification, support replies) are sent via AWS's email service operating in Europe (Stockholm, Sweden). During delivery, your email address and email content pass through AWS.
• Cloudflare: Used for domain name (DNS) and inbound email routing services.
• Vultr: Our own mail server (for incoming emails sent to addresses such as [email protected]) is hosted on Vultr infrastructure in the United States.
• Google reCAPTCHA (Firebase App Check): Used to protect the service against automated attacks and abuse. Google may process data such as your IP address and browser information and may set its own cookies for this purpose.
• Cloudflare Web Analytics: Used to measure site performance and visit counts. It does not use cookies or local storage and does not track you across sites.
• Google Play and Sign in with Apple/Google: The respective platforms' own services are used for in-app purchases and authentication.
• Other AI Providers (OpenAI, Anthropic, Mistral AI, xAI, etc.): If you select a different AI model in the settings menu, the relevant text data is transmitted to the selected provider solely for the duration of the request and may be processed in that provider's regions (including the US and Europe). Please note that providers may process data in accordance with their own policies, including for service improvement. By using our service, you also agree to the privacy policy of the AI provider you select.

Data processors process your data primarily in accordance with our instructions, though their own terms of service and privacy policies may also apply. Reviewing those providers' policies is your responsibility.

5. Data Storage Locations and International Transfers

The application's primary database, servers, and file storage are located in Google Cloud's data center in the United States (Iowa, us-central1). Outbound email delivery is handled via AWS infrastructure in Europe (Sweden). AI providers process data in their respective regions. Consequently, your data may be transferred outside your country of residence. Such transfers rely on legal safeguards such as data processing agreements and standard contractual clauses (SCCs) with our providers.

6. Legal Basis for Processing Data

• Performance of a contract: Managing your account and providing translation, chat, and other core services.
• Legitimate interests and defense of legal claims: Ensuring security, preventing abuse and fraud, troubleshooting errors, resolving balance and billing disputes, and establishing, exercising, or defending legal claims.
• Explicit consent: Device permissions such as camera, microphone, and notifications, as well as optional features. You may withdraw your consent at any time.
• Legal obligation: Records and disclosures required by applicable tax, accounting, e-commerce, and consumer protection laws.

7. We Do Not Sell Your Data

We do not sell your personal data and do not share it with third parties for advertising purposes. We do not engage in cross-context behavioral advertising or tracking. We only use the services listed above to protect the service and measure performance.

8. Cookies and Local Storage

When you visit the site without signing in, Checkta does not set its own cookies. When you sign in and use the application, the following are used:

• Strictly necessary session cookie: Authentication cookie used to keep your session signed in.
• Browser local storage: Preferences such as your selected AI model, language preferences, recently used languages, theme, and layout settings are stored on your device.
• Firebase data (IndexedDB): Technical data such as session credentials, App Check tokens, and version state are stored in your browser's database.
• Third parties: Google reCAPTCHA may set cookies on its own domain. Cloudflare Web Analytics does not use cookies.

None of this storage is used for advertising purposes. You can clear cookies and site data through your browser settings; doing so will sign you out and reset your local preferences.

9. Age Requirement

Checkta may only be used by individuals who are at least 18 years old. If the legal age of majority in your country or jurisdiction is higher, you must meet that higher age requirement. We do not provide services to individuals under 18 and do not knowingly collect personal data from them. If we become aware of an account belonging to someone under the age requirement, we will delete the account and its data. To report such an account, please contact [email protected].

10. Data Security and Encryption

We take appropriate technical and organizational measures to safeguard your data. Your data is encrypted both in transit (SSL/TLS) between your device and our servers and at rest (At-Rest Encryption) on our servers. Database access is protected by strict security rules (Firestore Security Rules) ensuring that each user can only access their own private data.

11. Data Retention

Your personal data is retained for as long as your Checkta account remains active. When you request to delete your account, your account is suspended for 30 days; during this period, you may sign in again to cancel the deletion and restore your account. Once the 30-day period expires (on day 31), your authentication record, name, email address, profile data, media files linked to your account, and any remaining token balance are permanently deleted (remaining tokens are non-refundable). Community posts and comments you have shared are not deleted, but their author attribution is anonymized as "Deleted Member" and unlinked from your profile.

Retention of Token Usage and Payment Records (10 Years): Token balance movement records and purchase/payment verification records are retained for 10 years from the transaction date for balance accounting, statutory retention obligations, resolving potential billing or usage disputes, and defending legal claims, and are automatically deleted when this retention period expires. When your account is permanently deleted on day 31, your name, email address, and profile data are deleted; however, token usage records and payment records continue to be retained for this retention period without identity information (with your user identifier pseudonymized via a one-way cryptographic hash) and under restricted access for legal obligations and the defense of legal claims. Content shared with other users (such as messages in another user's chat) and system backups may also be retained for a limited period.

12. Your Rights Under Turkish Data Protection Law (KVKK Article 11)

If you are located in Turkey, under KVKK Article 11 you have the following rights as a data subject regarding your personal data:

• To learn whether your personal data is processed,
• To request information if your personal data has been processed,
• To learn the purpose of processing and whether data is used in accordance with that purpose,
• To know the third parties to whom your personal data is transferred domestically or abroad,
• To request correction if your personal data is incomplete or inaccurately processed,
• To request deletion or destruction of your personal data under the conditions set forth in Article 7 of the KVKK,
• To request notification of correction, deletion, or destruction operations to third parties to whom your personal data has been transferred,
• To object to unfavorable outcomes resulting from analysis of your data exclusively through automated systems,
• To request compensation for damages incurred due to unlawful processing of your personal data.

To exercise these rights, you may contact us at [email protected].

13. Your Rights Under the GDPR and US State Privacy Laws

• To access your personal data, obtain a copy, and request data portability,
• To request rectification of inaccurate personal data,
• To request erasure (deletion) of your personal data,
• To object to processing or request restriction of processing,
• For data processed based on consent, to withdraw your consent at any time,
• In California and other applicable US states: to know what personal data is collected, to request deletion or correction, and to opt out of the sale or sharing of personal data (we do not sell or share your data for advertising). You will not be discriminated against for exercising your privacy rights,
• To lodge a complaint with the data protection supervisory authority in your country of residence.

We respond to verifiable requests within 30 days. We may need to verify your identity before fulfilling a request.

14. Data Breach Notification and Vulnerability Reporting

In the event of a security breach affecting your personal data, we will notify the relevant supervisory authorities and affected users within the timeframes required by law. If you believe you have discovered a security vulnerability, please report it to [email protected].

15. Changes to This Policy

We may update this Privacy Policy from time to time. Changes become effective as soon as they are published on this page.