Privacy Policy
Last updated: 26 October 2026This policy explains what personal data the Diksy mobile app (an AI-powered presentation and speaking coach) collects, why it is processed, who it is shared with and how you can exercise your rights. Turkish version: Gizlilik Politikası (Türkçe).
1. Data controller
Dode Yazılım (“we”) develops Diksy and is the data controller.
Privacy and data requests: [email protected]
General support: [email protected]
Your video never leaves your device. Footage you record with the camera is stored only on your phone and is not uploaded to our servers. Only the audio of your speech is sent, temporarily, for analysis (see section 3).
2. Data we collect
| Category | What | Source |
|---|---|---|
| Account | Email address, display name, (optional) profile photo, user ID, language, your device’s time zone, user type and industry | Sign in with Google or Apple, or email sign-up; profile and onboarding screens |
| Presentation recordings | Audio of your speech (temporary), transcript with timestamps, presentation title, type, target audience and optional slide outline | Your recording and the details you enter |
| Metrics and analysis | Speaking pace, filler words, vocal energy, eye-contact percentage, scores, AI coaching suggestions, anticipated Q&A and audio-coaching scripts | Derived from your recording; eye contact is measured on your device and only the percentage is sent |
| Documents | Presentation files (PDF) you upload for content analysis and their AI summary | Only if you upload them |
| Drills and interview simulation | Short answer recordings (temporary), their transcripts, questions and AI feedback | If you use these features |
| Progress | Daily streak, badges, daily statistics, mistakes to review, usage quota | In-app usage |
| Subscription | Subscription status and purchase record | App Store / Google Play via RevenueCat |
| Technical | App version, device and OS information, crash and error logs | Automatic |
We do not show ads or track you across other companies’ apps or websites. We use PostHog to understand product usage and Sentry for error and performance diagnostics; neither is used for advertising or cross-app tracking.
We do not see your card details. All purchases go through the App Store or Google Play; card and billing details stay with Apple/Google. We process subscription status and the product, price and currency of a purchase; these are not card details.
3. Your audio and AI processing
- When you analyse a presentation, the audio of your speech is uploaded to a private storage area that only your account can access. The audio file is deleted once the analysis completes; only the transcript and results remain. If the app cannot delete it for any reason, the audio file is removed by automatic clean-up within about 24 hours of the analysis.
- If an analysis fails midway, the audio file is kept briefly so you can retry, and is deleted automatically about 24 hours after the last attempt.
- Short drill and interview answer recordings are deleted right after they are transcribed; if that deletion fails, the recording is removed by automatic clean-up within about 24 hours.
- For transcription, analysis, coaching and text-to-speech, your audio, transcript and the necessary context (presentation type, audience, language) are sent to our AI provider OpenAI while the request runs. Under OpenAI’s API terms this data is not used to train models and may be retained for up to 30 days for abuse monitoring.
- Scores, feedback, suggestions and audio coaching in the app are generated by AI and may be inaccurate or incomplete.
- We do not use your recordings for identification or biometric recognition.
Content safety
Free text sent to the AI (for example a slide outline, a drill sentence, an interview answer, the text of a document you upload or a transcript) goes through automated content moderation before anything is generated: a word list and OpenAI’s moderation and classification models look for sexual, violent or otherwise harmful content. Some AI outputs are checked the same way before they are shown to you. If moderation rejects a request, nothing is generated; after several rejections in a short time, new requests are paused temporarily. Rejection events are logged against your account with only the feature, the type of rejection and the time; the rejected text itself is not stored. If an account triggers many rejections in a short time, your user ID (without any text) is sent to our error-monitoring provider Sentry as an abuse alert.
Presentation Studio
The topic or text you enter in Presentation Studio, any PDFs and photos you choose, and the text extracted on your device from PowerPoint and Word files are sent to OpenAI to generate a slide plan and script — the PowerPoint/Word files themselves are never uploaded, only that extracted text. Your files and photos are not stored; a PDF is deleted from OpenAI once the request completes. The generated plan is stored in your account; you can delete it at any time, and it is deleted with your account. Your topic or text, the extracted file text and your photos are moderated before anything is generated; a PDF's content is instead checked in the generated result. Rehearsal reports created from a plan keep their own slide titles even if the plan is later deleted — they are removed only when you delete that report or your account.
4. Why we process your data
- Providing the service: analysing your recordings, coaching, drills, progress tracking and managing your account. Daily and monthly usage quotas and your daily streak are counted from your local midnight, using the time zone taken from your device and stored with your account; if no time zone is stored, UTC is used.
- Subscriptions: verifying access to Pro features and tracking the free quota.
- Communication: verification-code and password-reset emails, the weekly progress email (if you turn it on) and (if you allow them) reminder notifications scheduled on your device.
- Security and improvement: finding and fixing errors, preventing abuse.
The weekly progress email is off by default for new accounts; it is only sent if you opt in, and you can turn it on or off at any time in Settings. Every email contains a one-click unsubscribe link. Reminder notifications are only sent if you grant permission.
Legal bases
Under the GDPR (Art. 6) and Turkish KVKK (Art. 5) we rely on performance of a contract (to provide the service), consent (analysing your audio, document uploads, the weekly email, notifications) and legitimate interests (security, abuse prevention, fixing technical errors). You can withdraw consent at any time.
5. Share links
If you create a share link for a presentation report, anyone with the link can see that report’s title, overall score, coaching summary and suggestions, speaking pace and filler-word count. Your audio, video and transcript are never shared. Links exist only if you create them, and you can disable one at any time from the Public Share Links screen with Revoke.
When a link is created, its title and the text to be shared go through automated content moderation. The page shows the title as it was when the link was created; renaming the presentation later does not change the share page. Anyone who opens the page can flag the link with Report; a reported link is taken down until it has been reviewed. We do not store the reporter’s IP address or browser details; to recognise repeat reports from the same person on the same day we keep only a one-way digest derived from them.
If you upload a profile photo, it is stored at a location that anyone who knows its address can open.
6. Who we share data with
We do not sell your data or share it for advertising. We use these providers to run the service:
| Provider | Purpose | Data |
|---|---|---|
| Supabase | Database, authentication, file storage, server functions | Account, recording and analysis data, temporary audio, documents (EU — Frankfurt) |
| OpenAI | Speech-to-text, analysis, coaching, text-to-speech, content moderation, presentation plan generation | Audio, transcript and context while a request runs; in Presentation Studio also the text, documents and photos you provide (US) |
| RevenueCat | Subscription management | User ID, subscription status |
| Apple / Google | Sign-in and payments | Account ID, purchase record |
| Resend | Email delivery | Email address, display name, email content |
| PostHog | Optional product analytics | Installation ID, usage and purchase-funnel events, product/price/currency, platform and OS (EU; eu.i.posthog.com) |
| Sentry | Crash, error and performance diagnostics | Reports linked to a Supabase user UUID, performance traces, screen template, app state and memory-warning count |
Some providers are located outside Türkiye and the EU (e.g. the US). These transfers are made under the providers’ data processing agreements and standard contractual clauses. We do not share your data with authorities unless legally required.
PostHog product analytics and your choices
We use PostHog to improve the service and purchase flow. We send app-open events, paywall views (whether it loaded and package count), purchase started/completed/cancelled/failed and restore events. Where relevant, events include product ID, price, currency and whether a restored subscription is active, along with app, platform and operating-system information.
The identifier is an anonymous installation ID generated on the device. It is not linked to an
account; we do not use identify or alias. Data goes to the EU region at eu.i.posthog.com.
IP-based geographical enrichment is disabled with $geoip_disable=true. We use no
advertising ID, cross-app tracking, data sales or advertising-related sharing.
EU/EEA, United Kingdom and Switzerland: product analytics runs only with your explicit consent and is off by default. You can withdraw consent at any time in Settings → Privacy → Usage analytics. If your region cannot be determined, we also ask for consent and keep analytics off until you agree.
Other regions: the legal basis is our legitimate interest in improving the service (GDPR Article 6(1)(f), where applicable). Analytics is on by default; you may object and switch it off at any time in the same Settings section.
Where consent is required, until it is given, or whenever analytics is off, no persistent analytics ID is created and no events are sent. Withdrawing consent or switching analytics off stops events and deletes the analytics ID on the device. Account deletion also deletes that on-device ID.
PostHog retention: up to 1 year. Historical anonymous events are not linked to an account and cannot be matched to an account-based deletion or export request. Opting out or deleting an account does not delete those past server events by account. To object or make a data request, contact [email protected].
Sentry error and performance diagnostics
Sentry processes crash and error reports, performance traces, app/device/OS versions, the screen
template name (for example presentation/[id]; this field contains no actual presentation
ID), app state and memory-warning count. Reports are linked to your Supabase user ID (UUID), not
only for moderation alerts. The user identity is cleared on sign-out; earlier reports may remain
for up to 90 days. The purpose is service reliability and fixing technical problems. The Usage
analytics switch does not disable Sentry; these diagnostics continue.
7. Retention and deletion
- Your data is kept while your account is open. Temporary audio is deleted as described in section 3.
- You can revoke share links in the app at any time. You can delete a single recording in the app; any audio or document files of that presentation left on our servers are removed by automatic clean-up. To have other data deleted, email [email protected].
- If you delete your account in the app, your profile, all recordings, transcripts, analyses, documents, audio files, interview simulations, progress data and share links are deleted permanently. This cannot be undone. Details: Account deletion.
- If you use the same Google/Apple/email account in other Dode Yazılım apps, only your Diksy data is deleted; your sign-in account is kept for those apps.
- If you signed in with Apple, deleting your account also revokes the sign-in authorization Apple granted to this app.
- Deleted data may remain in our provider’s automatic backups for up to 30 days before it expires. Purchase records are kept by Apple and Google under their own policies.
- Videos saved on your device are under your control; deleting the app or removing them from your gallery deletes them.
8. Your rights
Under the GDPR and KVKK you have the right to:
- know whether your data is processed and access it,
- have inaccurate or incomplete data corrected,
- have your data deleted,
- receive your data in a structured format (in the app: Profile → Export my data),
- object to processing and withdraw consent,
- lodge a complaint with a supervisory authority (in Türkiye, the Personal Data Protection Authority; in the EU, your local authority).
Send requests to [email protected]; we respond within 30 days.
9. Security
All traffic is encrypted (HTTPS/TLS). Your session is stored encrypted on your device. Recordings and files are kept in areas private to your account and protected by row-level access rules. No system is 100% secure, however.
10. Children
Diksy is not directed to children under 13 and we do not knowingly collect their data. If you are under 18, use the app only with a parent’s or guardian’s consent. If we learn we have collected data from a child under 13, we delete it promptly.
11. Changes
We may update this policy. We will notify you in the app about significant changes. The effective date at the top shows the latest version.
12. Contact
Privacy and data requests: [email protected]
Support: [email protected]
Content safety and screening
For rejected content, a rejection timestamp and reason code are associated with the account; the rejected prompt, audio, image or output is not included in that rejection record. Rejection records are deleted with the app account data. A manually applied AI access restriction is a separate security record and may remain while the shared sign-in identity exists to prevent deletion from bypassing the restriction. Contact support about restrictions or appeals.
Updated: 17 October 2026.
5-minute Pro gift and device identifier
To give the Pro gift only once per account and device, the app sends a device identifier to our server: on iOS a random identifier created in the app's keychain, on Android the ANDROID_ID, on the web a random identifier stored in the browser. The server turns this identifier and your account's email address (only if the address is verified; it is taken from your signed-in account, not from the app) into irreversible keyed hashes (HMAC-SHA256). The raw identifier is not stored, and no separate copy of your email address is kept for this purpose. The gift starts when the device identifier is first sent while the gift is offered. The copies tied to your account (the device and email hashes and your gift usage: start date, remaining seconds, number of recordings) are deleted when your account's app data is deleted. If your gift has started, separate "already used" hash records are also kept for at most 24 months so the gift cannot be claimed again with the same device or email, and are then deleted automatically. These records hold the hashes, the date and your account's random user ID; they contain no name or email address. The legal basis is our legitimate interest in protecting the service against abuse. The identifier is not used for advertising or tracking and is not shared with third parties.
Updated: 26 October 2026.