Privacy Policy

Last updated: 26 October 2026

This policy explains what personal data the Diksy mobile app (an AI-powered presentation and speaking coach) collects, why it is processed, who it is shared with and how you can exercise your rights. Turkish version: Gizlilik Politikası (Türkçe).

1. Data controller

Dode Yazılım (“we”) develops Diksy and is the data controller.
Privacy and data requests: [email protected]
General support: [email protected]

Your video never leaves your device. Footage you record with the camera is stored only on your phone and is not uploaded to our servers. Only the audio of your speech is sent, temporarily, for analysis (see section 3).

2. Data we collect

CategoryWhatSource
Account Email address, display name, (optional) profile photo, user ID, language, your device’s time zone, user type and industry Sign in with Google or Apple, or email sign-up; profile and onboarding screens
Presentation recordings Audio of your speech (temporary), transcript with timestamps, presentation title, type, target audience and optional slide outline Your recording and the details you enter
Metrics and analysis Speaking pace, filler words, vocal energy, eye-contact percentage, scores, AI coaching suggestions, anticipated Q&A and audio-coaching scripts Derived from your recording; eye contact is measured on your device and only the percentage is sent
Documents Presentation files (PDF) you upload for content analysis and their AI summary Only if you upload them
Drills and interview simulation Short answer recordings (temporary), their transcripts, questions and AI feedback If you use these features
Progress Daily streak, badges, daily statistics, mistakes to review, usage quota In-app usage
Subscription Subscription status and purchase record App Store / Google Play via RevenueCat
Technical App version, device and OS information, crash and error logs Automatic

We do not show ads or track you across other companies’ apps or websites. We use PostHog to understand product usage and Sentry for error and performance diagnostics; neither is used for advertising or cross-app tracking.

We do not see your card details. All purchases go through the App Store or Google Play; card and billing details stay with Apple/Google. We process subscription status and the product, price and currency of a purchase; these are not card details.

3. Your audio and AI processing

Content safety

Free text sent to the AI (for example a slide outline, a drill sentence, an interview answer, the text of a document you upload or a transcript) goes through automated content moderation before anything is generated: a word list and OpenAI’s moderation and classification models look for sexual, violent or otherwise harmful content. Some AI outputs are checked the same way before they are shown to you. If moderation rejects a request, nothing is generated; after several rejections in a short time, new requests are paused temporarily. Rejection events are logged against your account with only the feature, the type of rejection and the time; the rejected text itself is not stored. If an account triggers many rejections in a short time, your user ID (without any text) is sent to our error-monitoring provider Sentry as an abuse alert.

Presentation Studio

The topic or text you enter in Presentation Studio, any PDFs and photos you choose, and the text extracted on your device from PowerPoint and Word files are sent to OpenAI to generate a slide plan and script — the PowerPoint/Word files themselves are never uploaded, only that extracted text. Your files and photos are not stored; a PDF is deleted from OpenAI once the request completes. The generated plan is stored in your account; you can delete it at any time, and it is deleted with your account. Your topic or text, the extracted file text and your photos are moderated before anything is generated; a PDF's content is instead checked in the generated result. Rehearsal reports created from a plan keep their own slide titles even if the plan is later deleted — they are removed only when you delete that report or your account.

4. Why we process your data

The weekly progress email is off by default for new accounts; it is only sent if you opt in, and you can turn it on or off at any time in Settings. Every email contains a one-click unsubscribe link. Reminder notifications are only sent if you grant permission.

Legal bases

Under the GDPR (Art. 6) and Turkish KVKK (Art. 5) we rely on performance of a contract (to provide the service), consent (analysing your audio, document uploads, the weekly email, notifications) and legitimate interests (security, abuse prevention, fixing technical errors). You can withdraw consent at any time.

5. Share links

If you create a share link for a presentation report, anyone with the link can see that report’s title, overall score, coaching summary and suggestions, speaking pace and filler-word count. Your audio, video and transcript are never shared. Links exist only if you create them, and you can disable one at any time from the Public Share Links screen with Revoke.

When a link is created, its title and the text to be shared go through automated content moderation. The page shows the title as it was when the link was created; renaming the presentation later does not change the share page. Anyone who opens the page can flag the link with Report; a reported link is taken down until it has been reviewed. We do not store the reporter’s IP address or browser details; to recognise repeat reports from the same person on the same day we keep only a one-way digest derived from them.

If you upload a profile photo, it is stored at a location that anyone who knows its address can open.

6. Who we share data with

We do not sell your data or share it for advertising. We use these providers to run the service:

ProviderPurposeData
SupabaseDatabase, authentication, file storage, server functionsAccount, recording and analysis data, temporary audio, documents (EU — Frankfurt)
OpenAISpeech-to-text, analysis, coaching, text-to-speech, content moderation, presentation plan generationAudio, transcript and context while a request runs; in Presentation Studio also the text, documents and photos you provide (US)
RevenueCatSubscription managementUser ID, subscription status
Apple / GoogleSign-in and paymentsAccount ID, purchase record
ResendEmail deliveryEmail address, display name, email content
PostHogOptional product analyticsInstallation ID, usage and purchase-funnel events, product/price/currency, platform and OS (EU; eu.i.posthog.com)
SentryCrash, error and performance diagnosticsReports linked to a Supabase user UUID, performance traces, screen template, app state and memory-warning count

Some providers are located outside Türkiye and the EU (e.g. the US). These transfers are made under the providers’ data processing agreements and standard contractual clauses. We do not share your data with authorities unless legally required.

PostHog product analytics and your choices

We use PostHog to improve the service and purchase flow. We send app-open events, paywall views (whether it loaded and package count), purchase started/completed/cancelled/failed and restore events. Where relevant, events include product ID, price, currency and whether a restored subscription is active, along with app, platform and operating-system information.

The identifier is an anonymous installation ID generated on the device. It is not linked to an account; we do not use identify or alias. Data goes to the EU region at eu.i.posthog.com. IP-based geographical enrichment is disabled with $geoip_disable=true. We use no advertising ID, cross-app tracking, data sales or advertising-related sharing.

EU/EEA, United Kingdom and Switzerland: product analytics runs only with your explicit consent and is off by default. You can withdraw consent at any time in Settings → Privacy → Usage analytics. If your region cannot be determined, we also ask for consent and keep analytics off until you agree.

Other regions: the legal basis is our legitimate interest in improving the service (GDPR Article 6(1)(f), where applicable). Analytics is on by default; you may object and switch it off at any time in the same Settings section.

Where consent is required, until it is given, or whenever analytics is off, no persistent analytics ID is created and no events are sent. Withdrawing consent or switching analytics off stops events and deletes the analytics ID on the device. Account deletion also deletes that on-device ID.

PostHog retention: up to 1 year. Historical anonymous events are not linked to an account and cannot be matched to an account-based deletion or export request. Opting out or deleting an account does not delete those past server events by account. To object or make a data request, contact [email protected].

Sentry error and performance diagnostics

Sentry processes crash and error reports, performance traces, app/device/OS versions, the screen template name (for example presentation/[id]; this field contains no actual presentation ID), app state and memory-warning count. Reports are linked to your Supabase user ID (UUID), not only for moderation alerts. The user identity is cleared on sign-out; earlier reports may remain for up to 90 days. The purpose is service reliability and fixing technical problems. The Usage analytics switch does not disable Sentry; these diagnostics continue.

7. Retention and deletion

8. Your rights

Under the GDPR and KVKK you have the right to:

Send requests to [email protected]; we respond within 30 days.

9. Security

All traffic is encrypted (HTTPS/TLS). Your session is stored encrypted on your device. Recordings and files are kept in areas private to your account and protected by row-level access rules. No system is 100% secure, however.

10. Children

Diksy is not directed to children under 13 and we do not knowingly collect their data. If you are under 18, use the app only with a parent’s or guardian’s consent. If we learn we have collected data from a child under 13, we delete it promptly.

11. Changes

We may update this policy. We will notify you in the app about significant changes. The effective date at the top shows the latest version.

12. Contact

Privacy and data requests: [email protected]
Support: [email protected]

Content safety and screening

For rejected content, a rejection timestamp and reason code are associated with the account; the rejected prompt, audio, image or output is not included in that rejection record. Rejection records are deleted with the app account data. A manually applied AI access restriction is a separate security record and may remain while the shared sign-in identity exists to prevent deletion from bypassing the restriction. Contact support about restrictions or appeals.

Updated: 17 October 2026.

5-minute Pro gift and device identifier

To give the Pro gift only once per account and device, the app sends a device identifier to our server: on iOS a random identifier created in the app's keychain, on Android the ANDROID_ID, on the web a random identifier stored in the browser. The server turns this identifier and your account's email address (only if the address is verified; it is taken from your signed-in account, not from the app) into irreversible keyed hashes (HMAC-SHA256). The raw identifier is not stored, and no separate copy of your email address is kept for this purpose. The gift starts when the device identifier is first sent while the gift is offered. The copies tied to your account (the device and email hashes and your gift usage: start date, remaining seconds, number of recordings) are deleted when your account's app data is deleted. If your gift has started, separate "already used" hash records are also kept for at most 24 months so the gift cannot be claimed again with the same device or email, and are then deleted automatically. These records hold the hashes, the date and your account's random user ID; they contain no name or email address. The legal basis is our legitimate interest in protecting the service against abuse. The identifier is not used for advertising or tracking and is not shared with third parties.

Updated: 26 October 2026.