The short version
What we sell is teaching, not data. Everything we collect is there either to run the product or to measure your learning. We do not sell your data and we do not use it for advertising.
This document is a draft and has not been reviewed by a lawyer.
Who is responsible
[FULL NAME] · [ADDRESS] · destek@shipaiengineer.com
What we collect
Account data. Name, email address, a derivation of your password (the password itself is never stored: what is stored is the output of a slow, salted, per-user derivation), and when the account was created.
Session data. A hash of the session token in your browser, and when the session started and expires. The token itself is never in the database.
Learning data. Which lessons you completed and when, quiz answers, exercise attempts, which level of help you asked for, your streak counter, capstone submissions and any repository URLs you provide.
Mentor conversations. The mentor is currently switched off, so no new conversations are created. When it is on, what you write to it and what it answers are stored against your account so your history survives a page reload.
Payment data. Payments run through Polar (polar.sh). Your card details never reach us: you enter them on Polar's checkout page. Because Polar is the seller of record for the purchase, what you give it at checkout is processed under Polar's own privacy policy. We hold only which package you bought, when, and the provider's transaction reference.
Technical data. To limit sign-in, sign-up and password-change attempts, the IP address of a caller without an account is stored in the database for the length of the counting window (one hour at most); expired rows are deleted regularly. Elsewhere the IP is only held briefly in memory. Server error logs are kept for 30 days at most.
Visit statistics. We count page views and measure page speed with Cloudflare Web Analytics. It sets no cookies, does not recognise you between visits and does not store your IP address; what we see are totals (which page, which country, which referring site).
Why we collect it (legal basis)
- Performance of the contract: account, access, progress, mentor.
- Legitimate interest: abuse prevention, rate limiting, security.
- Explicit consent: newsletter only, separate and revocable.
- Legal obligation: invoices and accounting records.
Who else sees it
- Polar: taking payment, refunds, subscriptions. What goes: name, email, country, amount; card details are entered directly with Polar.
- Cloudflare: running the application (servers, network) and visit statistics (Web Analytics, cookieless). What goes: the technical data sent with every request (IP address, browser details, the page asked for).
- Neon: database (Frankfurt, Germany). What goes: all account, learning and submission data.
- Language model provider (when the mentor is on): generating mentor replies. What goes: the text you send the mentor.
⚠️ The AI mentor is currently switched off; while it is off, nothing goes to any model provider. When it is on, what you type to it is sent to a third-party model that generates the reply, and the provider is named in this table before the mentor opens. So do not put personal data, customer data, real API keys or secrets into it. The course teaches this rule; we are applying it to ourselves here.
Beyond these, we share nothing. If a legal obligation arises (a court order, say), we tell you where we are permitted to.
Transfers abroad
All of our providers are outside Turkey: the database is held in Frankfurt, Germany, Cloudflare processes requests across its global network, and Polar takes payment. The legal basis for these transfers under KVKK Article 9 will be written into this section after legal review.
How long we keep it
- Account and learning data: until the account is deleted.
- Mentor conversations: until the account is deleted.
- Session records: deleted when they expire (30 days at most).
- Invoices and accounting records: the statutory retention period ([PERIOD]).
- Server error logs: 30 days at most.
Deleting your account removes your learning data, submissions and mentor history in the same operation. Invoice records we are legally required to keep are the exception.
Your rights
From the account settings page, without asking anyone and without needing to have paid, you can:
- download everything as JSON (minus the password derivation and session token hashes, neither tells you anything useful and both are dangerous if the file leaks),
- delete your account and all of your data.
For the other rights under KVKK Article 11 and the GDPR (correction, objection and so on), write to destek@shipaiengineer.com. We answer within 30 days.
Cookies
Functional cookies only: the session cookie (sae_session), your theme preference and
your language preference. No advertising or tracking cookies. That is also why there
is no cookie banner: asking permission for something we do not do would be theatre.
Changes
If we update this policy we change the date at the top. For a change that materially alters its scope, we email you.