Privacy Policy

This Privacy Policy explains how Tontiş Atölyesi ("the app"), developed by GM DevHub, handles information. The app is a coloring and learning app designed for children aged 0 to 6. It is prepared to comply with the Google Play Families Policy, the Children's Online Privacy Protection Act (COPPA), the GDPR (including the rules for children's data) and Türkiye's Law No. 6698 (KVKK). The app is distributed on Google Play (Android).

1. Who we are (data controller)

GM DevHub is the developer of the app and the data controller. Email: info@gmdevhub.com.tr · Web: gmdevhub.com.tr.

2. Information we collect

We do not collect personal information from children or parents.

• There is no account, registration or sign-in.
• The app does not ask for names, email addresses, phone numbers, photos, voice recordings, location or contacts.
• The app does not use camera, microphone, location or contacts permissions. Its only permission is internet access (used for the ad and anonymous statistics).
• We do not operate any server that stores user data; the app sends no personal data to us.

3. Information stored on the device

The selected age profile, language, sound/music settings, daily time limit, colorings, drawings, scenes and progress are stored only on your device. They are not sent to us or to third parties. They can be deleted via "reset progress" in the parent settings or by uninstalling the app.

4. Advertising (Google AdMob)

A single banner ad is shown at the bottom of the app (in the Android build). Ads are served by Google AdMob with these settings:

• Tagged as child-directed content (COPPA "child-directed treatment").
• Maximum ad content rating limited to G (general audiences).
• Ads are non-personalized (no interest-based advertising or remarketing).
• The Android advertising ID (AD_ID) permission is removed from the app, and the advertising ID is not used.
• There are no full-screen ads, rewarded ads or in-app purchases, and no ads are shown once the daily time limit screen is reached.

To serve ads, the Google Mobile Ads SDK may automatically process some information from the device: IP address (to estimate approximate location), ad interactions (impressions, taps), diagnostic information (such as app launch time) and non-advertising device identifiers (such as the app set ID). This is used for ad delivery, measurement and fraud prevention and is encrypted in transit. Details:

• Google Privacy Policy: policies.google.com/privacy
• How Google uses information from partner apps: policies.google.com/technologies/partner-sites

5. Anonymous usage statistics (Google Analytics for Firebase)

The app includes the Firebase Analytics SDK to count how the app is used (for example, how many installs and sessions) and to find problems. For this child-directed app it is configured conservatively:

• Collection of the advertising ID and the Android device ID (SSAID) is turned off, and ad-personalization signals are turned off.
• The app sets no user ID, no user properties and logs no custom events; it does not use Analytics for advertising or remarketing.
• What is collected is limited to automatic, pseudonymous data: a randomly generated app-instance ID (reset on reinstall), first-open and session/engagement events, screen-level information, device model, OS and app version, language, and approximate country/city derived from the IP address (Google Analytics does not log or store IP addresses).

Google acts as our processor (Google Ireland Limited for the EEA, UK and Switzerland; Google LLC elsewhere). Event-level data is kept for at most 14 months. We do not combine it with any personal data, and we do not use it to identify anyone. Details: firebase.google.com/support/privacy. There is no in-app switch for this; parents can ask us to remove data linked to their device or can uninstall the app, which stops all collection.

6. Third-party services

We do not sell or share children's data. We do not allow anyone to use it for interest-based advertising or profiling.

7. Internet connection check

At launch the app checks for an internet connection (a simple DNS lookup for google.com and cloudflare.com). No personal information is sent during this check. The internet connection is used only to load the ad and to send the anonymous statistics described above.

8. Narration, printing, saving and sharing

• Narration recordings are bundled with the app. If a text has no recording, the device's own text-to-speech (TTS) engine is used.
• "Print" opens the device's system print dialog; you decide which printer or service to use.
• A picture can be saved to the device gallery or shared through the system share sheet, only after a deliberate press-and-hold. The app itself sends nothing; what happens next depends on the app you choose to share with.

9. Children's privacy

The app is designed for children and prepared to comply with the Google Play Families Policy. We do not knowingly collect personal information from children. Settings are protected by a parent gate (press-and-hold). The app has no accounts, chat, social features, purchases or links to external sites (other than the ad itself). Only advertising and analytics services that are permitted for child-directed apps are used. If you believe a child has provided personal information to us, contact us and we will delete it.

10. Legal bases, rights and retention

• Legal bases: the ad and anonymous statistics rely on our legitimate interests in funding and improving a free children's app (GDPR Art. 6(1)(f); KVKK Art. 5/2-f). We process no personal data of children for any other purpose.
• Your rights (parents/guardians): under GDPR, KVKK Art. 11 and similar laws you can ask whether data is processed, request access, correction, deletion or restriction, object to processing and withdraw consent. As the app collects no personal information and has no account, the main step is to delete local data in the app ("reset progress") or uninstall it. To have analytics data linked to the device removed, email us. We answer within 30 days. You may also complain to the Turkish Personal Data Protection Authority (kvkk.gov.tr) or the authority in your EU/UK country of residence.
• Retention: on-device data until reset or uninstall. Analytics event data at most 14 months at Google. Advertising data follows Google's retention periods.
• California (CCPA/CPRA): we do not sell or share personal information and have no knowledge of selling or sharing the personal information of anyone under 16.

11. International data transfer

The Google services listed above may process data on servers outside your country, including the United States, under Google's Standard Contractual Clauses and equivalent safeguards, in line with KVKK Art. 9. All connections use encrypted HTTPS.

12. Security

All network connections use encryption in transit. Because we store no user data on servers, there is no user database on our side. No method of transmission or storage is 100% secure.

13. Changes to this policy

If we update this policy, we will publish the new version on this page and change the "Last updated" date (currently 5 November 2026).

14. Contact

GM DevHub
Email: info@gmdevhub.com.tr
Web: gmdevhub.com.tr