Privacy policy

Who is responsible

digiwleea is operated by Taceddin Sancak, Türkiye, the controller of personal data described here. For privacy questions and requests, email [email protected].

What we collect and why

• Accounts: your email address, password hash, verification status, account settings and access entitlements. We use these to authenticate you, secure your account, provide the service and send account-related messages. We do not store your password in plain text.
• Your work: circuits, component libraries, learning progress, achievements, settings and chat history. Some information stays in your browser; account features synchronize information to our server. Classroom features also store membership, assignments and submissions, which are available to the relevant teacher.
• AI requests: when you use Wleea, your prompt, relevant conversation and circuit context are sent through our server to an AI provider to produce a response. Signed-in chat history can be saved for you to revisit. Guest usage uses a browser identifier and server-side limits to meter the free allowance and prevent abuse.
• Billing: checkout, customer, order and subscription identifiers, payment status and plan information. Polar handles checkout and payment details. We use the information returned by Polar to provide paid access and handle billing support; our application does not store full payment-card numbers.
• Optional analytics: when usage metrics are enabled, we collect page paths, referral sources and product events such as lesson activity. Our server creates a daily visitor identifier from network and browser information. Optional metrics also use a temporary browser-tab identifier to connect a tool visit with a lesson or save in that tab on the same UTC day. It rotates daily and is removed when usage metrics are disabled. Pending usage events are buffered in this tab for up to 24 hours while delivery is retried, and are discarded when usage metrics are disabled. A clicked practice recommendation is remembered in that tab for at most two hours within the same UTC day, so we can measure whether the matching task was started, wired or completed. This is not a reliable count of distinct people, and accounts may be associated with events when signed in. The analytics event database does not store raw IP addresses.
• Optional session replay and diagnostics: when recording is enabled, administrators can inspect clicks, sampled pointer positions, scroll depth, foreground viewing time and browser error counts across public pages, as well as circuit snapshots and contents, edits, cursor positions, clicks, open panels, learning milestones, errors and AI interactions. This includes guests. Page interaction logs contain page paths without query strings, viewport and document dimensions, fixed element identifiers and a temporary browser-tab identifier that rotates daily and clears when recording is disabled. They do not capture page text, field values or HTML snapshots. Circuit names, labels, notes and AI prompts can contain information you enter. Replay does not record password fields or general form typing, but this is not a guarantee that information included in circuit content, conversations or error messages will be masked.
• Voluntary beginner trials: when you submit trial feedback, we store your answers and a temporary trial reference. That reference can connect the answers to available circuit recordings when recording is enabled. Submitting feedback is a requested feature and works even when optional analytics and recording are off. Trial feedback has no automatic expiry; contact us to request deletion.
• Operations and support: requests necessarily expose network information to the services delivering the site. We also process security and usage-limit records, support messages and any problem reports you choose to submit.

Please avoid putting passwords, payment details, confidential material or sensitive personal information into circuit notes, AI prompts or problem reports.

Your choices

Usage metrics and session recordings are enabled by default to help develop and improve the platform. During our 28 September 2026 settings update, earlier website preferences were reset to enabled. Choices saved after that reset remain in effect. You can turn either category off separately, turn both off, or change your choice using Privacy settings. Browser Do Not Track and Global Privacy Control signals do not automatically change these website settings; use the controls here to turn collection off. These choices apply to this browser, not automatically to every device you use.

Turning an option off stops future optional collection and discards pending diagnostic uploads in this browser. It does not erase information already sent. Account services, saved chat history, billing, security controls and AI requests you initiate still operate. You can request deletion of previously collected data by contacting us.

How we obtain and use information

We obtain information directly from you, from your use of the service and browser, and from service providers such as Polar. We process account, circuit, chat and billing information to provide the features you request and perform our agreement with you. Usage metrics and session diagnostics help us understand how the platform is used, diagnose problems and guide its development. These features use opt-out preferences; continued use or closing a notice is not an affirmative statement of consent. We process information for legal obligations, and for legitimate operational interests such as security, abuse prevention and responding to support requests, where the applicable law permits. We do not use a cookie choice as consent to unrelated processing.

Who receives information

Access is limited to the operator, authorized administrators and providers needed to deliver the service. Relevant information may be shared with:

• Hosting, delivery and security services, including Cloudflare, to serve and protect the site. See Cloudflare’s privacy policy.
• Polar for checkout, payments, taxes and subscriptions. See Polar’s privacy policy.
• OpenRouter and the AI provider used through it, normally OpenAI, when you request AI assistance. Wleea uses OpenAI’s GPT-6 Luna by default. OpenRouter can route requests to another provider serving the same model if the preferred provider is unavailable. DeepSeek remains available as an alternative configuration. See OpenRouter’s privacy policy, OpenAI’s API data controls and DeepSeek’s privacy policy. The relevant providers’ processing and retention practices apply to information sent to them.
• Email infrastructure for verification, password resets and other service messages, and relevant authorities where disclosure is legally required.

Providers can process information outside Türkiye and outside your country, including in the United States and China. International processing is subject to applicable data-protection and transfer requirements; the service is not a promise of local-only data storage. Contact us for information about the arrangements relevant to your data. We do not sell personal data or run advertising trackers on the site.

How long information is kept

Uploaded circuit session recordings and public-page interaction logs currently have no automatic expiry and are retained indefinitely. This includes circuit contents and guest AI events contained in recordings. Turning recording off does not delete earlier recordings. Deleting an account can detach its account reference while preserving recordings, so request removal of recordings explicitly if that is what you want.

Account information, saved circuits, progress and conversations remain until removed through an available product feature or a deletion request, subject to necessary legal, security and billing retention. Historical analytics events are retained without a fixed automatic expiry. Separate signed-in AI diagnostic logs have a volume limit, so older entries can be removed as new entries arrive. Browser data normally remains until you clear it; the sign-in cookie lasts up to 30 days, and privacy choices remain until you change them or clear browser storage. Backups and provider-held records may have separate retention cycles. We handle valid deletion requests subject to applicable obligations and exceptions.

Your rights and requests

Depending on applicable law, including Türkiye’s Personal Data Protection Law No. 6698 (KVKK), you may request information about whether and why your data is processed, recipients of your data, access, correction, deletion or destruction, and notification of corrections or deletion to recipients. You may also have rights to object to certain processing, challenge adverse results based solely on automated analysis, seek compensation for unlawful processing, restrict processing, obtain a portable copy, withdraw consent, or complain to the relevant data-protection authority.

Email [email protected] with your request and enough information to identify the relevant data. For guest recordings, include the recording session ID if available in Lab → Settings → Diagnostics, or approximate dates and circuit details. We may need to verify your identity. Withdrawal of consent does not affect the lawfulness of processing before withdrawal. Daily visitor identifiers and guest sessions may not be enough to reliably identify a person.

Schools and younger learners

Parents, guardians and schools should supervise use where appropriate and obtain any permissions required before a learner supplies personal information. Teachers should avoid unnecessary student information in circuits and prompts. If you believe a child’s information has been supplied without required permission, contact us so we can investigate and address it.

Changes

We will update the date on this page when this policy changes. Where required, we will provide further notice or request a new choice before using optional data for a new purpose.