Privacy Notice
What personal data YourWorksheets handles, why, who receives it, where it goes, how long it is kept, and the rights you have over it.
Version 2.0 · In force from 13 October 2026 · Last updated 13 October 2026
1. Who is responsible for your data
YourWorksheets is run by an individual based in Türkiye, who decides how and why your personal data is handled — the “controller” in data-protection law.
YourWorksheets — run by an individual based in Türkiye.
Our full name and an address for legal notices are being added here; until then, reach us by the routes below.
E-mail: privacy@yourworksheets.com · Help center · www.yourworksheets.com
We have not appointed a data protection officer, or a representative in the European Union or the United Kingdom. Write to us directly at privacy@yourworksheets.com.
If you are in Türkiye, the KVKK notice gives the same information in the form Turkish law sets out.
2. Whose data this notice covers
- people who visit the website;
- teachers, parents and guardians who have an account;
- people who write to us, send a data request or report content.
Student accounts are created by teachers and work differently — see section 9.
3. What we collect, why, and on what legal basis
| What | Data | Why | Legal basis (GDPR, UK GDPR) |
|---|---|---|---|
| Your account | E-mail address, display name; from Google if you sign in with it: name, e-mail and profile picture. Your password is checked by Firebase Authentication and never reaches us. | To create and run your account | Contract |
| Signing in and security | Sign-in times, IP address, browser details, the bot check (reCAPTCHA through Firebase App Check), rate-limit counters | To keep accounts and the service safe from abuse | Legitimate interests |
| Your worksheets | The worksheets, templates, images and files you create or upload, with their titles and descriptions | To store, edit, print and export them for you | Contract |
| Publishing | A worksheet you publish, and your display name as its author | To show it in the public library | Contract — publishing is your choice |
| AI drafts | The subject, topic, grade or level, language, question types and difficulty you choose; counts and outcomes of your generations. We do not store the text of your request. | To write the draft and apply your plan’s monthly allowance | Contract |
| Classes and students | See section 9 | — | On the teacher’s or school’s behalf |
| Messages with your students | Message text, date, the worksheet it is about | To let teachers and their own students talk about the work | On the teacher’s or school’s behalf |
| Messages to us | Name, e-mail, your message, and — from inside the app — the page you were on, your browser and your plan | To answer you | Legitimate interests; contract if you have an account |
| Data requests and reports | What you tell us in the form | To handle your request or report and meet our legal duties | Legal obligation; legitimate interests |
| Your plan | Plan, plan status and Polar’s identifiers for your subscription | To give you your plan’s features | Contract |
| Your choices | Your cookie choice and the documents you accepted, with dates, versions and a coarse browser family — no IP address | To respect your choices and prove them | Legal obligation; legitimate interests |
| Analytics — only if you allow it | A random identifier, IP address, device and browser details, pages and features used, page-load timings | To see how the site is used and fix slow pages | Consent — you can withdraw it at any time |
We rely on legitimate interests only where your rights do not override them: keeping the service safe, answering you, and proving what we did. You can object to it at any time (section 8).
4. Cookies and similar technologies
We use only what YourWorksheets needs to work, unless you allow analytics. Every cookie and storage item is listed in the Cookie Policy. You can change your choice at any time under Cookie settings in the footer.
5. Who receives your data
We do not sell personal data, and we do not share it with advertisers. These providers handle data for us, only for the purpose shown:
| Provider | Purpose | Data | Location | Role |
|---|---|---|---|---|
| Vercel Vercel Inc., San Francisco, USA Privacy policy | Hosting of the website and its server functions; delivery of pages; if you allow it, page-speed measurement (Speed Insights). | IP address, request details, and everything that passes through our server (account, worksheet and form data). | United States, with worldwide edge locations | Processor (acts for us) · Handles student data |
| Google Firebase and Google Cloud Google LLC, Mountain View, USA Privacy policy | Sign-in (Firebase Authentication), the database (Cloud Firestore), file storage (Cloud Storage), and the bot check (App Check with reCAPTCHA). | Account data, worksheets and uploads, class and student records, messages, IP address and browser details for sign-in and the bot check. | United States for sign-in; the database and file storage are in the Google Cloud location chosen for our project | Processor (acts for us) · Handles student data |
| Google Analytics for Firebase (only with your consent) Google LLC, Mountain View, USA Privacy policy | Counting visits and how features are used, only if you allow analytics in the cookie settings. | A random identifier, IP address, device and browser details, pages and features used. | United States | Processor (acts for us) |
| Google Gemini API Google LLC, Mountain View, USA Privacy policy | Writing worksheet drafts in AI Studio from the settings you enter. | The subject, topic, grade or level, language, question types and difficulty you choose. No account details are sent. | United States and other Google locations | Processor (acts for us) |
| Anthropic (Claude) Anthropic, PBC, San Francisco, USA Privacy policy | Writing worksheet drafts on the AI Studio page, and pictures for your picture library, from what you ask for. | What you ask for — subject, topic, goals, level, languages, question types, a theme and any text you paste, or a few words describing a picture — and an anonymous code in place of your account. Never your name or e-mail. | United States | Processor (acts for us) |
| Upstash Upstash, Inc., USA Privacy policy | Rate limiting: short-lived counters that stop the service being overwhelmed or abused. | IP address and account identifier, held only for the length of the counting window (at most one day). | The Upstash region chosen for our database | Processor (acts for us) |
| Resend Resend, Inc., USA Privacy policy | Delivering a copy of your help-form message, data request or content report to our inbox so we can answer it. | Your name, e-mail address and the text of your message. | United States | Processor (acts for us) |
| Polar Polar Software, Inc., Dover, Delaware, USA Privacy policy | Selling the Plus and Pro plans as merchant of record: checkout, payment, tax, receipts, refunds and the subscription portal. | Your e-mail address and account identifier from us; your name, billing address and card details, which you give directly to Polar and which we never see. | United States | Independent controller |
When you search for pictures in the designer, the image libraries Openverse and Wikimedia Commons receive your search and your IP address. When you choose “Continue with Google”, Google receives your sign-in. When you upgrade, you deal with Polar under its own terms.
We disclose data to public authorities only when the law requires us to. If YourWorksheets is ever transferred to someone else, your data goes with it under this notice, and we will tell you first.
6. Transfers to other countries
Most of our providers are in the United States, so your data is transferred outside Türkiye, the European Union and the United Kingdom.
| Provider | Location | Türkiye (KVKK art. 9) | EU and UK |
|---|---|---|---|
| Vercel | United States, with worldwide edge locations | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | EU–US Data Privacy Framework and Standard Contractual Clauses, per Vercel’s data processing addendum |
| Google Firebase and Google Cloud | United States for sign-in; the database and file storage are in the Google Cloud location chosen for our project | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | EU–US Data Privacy Framework and Standard Contractual Clauses, per the Google Cloud data processing terms |
| Google Analytics for Firebase (only with your consent) | United States | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | EU–US Data Privacy Framework and Standard Contractual Clauses, per Google’s terms |
| Google Gemini API | United States and other Google locations | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | Google’s data processing terms for the Gemini API |
| Anthropic (Claude) | United States | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | Anthropic’s data processing addendum, with Standard Contractual Clauses |
| Upstash | The Upstash region chosen for our database | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | Upstash’s data processing agreement |
| Resend | United States | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | Resend’s data processing agreement |
| Polar | United States | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | Polar’s own privacy policy and buyer terms (Polar decides how payment data is handled) |
- For people in the EU and the UK, the providers use the safeguards shown above (the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses).
- For people in Türkiye, Turkish law (KVKK, article 9) asks for a safeguard such as the standard contract announced by the Personal Data Protection Board. The table shows its status for each provider.
You can ask us for a copy of the safeguards at privacy@yourworksheets.com.
7. How long we keep it
| Data | How long | How it is removed |
|---|---|---|
| Account profile and sign-in record | Until you delete your account; removed at once when you do | When you or a teacher delete it |
| Your worksheets, templates and uploads | Until you delete them, or your account | When you or a teacher delete it |
| Worksheets you published to the library | Public until you unpublish or delete them; deleting your account removes them | When you or a teacher delete it |
| Classes, student accounts, their work, results, rewards and messages | Until the teacher removes the student or the class, or deletes their own account; teacher–student messages are kept 90 more days for safeguarding, then deleted | When you or a teacher delete it |
| Messages of a removed student | 90 days after the student was removed | Scheduled clean-up |
| AI usage records (counts and outcomes; no prompt text is stored) | 13 months | Scheduled clean-up |
| Monthly generation counters for your plan | 13 months | Scheduled clean-up |
| AI Studio history: the requests you wrote and the drafts made from them | 90 days, or until you delete them | Scheduled clean-up |
| AI credit counters, and the record of changes to them | 13 months | Scheduled clean-up |
| Short-lived records that stop one AI request being charged twice | 30 days | Scheduled clean-up |
| Pictures you make, upload or generate for your picture library | Until you delete them, or your account | When you or a teacher delete it |
| Rate-limit counters with IP address or account identifier | From one minute up to one day, then they expire | Provider’s own settings |
| Help-form and in-app messages to us | 24 months after you sent it | Scheduled clean-up |
| Data requests and our answers | 3 years after the request is closed | Scheduled clean-up |
| Content reports and our decisions | 3 years after the decision, longer only while a legal claim is open | Scheduled clean-up |
| Records of your cookie choices (no IP address is stored) | 3 years after the choice | Scheduled clean-up |
| Records of the documents you accepted and when | While your account exists, and 3 years after you delete it | Scheduled clean-up |
| Request logs at our hosting provider | The short period set by Vercel for our plan; we keep no separate copy | Provider’s own settings |
| Analytics data, only if you allowed it | The data-retention period set in our Google Analytics account | Provider’s own settings |
| Orders, invoices and payment records | Kept by Polar as seller under its own legal duties; we keep only your plan status | Provider’s own settings |
Some providers keep short-term technical backups; deleted data leaves them on their normal cycle. More detail: Retention summary.
8. Your rights
You can ask us to:
- tell you whether we hold data about you and give you a copy;
- correct it;
- delete it;
- restrict how we use it, or object to our use of it based on legitimate interests;
- give you the data you provided in a machine-readable format (portability);
- not make decisions about you based solely on automated processing.
Where we rely on your consent, you can withdraw it at any time — for analytics, under Cookie settings. Withdrawing does not affect what happened before.
How: most of this you can do yourself — Account → Your data → Download my data, edit your profile, or Delete account. For anything else use the data request form or write to privacy@yourworksheets.com. We answer free of charge, as soon as we can and at the latest within 30 days. We may ask you to confirm your identity, but only as far as needed.
Complaints: you can complain to a data protection authority — in Türkiye the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu); in the EU the authority of your country; in the UK the Information Commissioner’s Office. We would be glad to hear from you first.
United States: we do not sell personal information or share it for cross-context behavioural advertising, and we honour the Global Privacy Control signal.
9. Children and student accounts
YourWorksheets is for adults. Teachers can create accounts for the students in their classes. A student account holds:
- the name or nickname the teacher typed, a username and a password — no e-mail address (the account uses an internal address that receives nothing);
- the class, the work the student hands in and its results;
- the student’s avatar, rewards and pets, including any pet names the student types;
- messages between the student and their own teacher.
For this data the teacher or the school is the controller: they decide what is entered and why, and we handle it on their behalf under the Data Processing Terms. Students see no advertising and no cookie banner, no analytics runs on their pages, they cannot message other students, and their work is visible to their teacher, not to their classmates. Parents and guardians should contact the teacher or school first; they can also use our data request form. More in Children and schools and on the kids’ privacy page.
10. Security
How we protect data, and how to report a vulnerability, is on the Security page.
11. Automated decisions
We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. AI drafts are suggestions a teacher reviews.
12. Changes to this notice
When we change this notice we publish the new version here, keep earlier ones in the version history, and tell you directly about changes that matter.