Privacy Policy

Plus speaking submissions

In a UniverseHall Plus speaking assignment, if you choose to submit an audio response, the audio file is uploaded to and stored by UniverseHall. You can play the submitted recording through the Plus area. The mentor assigned to that task can also play it while authorized for that assignment. This is separate from local speaking practice in lessons.

Google account access

When available and selected, Google account access requests only your verified email address, name and stable Google account identifier to create or access your UniverseHall account. Your Google password is entered only on Google’s own pages; UniverseHall does not receive it. Gmail messages, Drive files, contacts and calendars are not requested. Missing profile information and the required account acknowledgement are collected before a new account is created.

The verified Google identifier is linked to your internal account so learning history remains with that account. Matching email addresses alone never merge accounts; an existing password account requires explicit password verification to link Google. Temporary sign-in handoffs expire after 10 minutes, pending profiles after 15 minutes, and access/refresh tokens are not stored. Google processes the sign-in under its own privacy terms. Account-data requests can be submitted through the KVKK page or destek@universehall.com.

Privacy by feature

Account, learning, assessment and game-room data are kept in separate logical records so access can be limited to the feature and role that needs it. Learner-facing assessment responses never include answer keys or private administration fields.

Daily request totals

The existing traffic counter estimates daily sources on eligible public pages, including guests and bots. It processes the connection IP and a bounded browser signal transiently to derive the same day-specific technical hash used by the historical counter; raw IP addresses and browser strings are not stored. The stored traffic record contains that pseudonymous hash, an estimated class and measurement/expiry times. A source is counted in only one class per Istanbul calendar day: likely human, bot or unclassified. These are not verified people; network or browser changes can affect the estimate. No account ID, page path, query string, cookie or local-storage identifier is recorded by this counter. Historical records remain in the same traffic series. Expiry fields are not a guarantee of scheduled physical deletion. Other optional event-level analytics remain disabled.

Security

Passwords are stored as salted cryptographic hashes. Administrative routes check the ADMIN role on the server. Sessions are time-limited, sensitive responses are not cached and repeated authentication attempts are rate-limited.

Result email

A level-check result is sent only to the address entered for that attempt. Delivery status is recorded so an administrator can follow failed or queued delivery. The address is not added to a marketing list.

Changes and contact

Material changes will be published with a new version date. Privacy questions and Article 11 requests can be submitted on the KVKK page.