Maxfiyligingiz muhim.

1. Introduction & Scope

Welcome to IlmFun, operated by CHERRY SOFTWARES LLC ("Company", "we", "us", or "our"). We are committed to safeguarding the privacy and personal data of our users, students, educators, and academy administrators.

This Privacy Policy explains how we collect, store, use, process, and protect your information when you access or use:

• The official website at ilmfun.com and associated subdomains (including api.ilmfun.com).
• The IlmFun desktop applications (for Microsoft Windows 10 & 11).
• The IlmFun mobile applications (for Android and iOS).
• All related APIs, WebSocket hubs, real-time communication stages, and digital services provided by IlmFun.

2. Information We Collect

We collect only the minimum necessary information required to provide reliable educational services, authenticate users, facilitate real-time classes, and operate secure academy workspaces.

A. Account Information

When you register an account on IlmFun, we collect:

• Identity Data: Display name, unique username, and email address.
• Security Credentials: Passwords are cryptographically salted and hashed using state-of-the-art one-way hashing algorithms (Argon2 / Bcrypt). We never store or have access to plaintext passwords.
• Profile Customization: Optional profile avatar picture, custom biography, and timezone settings.

B. Third-Party Sign-In (OAuth & Gilos)

If you choose to authenticate using Google Sign-In or Gilos single sign-on, we receive authorized profile information from the identity provider, including your verified email address, full name, profile picture URL, and third-party user ID. We use this data solely to create or link your IlmFun account.

C. Educational & Community Communications

• Academy Interactions: Channels joined, messages posted, homework submissions, study notes, and file attachments.
• Educator Verification: Educational credentials, certificates, or identity verification documentation submitted by teachers applying for verified status.
• Direct Messages: 1-on-1 and group direct messages sent between connected study partners.

D. Technical & Operational Telemetry

To maintain connectivity and troubleshoot connection issues during live streams, we collect:

• IP address and approximate geolocation (city/country level).
• Operating system type and architecture (e.g. Windows 11 x64, Android 14).
• App version and build number.
• Connection diagnostics (packet loss, audio bitrate, WebRTC connection latency).

3. Device & Hardware Permissions

Depending on your platform (Windows, Android, or iOS), IlmFun requests specific operating system permissions. These permissions are strictly utilized for educational and communication features:

4. Real-time Audio, Video & WebRTC (LiveKit)

Live audio and video interactions within IlmFun academies are powered by LiveKit's secure WebRTC Selective Forwarding Unit (SFU) infrastructure.

Educational Lesson Archiving: If a verified instructor or academy administrator elects to record a scheduled lecture or masterclass for students who could not attend live, all participants receive an immediate visual and auditory indicator confirming that the session is being recorded. Recordings are stored encrypted in Cloudflare R2 storage and are accessible only to authorized academy members.

5. In-App Economy & Financial Transactions ("Emeralds")

IlmFun features an in-app virtual currency known as "Emeralds". Emeralds are utilized to enroll in premium educational lessons, reserve seats in specialized masterclasses, and support verified instructors.

• Payment Processing: When purchasing Emeralds, payments are processed directly through authorized third-party billing providers (such as Google Play In-App Billing or Apple In-App Purchase). CHERRY SOFTWARES LLC does not collect, process, or store credit card numbers, bank account numbers, or CVVs.
• Transaction Logs: We maintain records of Emerald balances, purchase receipts, lesson enrollment history, and educator transfers to ensure account integrity and prevent fraud.

6. How We Use Information

We process your data exclusively for legitimate business and educational purposes:

• Service Delivery: To operate academies, channels, live voice stages, homework submissions, and messaging.
• Account Administration: To authenticate your identity, manage permissions, and enforce academy roles (Owner, Administrator, Teacher, Student).
• Safety & Moderation: To detect, investigate, and prevent harassment, hate speech, spam, automated bot abuse, and unauthorized intrusions.
• Platform Reliability: To monitor system uptime, analyze crash logs, and optimize WebRTC media performance.
• Customer Communication: To send critical service alerts, security notices, and respond to support inquiries.

7. Cloud Infrastructure & Subprocessors

We partner with world-class, security-compliant infrastructure providers to deliver high availability and data protection:

• Cloudflare Inc. (Cloudflare R2): Encrypted global object storage for avatars, attachments, assignments, and educational assets.
• LiveKit: Secure WebRTC audio and video streaming infrastructure.
• Google Firebase: Firebase Cloud Messaging (FCM) for push notifications and Google OAuth for authentication.
• Vultr / Dedicated Cloud Hosting: Hardened application and database server hosting with network firewalls and TLS 1.3 encryption.

8. Data Sharing & Disclosure

Your information is only shared in the following limited circumstances:

• Academy Members: Users who share an academy with you can see your display name, username, avatar, roles, and status.
• Service Subprocessors: Technical vendors listed in Section 7 who process data strictly under our contractual instructions.
• Legal & Law Enforcement: If required by valid subpoena, court order, or binding legal process, or when necessary to protect personal safety or investigate urgent threats.

9. Data Retention & Account Deletion (GDPR & CCPA)

We retain personal data only for as long as your account remains active or as needed to provide you with educational services.

Your Right to Delete:

You have the absolute right to delete your account and personal data at any time:

• In-App Deletion: Navigate to User Settings → My Account → Delete Account within the desktop or mobile client.
• Email Request: Send an email from your registered address to privacy@ilmfun.com with the subject "Account Deletion Request".

Upon receiving a deletion request, your authentication credentials, personal identifiers, and private profile data will be permanently purged within 30 days. Public or academy-level chat messages are anonymized to maintain educational continuity for enrolled students.

10. Children's Privacy (COPPA & Under-Age Protection)

IlmFun is designed as an educational collaboration platform. In compliance with the Children's Online Privacy Protection Act (COPPA) and international child safety standards:

• Our general consumer service is intended for users aged 13 and older (or the minimum legal age in your jurisdiction).
• If an educational institution, school, or academy utilizes IlmFun for younger students, the institution or academy is responsible for obtaining verifiable parental consent in accordance with COPPA and local regulations.
• If we discover that personal data from a child under 13 was collected without verified consent, we take immediate steps to delete the account and associated records.

11. Security Safeguards

CHERRY SOFTWARES LLC implements industry-standard administrative, physical, and technical safeguards:

• Encryption in Transit: 100% of web traffic, API calls, and WebSocket connections use TLS 1.3 encryption.
• Encryption at Rest: Database backups and Cloudflare R2 object storage are encrypted using AES-256.
• Authentication Security: High-entropy cryptographic hashing for passwords, rate-limiting on sensitive endpoints, and automated bot mitigation.

12. Your Rights & Contact Information

Depending on your location (including under GDPR, UK GDPR, and CCPA/CPRA), you have the right to access, rectify, export, or restrict processing of your personal data.