Data controller
The data controller (GDPR) and data controller under KVKK for personal data processed when operating this browser game portal (the “Portal”) is:
| Item | Value |
|---|---|
| Legal name | [to be filled: company name] |
| Address | [to be filled: address] |
| Contact e-mail | [to be filled: contact e-mail] |
| Registered e-mail (KEP) | [to be filled: KEP address] |
| VERBİS registration number | [to be filled: VERBİS registration number] |
| EU / UK representative | [to be filled: EU / UK representative] |
Scope
This policy covers the Portal pages, the Portal's back-end services and the games opened inside the Portal. It does not cover the privacy practices of third-party sites linked from the Portal, or of a game opened outside the Portal at its own address.
You can use the Portal as a guest without an account, or with an account. For cookies and similar technologies, see the Cookie Policy.
Age limit
The Portal is intended for people aged 13 and over and is not directed at children. When you create an account you are asked to declare that you are 13 or older; people under 13 cannot create an account.
We do not knowingly aim to collect personal data from children under 13. If we find an account or data belonging to a child under 13, we delete it. If you are a parent or guardian and want to report this, write to the address in “Changes and contact”.
For processing based on consent (analytics and advertising) the minimum age depends on your country (in the European Economic Area between 13 and 16, depending on the country). This processing starts only when you give consent; if you are under that age, do not consent.
What data we collect
The table below lists the data processed, or that may be processed, in the MVP version of the Portal. Rows marked “optional” apply only if the relevant service is enabled; for analytics and advertising we also ask for your consent.
| Data | Details | Source |
|---|---|---|
| Guest ID | A randomly generated anonymous user ID (anonymous session). It contains no name or e-mail. It is created when you start your first game; your progress is tied to it. | You / your browser |
| Account details | Your e-mail address (kept with the authentication provider; the Portal's application tables hold no e-mail), sign-in method and verification time. We keep no password; you sign in with an e-mail link. | You |
| Sign-in with Google | If you sign in with Google we receive your Google account ID, your e-mail address and the basic profile details Google shares (for example name, profile picture URL). | Google, with your permission |
| Age declaration | The “I am 13 or older” declaration you give when creating an account. We store only that the declaration was given (yes) and its date; we do not ask for or store your date of birth or age. | You |
| Profile settings | Language, time zone (the IANA name your browser reports, e.g. Europe/Istanbul), creation time and, if any, the time of a deletion request. | You / your browser |
| Progress data | Total XP, level, streak, daily reward step and time, the XP ledger (source, amount, game and time of each XP event), unlocked badges and your daily challenge results. | Portal server, based on your play |
| Game saves | Up to 256 KB of save data (JSON) per game, plus the previous 5 saves; a save refused because of a conflict is kept for 7 days so it can be recovered. The game decides the content (e.g. game progress); games do not ask for personal information. | The game, via the Portal |
| Play sessions | Which game you played, when, and your active play time. Time is computed from signals (heartbeats) sent about every 30 seconds while the tab is visible. | Portal, based on your play |
| Scores and leaderboards | Game, mode, score value, week and whether the score was accepted (suspicious scores do not enter the table). A player who sends several suspicious scores within a short time is hidden from that game's leaderboards for at most 7 days; their scores are not deleted, they are not notified separately, and an administrator can review and lift the hold early. An unusually high score also stays off the table until an administrator approves it. The public leaderboard on a game page (weekly and all-time) shows only a rank, a score and an eight-character pseudonymous label derived from your ID (e.g. "Guest 3FA09C21"); your name, e-mail and user ID are never shown. | The game, via the Portal |
| Favorites, votes and shares | The games you marked as favorites, your like or dislike per game (one vote) and the games whose link you copied to share, with their times. A game's like ratio is shown publicly; who voted is not. | You, via the Portal |
| Request keys | A unique key sent with each request so the same action is not counted twice, and a copy of the response given. | Portal, automatic |
| Technical data and logs | IP address, browser and device information (user agent), request time and address, error logs. Our server and the database keep these in security and operational logs. | Your browser, automatic |
| Bot check | Cloudflare Turnstile runs at abuse-prone steps such as anonymous sessions and sign-up; your IP address and browser signals are processed by Cloudflare during the check. | Your browser, automatic |
| Rate-limit counters | Short-lived counters tied to a hash of your account ID or IP address, used to limit excessive requests. They are kept in the Valkey data store on our own server and expire on their own within minutes to hours. | Portal, automatic |
| Error reports (optional) | When an error occurs: stack trace, browser and operating system, and page address. Your e-mail is not included; your IP address is not stored or is scrubbed. Applies when the service is enabled. | Your browser / server, automatic |
| Product analytics (optional, with consent) | Events such as page views, game open and close, XP and reward events, sign-up steps and load errors, together with a random pseudonymous ID that the analytics provider creates in your browser (your user or guest ID is not sent). No name or e-mail. Only if enabled and you consent. | Your browser, with your consent |
| Advertising (optional, with consent) | If ads are shown on Portal pages: the ad provider's cookies and device identifiers and ad interaction. Personalised ads are shown only if you consent. If the Portal's operator has switched on Google's own certified consent message (Privacy & messaging, TCF v2.2), Google's message script loads on every Portal page except the admin panel so that Google can tell the visitor's region; this sends a request to Google (IP address, page address) before any choice. Visitors in the European Economic Area, the United Kingdom and Switzerland then see Google's message for advertising, and the Portal's notice asks only about analytics. If they refuse there, they get no ads, or at most non-personalised (limited) ads if the operator allows that for people who refuse, the same rule as refusing in the Portal's own notice. With the switch off, visitors in these regions are shown no personalised ads, at most non-personalised (limited) ads. There are no ads inside games. | Your browser, with your consent |
| Correspondence | If you write to us, your e-mail address and the content of your message. | You |
We do not ask for your real name, phone number, precise location or payment details, and we do not pass them to games.
Purposes and legal bases
We process your data for the purposes below, on the legal bases stated. The bases under KVKK article 5 and GDPR article 6 are shown side by side.
| Purpose | Legal basis (KVKK art. 5 / GDPR art. 6) | Data concerned |
|---|---|---|
| Opening a guest or account session; storing and providing your progress, XP and game saves | Establishment and performance of a contract (KVKK 5/2-c; GDPR 6(1)(b)) | Guest ID, account details, profile settings, progress data, game saves, play sessions |
| Sending the sign-in link by e-mail, creating an account and moving guest progress to it | Establishment and performance of a contract (KVKK 5/2-c; GDPR 6(1)(b)) | Account details, Google sign-in data, progress data |
| Calculating XP, rewards, streaks and badges correctly; preventing cheating and abuse | Legitimate interest (KVKK 5/2-f; GDPR 6(1)(f)); contract for providing the progress system | XP ledger, play sessions, scores, request keys |
| Showing leaderboards, favorites and like ratios | Establishment and performance of a contract (KVKK 5/2-c; GDPR 6(1)(b)) | Scores, favorites, votes, shares |
| Security, bot checks and rate limiting; preventing abuse of the service | Legitimate interest (KVKK 5/2-f; GDPR 6(1)(f)) | IP address, technical data, bot check, rate-limit counters |
| Finding errors and keeping the service running | Legitimate interest (KVKK 5/2-f; GDPR 6(1)(f)) | Error reports, technical data and logs |
| Measuring usage to improve the product (analytics) | Explicit consent (KVKK 5/1; GDPR 6(1)(a)); you can withdraw it at any time | Product analytics events, pseudonymous ID |
| Showing ads on Portal pages | Explicit consent (KVKK 5/1; GDPR 6(1)(a)); you can withdraw it at any time | Advertising cookies and identifiers |
| Answering your requests; letting you exercise your rights | Legal obligation (KVKK 5/2-ç; GDPR 6(1)(c)) and legitimate interest | Correspondence, information needed to verify identity |
| Responding to legal claims and establishing, exercising or defending a right | Establishment, exercise or protection of a right (KVKK 5/2-e); legitimate interest (GDPR 6(1)(f)) | Data relevant to the dispute |
For every processing based on legitimate interest we carried out a balancing test: is our interest legitimate, is the processing necessary for it, and do your rights and reasonable expectations override it? The results:
- Security, bot checks and rate limiting. Interest: protecting the service against attacks, fake accounts and overload. Necessity: automated abuse cannot be told apart without the IP address and browser signals. Safeguards: counters are keyed by a hash of the IP or account and are deleted within hours; the bot check runs only when a guest session is created. Result: people using the Portal expect this protection; your rights do not override it.
- Correct XP, rewards and badges, preventing cheating. Interest: a progress system that is fair for everybody. Necessity: without the XP ledger, play sessions and scores, cheating and double counting cannot be detected. Safeguards: the data is tied to a pseudonymous player ID, games never receive your identity, and a suspicious score only affects the leaderboard: it is kept off the table, and several suspicious scores within a short time hide the player from that game's leaderboards for at most 7 days; XP, rewards and the account are not affected, and an administrator can always lift the hold. Result: low impact, balanced processing.
- Error monitoring. Interest: finding and fixing errors and keeping the service running. Necessity: where an error happens cannot be understood without technical details. Safeguards: no e-mail or user details are added to reports, the IP address is scrubbed, session replay is off, reports are kept for at most 90 days. Result: your rights do not override it.
- Responding to legal claims. Interest: protecting a right or answering a claim. Necessity and safeguards: only the data concerned by the dispute is used, only as far and as long as needed. Result: balanced.
You can object, on grounds relating to your particular situation, to processing based on legitimate interest; send your objection to the addresses in “How to exercise your rights”. You can also ask there for the details of this assessment.
We do not use your personal data for automated decisions or profiling that produce legal effects. XP and badges are only an in-game progress indicator and have no monetary value.
Games and the separate domain
Games run at a separate address from the Portal (a separate origin) and open inside the Portal as a frame (iframe). This separation exists so that game code cannot reach the Portal's cookies or session.
- Games are not given your user ID, e-mail address or session key.
- A game learns only: whether you are a guest, your language, the save data for that game, and the server time and daily challenge information.
- The Portal, not the game, awards XP; a game can only report scores and game events.
- The address hosting the games sets no cookies. In this version there are no ads or third-party tracking inside games.
- If a game is opened outside the Portal, at its own address, it may keep its own save in the browser's local storage; details are in the Cookie Policy.
- Online matches (two-player games): your opponent sees only your public nickname (the same 8-character handle as on the leaderboards, the same in every game), whether you are a guest, and whether you are online. The game gets a seat ID valid for that match only, never your user ID. There is no free-text chat, only preset reactions.
Recipients and transfers abroad
To provide the service we use the service providers below. They process data on our behalf and on our instructions (processors) and may not use it for their own purposes unless stated otherwise. We do not sell your data.
| Provider | What for | Which data | Location |
|---|---|---|---|
| Our own server (including PostgreSQL and Valkey) | The Portal, the game files, the PostgreSQL database with the sign-in records, and the Valkey data store run with Docker Compose on a Linux server that we operate. The operator of the data centre where the server is located provides the infrastructure and acts as a processor. | All data the Portal keeps: account and guest details, progress, game saves, sessions, request keys, rate-limit counters, logs and backups | [to be filled: data centre and location] |
| Vercel and Upstash, only if the Portal is run on Vercel | An alternative to our own server: hosting and serverless functions (Vercel), rate-limit counters and the leaderboard cache instead of Valkey (Upstash). Not in use at the moment; if that changes, this policy is updated beforehand. | IP address, technical data, request logs; hash of the account ID or IP address and a counter | US and global network (Vercel), EU region (Upstash); standard contractual clauses |
| Cloudflare (Turnstile) | Bot check | IP address, browser signals | Global network, US-based company; standard contractual clauses |
| Cloudflare (Web Analytics) | Page load and speed measurement (cookieless) | Page visited, load timings, browser type; the IP address is not stored | Global network, US-based company; standard contractual clauses |
| E-mail delivery provider | Sending sign-in link e-mails | E-mail address, e-mail content | [to be filled: e-mail provider and location] |
| Sentry, when the service is enabled | Error monitoring | Stack trace, browser and operating system, page address; no e-mail, IP not stored or scrubbed | EU (Germany); the account is created in Sentry's EU data region |
| PostHog, only if enabled and with your consent | Product analytics | Analytics events, pseudonymous ID | EU (Germany); PostHog's EU cloud |
| Google (AdSense), only if enabled and with your consent | Showing ads on Portal pages. For personalised ads Google processes this data partly for its own purposes, as an independent controller. | Advertising cookies and identifiers, ad interaction | US and global; Google's ads data protection terms and standard contractual clauses |
Location of our server: [to be filled: data centre and location]. Transfers of data outside Türkiye rely on KVKK article 9: where there is no adequacy decision we sign the standard contract published by the Turkish Personal Data Protection Board with the provider and notify the Board within 5 business days of signing. For transfers outside the European Economic Area we rely, under GDPR Chapter V, on an adequacy decision (for the US: providers certified under the EU-US Data Privacy Framework) or on the European Commission's standard contractual clauses. A data processing agreement is signed with every provider.
Your data may be shared with competent public authorities when a legal obligation requires it or when it is necessary to protect a right.
Retention periods
We keep data for as long as needed for the purpose of processing, then delete, destroy or anonymise it. A job that runs every day performs the deletions on the server automatically.
| Data | Retention period |
|---|---|
| Account, progress and game saves | Until you delete your account. You can delete your account on the account page or send your request to [to be filled: contact e-mail]. Once a deletion request is recorded, the daily job deletes the account within 30 days at the latest (usually the next day). |
| Inactive guest IDs | A guest ID not used for 90 days (no play, save or visit) is deleted by a daily job, together with its progress and saves. |
| Earlier versions of a game save | The last 5 saves per game; older ones are deleted automatically. Saves refused because of a conflict are deleted after 7 days. |
| XP ledger, rewards and badges | Deleted completely when the account is deleted; not kept in anonymised form. Aggregate statistics that do not identify you (for example a game's total play count) may remain only as anonymous numbers. |
| Play sessions | Until the account is deleted or an inactive guest ID is deleted after 90 days; play counts, badges and the daily challenge are computed from them. Heartbeats are not stored separately; only the session's total time is updated. |
| Age declaration | Kept with the account; deleted when the account is deleted. |
| Scores and leaderboards | Until the account is deleted or an inactive guest ID is deleted after 90 days; they then leave the leaderboard too (the cache refreshes within 10 minutes). |
| Favorites, votes and shares | Until the account is deleted or an inactive guest ID is deleted after 90 days; votes then leave the like ratio too. |
| Request keys | Deleted by a daily job 24 hours after the request. |
| Rate-limit counters | Expire on their own within minutes to hours. |
| Database backups | Taken every day and kept for 7 days; deleted data disappears from the backups after 7 days at the latest. Backups are kept on our own server with restricted access. |
| Server and operational logs | At most 14 days; logs also rotate by size (at most 50 MB per service). |
| Error reports | At most 90 days in Sentry. |
| Product analytics events | At most 12 months in PostHog; no new events are collected once you withdraw consent. |
| Correspondence | 2 years after the request is concluded (as evidence in case of a dispute), then deleted. |
| Data that law requires us to keep | If a law or a request by a competent authority requires longer retention, only the data concerned is kept, only for that period and with restricted access. |
| Online matches | Finished, cancelled and expired matches are deleted 30 days after they end; an unused invite expires after 15 minutes. If you delete your account, your seat in a match stays only as an anonymous seat until then. Your own matches are included in the data export. |
| Cookies and local storage in your browser | In the table in the Cookie Policy. |
How to exercise your rights
Under KVKK article 11 you can apply to the data controller to:
- Learn whether your personal data is processed and, if so, request information about it,
- Learn the purpose of processing and whether it is used accordingly,
- Know the third parties, in Türkiye or abroad, to whom data is transferred,
- Request correction if data is incomplete or inaccurate,
- Request deletion or destruction under KVKK article 7, and have this notified to third parties to whom the data was transferred,
- Object to a result against you arising from analysis of the data exclusively by automated systems,
- Claim compensation if you suffer damage because of unlawful processing.
If you are in the European Economic Area or the United Kingdom, you also have under GDPR the rights of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interest. Where processing is based on your consent you can withdraw it at any time; withdrawal does not affect the lawfulness of earlier processing.
You can send your request by e-mail to [to be filled: contact e-mail], in writing to [to be filled: address] or to our registered e-mail address (KEP: [to be filled: KEP address]). We conclude your request free of charge within 30 days at the latest, depending on its nature. We may ask for additional information to verify your identity.
If you play as a guest, your data is tied only to the guest session in your browser. If you clear browser data or switch devices we cannot find that ID and may not be able to verify that a request is yours; you can create an account to keep your progress.
If you think we have not resolved your concern, you have the right to complain to the Turkish Personal Data Protection Board or, if you are in the European Economic Area, to the data protection authority of your country of residence.
Security measures
- The connection between the Portal and your browser is encrypted (HTTPS).
- XP, rewards, streaks, badges and game saves are written only on the server; the browser cannot write them directly. Row-level access rules are enabled on the database tables.
- The database administrator key exists only in server code and is never sent to the browser.
- We keep no passwords; you sign in with an e-mail link or Google.
- Games run at a separate address in a restricted frame; message origins are verified and games cannot reach the Portal's cookies.
- Requests that change data go through an origin check, carry a unique key, and are rate limited.
- Bot checks and rate limiting reduce abuse.
- Data is backed up every day; access to the server and the data is limited to authorised people.
No system is completely secure. If a data breach occurs we notify the Turkish Personal Data Protection Board and, where required, the competent authority in the European Economic Area within 72 hours of becoming aware of it, and you without undue delay if you are affected.
Changes and contact
We update this policy as the Portal or legislation changes. The date of the current version is at the top of the page. We announce important changes on the Portal and, for consent-based processing, ask for consent again where required.
For questions and requests: [to be filled: company name], [to be filled: address], [to be filled: contact e-mail]. This policy is published in several languages; if the translations differ, the Turkish text prevails.