Privacy Policy

1. Information We Collect

When you sign in with Google, we receive the following information from your Google account:

• Email address: Used for account identification and authentication.
• Display name / Username: Used to identify you within the applications you use (e.g., leaderboards, profiles).
• Profile picture (optional): If provided by your Google account, used solely for display purposes.

We do not collect or store passwords. Authentication is handled entirely through Google Sign-In (OAuth 2.0).

Additionally, the following technical telemetry data may be collected across all our platforms (Web, Android, and Windows) for security, debugging, and service improvement purposes:

• User / Device Identifier (UID): Standard across all platforms (Web, Android, Windows); a unique UUID v4 identifier generated upon setup, and the Supabase User ID (UID) assigned when signing in.
• IP Address: Transmitted from all platforms for network security, abuse prevention, and request routing.
• Client Information (User-Agent): Standard browser and operating system details in web environments; runtime client details (e.g., Dart/HTTP client header) in Android and Windows applications.

2. How We Use Your Information

• To create and manage your account across our applications; to authenticate your identity when you sign in via Google. (Legal basis: Contractual Necessity – GDPR Art. 6(1)(b) / KVKK Art. 5(2)(c))
• To enable features such as leaderboards and cross-app profiles. (Legal basis: Contractual Necessity – GDPR Art. 6(1)(b) / KVKK Art. 5(2)(c))
• To detect and prevent fraudulent or unauthorized access; for debugging and security logging. (Legal basis: Legitimate Interests – GDPR Art. 6(1)(f) / KVKK Art. 5(2)(f))
• To comply with applicable legal obligations. (Legal basis: Legal Obligation – GDPR Art. 6(1)(c) / KVKK Art. 5(2)(ç))

3. Data Storage, Security and International Data Transfers

All data is hosted on Supabase infrastructure within secure data centres located in the European Union (AWS Ireland).

For users residing in Turkey: identity and telemetry data is transferred to secure servers outside Turkey (EU region) for the purpose of operating and hosting the service, in accordance with the Turkish Personal Data Protection Law No. 6698 (KVKK).

Row Level Security (RLS) policies are enforced at the database level, and all data in transit is protected with HTTPS/TLS encryption.

Your data is retained for as long as your account remains active. Upon account deletion, data is permanently removed from Supabase within 30 days. Security and system logs are retained for a maximum of 90 days.

4. Third-Party Service Providers

We use the following third-party services to operate our authentication system. These providers may have access to your personal information only to perform tasks on our behalf and are obligated not to disclose or use it for any other purpose.

• Supabase – Authentication and database infrastructure. (Role: Data Processor)
• Google (Sign in with Google) – OAuth 2.0 sign-in provider. (Role: Independent Identity Provider) By signing in with Google, you are also subject to Google's Privacy Policy.

5. Data Sharing

We do not sell, trade, or rent your personal information to third parties. Your data may only be shared in the following limited circumstances:

• With service providers listed above, solely to operate the authentication service.
• If required by law, regulation, or a valid legal process.
• To protect the rights, property, or safety of Kerem Kuyucu or our users.

6. Log Data

In the event of an error or security event, our servers may automatically collect Log Data such as your IP address, browser type, the time and date of your request, and the pages visited. This information is used solely for security monitoring and debugging purposes.

7. Children's Privacy

Our applications are rated PEGI 3 and are designed to be suitable for all ages. Sign-in is handled exclusively through Google Sign-In, which means users must have a valid Google account to access the service. Google's own policies apply regarding account eligibility for minors.

We do not knowingly collect any personal information beyond what is provided through the Google Sign-In flow.

If you are a parent or guardian and have concerns about your child's use of our applications, please contact us at help@keremkuyucu.com.tr.

8. Your Rights (Under GDPR and Turkish KVKK)

Under GDPR Articles 15–22 and Turkish KVKK Article 11, you have the following rights:

• Access the personal data we hold about you (Right of Access).
• Request correction of inaccurate data (Right to Rectification).
• Request deletion of your account and all associated data (Right to Erasure). You can submit this request via email or visit our Account & Data Deletion page.
• Object to or restrict certain uses of your data (Right to Object / Restriction).
• Request that your data be provided to you in a structured, machine-readable format (e.g. JSON) (Right to Data Portability).

Requests are processed free of charge within 30 days at the latest, in accordance with GDPR and KVKK.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes are effective immediately upon being posted on this page. We encourage you to review this page periodically. Your continued use of our services after any changes constitutes your acceptance of the new policy.

10. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at help@keremkuyucu.com.tr.