Courtesy translation
1. In short
- We only process the data needed for accounts, purchases, licences and support.
- The desktop app does not send the contents of your game or career to us. It uses the network only for the update check and licence operations.
- The app contains no analytics (telemetry) code; the website uses no optional cookies.
- Your card data does not reach this site or us; payment is made on iyzico's payment page.
- We do not sell your data or share it for advertising.
The data controller is [Data controller — to be completed]. The detailed notice under Turkish law is the KVKK Privacy Notice (Turkish); if the two texts differ, that notice prevails.
2. Website
2.1 Account
When you create an account we store your name, e-mail address and a one-way hash of your password (never the password itself). A strictly necessary session cookie keeps you signed in.
2.2 Purchases
For an order we collect your name, e-mail, billing details and, where needed, phone number and, if Turkish law requires it, your national ID or tax number. Payment happens on the external payment page hosted by iyzico; this site does not receive card details. We only see the payment result and a transaction reference. To prove that the contract was formed we record the versions of the documents you accepted, the time of each confirmation, your IP address and browser information.
2.3 Support and contact
When you write to us we process your name, e-mail, message and any attachments to answer you.
2.4 Cookies
The site uses only strictly necessary cookies (session, language, cookie choice). Optional cookies are used only with your consent; see the Cookie Policy and change your choice at any time on Cookie preferences.
3. Desktop app
The app uses the network only for the following:
- Update check: at most once every 24 hours (can be switched off in Settings) and when you ask for it, the app downloads the update information file from the release server. No account or licence data is sent; as with every internet request, your IP address reaches that server.
- Licence activation and validation: when you enter a key and periodically afterwards, the app sends the licence key (activation only), a one-way hash of the device ID, a device-specific public key, the device name (Windows computer name) and the app version to the licence server.
- Freeing a device slot: when you choose “Remove this device”, the device ID hash and a signed request are sent to the licence server.
- Buy link: “Buy” opens the purchase page in your default browser; the app does not process payment data.
For your licence the licence server keeps your e-mail address, the device ID hash, a hash of the device public key, the device name, app version, activation and last-seen times, and hashed IP addresses for security. Hashing the IP address is a security measure; these records remain personal data as long as they can be linked to your licence.
The app keeps its logs, settings, licence file (encrypted with Windows DPAPI) and save backups only on your computer. A bug report is created only when you ask for it and is never sent by the app; if you send it to support yourself, its contents are processed as part of your support request.
4. Who we share data with
We share data only with the providers we use to run the service, with the e-invoicing provider and our accountant for tax duties, and with authorities where the law requires it.
| Service | Provider | Data shared | Country | Transfer mechanism |
|---|---|---|---|---|
| Website hosting | [Website hosting provider — to be completed] | Account data, session and technical connection data (IP address, browser data) | [Website hosting country — to be completed] | [Website hosting transfer mechanism — to be completed] |
| Licence server and database | Cloudflare (Workers, D1) | E-mail address, licence status, device ID hash, device public key, device name, app version, hashed IP addresses | [Licence server and database country — to be completed] | [Licence server and database transfer mechanism — to be completed] |
| Transactional e-mail delivery | Brevo | E-mail address, name, message content (e.g. licence key) | [Transactional e-mail delivery country — to be completed] | [Transactional e-mail delivery transfer mechanism — to be completed] |
| Payment provider | iyzico | Name, e-mail, phone, billing data, payment transaction data (card data is processed only by the payment provider) | [Payment provider country — to be completed] | [Payment provider transfer mechanism — to be completed] |
Transfers to providers outside Türkiye rely on the safeguards of art. 9 of Turkish Law No. 6698, in particular the standard contract published by the Turkish data protection board.
5. How long we keep data
| Record | Period |
|---|---|
| Website account data | For the life of the account; after closure deleted or anonymised, except for the records below |
| Invoices and accounting records | The period required by tax law (at least 5 years under Turkish Tax Procedure Law art. 253; subject to accountant confirmation) |
| Distance-contract records (pre-information, confirmations, delivery, withdrawal) | At least 3 years (Turkish Distance Contracts Regulation art. 20) |
| Evidence of contract formation (document versions, timestamps, IP address) | [Evidence of contract formation (document versions, timestamps, IP address) retention period — to be completed] |
| Licence and device records | [Licence and device records retention period — to be completed] |
| Licence server security log (hashed IP addresses) | [Licence server security log (hashed IP addresses) retention period — to be completed] |
| Support correspondence | [Support correspondence retention period — to be completed] |
| Marketing consent records | 3 years after the consent ends (Turkish Commercial Electronic Messages Regulation art. 13) |
| Cookie preference record | 6 months in your browser; if stored on the server, while the consent is relied on plus the proof period |
6. Security
- All communication with the website and the licence server uses encrypted connections (HTTPS).
- Licence keys are stored only as one-way hashes, never in plain text; IP addresses in security logs are hashed.
- Licence tokens are signed by the server; device keys cannot be exported from the device.
- Access is limited to those who need it. If a data breach occurs we make the notifications required by law.
7. Your rights
You may ask to access, correct or delete your data and exercise the other rights listed in the KVKK notice. Contact: [Privacy request e-mail — to be completed]. If you live in the European Union or the United Kingdom you also have the right to data portability, to object to processing based on legitimate interests and to lodge a complaint with your local data protection authority.
8. Children
You must be at least [Minimum age — to be completed] years old to create an account or buy. We do not knowingly collect data from younger people.
9. Marketing messages
We send promotional e-mail only if you have separately and optionally given consent. Order, licence and security notices are service messages without promotion.
10. Changes
Every version of this policy is numbered; the current version is published on this page.