Zincir Online — Privacy Policy
DRAFT — not legal advice. Items in
[BRACKETS]must be filled in or confirmed before publishing. Have the final text reviewed by a lawyer familiar with KVKK and GDPR. The Turkish version (privacy-policy.tr.md) prevails in the event of any conflict, unless the law of your country requires otherwise.
Effective date: [EFFECTIVE_DATE] Last updated: [LAST_UPDATED] Applies to: the Zincir Online web app / PWA at [WEB_URL], the Android app "Zincir Online" on Google Play (package name [ANDROID_APPLICATION_ID]), and later the iOS app on the App Store.
This Privacy Policy explains what personal data Zincir Online (the "Game") processes, why, for how long, who it is shared with, and what rights you have. It is also the "Disclosure Notice" (Aydınlatma Metni) under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the information required by Articles 13–14 of the EU General Data Protection Regulation ("GDPR").
1. Who is responsible (data controller)
| Data controller | Tuğsan Koyuncu (individual developer / publisher) |
| Address | [POSTAL_ADDRESS, Türkiye] |
| Contact for privacy requests | [SUPPORT_EMAIL] |
| KEP address (optional, for KVKK requests) | [KEP_ADDRESS or delete this row] |
| VERBİS registration | [VERBIS_STATUS: registered under no. ___ / exempt under Board Decision 2018/87 and later decisions] |
| EU representative (GDPR Art. 27) | [EU_REPRESENTATIVE: name and address, or delete if not required — see open questions] |
We have not appointed a data protection officer because we are not required to. [CONFIRM]
2. Summary
- No email, phone number, password or real name is needed to play. If you request manual review of a deletion after losing your login code, you provide an email address for a reply. You create a profile with a display name and an icon. The Game gives you a secret login code that you use to get back to your profile on another device.
- No third-party advertising or analytics SDKs, and no payments in the current version.
- Data is stored on Cloudflare (Cloudflare Workers + D1 database), which acts as our service provider.
- Your display name and icon are visible to other players in your rooms. Unless you turn off leaderboard visibility in Profile, your name, icon, optional chosen flag/symbol, League and private-room ratings and their respective match counts can appear in separate public top-50 tables. Completed-period championships are also displayed.
- You can delete your account at any time inside the Game (Profile screen) or at [WEB_URL]/delete-account.html.
3. What data we process and why
Automatic multiplayer matches have a separate rating, finishing place and repeated-opponent weighting, independent of duel and private-room ratings. Bot training XP, levels and badges are stored separately for each profile on this device only. They are not uploaded or synced and do not affect human rankings. You can reset them under Free play. Deleting the account here, or confirming its remote deletion while online, also removes its local training progress.
3.1 Profile (only if you create one)
| Data | Details | Purpose |
|---|---|---|
| Display name | Free text you choose, up to 20 characters. Use a nickname, not your real name. | Show you to other players, leaderboard |
| Icon | One of 8 built-in icons | Same as above |
| Optional flag or symbol | A flag-region or neutral-symbol identifier you choose, or none. Never inferred from IP address, device language or location; not verified nationality/location. | Display your chosen marker in profiles, rooms and rankings |
| Profile ID | Random identifier (UUID) generated by the server | Link your profile, sessions and results |
| Login code (recovery code) | 128-bit random secret. The server stores only a SHA-256 hash of it. The mobile app keeps it in secure storage. The current web version does not newly write it to browser storage; a code saved by an older web version is retained until the account is verified with the server, then removed | Authenticate you without email/password |
| Creation and last-update time | Timestamps | Integrity, troubleshooting |
| Acceptance of the Terms of Use | The time you ticked the acceptance box when creating the profile, and the version of the Terms you accepted | Being able to show that you accepted the Terms (community rules, Google Play user-generated content policy) |
3.2 Sessions
| Data | Details | Purpose |
|---|---|---|
| Device session key | 256-bit random token per logged-in device. The server stores only a SHA-256 hash plus its creation time and the linked profile ID | Keep you logged in on that device |
Logging out on a device deletes that device's session from the server. A session expires 180 days after login; after that you need your login code to log in again on that device, and the expired session is deleted from the server.
3.3 Rooms, gameplay and presence
| Data | Details | Purpose |
|---|---|---|
| Room data | 8-character room code, board size, time-control settings, players' display names, icons, colours, turn order, moves/board state, a short log of the last 48 moves (which player played which cell, skipped turns, eliminations for time/forfeit), clocks, bots, a per-tab "rejoin" key, and a salted hash of the network that opened the room (see section 3.8) | Run the match, keep all devices in sync and make replays complete |
| Presence | Room code, in-room player ID, "last seen" time (updated about every 5 seconds while you are in a room) | Show who is connected; apply the 60-second disconnect tolerance |
Rooms expire 2 hours after the last activity. A room with no active human player left, or that no player has connected to for 5 minutes, is deleted earlier, after about 5 minutes. Expired rooms and presence records are deleted when a room is created, by the scheduled cleanup, and in the background on a small share of requests. [CONFIRM CLEANUP: once the scheduled cleanup is confirmed running in production, state the maximum actual retention, e.g. "deleted no later than [RETENTION: X days] after expiry".]
The replay ("Analyse game") opens only from the completed match's result screen and is built in the memory of your open browser tab / app. It is discarded when you leave that screen, start a new match or reload; there is no match archive. The server's short buffer of the last 48 transitions supports live synchronization, chain animations and reconnection; it resets for a new match and is deleted with the room. Finished local and practice board snapshots are not saved on the device; unfinished offline matches can still be resumed.
3.4 Match results, league and leaderboard
| Data | Details | Purpose |
|---|---|---|
| Legacy match result | Match ID, profile ID, outcome and end time | Personal statistics from earlier versions; never converted into league points |
| League rating event | Match and profile IDs, opponent profile ID, outcome, end time, skill rating, rating deviation, volatility, total and human match counts, human base rating, bounded Bot contribution, human/Bot opponent type, Bot difficulty and repeat weight | Calculate ratings in the separate one-to-one league, rank players and reduce repeated-match impact |
| Private-room rating and opponent pair | Match/profile IDs, outcome, end time, rating before/after, rating change, match count and repeat weight; pairs of accounts participating in a match | Rate 2–6 online players separately from League, rank players and reduce repeated encounters within 24 hours; contains no moves or board state |
| Matchmaking queue | Profile ID, request/update time, pairing state, claiming profile and room code | Find an opponent and prevent duplicate concurrent matches |
| Ranking | Name, icon, optional flag/symbol, rank, rounded rating, match count and provisional label for the first 10 human duel League matches only | All-time, weekly, monthly and yearly rankings; periods follow Türkiye time |
| Period championship | Period type/boundaries, finalization time, winner profile ID, closing rating and match count | Preserve completed-period champions, including joint winners with exactly equal ratings |
League and private rooms have separate ratings, period rankings and championship histories. Only the private-room winner gains points; the other players lose points. Surrender in a rated match is a loss; a cancellation for a verifiable server interruption creates no rating event. One rated match in the relevant pool and period is enough to qualify for its ranking and championship; ratings do not reset. Free-play Bot training and same-phone games do not award league points. In Find opponent, a clearly labeled rated Bot match can start after 10 seconds without a human opponent. These matches apply small gains/losses based on difficulty and Bot encounters during the previous 24 hours; cumulative Bot contribution is bounded to −40…+40 in each automatic pool. Bot results do not change the human base rating or Glicko confidence measures. Contributions and match counts are stored on the server for results/rankings and are also removed by account deletion. Private opponent-pair records are removed by cleanup after their 24-hour calculation window; rating events remain for rankings. Account deletion also removes private rating events and pairs involving that account, and clears its profile link from private championship records.
Turning off Show my name on the leaderboard removes your name and marker from the public table. Your authenticated session can still see your own rank. Championship history shows a hidden-player label, without transferring the award to another player. This preference does not by itself determine the legal basis (section 4).
Account deletion removes your profile, marker, queue entries and rating events; it clears your opponent ID in other players' events and the profile link in championship records. Period, rating and match count remain. Removing the profile link does not guarantee that previously published rankings cannot be used to re-identify a record. Before release: review historical retention and re-identification risk.
3.5 Anonymous gameplay events and client error logs
| Data | Details | Purpose |
|---|---|---|
| Gameplay events | The event type and only these fields: match started / finished: mode (online, same phone, practice), board size, number of players, number of bots, number of same-phone players, bot difficulty; when finished also the number of moves and the outcome (win / loss / other). Room created: board size, whether Fischer time is on. Room joined: number of players. Plus the platform (web, Android, iOS) and the time rounded down to the minute. | Understand how the Game is used and improve it |
| Client error logs | Error kind (error / unhandled rejection), line and column number, truncated error message and stack trace (at most 300 / 2,000 characters; URL queries and anything that looks like an email, key or room code are removed), platform, and the time rounded down to the minute | Find and fix bugs |
| Server error logs | For an unexpected server error: the 8-character error code shown to you, the name of the action (e.g. "join room"), the error class, the error message / stack trace truncated and cleaned with the same rules, and the time rounded down to the minute | Find and fix the error from the code you send us |
None of these records contains a profile ID, display name, login code, session key, room code, match ID, IP address, browser information (User-Agent), device identifier or persistent installation ID. If your browser sends a "Do Not Track" or "Global Privacy Control" signal, gameplay events and client error logs are not sent at all.
These are first-party records stored in our own Cloudflare account; no third-party analytics service receives them. Retention: 90 days.
If these events can in practice be linked back to you (for example together with network data), we treat them as personal data and this Policy applies to them in full.
3.6 Data stored only on your device
| Data | Where | Purpose |
|---|---|---|
| Profile data and session key | Android/iOS app: the operating system's secure storage (Android Keystore / iOS Keychain). Web: tab session storage; an older persistent web record is copied there and removed only after server verification of the account | Keep you logged in |
| Login code | Mobile app secure storage. The current web version holds newly issued or migrated codes only in the open tab's memory; it does not newly write them to browser storage. An older saved code remains in local storage until server verification or successful login, so an expired session does not erase the only recovery method | Sign in on another device; generate a new code from an active session if needed |
| Last entered name, display preferences (plain or virus theme, last-move marker) | Local storage | Remember your preferences |
| Practice game in progress | Local storage | Let you continue practice |
| Saved same-phone match (player names, colours, board state) | Local storage; stored separately for each profile, other profiles on the same device cannot see it | Let you continue a same-phone match |
| Tutorial seen, session-expiry warning dismissed, "hide master portraits" preference | Local storage | Not show these again / remember the preference |
| Current room session | Session storage of the tab | Rejoin after a reload |
| Offline copy of the Game's files | Browser cache (service worker) | Make the PWA load fast / offline |
This data does not leave your device except as described above (e.g. the session key is sent with requests). A saved same-phone match is deleted immediately when you delete your account on this device. If the account was deleted on another device or on the web deletion page, the app asks the server on its next start whether the profile IDs that own saves on this device still exist, and removes the saves of deleted profiles. We do not use cookies for tracking, and the Game does not use third-party cookies. Practice mode and guest mode ("play without account") work entirely on your device.
3.7 Technical data processed by our hosting provider
When your device connects to the Game, Cloudflare necessarily processes your IP address, request time, and browser/app technical information (e.g. User-Agent) to deliver the service and protect it against attacks. [CONFIRM: whether Workers Logs / Logpush / Analytics are enabled in the Cloudflare account and whether we can see IP addresses; retention: [RETENTION: X days]]. We do not use this data to identify you or build profiles.
The Game is hosted on ChatGPT Sites (OpenAI), which runs it on Cloudflare. Sites automatically records visitor analytics for the website — such as the number of unique visitors and page views over time — and shows them to us only as aggregated totals. We have not added any analytics SDK for this. [CONFIRM: what Sites stores for these statistics and for how long, and OpenAI's role as processor]
The Android app requests only the Internet permission. It does not access your location, contacts, camera, microphone, photos or files, and it does not read advertising IDs or other device identifiers. When you share an invite, your device's share menu or clipboard is used; we do not see which app you share with.
3.8 Abuse protection: rate limiting with hashed network addresses
To protect the Game against request floods, mass account creation and guessing of room codes, the server counts requests per network address. Your IP address itself is not stored.
| Data | Details | Purpose |
|---|---|---|
| Rate-limit counter | A one-way, salted SHA-256 hash (shortened to 32 hexadecimal characters) of your network address — your IPv4 address, or the first half (/64 prefix) of an IPv6 address — combined with the type of request and the time window; a request count; and the time the window ends | Limit how many requests, rooms, room joins and profiles can be created from one network in a short time |
To limit how many rooms one network can keep open at the same time, a one-way salted hash of the network that opens a room (again IPv4 or IPv6 /64) is also stored in the room record; it is deleted together with the room.
Counting windows last 1 minute (all game requests, anonymous events), 10 minutes (creating and joining rooms) or 60 minutes (creating profiles). A counter is useless once its window has ended; expired counters are deleted automatically by the server. [CONFIRM: maximum actual retention once the scheduled clean-up is confirmed to run in production, e.g. "deleted no later than 1 hour after the window ends"] The hash is keyed with a secret value held only on the server, but because it is derived from your network address we treat it as personal data. Legal basis: legitimate interest in a secure service (see section 4).
3.9 Display-name checks and name reports
Display names are checked automatically against a list of offensive words when you choose them; a rejected name is not stored. Signed-in players can report another player's display name from the room list.
| Data | Details | Purpose |
|---|---|---|
| Name report | The reported display name as it was shown, the reported player's profile ID (only if they use a profile; none for guests or same-phone players), the reporter's profile ID, the reason chosen (offensive / impersonation / other), a review status and the time | Let us review reported names and act on names that break the Terms of Service |
Reports are reviewed manually by us; there is no automated decision about you. If a name breaks the Terms we may change it or delete the profile. No IP address, room code or game content is stored with a report. A player can file at most 20 reports per day. Each report, whatever its status (reviewed or pending), is kept for at most 180 days and then deleted automatically; all reports filed by or about a profile are deleted immediately when that profile is deleted.
3.10 Data we do NOT collect
We do not collect email, phone number, password, real name, date of birth, precise or approximate location, contacts, photos, payment information, advertising ID or special categories of personal data (health, religion, biometrics etc.) to create a game account. Exception: if you request manual review of deletion without a code, we collect a reply email, claimed display name, optional details and request time for that request only.
3.11 Lost-code deletion review
If you submit the form on the web deletion page, we store your reply email, claimed display name, the approximate month you created the profile (month and year), optional details of at most 300 characters, a random case number, status and time. If a verified request results in deletion, the case also retains the resolved profile ID for the request record. Submitting a request does not automatically delete an account. A name or email alone does not prove profile ownership; if adequate verification is impossible, we may be unable to delete the claimed profile. Never put your secret login code in the details field. At most three requests per network can be submitted in an hour.
How your email is used: we use the reply email only to answer this request and to verify ownership of the profile. It is not added to your game account, not used for marketing, notifications or any other purpose, and not shared with third parties (it is only stored on our service provider Cloudflare's infrastructure, section 5). Retention: the request record (including the email) is deleted automatically 30 days after it is handled (closed as completed or rejected). Pending and interrupted requests stay in the review queue until they are resolved; an interrupted request is not automatically deleted.
Limitation: without your login code or an open session we cannot verify automatically that a profile is yours; a name, date or email does not replace that verification. Some requests may therefore not result in deletion; we will tell you by reply email. [OPERATIONAL CONFIRMATION: designate a reviewer, reply address and retention period before release.]
4. Legal bases
| Processing | KVKK (Art. 5) | GDPR (Art. 6) |
|---|---|---|
| Profile, sessions, rooms, presence, match results (providing the Game you asked for) | Art. 5(2)(c) — necessary for the establishment or performance of a contract | Art. 6(1)(b) — performance of a contract |
| Leaderboard (optional public display) | [LEGAL REVIEW: Art. 5(2)(c) contract or 5(2)(f) legitimate interest; not final] | [LEGAL REVIEW: Art. 6(1)(b) or (f); not final] |
| Security, abuse prevention (incl. rate limiting, section 3.8), technical logs, error logs | Art. 5(2)(f) — legitimate interest in a secure, working service | Art. 6(1)(f) — legitimate interests |
| Display-name checks and name reports (section 3.9) | Art. 5(2)(f) — legitimate interest in a safe community | Art. 6(1)(f) — legitimate interests |
| Anonymous gameplay events (if not anonymous in practice) | Art. 5(2)(f) legitimate interest | Art. 6(1)(f) legitimate interests |
| Responding to authorities, exercising legal claims | Art. 5(2)(a), (ç), (e) | Art. 6(1)(c), (f) |
| Data on your device (local storage) | Strictly necessary for the service you request | ePrivacy: strictly necessary storage, no consent required |
We do not use your data for automated decision-making or profiling with legal or similarly significant effects. The leaderboard ranking (wins desc., losses asc.) is a game feature only.
5. Who receives your data
- Other players: in a room they see your display name, icon, colour and moves; if you leave leaderboard visibility on, anyone using the Game can see your name, icon and record there.
- Cloudflare, Inc. (and its affiliates) — hosting, database (D1) and network/security services, as our data processor under its Data Processing Addendum. [CONFIRM D1 location hint / jurisdiction]
- Google / Apple — only the data they collect themselves when you download the app from their stores, under their own privacy policies. We do not send them your game data.
- Authorities — if we are legally obliged to.
We do not sell your personal data and do not share it for advertising.
6. International transfers
Cloudflare operates a global network; your data may be processed in data centres outside Türkiye and outside the EU/EEA, including in the United States.
- KVKK (Art. 9): transfers abroad are based on [TRANSFER_MECHANISM: standard contract approved by the KVKK Board and signed with Cloudflare, notified to the Personal Data Protection Authority within 5 business days / other appropriate safeguard]. [CONFIRM]
- GDPR (Chapter V): for users in the EU/EEA, transfers to Cloudflare in the US rely on the EU–US Data Privacy Framework (Cloudflare is certified) [CONFIRM] and/or the EU Standard Contractual Clauses in Cloudflare's DPA. Because the publisher is in Türkiye, data of EU users is also transferred to Türkiye under [EU_TO_TR_MECHANISM].
You can ask us for a copy of the relevant safeguards at [SUPPORT_EMAIL].
7. How long we keep data
| Data | Retention |
|---|---|
| Profile, optional marker, match results, League and private-room rating events | Until you delete your account. [DECISION: or automatically after [RETENTION: X months] of inactivity] |
| Matchmaking queue | Deleted on cancellation/account deletion. Waiting entries older than 60 seconds are cleaned on the next matchmaking request; matched entries are cleaned on a later matchmaking request after their room expires. Physical cleanup may be delayed if nobody searches. |
| Period championship history | The development version has no automatic age limit; account deletion removes the profile link. [PRE-RELEASE DECISION: retention and necessary data minimisation] |
| Session keys | Until you log out on that device or delete your account, and at most 180 days after login (the session then expires and is deleted) |
| Rooms and presence (including the hash of the network that opened the room and the last-48-moves log) | Expire 2 hours after last activity, or about 5 minutes after the room is left empty; physically deleted within [RETENTION: X days] |
| Gameplay events | 90 days |
| Client and server error logs | 90 days |
| Rate-limit counters (hashed network address, section 3.8) | Until the counting window (1–60 minutes) ends, then deleted automatically |
| Name reports (section 3.9) | At most 180 days, then deleted automatically; deleted immediately with the reporting or reported profile |
| Cloudflare technical/security logs | [RETENTION: X days] (per Cloudflare's configuration) |
| Lost-code deletion requests (section 3.11: reply email, claimed name, approximate creation month, details) | Deleted automatically 30 days after the request is handled; pending and interrupted requests stay in the review queue until resolved |
| Other privacy requests and our replies | [RETENTION: X years], to demonstrate compliance; decide the exact period before release |
| Data on your device | On mobile, until logout or uninstall; on the web, the account session belongs to this browser tab session; local matches and preferences remain until browser data is cleared |
After these periods, data is deleted or irreversibly anonymised (KVKK Art. 7 and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data). Database backups maintained by Cloudflare D1 (Time Travel) may retain deleted data for up to [RETENTION: X days, D1 default is up to 30 days] before being overwritten.
8. Deleting your account
You can delete your account at any time, free of charge:
- In the Game: Profile → Hesabı sil (Delete account) → Hesabımı kalıcı olarak sil → confirm.
- On the web, without the app: go to [WEB_URL]/delete-account.html, enter your secret login code, tick the confirmation box and confirm.
- If you lost the code: if you still have an active signed-in device, generate a new login code or delete the account from Profile. If you have no active session either, submit the I lost my login code form on the web deletion page and keep the case number. The form asks for your display name, the approximate month you created the profile and a reply email; the email is used only for this request (section 3.11). A display name or date alone does not prove ownership; if no adequate verification is available, we may be unable to delete the account. [SUPPORT_EMAIL] must be verified before release.
What is deleted immediately: your profile (name, icon, login-code hash), all your device sessions, all your match results (so you disappear from the leaderboard) all name reports you filed or that concern your profile, and the saved same-phone match of your profile on the device you deleted from (on other devices it is removed the next time the app starts, see section 3.6). In any active room your name and icon are replaced with "Deleted player" and you leave the room. What may remain for a limited time: database backups (see section 7), anonymous gameplay events and error logs that cannot be linked to you, and technical logs at Cloudflare.
9. Your rights
Under KVKK (Art. 11) you have the right to: learn whether your personal data is processed; request information about it; learn the purpose and whether it is used accordingly; know the third parties in Türkiye or abroad to whom it is transferred; request correction of incomplete or inaccurate data; request deletion or destruction under Art. 7; request that correction/deletion be notified to third parties; object to a result against you arising exclusively from automated analysis; and claim compensation for damages caused by unlawful processing.
Under GDPR (Arts. 15–22), if you are in the EU/EEA, you have the right of access, rectification, erasure, restriction, data portability, objection (including to processing based on legitimate interests), and the right not to be subject to solely automated decisions.
How to exercise them: many rights can be exercised directly in the Game (change name/icon, log out, delete account). Otherwise send a request to [SUPPORT_EMAIL] [or KEP / registered mail to POSTAL_ADDRESS, per the Communiqué on the Procedures and Principles for Applications to the Data Controller]. To identify your profile we may ask you to prove possession of your login code — never send the full login code by email; we will tell you a safe way to verify. We respond within 30 days free of charge (KVKK Art. 13; GDPR Art. 12 — one month, extendable where permitted).
Complaints: in Türkiye, to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, www.kvkk.gov.tr) after applying to us first; in the EU/EEA, to the data protection authority of your country of residence.
10. Children
The Game contains no violence, chat, ads or payments and is suitable for a general audience, but it is not directed at children under [AGE: 13]. [DECISION — target audience in Google Play Console.] If you are under [AGE: 13] (or under the age of digital consent in your EU country, between 13 and 16), please use the Game only with the permission of a parent or guardian, and do not use your real name as your display name. If we learn that we hold profile data of a child without valid permission, we will delete it. Parents can contact us at [SUPPORT_EMAIL].
11. Security
- All connections use HTTPS/TLS; the Android app blocks unencrypted (cleartext/mixed) content.
- Login codes and session keys are random (128 / 256 bits) and stored on the server only as SHA-256 hashes; they are never shown to other players or included in room or leaderboard responses.
- In the mobile apps the login data is kept in the OS secure storage, and Android app backup is disabled.
- Server-side validation of moves and turns; strict content-security policy on the web app.
- The web session key is kept only in tab session storage, and the login code is not written to web storage. This reduces exposure compared with persistent storage but does not by itself stop malicious same-origin code running in an open tab from reading the session key.
Your responsibility: anyone who has your login code can access and delete your profile. Keep it secret and do not share screenshots of it. We cannot reset a lost code by email.
No system is perfectly secure. If a personal data breach occurs, we will notify the KVKK Board within 72 hours and, where required, affected users and/or the competent EU authority.
12. Free game, no ads
The Game is free; it shows no ads and takes no payments, so no payment or advertising data is processed. If this changes, we will update this Policy and the store data-safety disclosures, and ask for your consent where required, before the change takes effect.
13. Changes to this Policy
We may update this Policy. The "Last updated" date will change, and for material changes we will inform you in the Game before they apply. Previous versions are available at [POLICY_ARCHIVE_URL].
14. Contact
Tuğsan Koyuncu — [SUPPORT_EMAIL] — [POSTAL_ADDRESS]