Privacy Policy

Last updated: October 29, 2026

In short

You can play the computer without an account. Then only your settings and a random device ID are kept on your device; when you finish a game, its record is written to the server under that ID.
If you create an account, your email address, username, games and the social features you use (friends, messages, chat) are stored.
While you just browse, only totals are kept (how many people, which country, which device); who you are is not kept.
We do not sell your data, use it for advertising or track you for advertising.
Optional analytics measurement runs only if you allow it; you can refuse it or take it back later.
You can download your data and delete your account in Settings; 30 days after a deletion request your data is permanently erased.
You must be at least 15 to create an account and use the social features.

Data controller

Timur Satrancı is run as a non-profit project by Faruk Büberci. Under the Turkish Personal Data Protection Law No. 6698 (KVKK), the data controller is Faruk Büberci. You can reach us at faruk.bubercii@gmail.com.

This policy is a general summary. The formal notice required by KVKK Art. 10 (legal grounds, transfers, your rights and how to apply) is in the KVKK privacy notice.

What do we collect, and why?

Here is which data is processed in which situation, and why.

If you play as a guest

Data: A random device ID kept in your browser, your game settings and language; when you finish a computer game, the game record (moves, result) and simple statistics.
Why: To provide the game, show your history and statistics, and prevent abuse.

If you create an account

Data: Username, email address and an irreversible hash of your password (the password itself is not stored). If you sign in with Google: the name, email and profile photo Google shares. Optional profile details: photo, bio, country. At every sign-in, the country you signed in from (found from your IP address in memory; only the country code is kept, not your IP address).
Why: To create and secure your account, verify your email, reset passwords and serve you.

As you play

Data: Your games and moves, results, rating (Elo) and statistics, online status.
Why: Matchmaking, rankings, game replays and statistics.

If you just browse (visitor count)

Data: A random number that your open tab keeps in memory only (nothing is written to your device; it is gone when you close or reload the tab), the part of the site you are on, your kind of device (phone, tablet or computer), your site language and the domain of the site you came from (if any). Your country is found from your IP address in memory and only the country code is counted; your IP address is not stored.
Why: To see, as totals, how many people are on the site, which countries and devices they come with and which parts they use, and to improve the site accordingly.
Keeping: The live information is deleted after 90 seconds. The daily totals (for example "120 visitors today, 80 from Türkiye") contain no personal information and cannot be tied to a person.
Not being counted: If your browser sends a "Do Not Track" or Global Privacy Control signal, you are not counted.
Source: The country is found with DB-IP.com's free DB-IP Lite database (IP Geolocation by DB-IP, https://db-ip.com).

If you use the social features

Data: Friend requests and your friend list, private messages, global chat messages, notifications.
Why: So you can play and talk with friends; to review behaviour that breaks the rules.

If you write to us or report someone

Data: The subject and message in the feedback form; if you report a player, your report text, the game concerned and the reported person's last public chat messages, at most 20 (copied when the report is filed, because the global chat is erased after a day). Nobody reads private messages: only if the person filing the report chooses to show some of the reported person's private messages (at most 10) are the chosen ones copied into the report; only moderators and admins can read them, every reading is written in an audit log, and the rest of the conversation is never read. If a moderator warns, mutes or bans an account, the action, its reason and its length are kept on the account's record; a banned account that tries to sign in is shown the reason and the length.
Why: To answer you, fix problems and keep the community safe.

Security and logs

Data: IP address, browser and device information, hashes of session tokens, last sign-in time, rate-limiting records; a record of your cookie and acceptance choices.
Why: To protect your account, prevent abuse and attacks, meet legal obligations and be able to prove your choices.

Stored on your device

Data: Session cookies, language preference, your settings, an unfinished game, your tutorial progress and the game files kept so that you can play offline.
Why: To keep you signed in, remember your preferences and work offline. Details are in the Cookie Policy.

Optional measurement (only if you allow it)

Data: Page views, referrer, device and browser type and country through Vercel Web Analytics. No cookies are used.
Why: To understand how the site is used and improve it.

Who do we share your data with?

We do not sell your data or give it to anyone for advertising. To run the service we use the infrastructure of the providers below, which process data only on our behalf and instructions:

Vercel Inc.: hosting of the website and (if you allow it) Web Analytics.
Railway Corp.: server, PostgreSQL database and Redis cache infrastructure.
An email infrastructure provider: sending verification and password-reset emails.
Google LLC: only if you choose "Sign in with Google", for authentication.

If the law requires it (a court order, a request from a competent public authority), data may be passed to the authorities concerned.

These providers' servers may be outside Türkiye. That counts as a "transfer abroad" and is carried out with appropriate safeguards under KVKK Art. 9 and the related Regulation. Details: KVKK privacy notice, section 5.

How long do we keep data?

As long as your account is open. After you ask to delete it, your data is permanently erased within 30 days (the delay lets you undo an accidental deletion).
Guest (account-less) records are deleted 24 months after the last activity.
The live information of the visitor count is deleted after 90 seconds; the daily totals may be kept because they contain no personal information.
Session refresh tokens last at most 7 days; they are deleted when they expire or when you sign out.
Only the last 500 messages of the global chat are kept.
Private conversations are deleted when either person deletes their account.
Records of your acceptance and preferences are kept to prove them, limited by the relevant limitation periods; those tied to an account are deleted with it.
Reports of rule violations (including the chat messages and, if chosen, private messages copied when they are filed), moderation actions (warnings, chat mutes, bans) and unlawful-content notices may be kept for the periods the law requires.

Your rights

Under KVKK Art. 11 you may, among other things, learn whether your data is processed, ask for information, correction or deletion, object, and claim compensation for damage. The full list and how to apply are in the KVKK privacy notice.

The quickest way: in Settings you can download your data and delete your account. For anything else, write from the email address registered to your account to faruk.bubercii@gmail.com.

Children and the age limit

To create an account and use social features such as friends, messages and the global chat you must be at least 15 (the rule added to Law No. 5651 by Law No. 7578, in force from 1 November 2026). Under-15s can only play the computer, without an account.

If you notice an account that belongs to someone under 15, or want a child's data deleted, write to faruk.bubercii@gmail.com and we will delete the account and its data.

We recommend that users under 18 use the Service with their legal guardian's knowledge.

Security

We take reasonable technical and organisational measures: all traffic is encrypted with HTTPS, passwords are stored only as irreversible hashes, session cookies are kept out of reach of page scripts (httpOnly), requests are protected against CSRF and rate-limited, and administrator actions are logged.

If personal data is unlawfully obtained by others, we notify the Personal Data Protection Board as soon as possible and within 72 hours at the latest (KVKK Art. 12), and the people concerned where necessary.

Cookies and similar technologies

Apart from strictly necessary cookies and local storage, nothing is used without your permission. See which cookies and storage items are used in the Cookie Policy, and change your choice at any time with .

Visitors in the European Economic Area and the United Kingdom

If you use the Service from these regions your GDPR / UK GDPR rights also apply: access, rectification, erasure, restriction, data portability (download your data in Settings), objection and withdrawing consent. Our grounds are performance of the contract, legitimate interests (security, preventing abuse) and your consent for analytics measurement. You may complain to the data protection authority where you live, or to the Turkish Personal Data Protection Board.

Changes and contact

If we update this policy we change the date at the top of the page and announce important changes within the Service.

Questions: faruk.bubercii@gmail.com · Contact and legal information