Privacy Notice

This is the whole of what we do with your data. It is written to be read once and understood, and it is deliberately short on soothing language: what follows is the list of what we hold, why we are allowed to hold it, who else touches it, how long it stays, and what you can make us do about it.

Two sections at the end say the same things again in the form two laws require: the aydınlatma metni under Article 10 of Law No. 6698, and the information under Articles 13 and 14 of the GDPR for players in the EU and EEA. Neither of them asks you for anything. This document is information, not a consent form — nowhere does reading it count as agreeing to anything.

1. Who is responsible

The data controller is Azakhan Studios, the trading name of [COMPANY LEGAL NAME], at [REGISTERED ADDRESS].

• Data protection requests: [PRIVACY CONTACT ADDRESS]
• Contact person for data protection: [DATA CONTACT PERSON]
• Representative in the European Union (Article 27 GDPR): [EU REPRESENTATIVE]
• Everything else: the Imprint

2. What we hold

When you register (this is the complete list of what is stored):

What	Note
Account name	Chosen by you; visible to other players in the game
E-mail address	Stored lower-cased; it is the account’s contact channel
Password	Never stored. What is stored is an argon2id hash; we cannot read your password and cannot recover it for you
Which documents you accepted, and when	The version of these Terms and of this notice, plus the timestamp
Whether you asked for news e-mail	A yes/no. See section 9
A verification token	32 random bytes, kept only as a SHA-256 hash, usable once, valid 24 hours

You tick a box to confirm you are 18 or older. We do not ask for your date of birth and we store no age.

When you play, the game servers record what the game is made of: your characters and their progress, your sign-ins, your inventory and the records of trades, market listings and transfers between players. If your account is penalised, the penalty and the reason for it are recorded.

For security and to keep bots out, the gateway keeps a short-lived count of requests per IP address in memory only — never written to a database, and dropped after 24 hours of inactivity. The web server in front of it writes an access log that contains the client IP address; the password, account name, e-mail and token values are stripped from that log before it is written.

When you write to support, we have your message and whatever you put in it.

What we never collect: no date of birth, no real name, no address, no phone number, no payment data (there is nothing to pay for), no advertising identifiers, no analytics, no profiling, no location beyond what an IP address implies, and nothing at all from a data broker.

3. Why, and what allows us to

Each purpose below is tied to the specific legal ground it rests on. The naming is exact on purpose: a notice that says “we process your data under the applicable articles” tells you nothing, and both laws forbid it.

Why	Under the GDPR	Under Law No. 6698
Create and run your account; let you sign in; keep your characters and progress; answer your support mail	Art. 6(1)(b) — necessary to perform our contract with you	md. 5/2-c — directly related to the making and performance of the contract
Verify your e-mail address	Art. 6(1)(b) for concluding the contract; Art. 6(1)(f) for the part that is about stopping abuse	md. 5/2-c, and md. 5/2-f for the anti-abuse part
Keep the service secure: rate limiting, the anti-bot check, access logs, investigating cheating and account theft	Art. 6(1)(f) — our legitimate interest in network and information security, which recital 49 of the GDPR names expressly	md. 5/2-f — our legitimate interest, weighed against your rights, and md. 12 which obliges us to secure the data
Enforce the Game rules and handle appeals	Art. 6(1)(f), and Art. 6(1)(b) for the terms you accepted	md. 5/2-c and md. 5/2-f
Keep the record of which terms you accepted and when	Art. 6(1)(c) — we are required to be able to show it; and Art. 6(1)(f) for keeping evidence for a legal claim	md. 5/2-ç — our legal obligation; md. 5/2-e — establishing and defending a right
Service e-mail: verification, password reset, security alerts, maintenance and reset notices, changes to these documents	Art. 6(1)(b), and Art. 6(1)(c) where the law obliges the notice	md. 5/2-c
News and announcement e-mail	Art. 6(1)(a) — your consent, which you can take back at any time	md. 5/1 — açık rıza, plus the separate permission required by Law No. 6563

There is no other purpose. We do not use your data to build a profile, to target advertising, or to train anything.

4. Who else touches it

We do not sell your data, we do not share it for anyone else’s purposes, and there are no advertising or analytics companies in this list. These providers process it on our instructions and nothing else:

Provider	What for	What they see
Google Cloud	Runs the account system and the game servers, in a European Union region	Everything stored, as the infrastructure it runs on
Google Workspace	Sends our e-mail, from [email protected], over an authenticated SMTP connection	Your e-mail address and the content of the mail we send you
Cloudflare	The Turnstile anti-bot check on the registration form	Your IP address, which is sent to Cloudflare as part of checking the challenge, plus the challenge result and the site it came from
[SITE HOST]	Serves this website	Ordinary web-server request data for this site

Beyond that, we disclose data only where a law or a lawful order requires it, and where it is needed to establish, exercise or defend a legal claim. If that ever happens to you and we are allowed to tell you, we will.

5. Sending data outside the country

Our providers are outside the country the studio is established in, and that makes every one of those flows a transfer abroad. Two regimes apply and they do not say the same thing, so both are set out.

Under Law No. 6698 (Article 9). The Personal Data Protection Board has not issued an adequacy decision for any country — so there is no country, including in the European Union, to which we may transfer on that ground. We also cannot lean on your consent here: consent is only available for transfers that are occasional, and hosting, e-mail and an anti-bot check are the opposite of occasional. The route we use is therefore the standard contract published by the Board under Article 9(4)(c), signed with each provider and notified to the Authority within five business days of signature. [KVKK STANDARD CONTRACT STATUS]

Under the GDPR (Chapter V). There is no European Commission adequacy decision covering transfers from where we are established, and the EU-US Data Privacy Framework does not apply to a transfer that does not start in the Union. So, plainly: no adequacy decision covers these transfers. We rely on the standard contractual clauses of Commission Implementing Decision (EU) 2021/914, which both Cloudflare’s and Google’s own data processing terms incorporate. You can ask us for a copy of the clauses that apply to your data at [PRIVACY CONTACT ADDRESS] and we will send it.

Hosting sits in a European Union region, which is good for latency and for you — but under Article 9 of Law No. 6698 it earns us nothing, and we are not going to pretend otherwise.

6. How long we keep it

What	How long
An account you use	While the account exists
A registration whose e-mail was never verified	Deleted after 3 days, automatically
A verification token	24 hours, then it stops working; the record is cleared afterwards
Rate-limit counters (IP)	In memory only, dropped after 24 hours of inactivity
Web-server access log (contains your IP)	[ACCESS LOG RETENTION]
Characters, progress, trades and transfers	Live for 90 days, then moved to an archive kept as the record of what happened in the game
The record of which terms you accepted	While the account exists, and afterwards for as long as a claim about it could still be brought
Support correspondence	While it is needed to deal with the matter, and afterwards for as long as a claim about it could still be brought
A closed account	Deleted on request; otherwise the identifying parts are removed once nothing requires us to keep them

Be told this plainly: there is no self-service delete button today, and no automatic erasure of an account that has been used. Erasure is done by hand when you ask for it. That is lawful, and it is also a gap we intend to close with code rather than with a paragraph. Ask, and we do it inside the deadlines in sections 7 and A.5.

7. What you can make us do

Write from the address on your account to [PRIVACY CONTACT ADDRESS]. It is free, and we do not charge for it.

You can ask us to:

• tell you whether we hold data about you, and give you a copy of it;
• correct anything that is wrong or incomplete;
• delete your account and its data;
• restrict what we do with it while something is being sorted out;
• hand it over in a machine-readable form, or send it to someone else;
• stop: object to processing we base on our legitimate interest, and — with no reason needed and no exceptions — to marketing;
• take back a consent you gave, at any time, without that affecting what was lawful before you took it back;
• have a person look at it if a decision about your account was made automatically.

When we answer. Within one month under the GDPR, which we may extend by two further months for a complicated request — and if we do, we tell you inside the first month and say why. Within 30 days under Law No. 6698. In practice, sooner.

If we say no, we say why, and we tell you how to complain.

8. Decisions made by a machine

Two places in the service make decisions without a person:

• Rate limiting and the anti-bot check can refuse a request or a registration. That is not a decision about you as a person; if it catches you wrongly, write to support and we will sort it out.
• Enforcement. Where a penalty is applied automatically, the appeal is where a human reviews it: every penalty can be appealed once, a different person decides it, and the answer comes within seven days. You can put your side of it and the decision can be reversed. That is section 7 of the Terms of Use, and it is also what Article 22(3) of the GDPR requires of us.

9. News e-mail

If we send announcement e-mail at all, it is only to people who asked for it, and:

• the permission is separate, never bundled with accepting the Terms or with this notice, and never pre-ticked;
• refusing changes nothing about your access to the game — it cannot be a condition of the service;
• every message carries a way out that is free and takes one click, and we stop within three working days;
• you can change your mind in your account settings, as easily as you agreed.

Service e-mail is not marketing. Verification, password reset, a security alert, a maintenance or reset announcement, a change to these documents: those go to everyone, because they are the service. They will not carry a promotion, an offer or a store link — partly because that would be wrong, and partly because under Law No. 6563 one promotional line would turn a service message into a commercial one.

Today we have sent no marketing e-mail at all.

10. Keeping it safe

Passwords are stored as argon2id hashes and nowhere else. Verification tokens are random, stored hashed, and work once. Everything travels over TLS. The game and database servers have no public address: the gateway is the only door, and administrative actions need their own credential. The logs that could identify you have the sensitive fields stripped before they are written.

If a breach happens and it is likely to put your rights at serious risk, we will tell you — in plain language, saying what happened and what to do — and we will notify the competent authority as the law requires.

11. Under 18

The service is for adults. We do not knowingly process the data of anyone under 18, and there is no flow for minors. If we find out that an account belongs to someone under 18, we close it and delete its data. A parent can write to [email protected] about a child’s account and we will act on it.

12. When this notice changes

We publish the new text here with a new version number and date, and we keep every earlier version published, so the text you accepted can always be read. If a change matters to you, we tell you at least 30 days beforehand by e-mail and on this site. A new purpose is announced before the processing starts, not after — that is a requirement, not a courtesy.

---

A. Aydınlatma metni — Law No. 6698

This section exists because Article 10 of Law No. 6698 and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Disclosure Obligation require it, in this order and with these headings. It is not a consent text. If you ever see a screen asking you to “accept” or “consent to” this notice, that screen is wrong: the only thing you can sensibly say about an information text is that you have read and understood it.

A.1 — Identity of the data controller and its representative. Azakhan Studios ([COMPANY LEGAL NAME]), [REGISTERED ADDRESS]. Contact: [PRIVACY CONTACT ADDRESS]; contact person [DATA CONTACT PERSON]. Entry in the Data Controllers’ Registry (VERBİS): [VERBIS REGISTRATION].

A.2 — What is processed, and for what purpose. Identity and contact data (account name, e-mail address), account security data (password hash, verification token), transaction and game data (characters, progress, inventory, trades, market records, sign-ins), and transaction security data (IP address, request timestamps, anti-bot check result). The purposes are those in section 3: creating and running the account, verifying the e-mail address, keeping the service and its players secure, enforcing the game rules and handling appeals, proving which documents you accepted, sending service e-mail, and — only with separate express consent — sending news e-mail.

A.3 — To whom and for what purpose it may be transferred. To the providers in section 4 — cloud infrastructure, e-mail delivery and the anti-bot check — solely so that they can perform those functions for us; and to public authorities and courts where a law requires it. Transfer abroad is covered in section 5, under Article 9(4)(c).

A.4 — The method of collection and the legal ground. Collected by automated means through this website, the account system and the game client, from you directly. The legal grounds are named article by article in the table in section 3: Article 5(2)(c) for the contract, 5(2)(ç) for our legal obligations, 5(2)(e) for establishing and defending a right, 5(2)(f) for security, and express consent under Article 5(1) for news e-mail only. No special-category data under Article 6 is processed.

A.5 — Your rights, and how to use them. You have the rights listed in Article 11 of Law No. 6698. To use them, apply to us under the Communiqué on the Procedures and Principles of Application to the Data Controller: in writing, or through a registered electronic mail (KEP) address, a secure electronic signature, a mobile signature, or the e-mail address you have already registered with us and verified. The application has to be in Turkish and has to contain your name and surname (and signature, if on paper), your identity or passport number, your address for service, your e-mail or telephone, and what you are asking for. We answer within 30 days, free of charge — a written answer longer than ten pages may carry the fee in the Communiqué’s tariff.

Send applications to: [PRIVACY CONTACT ADDRESS] · postal address [REGISTERED ADDRESS] · KEP address [KEP ADDRESS].

A.6 — Complaints. If we refuse, answer inadequately, or fail to answer in time, you may complain to the Personal Data Protection Board within 30 days of learning our answer and in any case within 60 days of your application. You have to apply to us first — the law does not allow a complaint to the Board before that. Your right to go to court and to claim damages is untouched by any of this.

---

B. Information under the GDPR — the EU and EEA

If you are in the EU or EEA, this service is offered to you and the GDPR applies to it. The information Article 13 requires is in sections 1 to 6 above; this section completes it.

B.1 — Controller and representative. Section 1. Our representative in the Union under Article 27 is [EU REPRESENTATIVE]. We have assessed whether we must appoint a data protection officer under Article 37 and recorded the reasoning; [DATA CONTACT PERSON] is the person who answers data questions either way.

B.2 — Legal bases, and our legitimate interests. Named purpose by purpose in section 3. Where we rely on Article 6(1)(f), the interest is specific, not a slogan: keeping the account system available and free of automated abuse, detecting cheating and account theft, and being able to prove what was agreed. We weigh that against your rights before we start, and you can object under Article 21 at any time.

B.3 — Is giving us the data obligatory? An account name, an e-mail address and a password are required in order to conclude the contract — without them we cannot create an account, and that is the only consequence. The news-e-mail box is optional, and refusing it costs you nothing. Nothing else is asked of you.

B.4 — Your rights. Access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21) including an unconditional right to object to marketing, and not to be subject to a solely automated decision with significant effects (22). Where we rely on consent you may withdraw it at any time (Art. 7(3)), and withdrawing is as easy as giving. We answer within one month, extendable by two (Art. 12(3)).

B.5 — Complaining. You may lodge a complaint with a supervisory authority, in particular in the Member State where you live, where you work, or where you think the infringement happened (Art. 77) — you do not have to come to us first, though we would rather you did. The authority for our representative is [EU SUPERVISORY AUTHORITY].

B.6 — Transfers. Section 5: no adequacy decision applies, and we rely on the standard contractual clauses in Decision (EU) 2021/914. Ask and we will send you a copy.

B.7 — Automated decisions. Section 8.

---

Version 1 — 13 September 2026. Published in English and Turkish; for people covered by Law No. 6698 and Law No. 6502, the Turkish text is the one that counts, and any difference between the two versions is read in your favour. Questions, and anything you want us to do with your data: [PRIVACY CONTACT ADDRESS].