Notice on the Processing of Personal Data (KVKK)
okka · Article 10 of Türkiye's Law No. 6698 · Last updated:
This notice is provided for users in Türkiye under the Personal Data Protection Law No. 6698 (KVKK). The full list of data, purposes and retention periods is in the Privacy Policy; this notice gathers the information the KVKK requires. The Turkish version is the authoritative one.
1. Data controller
ninefold. Contact: [email protected].
2. Personal data processed
- Identity and contact: nickname, username, avatar; name and email when signing in with Apple or Google; phone number when signing in by phone; optional birthday (day and month).
- Account and transactions: sign-in ID, device key, session records, chips balance, in-app purchase records (store transaction ID, product, amount).
- Game and interaction: hands played and results, level, badges and items, friends, coffeehouse memberships, table chat and reactions (30 days), coffeehouse chat (until the coffeehouse is deleted), report and block records.
- Technical: IP address, device model and OS version, app version, crash and error logs, push token.
- Contacts (optional): with "Find friends from contacts", phone numbers are sent only as one-way hashes for matching and are not stored.
3. Purposes and legal grounds
- Providing the game service, matching tables, keeping progress across devices, processing chips and okka Club membership — performance of a contract (KVKK art. 5/2-c).
- Verifying purchases and keeping accounting records — legal obligation (art. 5/2-ç).
- Preventing cheating, abuse and fraud, reviewing reports, security — legitimate interest (art. 5/2-f).
- Contact matching, birthday gift, notifications — explicit consent (art. 5/1); you can withdraw it at any time in the app settings.
4. Transfers
Data is shared with Fly.io and Neon for hosting (European Union data centres) and with Apple and Google (Firebase) for sign-in, purchases and notifications, with RevenueCat for purchase validation (purchase and subscription details are also passed through RevenueCat to PostHog and Customer.io) and, if you allow it, with PostHog (EU) for usage statistics and Customer.io for notification and offer messages. Transfers abroad are made under Article 9 of the KVKK, only to the extent needed to provide the service, with your explicit consent or adequate safeguards. Data is not sold or shared for advertising.
5. Retention
Data is kept while your account is open. When the account is deleted, identity and contact data are deleted or anonymised immediately; purchase records are kept anonymised for the statutory period (up to 10 years) and report and block records anonymised for up to 1 year. Table chat is deleted after 30 days; coffeehouse chat stays under the name "Silinmiş Oyuncu" until the coffeehouse is deleted. Server access logs are kept for up to 30 days and crash logs for 90 days.
6. Your rights (KVKK art. 11)
You have the right to learn whether your data is processed, request information, learn whether it is used for its purpose, know the third parties it is transferred to in Türkiye or abroad, request correction if incomplete or inaccurate, request deletion or destruction, request that these operations be notified to third parties, object to a result that is to your detriment from analysis by automated systems, and claim compensation if you suffer damage.
7. Requests
Send requests to [email protected]; we reply within 30 days at the latest. You can delete your account yourself in the app via Profile → "Delete account permanently" (account deletion). If you are not satisfied with our reply you may complain to the Personal Data Protection Board.