okka Privacy Policy
Last updated:
This policy explains what okka Turkish Card Games ("okka") for iPhone and Android collects, why, who processes it and what you can do about it. okka is published by ninefold ("we", "us"). We follow Türkiye's Personal Data Protection Law No. 6698 (KVKK; see the KVKK notice), the EU General Data Protection Regulation (GDPR) and the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).
- Chips are virtual, have no cash value, cannot be exchanged for money or prizes and cannot be sold between players. okka does not offer real-money gambling.
- okka has no ads; your data is never sold or shared for advertising.
- You can play as a guest without an account; link it to Apple, Google or your phone number whenever you like.
What we collect and why
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Account identity: a random device key when you play as a guest; the provider's ID, your name and email address when you sign in with Apple or Google; your phone number when you sign in by phone. | To create your account, sign you in and keep your progress across devices. | Contract | While your account exists; deleted when you delete your account. |
| Profile: nickname, username, avatar; optional birthday (day and month). | So other players can recognise you at a table, and so we can give you a birthday gift. | Contract | While your account exists. |
| Game data: hands played and their results, chips balance and history, level and XP, badges and items, friends list, coffeehouse memberships, rankings. | To run the games, match you with players, show your progress, keep your balance correct across devices and keep the game fair. | Contract | While your account exists; afterwards only in anonymous totals. |
| Table and coffeehouse chat, quick messages and reactions; your reports and blocks. | So you can talk to the players at your table and in your coffeehouses, and so we can review reports and prevent abuse. | Legitimate interest | Table chat and reactions are kept with the table record for 30 days, then deleted. Coffeehouse chat is kept until the coffeehouse is deleted and is shown to its members; if you delete your account, your messages stay under the name "Silinmiş Oyuncu" (deleted player). Report and block records are kept while your account exists, then anonymised for up to 1 year. |
| Contacts (optional): one-way hashes of the phone numbers in your address book, if you choose "Find friends from contacts". | To find okka players among your contacts. | Consent | Processed only during matching; not stored. |
| Purchase history and okka Club subscription status (product, date, amount, store transaction ID). We never see your card details. | To credit the chips you bought, unlock your membership, restore it on a new device and handle billing questions; and, through RevenueCat, to measure purchase and subscription performance (PostHog) and send subscription messages (Customer.io). | Contract | While your account exists; then anonymised for up to 10 years for tax and accounting records. |
| A push notification token, only if you allow notifications. | To send the notifications you agreed to (table invitations, daily bonus, reminders). | Consent | Until you turn notifications off, uninstall the app or delete your account. |
| Technical data: IP address, device model, OS and app version, server access logs. | To run the service, keep it secure and prevent cheating and abuse. | Legitimate interest | Access logs for up to 30 days. |
| Crash logs: where the app stopped, the app version, device model and operating system version. Only if you allow "Share usage data". | To find and fix crashes. | Consent | 90 days. |
| Usage statistics: screens you open, games you start and finish, store interactions; linked to your account ID. With your permission, a device identifier that is the same for all ninefold apps on your device (iOS identifierForVendor, Android App Set ID). Only if you allow "Share usage data". | To improve the app and understand usage across our apps. It is not an advertising identifier and is not shared with third parties for advertising. | Consent | Up to 2 years; no new data is collected after you withdraw permission. |
| Your preference and notification token for offers and news. Only if you allow "Offers and news". | To send tips, offers and news about okka and other apps from ninefold. | Consent | Until you withdraw permission or delete your account. |
We do not sell your personal data, do not use it for advertising and do not process it for anything other than the purposes above.
Legal basis
- Contract: to provide the app and what you bought (keeping your account, crediting your chips, unlocking okka Club).
- Legitimate interest: to keep the app working, secure and fair (crash reports, access logs, reviewing reports). You can object at any time.
- Consent: for push notifications, usage statistics and crash reports, offers and news, contact matching and anything else we ask your permission for in the app. Usage data and offers are off by default and can be changed in Settings. You can withdraw consent at any time in the app or your device settings; this doesn't affect processing before you withdrew it.
Service providers
We use these providers to run okka. They process data only on our instructions under data processing agreements; Apple and Google (App Store, Google Play) handle payments under their own terms. Purchase and subscription details (product, amount, subscription status) are passed with your account ID from our payment provider RevenueCat to our analytics (PostHog) and messaging (Customer.io) providers. This does not depend on the "Share usage data" permission.
| Provider | Purpose | Where |
|---|---|---|
| Apple | Sign in with Apple, App Store purchases, iOS notifications (APNs) | United States and worldwide |
| Sign in with Google, Firebase Authentication (phone sign-in), Google Play billing, Android notifications (FCM) | United States | |
| Firebase Crashlytics (Google) | Crash reports | United States |
| RevenueCat | Validating in-app purchases and subscription status | United States |
| PostHog (EU Cloud) | Anonymous usage statistics (with permission); purchase and subscription events (via RevenueCat) | European Union (Frankfurt) |
| Customer.io | Push notifications and offer/news messages (with permission); subscription events (via RevenueCat) | European Union |
| Fly.io | Game server and API hosting | European Union (Frankfurt) |
| Neon | Database | European Union |
Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and get a copy of it;
- have it corrected or deleted;
- restrict or object to how we process it;
- receive it in a portable format;
- withdraw consent at any time;
- complain to your data protection authority (the Personal Data Protection Board in Türkiye, the authority in your EU country, or the UAE Data Office).
You can delete your account yourself. For anything else, email [email protected] from the address or with the phone number linked to your account. We reply within 30 days.
International transfers
Our servers and database are in the European Union. Apple, Google, Firebase Crashlytics and RevenueCat process data outside the European Economic Area, Türkiye and the UAE, mainly in the United States. These transfers are protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework, by Article 9 of the KVKK and by equivalent safeguards under UAE law.
Children
okka is not directed to children under 13 and we do not knowingly collect their personal data. If you believe a child under 13 has given us personal data, contact [email protected] and we will delete it.
Security
Data in transit is encrypted (TLS). Our providers store data on encrypted, access-controlled systems, and only people who need it to run the service can access it. Game rules and the chips ledger run on the server; the app only displays them.
Changes to this policy
If we change this policy we will update the date at the top. For significant changes we will tell you in the app before they take effect.
Contact
ninefold. Email: [email protected].