EN
Profile

Privacy Notice Draft

Personal data notice under Turkey's Personal Data Protection Law (KVKK, Law No. 6698).

Draft — not yet through legal review

The text below was rewritten on 2026-09-14 to describe exactly what this site actually processes today. It remains a draft until legal review is complete. Email-based linking is kept disabled until then.

1. Data Controller

Biceberg Games (“the Studio”). Requests and contact: Biceberg Games page. This notice covers this website; data processing inside the game itself is covered by a separate notice.

2. When Data Is Processed

Browsing pages such as home, learn and the store showcase needs no account. Data is processed in four cases:

  • Leaderboard: the display names and scores of players ranked in the game are shown publicly (player IDs are not shown). While you view the table, your IP address is processed temporarily in server memory, solely to limit excessive requests.
  • Account linking: signing in with a code from the game, by email, or with Google.
  • An active session: reading the game data shown in your profile panel.
  • Contribution submissions: filling in the submission form (currently in test mode).

3. Data We Process

Sign-in with a link code

Your game account ID (PlayFabId), a hash of the session key (the key itself is never stored on the server), and creation/last-use timestamps. The link code is deleted after 5 minutes or on first use.

Sign-in by email

Your email address is stored as a SHA-256 hash, together with a hash of the one-time code and an attempt counter, for at most 10 minutes. The code itself is delivered by Azure Communication Services (United States).

Sign-in with Google

Google's stable user identifier (sub) is mapped to your game account and that mapping is stored. Your email address is used only at that moment to answer “which game account is this?” and is not stored.

Profile data

Display name, level, wins, matches played, rank points, owned cosmetics. This is read from the game server on every request, never stored by the site, and the response is marked no-store.

Leaderboard (ranking data)

Ranked players' display names, scores and appearance choices (character, pattern, colour) are read from the game server; player IDs are not passed to the site. The data is not stored permanently by the site: it is cached in server memory for 60 seconds in normal operation and for at most 15 minutes during a service outage.

Submission form

The form is visible but its backend is not live yet (test mode: pressing send stores nothing). Once live, your submitted content, files and submission records will be processed.

Logs

Operational logs contain the first 8 characters of the session key's hash and the game account ID. The key itself, your email address and the one-time code are never written to logs.

4. Purpose and Legal Basis

Purpose: verifying your account, maintaining the session, displaying profile data, and preventing abuse (brute force, spam). The legal bases envisaged are KVKK Art. 5/2-(c) (performance of a contract) and Art. 5/2-(f) (legitimate interest); the definitive bases will be settled by the legal review. Whether the email method additionally requires explicit consent (Art. 5/1) is part of the pending legal review — which is why that method is currently disabled.

5. Cookies and Browser Storage

The site uses no cookies. Visits are counted in aggregate with Cloudflare Web Analytics, which is cookie-free and stores nothing on your device (page address, referrer, browser type, country; no personal identifier or fingerprint is created). Beyond that, it uses your browser's own storage:

  • localStorage["wistoryOturum"] — the session key. Valid for a rolling 14 days and at most 90 days; “Unlink” deletes it from both your browser and the server.
  • sessionStorage["wistoryGoogleAkis"] — security values for Google sign-in; discarded when the tab closes.
  • Language preference — to remember which language version you were on.

6. Third Parties and International Transfers

The site's backend runs in the United States (Azure West US 2), so all of the data above is processed outside Türkiye (KVKK Art. 9; for EU/UK visitors this is also a transfer under the GDPR).

  • Microsoft Azure (Functions + Table Storage) — West US 2: session and mapping records.
  • Azure Communication Services — United States: email delivery.
  • PlayFab (Microsoft) — source of game account and profile data.
  • Google — only if you choose the Google sign-in method. Fonts are served from the site itself; no connection to Google Fonts is made.
  • Cloudflare — the global network the site is published on, plus cookie-free visit counting (Web Analytics); every request passes through this network (standard connection data, including your IP address).

7. Retention

  • Link code: 300 seconds or single use.
  • Email verification record: 600 seconds.
  • Session: rolling 14 days / 90 days maximum; expired rows are swept nightly at 03:17 UTC.
  • Google mapping: until you remove it or the game account is deleted.
  • IP address when viewing the leaderboard: not recorded; held only in an in-memory request counter until the counter refills (a few minutes at most).

8. Security Measures

All traffic is carried over HTTPS. Session keys and one-time codes are held on the server only as hashes; email addresses are stored hashed as well. Attempts are rate-limited per IP, per account and globally. Responses do not reveal whether an account exists (enumeration protection).

9. Your Rights (KVKK Art. 11)

You have the right to learn whether your personal data is processed, to request information, to have it corrected or deleted, to learn the third parties it is transferred to, and to claim compensation for damages. Requests go to our contact address and are answered within 30 days at the latest.

10. Age Limit

Age-related conditions will be determined as part of the legal review and published in this section.

11. Effective Date

Last updated: 11 October 2026. Changes are published on this page.