KVKK privacy notice
This is our information notice under article 10 of Türkiye's Personal Data Protection Law No. 6698 (KVKK). It is the English version of the Turkish aydınlatma metni.
1. Data controller
TavlArena (the TavlArena team). Contact: hello@tavlarena.com.
2. Personal data we process
| Category | Data | Whose |
|---|---|---|
| Identity and contact | Email address, Google account id (with Google sign-in), display name | Account holders |
| Game and usage | Moves, clocks and dice proofs of online games; ratings; backed-up games; solved puzzles; language | Guests who play online, and account holders |
| Security | Session cookie, guest id, server logs (IP address, time, request), Turnstile bot-check data, salted IP hash | Everyone |
| Requests and complaints | Feedback messages and feature requests, puzzle and player reports, moderation actions (name reset, ban from online play) | Senders and reported players |
For guests, games against the computer, puzzle progress and settings stay on your own device and are not sent to us.
Crash reports. If one of our own scripts fails, we record the error type, a cleaned message (links, emails, quoted text, ids and numbers removed, at most 120 characters), the script file and line, the page path and the app version, without cookies, identifiers or IP addresses. They are kept in Cloudflare Workers Analytics Engine for three months, based on our legitimate interest in keeping the service working (art. 5/2-f).
3. Purposes
- Providing games, accounts, ratings and backups;
- sending sign-in links and turn reminders by email;
- keeping the service secure and preventing abuse and bots;
- finding and fixing errors with crash reports;
- checking fair play in rated games;
- answering requests and complaints;
- improving the service with aggregate statistics that contain no personal data.
4. Legal bases and how we collect data
Data is collected electronically and automatically when you use the site. The legal bases under KVKK article 5 are:
- Establishing or performing a contract (art. 5/2-c): game and account services;
- Our legitimate interests (art. 5/2-f): security, bot and abuse prevention, fair play, aggregate statistics, crash reports;
- Your explicit consent (art. 5/1): PostHog analytics, session recordings and error reports, only if you accept analytics cookies; withdraw it at any time in Settings;
- Establishing, exercising or protecting a right (art. 5/2-e): complaints and disputes.
5. Transfers
Data is transferred to Cloudflare, Inc., our processor for hosting, email, statistics and bot checks. Cloudflare's network is worldwide, so data is also processed abroad. Transfers from Türkiye use the standard contracts under KVKK article 9, and transfers outside the EEA rely on the providers' standard contractual clauses (and the EU–US Data Privacy Framework where the provider is certified); write to hello@tavlarena.com for details or a copy. If you accept analytics cookies, usage data is also transferred to PostHog (PostHog Cloud EU, Frankfurt), our processor for analytics; see the privacy policy. If you sign in with Google, Google is a separate controller for your Google account. We don't sell data or share it with advertisers. Data may be shared with authorities when the law requires it.
6. Retention
- Server logs: 30 days;
- crash reports: three months;
- player reports and moderation records: up to one year;
- unused guest sessions: deleted or anonymised after 12 months;
- accounts: until you delete them; game history is then anonymised as "Deleted player";
- dice proofs: kept with random ids, no name or email, so games stay verifiable.
7. Your rights under KVKK article 11
You may ask us whether your data is processed and for information about it; learn the purpose and whether it is used accordingly; know the third parties it is transferred to in Türkiye or abroad; have it corrected if incomplete or wrong; have it deleted or destroyed under article 7; have corrections and deletions notified to those third parties; object to a result against you that arises only from automated analysis; and claim compensation for damage from unlawful processing.
Write to hello@tavlarena.com; we answer free of charge within 30 days. You can also export or delete your data directly on the Account page. If we reject your request, do not reply within 30 days or you are not satisfied with our answer, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within the legal deadlines.
8. Children
Accounts are for people aged 13 and over; under-18s need a parent's or guardian's permission. Guests are not asked their age.
More detail is in our privacy policy.