Draft for review. This text describes what the game really stores, but it has not been reviewed by a lawyer yet. Items in [brackets] will be filled in before game accounts and payments open.
Who is responsible
The data controller is [operator name and address]. Contact: [contact email]. Under the Turkish Personal Data Protection Law (KVKK, No. 6698) and the EU GDPR you can write to this address for anything about your data.
This website
- No cookies, analytics, advertising or third-party trackers.
- No fonts, scripts or images are loaded from other companies' servers.
- Your language choice is saved only in your own browser (
localStorage). - Our hosting and network providers keep standard request logs (IP address, page, time) to keep the site secure. They are deleted after [30] days.
Your game account
- Account: user name, email address, password and the date you registered. The password is stored only as a one-way hash (Argon2); nobody, including us, can read it.
- Sign-ins: time, IP address and a device identifier made by the game. We use them to protect accounts, find stolen or shared accounts and enforce bans. Kept for [180] days.
- Game data: your ships, items, currencies, progress, guild, quests, rankings and display name. Kept while your account exists.
- Fair play: the server records actions it refuses and signs of cheating, and bans (account, chat, device). Kept for the life of the account and, for bans, up to [2] years after.
- Chat: messages go through our server to other players and may appear in server logs, which are kept for [30] days to handle reports of abuse.
Payments
When the shop opens, payments are handled by [payment provider]. We never see or store your card details; we receive only what you bought, the amount and a payment reference, which tax law requires us to keep for [10] years.
Why we may use your data (legal basis)
- To provide the game you signed up for (contract): account, game data, purchases.
- Legitimate interest: security, fraud and cheat prevention, keeping the game fair, backups.
- Legal obligation: invoices and records the law requires, answering lawful requests from authorities.
- We do not sell your data, do not use it for advertising and do not build marketing profiles.
Where it is stored and who processes it
- Game servers: [server provider], in Turkey.
- Encrypted backups: [backup storage provider, e.g. Cloudflare R2]. Backups are encrypted before they leave the server; the provider cannot read them. Kept for 30 days.
- DNS and network protection: [e.g. Cloudflare]. Some of these providers may process data outside Turkey; where KVKK Article 9 requires it, we rely on the safeguards it allows (such as standard contracts).
Your rights
- You can ask whether we process your data, get a copy, have it corrected or deleted, object to processing, and learn who it was shared with (KVKK Article 11; GDPR Articles 15–22).
- Deleting your account removes your account and game data within [30] days, except records the law requires us to keep and active bans.
- Write to [contact email] from your account's email address. We answer within 30 days.
- You can also complain to the Personal Data Protection Authority (KVKK) or, in the EU, to your data protection authority.
Children
You must be at least [13] years old to create an account. Players under 18 need a parent's or guardian's permission to make purchases.
Changes
If we change this policy we will update the date below and, for important changes, tell players in the game or by email.
Last updated: 10 November 2026 (draft)