KVKK-1 · About this notice
KVKK-1.1 This notice is provided under Article 10 of the Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform. It covers the STRIKEHEART mobile game for iOS and Android ("the Game") including its online services, the official website strikeheart.com ("the Website"), and the support, privacy and deletion requests you send us.
KVKK-1.2 This notice is a summary. The full description of our processing is in the Privacy Policy; the clause references in brackets (for example PP-3.1) point to it. Both texts describe the same processing.
KVKK-1.3 The Game is in development and has not yet been released; its online features currently run only in a test environment and no real-money purchases are processed. The information on the Game applies to the released Game (PP-2.5). For the Website, this notice already applies.
KVKK-2 · Data controller
KVKK-2.1 The data controller is Adem Özdamar, the natural person who owns the sole proprietorship trading under the business name Garanti Web Tasarım in Türkiye and operates the STRIKEHEART brand ("we", "us"). A sole proprietorship has no legal personality separate from its owner. STRIKEHEART is not a separate company.
KVKK-2.2 Address: Eyüp, Istanbul, Türkiye. How to send a written application is described in KVKK-9.1. Further operator details are given in the Legal Notice.
KVKK-2.3 Contact for personal-data matters: privacy@strikeheart.com.
KVKK-3 · Personal data we process
KVKK-3.1 We process the following categories of personal data:
| Whose data | Data categories | Privacy Policy |
|---|---|---|
| Players (Game users) | Account and sign-in data: STRIKEHEART Player ID, identifier of the sign-in provider (Apple, Google, Facebook) and the display name and profile-photo link the provider supplies; for e-mail accounts the e-mail address and the password stored only as a one-way hash; hashed session tokens | PP-3.1 |
| Players | Birth year (not the full date of birth), declared once when the account is created, and a self-chosen country | PP-3.2 |
| Players | Profile and game progress (display name, username, avatar, levels, settings, progress, items, currency balances and ledger, achievements, cloud saves) | PP-3.3 |
| Players | Match and fair-play data (match results, verification data and input logs, online match records, rank data) | PP-3.4 |
| Players | Friends and messages, stored only in filtered form with personal details masked, for 30 days | PP-3.5 |
| Players | Technical connection data for live voice chat (at the voice provider: shortened IP address, pseudonymous voice identifier, device identifier, kept for at most 30 days); when you use voice chat, technical diagnostic and performance data collected by the voice provider (connection and audio-quality information, device identifier, approximate location derived from a truncated IP address; linked to a pseudonymous user ID, kept for at most 30 days, not used for advertising or tracking); voice chat is not recorded continuously | PP-3.6, PP-3.15 |
| Players | Safety and moderation data (reports; as evidence the last 20 messages between the two players, the match ID and, for reports made during a voice session, the last part of that session of at most 60 seconds; blocks; sanction records; records of staff access to evidence; masked filter samples) | PP-3.7 |
| Players | Purchase transaction data received from Apple or Google (no payment card data) | PP-3.8 |
| Players | Notification data, if you allow push notifications | PP-3.9 |
| Players | Salted hash of an installation identifier, not linked to your account | PP-3.11 |
| Players and Website visitors | Technical connection data, including the IP address and, for the Website, server access logs | PP-3.12, PP-3.13 |
| People who contact us | E-mail address, message content and the identifiers you give us | PP-3.14 |
KVKK-3.2 Voice chat is off by default and opens only when both players agree; players aged 13 to 17 can use it only with friends. It is transmitted live through the voice service provider Vivox (Unity Technologies). It is not recorded continuously and nobody listens to it live. Only when a participant reports a player during a voice session is the last part of that session – at most 60 seconds – attached to the report as evidence; players are informed of this when they join voice chat. Until then, this short audio is held only temporarily in working memory and is discarded when the player leaves the session. We do not use voice clips to identify people by their voice (PP-3.6, PP-3.7).
KVKK-3.3 The Website sets no cookies and uses no analytics, advertising or tracking tools. It stores only three functional values in your own browser – your language choice (local storage), your motion preference if you use the "Motion: Full / Reduced" switch in the footer (local storage) and, for the current browser session only, a note that the home page's cinematic opening has already been shown (session storage); none of them contains personal data and none is sent to us (Cookie Policy, CK-3). Our hosting provider keeps server access logs for the security and operation of the Website (PP-3.13).
KVKK-3.4 We do not ask for, and do not intend to process, special categories of personal data within the meaning of Article 6 of the KVKK. Please do not include such data in messages or support requests.
KVKK-3.5 We do not collect precise location, contacts or address book, advertising identifiers or payment card data, and we make no continuous recordings of voice chat. Apart from the voice-chat diagnostics described here, the Game contains no analytics, advertising or crash-reporting SDKs. When you use voice chat, our voice service provider Vivox (Unity Technologies) collects technical diagnostic and performance data from your device (connection and audio-quality information, a device identifier and an approximate location derived from a truncated IP address) to run and improve the service; this data is linked to a pseudonymous user ID assigned to you rather than to your identity directly, is kept for no longer than 30 days and is not used for advertising or tracking. If you never use voice chat, this data is not collected (PP-3.15).
KVKK-3.6 Minimum age. Children under 13 may not create an account or use the Game. If the birth year declared when an account is created shows that the person is under 13, no account is created and the declared birth year is not stored. If we find that an account belongs to a child under 13, we close the account and delete its personal data, except data we are required by law to keep. Parents and legal guardians can send such notices and deletion requests to privacy@strikeheart.com. Players aged 13 or over who are under 18 need the consent of a parent or legal guardian to accept the Terms of Service and to make purchases (PP-9).
KVKK-4 · Purposes and legal grounds
KVKK-4.1 We process personal data for the following purposes, on the legal grounds in Article 5(2) of the KVKK (PP-4.1):
| Purpose | Legal ground (KVKK Art. 5(2)) |
|---|---|
| Creating and running your account, sign-in, providing the Game and its online features, including live voice chat | Necessary for the establishment or performance of a contract – (c) |
| Minimum-age check and age-appropriate protections | Legitimate interest – (f); compliance with a legal obligation where applicable – (ç) |
| Fair play, anti-cheat, abuse and fraud prevention | Legitimate interest – (f) |
| Community safety, reports and moderation, including report evidence (messages and the voice clip) and sanction records | Legitimate interest – (f); establishment, exercise or protection of a right where evidence is needed for a review or a legal claim – (e); compliance with a legal obligation where a competent authority requests a record – (ç) |
| Delivering purchases, handling refunds and reversals, tax and accounting records | Performance of a contract – (c); compliance with a legal obligation – (ç) |
| Delivering push notifications you have allowed (never for marketing) | Performance of a contract – (c) |
| Answering support, privacy and deletion requests | Compliance with a legal obligation – (ç); performance of a contract – (c); establishment, exercise or protection of a right – (e) |
| Security of our systems and of the Website | Legitimate interest – (f); compliance with a legal obligation where the law requires us to keep traffic data – (ç) |
KVKK-4.2 We do not sell personal data, do not use it for third-party advertising, do not build advertising profiles and do not send marketing messages (PP-4.2, PP-4.3). None of the processing above is based on explicit consent.
KVKK-5 · How we collect personal data
KVKK-5.1 We collect personal data electronically: (a) directly from you when you create an account, play, chat, report or contact us; (b) automatically from the Game, our servers and the Website's server while you use them; (c) from Apple, Google or Meta when you sign in with them; and (d) from Apple or Google when you make a purchase (PP-5.1). Collection takes place through the Game, our backend services, the Website and e-mail, on the legal grounds listed in KVKK-4.
KVKK-6 · Recipients and purposes of transfer
KVKK-6.1 Platform providers. Apple, Google and Meta receive and send personal data as needed for sign-in, purchases, refunds and push notifications, under their own terms and privacy policies (PP-6.1).
KVKK-6.2 Service providers that host and operate our services on our behalf, for the purpose of providing those services (PP-6.2): Hostinger (hosting of the Website, the status page and the administration panel in its data centre in Frankfurt, Germany, EU; hosting of the central game backend – game server and database – on a virtual private server in its data centre in Düsseldorf, Germany, EU; mailboxes for our @strikeheart.com e-mail addresses; under a data processing agreement); an e-mail delivery provider (verification and password-reset e-mails); and Unity Technologies (Vivox – live voice chat, as a processor under Unity's data processing addendum). Providers not yet selected will be named in the Privacy Policy before they process any player data.
KVKK-6.3 Authorities. Courts, public prosecutors and other competent authorities, only where the law requires it (PP-6.3).
KVKK-6.4 Other players see your public profile (display name, username, avatar, level, rank and country if chosen) and, in matches and chats, what you send them (PP-6.5). Our authorised staff access player data only through role-based tools, as far as their task requires, and access is logged. Only authorised moderation staff can access report evidence; every access is logged, and downloading and sharing evidence are restricted (PP-6.4).
KVKK-6.5 Transfers abroad. The Game is offered worldwide, and some service providers process personal data outside Türkiye – for example our hosting provider Hostinger in its data centres in Germany (EU): in Frankfurt for the Website, and in Düsseldorf for the game server and its database – and Unity Technologies, whose voice service Vivox runs on servers outside Türkiye. We carry out such transfers in accordance with Article 9 of the KVKK as amended by Law No. 7499 and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad: on the basis of an adequacy decision of the Board where one exists; otherwise on the basis of appropriate safeguards, in particular standard contracts notified to the Personal Data Protection Authority within five business days of signature; and only where neither is available, under the incidental-transfer exceptions of Article 9(6). When you sign in or buy through Apple, Google or Facebook, you use their services directly under their own terms. Transfers concerning users in the EU/EEA and in other countries are described in PP-7.
KVKK-7 · Retention
KVKK-7.1 We keep personal data only as long as necessary for the purpose for which it was processed or as required by law, and then delete, destroy or anonymise it. There is no single retention period; the periods and criteria per category are set out in the Privacy Policy (PP-8). For example, messages are deleted after 30 days; report evidence (messages and any voice clip) is kept until the report has been resolved and any review completed, and no longer than 12 months after the report; sanction records (decision, reason and date) are kept for the life of the account; and a record requested by a competent authority is preserved for as long as the law requires (PP-8.4).
KVKK-8 · Your rights under Article 11 of the KVKK
KVKK-8.1 You have the right to: (a) learn whether your personal data is processed; (b) request information about the processing; (c) learn the purpose of the processing and whether data is used for that purpose; (d) know the third parties in Türkiye or abroad to whom data is transferred; (e) request correction of incomplete or inaccurate data; (f) request deletion or destruction of data under the conditions of Article 7; (g) request that correction or deletion be notified to third parties to whom data was transferred; (h) object to a result against you arising exclusively from automated analysis; and (i) claim compensation for damage caused by unlawful processing.
KVKK-8.2 Our moderation system can apply a temporary chat mute automatically when several different players report the same player within a short time. This mute is a temporary protective measure, not a sanction decision; decisions on sanctions are based on review by a person, and automatic filters only support our moderators. You may contest such a measure through support@strikeheart.com; it will then be reviewed by a person (PP-11.3).
KVKK-8.3 If you are in the EU/EEA, you also have the rights under the GDPR, including the right to lodge a complaint with the competent supervisory authority (PP-11.2, PP-11.6). Users in other countries may also have rights under the laws of their country (PP-11.8).
KVKK-9 · How to apply
KVKK-9.1 Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can apply: (a) by e-mail to privacy@strikeheart.com – if you write from the e-mail address registered for your account, this also helps us confirm your identity; (b) by e-mail to privacy@strikeheart.com signed with a secure electronic signature or mobile signature; or (c) in writing, by post or through a notary. For written applications, ask us at privacy@strikeheart.com for the full postal address and we will provide it without delay.
KVKK-9.2 Please state your name and surname, your signature for written applications, your Turkish identity number (or, for foreign nationals, your nationality and passport or identity-document number), an address or e-mail address for our reply, your Player ID or username and the right you wish to exercise, as required by the Communiqué. We may ask for information needed to confirm your identity; we will never ask for your password.
KVKK-9.3 We conclude your application free of charge as soon as possible and within 30 days at the latest (Article 13 of the KVKK). If the request requires additional cost, a fee may be charged in accordance with the tariff set by the Personal Data Protection Board.
KVKK-9.4 If your application is rejected, you find our answer insufficient or we do not answer in time, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning of our answer and in any case within 60 days of your application (Article 14 of the KVKK).
KVKK-9.5 Account deletion is described in the Account Deletion Policy.
KVKK-10 · Changes and contact
KVKK-10.1 We will update this notice when our processing changes; the version, the effective date and the date of the last update are shown at the top. Personal-data questions and applications: privacy@strikeheart.com.