Privacy policy
Last updated: [DATE]
This policy explains what personal data Hopdama ("we") collects when you play on our website and apps, why, how long we keep it and what rights you have. It applies worldwide and is written to meet the EU/UK General Data Protection Regulation (GDPR) and Türkiye's Personal Data Protection Law No. 6698 (KVKK).
Who is responsible
The data controller is [COMPANY NAME], [ADDRESS], [COUNTRY]. Contact: [PRIVACY E-MAIL]. [If required: our EU representative is [NAME, ADDRESS].]
What we collect
- Account: username, e-mail address, password (stored only as a one-way hash), country and avatar if you choose them, your year of birth if you give it (used only to decide whether free-text chat is allowed), language and game settings. If you sign in with Google or Apple we receive an account identifier and, if shared, your e-mail address.
- Guests: you can play without an account; we then create a guest profile with a random name.
- Games: your moves, results, ratings and rating history, puzzle attempts, lessons completed, and for live games the time you took per move and how often the game went to the background.
- Social: friends, blocks, challenges, chat messages in games, and reports you send or receive.
- Coins and store: your coin balance and every transaction (rewards, store items, analyses). Coins have no cash value.
- Device and security: IP address, browser or app version, and the devices you are signed in on (shown to you under Settings › Sessions).
- Crash reports: when the app or site fails we receive a technical report (error, device type, app version) through our error-tracking provider. It does not include your messages or password.
- Analytics (only with your consent): which screens are used and how, without advertising identifiers. On the web this is off until you accept it in the cookie banner; in the app it is off until you turn it on in Settings.
We do not sell personal data and we do not show third-party advertising.
Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Providing your account, games, ratings, friends and chat | Performance of our contract with you (GDPR art. 6(1)(b); KVKK art. 5(2)(c)) |
| Security, rate limiting and preventing abuse | Our legitimate interest in a safe service (GDPR art. 6(1)(f); KVKK art. 5(2)(f)) |
| Fair play: detecting engine assistance and multiple accounts | Legitimate interest in fair competition for all players |
| Moderating chat and handling reports and appeals | Legitimate interest; compliance with legal obligations |
| Crash reports | Legitimate interest in a working service |
| Analytics | Your consent (GDPR art. 6(1)(a); KVKK art. 5(1)), which you can withdraw at any time |
| Keeping transaction records | Legal obligation where applicable (GDPR art. 6(1)(c)) |
Fair play and automated checks
After rated games, software compares moves with engine choices and looks at timing patterns and switching away from the game. A high score only places the account in a review queue: a person, never the software alone, decides on any sanction, and you can appeal every sanction once from your account.
Who receives data
We use processors that act on our instructions: hosting and databases ([HOSTING PROVIDER], Frankfurt, Germany), content delivery ([CDN PROVIDER]), e-mail delivery ([E-MAIL PROVIDER]), error tracking ([ERROR-TRACKING PROVIDER]), analytics ([ANALYTICS PROVIDER], EU region) and, when you sign in with them, Google and Apple. Other players see your public profile: username, country, avatar, ratings and finished games. Chat messages are seen by your opponent.
Where data leaves the European Economic Area or Türkiye we rely on adequacy decisions or standard contractual clauses, and for Türkiye on the safeguards required by KVKK art. 9.
How long we keep it
- Account data: until you delete your account. Deleting it removes your profile, e-mail, sessions, coins and settings at once; finished games stay for your opponents with your name removed.
- Sign-in sessions: 30 days after last use.
- Chat messages and reports: as long as needed to handle reports and appeals, at most [PERIOD].
- Crash reports: [PERIOD]. Analytics: [PERIOD].
- Transaction records: as long as tax or accounting law requires.
Your rights
You can see and download your data (Settings › Download my data), correct it, delete your account (Settings › Delete account), object to processing based on legitimate interest, withdraw consent, and ask us to restrict processing. Under KVKK art. 11 you may also learn whether your data is processed, to whom it is transferred, and claim compensation for unlawful processing. Write to [PRIVACY E-MAIL]; we answer within 30 days. You may complain to your data protection authority (in Türkiye, the Personal Data Protection Authority, KVKK).
Children
Hopdama is not directed at children under 13. Players under 13 (or under the minimum age in their country) may use only preset chat messages and should play with a parent's permission. [LEGAL REVIEW: minimum age and parental consent rules per country.]
Changes
We will announce material changes in the app and on this page before they take effect.