Privacy Notice

1. Data Controller and Scope

This Privacy Policy explains how your personal data is processed when you use the website and game service provided at tokatlama.space (the "Platform"). Under Turkish Law No. 6698 on the Protection of Personal Data (the "KVKK"), the data controller is tokatlama.space.

For visitors located in the European Union, the General Data Protection Regulation (the "GDPR") also applies. This document is written to satisfy the information obligations of both regimes at once.

You can send any question or request to admin@tokatlama.space.

Every game function of the Platform can be used without an account. When you play without one, only the technical data described below is processed and no game progress is recorded.

2. The Personal Data We Process

Account data: your e-mail address, the display name you choose, an irreversible hash of your password (bcrypt), how the account was created (e-mail or Google), the creation date and the last sign-in date.

Game data: your total slap count, your best combo, your per-day slap counts, how many times you have slapped each character, and the streak derived from them.

Content you upload: the 3D model files, photographs and sound recordings belonging to characters you save, and the names you give them.

Group data: the name and join code of groups you create or join, your memberships, and the characters you add to them.

Notification data: if you allow notifications, your browser's notification endpoint, its encryption keys and your browser/device identification string (user agent).

Technical data: the IP address a request arrives from and browser information. These are not used to build a lasting profile; they limit abuse (repeated sign-in attempts against one address, for example) and help diagnose faults.

Analytics data: visit statistics collected by Google Analytics, only if you have given cookie consent. Without that consent this data is not collected.

We do not ask for special categories of data (health, religion, biometrics and the like). No facial recognition, identity matching or biometric identification is performed on the photographs you upload; a photograph is turned into a three-dimensional character on your own device and then stored as a file.

3. Purposes and Legal Bases

Creating your account, keeping you signed in, recording your progress, building the leaderboards, storing the content you upload and providing the group features: performance of a contract (KVKK art. 5/2-c; GDPR art. 6(1)(b)).

Keeping the Platform secure, preventing unauthorised access and abuse, applying rate limits and diagnosing faults: legitimate interests (GDPR art. 6(1)(f)) and the controller's legal obligation and legitimate interest (KVKK art. 5/2-ç and 5/2-f).

Sending notifications and collecting visit statistics: your explicit consent (KVKK art. 5/1; GDPR art. 6(1)(a)). You may withdraw that consent at any time, without affecting the lawfulness of processing carried out before you did.

We do not use your data for automated decision-making or profiling. We show you no advertising and we neither sell nor rent your data to third parties for advertising purposes.

4. Cookies and Local Storage

The Platform uses your browser's local storage for two distinct purposes: things that are strictly necessary, and things that depend on your consent.

• Strictly necessary: your session key (so you stay signed in), your language choice, your sound and vibration settings, and your cookie preference. These are required for the service to work, need no consent, and are never used for advertising.
• Consent-based: Google Analytics visit statistics. Unless you press "Accept" on the cookie notice shown on your first visit, these cookies are not set and no identifier is stored.

Before you give analytics consent, Google Analytics sends only cookieless signals carrying no identifier (Google Consent Mode v2). Pressing "Reject" keeps it that way.

You can change your cookie preference at any time: open the menu in the top bar, open the "About the Game" panel, and use the "Cookie preferences" row. This reopens the cookie question, and no statistics are collected until you answer it again.

5. Recipients and International Transfers

The Platform does not run its own servers. The following providers are used to deliver the service:

• Hosting and application infrastructure: Vercel Inc.
• Database and file storage: Supabase Inc.
• Sign in with Google (only if you use that option): Google LLC.
• Notification delivery (only if you allowed notifications): the notification service your browser is tied to (Google, Mozilla or Apple).
• Visit statistics (only if you gave cookie consent): Google Ireland Ltd. / Google LLC.

These providers' servers may be located outside Turkey and the European Union. Your data is therefore transferred abroad within the meaning of KVKK art. 9 and Chapter V of the GDPR. The providers are bound by their own data processing terms and by standard contractual clauses.

Beyond this, data is shared only on the lawful request of a competent public authority, and only to the extent requested.

Your display name, avatar and slap count are visible to other players on the leaderboard. Your e-mail address is never shown to other users. People you add as friends can bring the character you chose on your profile onto their own screen and slap it, and the tally is shown to both of you; you decide which character that is, and if you choose none, nobody can slap you.

6. Retention Periods

Your account data and game data are kept for as long as your account exists.

The character files you upload are kept until you delete them or your account is deleted.

Session keys are valid for at most 30 days and are not stored on the server; an expired key simply stops working.

Notification records are deleted when you turn notifications off or when your browser's notification endpoint stops being valid.

The retention period for analytics data is the one configured in Google Analytics.

You can delete your account and your data yourself at any time: the "Delete my account" option on your profile screen permanently removes your account, the characters you saved and the files you uploaded, your group memberships, your duels, your play history and your notification records. It cannot be undone, and you are asked to type your display name to confirm. tokatlama.space/account-deletion describes it in full.

You can also ask for deletion by writing to admin@tokatlama.space, in which case your request is completed within thirty days at the latest.

7. Your Rights

Under Article 11 of the KVKK you have the right to learn whether your personal data is being processed; to request information if it is; to learn the purpose of the processing and whether the data is used in line with that purpose; to know the third parties, in Turkey or abroad, that the data is transferred to; to request correction where it is incomplete or inaccurate; to request its erasure or destruction; to request that these actions be notified to the third parties the data was transferred to; to object to a result reached against you solely through automated analysis; and to claim compensation if you suffer damage.

Under the GDPR you additionally have the right to access your data, to have it corrected, to have it erased (the "right to be forgotten"), to restrict processing, to receive your data in a structured format and move it to another controller (data portability), to object to processing, and to withdraw a consent you have given.

You can send your requests to admin@tokatlama.space. Your request will be answered within thirty days at the latest.

If you are not satisfied with the outcome, you retain the right to complain to the Turkish Personal Data Protection Authority, or - if you are in the European Union - to the data protection authority of your country.

8. Data Security

Your password is never stored in plain text; only an irreversible hash of it (bcrypt) is kept. This means we cannot see your password either.

All traffic between the Platform and your browser is encrypted with TLS. Sessions are verified with signed keys, and there is no direct browser access to the database.

Despite the technical and organisational measures taken, we should note that no transmission over the internet is absolutely secure. In the event of a breach affecting the security of your data, you will be informed within the periods the legislation requires.

9. Children's Data

The Platform is intended for users under the age of eighteen only with the knowledge and permission of a parent or legal guardian.

If you notice that a child in your care has opened an account without your knowledge, the account and the associated data will be deleted once you notify admin@tokatlama.space.

10. Changes and Contact

This Privacy Policy may be updated as the scope of the service changes. The current version is always published on this page, and the revision date at the top of the document is changed with it.

You can reach us at admin@tokatlama.space about anything concerning your personal data.