YILKI GAMES
Privacy Policy
Version 2.1 · Last updated: 7 September 2026 · Effective: 7 September 2026
This document is published in Turkish and English. For players in other languages, the English version governs.
This policy explains which personal data the mobile games developed by Yılkı Games (XOXD and the studio's other applications, together the “Game”) process, for which purposes and on which legal bases, to whom the data is disclosed, and what rights you have over it.
It also serves as the disclosure notice required by Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”). This policy applies when you download and use the Game; a summary is shown and your consent is requested the first time you open it.
1. Data controller
Erdem Korkmaz — Yılkı Games
Country: Türkiye
E-mail:
info@yilkigames.com
XOXD package name: com.yilkigames.xoxd
Use the e-mail address above for any request, question or application concerning your personal data; the postal address for written applications is in Section 12. The procedure is described in Section 7.
The same details are published as trader information on the Google Play store listing, as required by the Digital Services Act (EU) 2022/2065.
2. Personal data we process
2.1. Account data
You need an account to use the online features. At that point we take your e-mail address and password. Your password is stored irreversibly hashed by our authentication provider; we cannot read it either.
We also store your chosen username, the account ID generated by the system, and appearance preferences such as avatar, background and name colour. Your username and appearance are visible to other players — we recommend not using your real name or anything that identifies you.
We do not ask for or store your real name, phone number, national ID number, address or date of birth.
2.2. Game data
- Match history, moves and results
- Points, rank and statistics from ranked matches
- Win/loss/draw counters and streaks
- Cosmetic items you own and achievement records
- Your friend list and the friend requests you send and receive
- Game invitations you send and receive
- Your online status — while the app is open it periodically sends an “I'm here” signal to the server; if you have signalled within the last two minutes you appear online to your friends
2.3. Chat messages
Messages you send to friends are stored on our servers. They are not end-to-end encrypted. They pass through a profanity filter when displayed, but the raw text is kept on the server as written: if a user is reported, we need to see what was actually said. We do not analyse your messages for advertising or profiling.
2.4. Reports and blocks
When you report a player we record who reported whom, the reason chosen, a timestamp and any evidence snapshot captured at that moment (e.g. the relevant chat message).
When you block a player we record who blocked whom and when. Blocking takes effect immediately: the blocked account cannot send you messages, friend requests or game invites, and does not appear in your search results. You can see everyone you have blocked in Settings → Safety → Blocked Players and unblock at any time.
These records are used only to investigate misuse and to enforce the rules.
2.5. Purchase data
Premium purchases run entirely through Google Play. We do not see or store your card details. We only keep the expiry date of your membership and the Google Play purchase token used to verify it.
2.6. Technical and connection data
The server logs of our hosting and authentication provider may generate and briefly retain technical records such as IP address, request time and request type, for operating the service, debugging and preventing abuse. We do not use these for marketing and do not process them to build profiles.
2.7. Data that stays only on your device
Some data is never sent to the server. It stays on your phone and is removed when you uninstall the app:
- Your audio and language settings
- Your level progress in challenge mode
- Whether you have seen the tutorial
- Your consent to this policy and the version you accepted
- The authentication token that keeps you signed in
- Your ad counter and the state of the discount offer
2.8. Advertising
The free version of the Game shows ads at intervals. Ads are served by Google AdMob. To serve and measure them, AdMob may access your device's advertising ID (Android Advertising ID), your IP address and general device information. We do not collect this data and have no access to it; the processing happens under Google's own privacy policy.
You can reset or delete your advertising ID and turn off personalised ads in your Android settings (Settings → Google → Ads). Personalised advertising depends on your explicit consent. If you are in the European Economic Area, Switzerland or the United Kingdom, a consent screen powered by Google's User Messaging Platform (UMP) opens before the first ad is shown; it lists the advertising partners and processing purposes, and you accept or refuse there.
You can withdraw your consent at any time: in the Game, go to Settings → Ad preferences and the same screen opens again. Withdrawal does not affect the lawfulness of processing carried out before it. Without consent, or after withdrawal, ads are served non-personalised and the Game keeps working. Premium members see no ads at all.
2.9. Data we do not process
- We process no special categories of personal data (health, religion, political opinion, biometric data, etc.).
- We do not access your location, contacts, photos, camera, microphone, calendar or the files on your device.
- We use no analytics, measurement or user-tracking tools.
- We do not collect crash logs or diagnostic data.
3. How we collect data
As required by Article 10 of the KVKK, our collection methods are:
| Method | Which data |
|---|---|
| Directly from you, through the Game's interface | E-mail, password, username, appearance preferences, chat messages, reports and blocks |
| Automatically from your use of the Game | Match records, points and statistics, friendships, last-seen time, matchmaking queue entry |
| Automatically from our provider's server logs | Technical records such as IP address and request timestamp |
| From third parties | Subscription status and purchase token from Google Play |
| From your device's operating system | Advertising ID (used by the ad network only; not passed to us) |
Data is processed automatically, over a connection between your device and our servers encrypted with TLS.
4. Why we process data — purpose and legal basis
| Data | Purpose | Legal basis (KVKK Art. 5 / GDPR Art. 6) |
|---|---|---|
| E-mail, password | Creating your account and signing you in | Performance of a contract (5/2-c · 6(1)(b)) |
| Username, appearance | Presenting you to other players | Performance of a contract (5/2-c · 6(1)(b)) |
| Match and point data | Matchmaking, ranking and your statistics | Performance of a contract (5/2-c · 6(1)(b)) |
| Chat, friendships, invitations | Running the social features | Performance of a contract (5/2-c · 6(1)(b)) |
| Reports, blocks, connection logs | Keeping the game safe, preventing harassment and misuse | Legitimate interests (5/2-f · 6(1)(f)) |
| Purchase records | Recognising and verifying your Premium membership | Performance of a contract (5/2-c · 6(1)(b)) |
| Responding to authorities, financial records | Meeting our legal obligations | Legal obligation (5/2-ç · 6(1)(c)) |
| Advertising ID — personalised ads | Serving the ads that fund the free version | Explicit consent (5/1 · 6(1)(a)) |
| Advertising ID — non-personalised ads | Same | Legitimate interests (5/2-f · 6(1)(f)) |
Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
5. Who we share data with
We do not sell your data and do not share it for third-party marketing. We share it only with the parties needed to run the Game:
| Recipient | Capacity | What they receive |
|---|---|---|
| Other players | — | Your username, rank, points, statistics, appearance, and the messages you send them. Your e-mail address is never shown to any player. |
| Supabase | Data processor | Our database and authentication provider; all your server-side data is hosted there |
| Google Play / Play Billing | Independent controller | Purchase token and subscription status |
| Google AdMob | Independent controller | Advertising ID and technical data needed to serve ads. We do not pass account or game data to the ad network. |
| Competent authorities and courts | Controller | Data we are legally required to disclose |
5.1. International transfers
Our providers' servers may be located outside Türkiye, which means your data is transferred abroad. Supabase server region: AWS eu-west-1 (Ireland, European Union). Google uses its own global infrastructure.
These transfers are made under Article 9 of the KVKK, only to the extent necessary to provide the service, and on the basis of the appropriate safeguards required by law (data processing agreements and standard contractual clauses concluded with the providers). You have the right to learn to which third parties your data is transferred.
6. How long we keep data
| Data | Retention |
|---|---|
| Account and game data | While your account exists; at most 30 days after a deletion request |
| Match history | While your account exists |
| Chat messages | While your account exists; deleted with the account |
| Reports and evidence snapshots | At most 12 months after the review is closed |
| Block records | Until you unblock, or the account is deleted |
| Purchase records | For the period required by financial legislation |
| Server connection logs | For the provider's log retention period (short) |
| On-device data | Until you uninstall; never held on our servers |
Records past their retention period are removed by a scheduled automated job.
6.1. Deleting your account and data
To delete your account: send an e-mail titled “Account deletion request” to info@yilkigames.com from the address registered to your account, and include your in-game username.
We complete the request within 30 days and confirm when it is done. The action is irreversible.
When we delete your account, the following are permanently removed:
- Your e-mail address and sign-in details
- Your username, appearance preferences and statistics
- Your match history
- Your friend list, requests and chat messages
- Your block records
Reports filed about you by other users, and purchase records we are legally required to keep, may be retained in a de-identified form until the periods above expire. Completed matches are anonymised so as not to break the other player's match history.
Note: uninstalling the app does not delete your account. If you have a subscription, you must also cancel it from your Google Play account.
7. Your rights and how to exercise them
7.1. Rights under Article 11 of the KVKK
By applying to the data controller you may:
- Learn whether your personal data is processed,
- Request information if it has been processed,
- Learn the purpose of processing and whether the data is used accordingly,
- Know the third parties in Türkiye or abroad to whom the data is transferred,
- Request correction if the data is incomplete or inaccurate,
- Request erasure or destruction within the conditions of Article 7,
- Request that correction, erasure and destruction be notified to the third parties the data was transferred to,
- Object to a result adverse to you arising from analysis exclusively by automated systems,
- Claim compensation if you suffer damage due to unlawful processing.
7.2. How to apply
Send your application by e-mail to info@yilkigames.com. So that we can assess it, include your first and last name, the e-mail address registered to your account, your in-game username, the subject of your request, and an address at which we can reach you.
You may also apply by the other methods set out in the Communiqué on Application Procedures to the Data Controller (in writing, by secure electronic signature or by registered electronic mail). If you wish to send your application in writing, you can request our postal address at the e-mail address above and we will provide it without delay.
7.3. Response time
We conclude your request as soon as possible and within thirty days at the latest, free of charge. If the request entails an additional cost, a fee set out in the tariff determined by the Board may be charged.
7.4. Complaint to the Board
If your application is rejected, if you find the response insufficient, or if no response is given in time, you may complain to the Turkish Personal Data Protection Board within thirty days of learning of the response and in any case within sixty days of the date of application (Article 14 of the KVKK).
7.5. EEA, Switzerland and the UK
If you are located in these regions, you also have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of consent (Art. 7(3)) under the GDPR / UK GDPR. Write to the e-mail address above to exercise them; we answer free of charge and, as a rule, within one month.
Right to complain. You may lodge a complaint with the data protection supervisory authority in your country:
- European Union / EEA: contact details for your national authority are on the European Data Protection Board's list of members.
- United Kingdom: the Information Commissioner's Office — ico.org.uk.
- Switzerland: the Federal Data Protection and Information Commissioner (FDPIC).
Where your data is processed. Account and game data is held on servers in Ireland, inside the European Union (Section 5.1). The controller is established in Türkiye and therefore accesses the data from there; that access relies on appropriate safeguards under Art. 46 GDPR — the data processing agreements and standard contractual clauses concluded with our providers.
7.6. Automated decision-making
No solely automated decision-making or profiling producing legal effects concerning you, or similarly significantly affecting you, is carried out. Points and rank are calculated automatically, but that concerns only the operation of the game.
8. Children's privacy
Our games are not directed at children under 13 and we do not knowingly collect data from that age group. The Game is not part of Google Play's Families programme. If we learn that a child under 13 has given us data, we delete the account and its data.
EEA and the UK. Article 8 GDPR sets 16 as the age at which a child can consent on their own to online services, and lets member states lower it to 13; the limit therefore varies by country. If you are below the limit in your country, you may only use the Game with the permission of a parent or guardian.
9. Security and data breaches
All communication with the server is encrypted over HTTPS. The database enforces row-level access rules: the app cannot write to tables directly, and every operation goes through server-side functions whose privileges are checked. A player can only reach their own data and the data of matches they are in. Passwords are stored one-way hashed. Points and rank are calculated on the server only.
Even so, no system is completely secure and we cannot guarantee absolute safety. We recommend a strong password that you do not use anywhere else.
If we determine that your personal data has been unlawfully obtained by others, we notify the Turkish Personal Data Protection Board and the affected users as soon as possible, in accordance with Article 12/5 of the KVKK.
10. Changes to this policy
We may update this policy from time to time. On update, the version number and date at the top of this page change. If a change is material (for example, if a new category of data begins to be processed), we ask for your consent again inside the Game. If you do not consent you cannot use the new feature; your existing account is not deleted automatically.
11. This website
The sections above concern our games. The site itself does far less: we use no cookies, there is no visitor tracking, no analytics and no advertising, and no requests are made to any third-party service.
The only exception: the language you pick is stored in your browser's own storage so you do not have to choose it again next time. That information is not sent to us and stays on your device. Which language the site opens in is read from your browser's own language preference — no external query is made for it.
Note: until 9 August 2026 the site asked an independent service for the visitor's country in order to pick a language, and the visitor's IP address reached that service in the process. This query has been removed entirely.
12. Contact
info@yilkigames.com · yilkigames.com
Controller / trader: Erdem Korkmaz — Yılkı Games (sole trader)
İnönü Mahallesi, 4134/3 Sokak No: 5 Daire: 4, 35660 Menemen / İzmir, Türkiye
