Personal data notice
Controller
Cryptosam LLC — 7901 4th N, STE 300, St. Petersburg, Florida 33702, USA. Sole contact: support@okeyland.com.
This notice explains the activities below under Article 10 of Turkey’s Personal Data Protection Law No. 6698 (KVKK). Information and consent are different. Activities requiring consent need a separate, specific choice.
1. Collection, purpose and legal grounds
Data is collected electronically through your app actions, device/session and server connections, written support requests and, only when selected, identity or store provider responses.
| Activity and data | Purpose | Relevant KVKK ground |
|---|---|---|
| Player/device ID, login and email account details | Account, session and recovery | Processing necessary and directly related to contract formation/performance, Article 5(2)(c) |
| Tables, actions, scores and virtual-chip transactions | Requested gameplay and accurate outcomes | Article 5(2)(c) |
| Friends and message content/delivery metadata | Requested social and messaging functions | Article 5(2)(c); necessary/proportionate safety review may use Article 5(2)(f) |
| Uploaded photo or Google photo imported into an empty profile when signing in/linking | Display the profile image, preserve your upload and honour removal | Necessary service performance, Article 5(2)(c); optional or permission-dependent activities require separate assessment |
| Connection/IP, server errors and report records; email failure/complaint and suppression records | Security, abuse and server-error investigation; preventing repeated failed or complained-about emails | Necessary legitimate interests not harming fundamental rights, Article 5(2)(f); establishing/exercising/protecting rights, Article 5(2)(e) |
| Separately enabled app error reports: device/operating-system and app-version information, error type/stack trace and technical context | Identify and fix technical app problems | A separate, specific and optional express-consent choice, Article 5(1) |
| Support and necessary transaction records | Answer requests, exercise rights, fulfil legal duties | As applicable, Article 5(2)(c), (ç) or (e) |
Listing more than one ground does not authorize unlimited use. Processing must be relevant, limited and proportionate to its purpose. No advertising profiles or automatic newsletter subscription are created. Do not send passwords, card security codes, medical records or unnecessary identity documents.
Optional app error reports are off by default. They require a separate choice in Settings → Privacy; accepting terms or reading this notice does not enable them. Declining or withdrawing the choice does not restrict gameplay/account features. Turning them off stops new report sends and starts cleanup of the app’s unsent error-report cache; already sent reports or transmissions already in progress cannot be recalled. Necessary service/security records are separate from this optional diagnostics choice.
Optional usage measurement
With a separate express-consent choice (KVKK Article 5(1)), Google Analytics for Firebase receives sessions, screen usage, app version, device/operating-system and language information, approximate country/region and an app instance identifier. Automatic app and purchase events may also be processed while measurement is enabled. The purpose is to understand usage, returning users and version adoption. Email, player name, game-account ID, photo and chat are not added to these events; advertising-ID collection and ad personalization are disabled.
This option is off by default and can be enabled during onboarding or in Settings → Privacy → Usage measurement. It is separate from error reporting and general terms acceptance; declining does not restrict gameplay. Turning it off stops new measurement and resets SDK analytics data on the device; previously sent Google records are not automatically erased. Google is an international service provider; the transfer conditions and request rights described elsewhere in this notice apply. See the privacy policy for details.
2. Recipients and transfers
- Relevant profile/game details go to other players for game/social functions; private messages go to the other participant.
- Photos use publicly accessible Cloudflare R2 image URLs, not a friends-only visibility promise.
- Hosting, Cloudflare delivery/security, image storage and support processors may handle necessary data. Sentry-compatible app error monitoring receives reports only when you separately enable the optional choice.
- Requested email verification codes, recipient addresses and message content are sent through AWS SES in Ireland (
eu-west-1). The sender isnoreply@mail.okeyland.com; the sole support/reply address is support@okeyland.com. AWS SNS delivers permanent-failure and spam-complaint notifications to the server; an address-derived keyed digest (HMAC) is retained to block repeated sends. This is neither anonymization nor marketing permission. - Enabled identity or store services participate in verification when you use them. Google photos are imported only into an empty profile; your upload is preserved and removal prevents automatic re-import.
- When purchasing is enabled, Unity IAP can send transaction/product, receipt, purchase-event and device/installation/session information to Unity for purchasing, transaction analytics and security. Payment services may process approximate country/region; precise GPS location is not collected. These records are separate from the optional app crash reports. Provider roles and purchase-data deletion requests are explained in the privacy policy.
- Competent authorities may receive data where applicable legal obligations, valid requests or protection of rights require it.
The US-based controller and international infrastructure can involve processing abroad. Valid Article 9 transfer conditions and safeguards must be established separately; reading this notice or accepting general terms is not by itself express consent to international transfers.
3. Retention and deletion
Account/social data, messages, reports and technical records have different purposes. Private messages have no fixed-day automatic deletion. Periodic 30-day game-action cleanup does not apply to all data. See privacy and retention.
Email suppression and notification-deduplication records have no automatic expiry. They protect addresses without a registered account and are not automatically removed by account deletion. Preventing repeated failed or complained-about sends, retention necessity and rights requests are assessed separately.
Account deletion cleans up access, photos, friendships and related private-message channels; some outcomes with direct identifiers removed may remain. Legal retention, safety records, retries and backups need separate consideration. See account deletion.
4. Article 11 rights
You may ask whether data is processed, obtain information about processing and purposes, learn domestic/foreign recipients, request correction, request deletion/destruction where the conditions apply and notification to recipients, object to an adverse result arising solely from automated analysis, and seek compensation for harm caused by unlawful processing.
5. Requests
Send your request to support@okeyland.com or in writing to the company address above. Include the request, minimum information needed to identify the relevant account and a reply channel. Email/account association or proportionate verification may be necessary to prevent unauthorized disclosure or deletion.
Requests are handled as soon as reasonably possible and, subject to the applicable legal conditions, within 30 days. Rights to receive a response and complain to the Turkish Personal Data Protection Authority remain available. This notice is not regulatory approval or a general compliance certificate.