Privacy policy
1. Controller and contact
Cryptosam LLC, 7901 4th N, STE 300, St. Petersburg, Florida 33702, USA. All requests: support@okeyland.com.
This policy covers the website and mobile app. Our separate personal data notice explains purposes, legal grounds, recipients and rights for processing under Turkey’s KVKK. Reading these notices is not blanket consent or marketing permission.
2. Data processed
- Account and session: device-linked identifier, player ID, username and authentication/refresh details; email and related security information when email registration or sign-in is selected. A guest account is not data-free.
- Game and virtual economy: table participation, actions, results, scores and virtual-chip transaction records.
- Social features: friend requests and relationships, blocks, table chat and persistent private messages, with sender, recipient and timing details.
- Profile photo: the image you upload, or the Google profile image imported when you sign in with or link Google and your game profile has no photo. Your uploaded photo is preserved. If you remove your photo, a later Google sign-in does not automatically import it again. Your entire photo library is not uploaded. The server rebuilds the image; original EXIF/location metadata is not carried into the published JPEG.
- Security and support: connection/IP and technical access records, server errors and session information, reported content and information you send to support.
- Optional error reports: if you separately enable this feature, device/operating-system and app-version information, crash or error type, stack trace and technical context needed to investigate the failure.
- Email delivery safety: delivery-failure or spam-complaint notifications for verification emails, event identifiers/times and a protected address-derived matching record used to prevent repeated sends.
- Purchases when enabled: store transaction ID, product, receipt/verification, price/currency and delivery/refund result; device, installation/session and approximate country/region information processed by the purchase service. The game does not collect full payment-card numbers or security codes.
The first release offers Google and Apple sign-in; Facebook sign-in is disabled. Authentication information and the provider’s user identifier are processed for the method you choose. Signing in with or linking Google can import its verified profile photo into an empty game profile under the conditions above. A provider email is not automatically set as your verified game email. Your phone address book and provider social friends are not read.
3. Purposes
Data supports account access and protection, gameplay, accurate chip outcomes, message delivery, your selected photo, abuse investigation, support and applicable legal obligations. There is no advertising or advertising-profile purpose.
Offline practice can be played without creating a new online account. Online connections follow the in-app document/acknowledgement flow. Optional error reports are off by default; accepting the general terms does not enable them. Make your separate choice in Settings → Privacy. Leaving them off or turning them off later does not restrict gameplay or account features.
These reports help fix technical problems, not advertising or behavioural profiling. Screenshot and view-hierarchy attachments are disabled. Filters reduce unnecessary personal information, but we do not guarantee that technical reports can never contain identifiers or personal information. This choice does not disable server/access records necessary to operate and protect the online service.
Optional usage measurement
Usage measurement is off by default. If you select the separate, initially unchecked option during onboarding or enable Settings → Privacy → Usage measurement, Google Analytics for Firebase processes sessions, lobby/game screen visits, app version, device/operating-system and language information, an app instance identifier, and approximate country/region derived from IP. The SDK may also record automatic app and purchase events while measurement is enabled. We use this to understand usage, returning users and version adoption. Precise GPS location is not requested. Game-account identifiers, email, player name, profile image and chat content are not added to Analytics events.
This choice is separate from error reporting; accepting general terms does not enable measurement. Declining or turning it off does not restrict gameplay, sign-in or chip purchases. Advertising-ID collection and ad personalization are disabled. We do not link Google Ads or match identities with other apps for advertising profiles.
Turning this off stops new measurement and resets the SDK’s analytics data and app instance identifier on this device. It does not retroactively erase data already sent. As Analytics is not linked to a game-account user ID, we do not promise to locate historical Analytics records using only a player name. Data may be processed in Google’s international infrastructure; see Google’s Analytics data-use explanation. Contact support@okeyland.com for access or deletion requests.
4. Visibility and providers
Your username, photo and relevant table/ranking information may be visible to other players. Profile photos are served from Cloudflare R2 at publicly accessible image URLs, not a friends-only storage location.
In-app private-chat access is limited to its participants. Messages are processed and stored by the service, not end-to-end encrypted; authorized technical or safety review may be necessary. We cannot prevent another participant from saving screenshots or other copies.
Accounts and messages use server infrastructure running Nakama and PostgreSQL. Cloudflare supports website delivery, network security and R2 images. The app’s optional error reports are sent to Sentry-compatible monitoring only when you separately enable them. Hosting, backup and support processors may handle data limited to their purpose. Selected identity and store providers also process information under their own policies.
Verification codes you request for email sign-in/registration are sent through Amazon Web Services (AWS) SES from noreply@mail.okeyland.com. The recipient address and email content, including the code, are provided to AWS for delivery; the current sending region is Ireland (eu-west-1). Permanent delivery failures (hard bounces) and spam complaints reach our server through AWS SNS. An address-derived keyed digest (HMAC) prevents further sends; this safety record is not treated as anonymous data. This flow does not subscribe you to marketing emails. The sole support and reply address is support@okeyland.com.
Cryptosam LLC is established in the USA; infrastructure and delivery services may operate in other countries. Appropriate legal transfer conditions must be addressed separately. This page is not itself permission or a safeguard instrument for international transfers. Contact support@okeyland.com for provider or processing questions.
When purchases are enabled, Google Play or Apple App Store handles payment. Unity IAP can transmit purchase attempts, success/failure and fulfilment events, with product/transaction and device/session details, to Unity services. These support purchasing, transaction analytics and security. Purchase records are separate from the optional crash reports you enable separately. Precise GPS location is not requested; payment services may process approximate country/region from store or network information. Unity IAP’s data notice explains its processing roles.
5. Retention and deletion
- Account and friendship data supports the active account; account deletion starts the relevant cleanup.
- Private messages are persistent server records, not automatically deleted after a fixed number of days. Account deletion cleans up the relevant private-message channels for both parties. Removing a friend is not equivalent to deleting an account.
- Table chat uses a limited in-match message buffer. Reported content can become a separate safety record.
- Game action/replay records have periodic 30-day cleanup. This is not a retention period for every type of data.
- Email suppression records for permanent failures/complaints and event records used to prevent duplicate processing have no automatic expiry. They also protect addresses without a registered account; deleting an account does not automatically remove a sending block. Their purpose is to prevent repeated failed or complained-about emails to the same address. Retention necessity and rights requests are assessed separately.
- Reports, technical errors, support records and backups have different purposes and systems. We do not promise that all are erased after 30 days or immediately upon account deletion. Retention necessity and legal obligations are considered when handling requests.
Replacing/removing a photo or deleting an account triggers image-object cleanup. Failures, retries, technical deletion markers and caches can delay completion across copies. Legally necessary records and some game/economy outcomes with direct identifiers removed may remain.
6. Your controls and rights
You can change/remove your photo, decline friend requests, block players and request account deletion. An outside-app deletion request is also available.
Settings → Privacy provides ongoing access to this policy, the terms, the personal data notice and account-deletion information. You can also enable or disable optional error reports there. Turning them off stops new report sends and starts cleanup of the app’s unsent error-report cache on the device. Reports already sent, or whose transmission has already started, cannot be recalled; contact support@okeyland.com with requests about them.
Send purchase-data access or deletion requests to support@okeyland.com as well. For Unity IAP data processed on our behalf, we verify your request and instruct the provider. Unity receives requests about transaction records it processes for its own purposes as an independent controller at unity-iap-contact@unity3d.com. Account deletion does not automatically erase every store or payment record subject to legal retention.
Subject to applicable law, you may request access, correction, deletion, objection, restriction and other applicable rights. Where processing relies on consent, you can withdraw it for future processing. Proportionate identity verification protects against unauthorized disclosure; do not send passwords or card details.
The data notice details rights under Turkey’s KVKK. Your rights to contact an applicable data-protection authority remain unaffected.
7. Security, children and changes
OkeyLand is intended for adults aged 18 and over and is not designed for children.
Measures include TLS in transit, access controls and server validation. Absolute security and uninterrupted availability cannot be guaranteed. Report child-data concerns or security issues to support@okeyland.com.
Material changes update the date/version and, where required, lead to further in-app information or separate permission.