Privacy Policy and Privacy Notice

Contents

1. Data controller
2. Data, purposes and legal bases
3. What other players can see
4. Community safety and automated checks
5. Data kept on your device and notifications
6. Recipients and international transfers
7. How data is collected
8. Retention
9. Account and data deletion
10. Your rights under KVKK and the GDPR
11. Children
12. Data security
13. Changes

1. Data controller

The data controller for personal data processed through the GolBil mobile app (the "App") is its developer, GolBil ("we", "us"). This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and its Communiqué on the duty to inform, and, for users in the European Economic Area, under Article 13 of the EU General Data Protection Regulation ("GDPR"). If the Turkish and English versions differ, the Turkish version prevails for users in Türkiye.

Contact: golbil.tr@hotmail.com

2. Data, purposes and legal bases

For each group of data we list what we process, why, on which legal basis (KVKK Art. 5 and GDPR Art. 6) and for how long.

2.1 Account and sign-in

Data

Your email address and a one-way hash of your password (we never receive your password in plain text); with Sign in with Apple or Google, the account ID, email address (including Apple's private relay address) and name shared by the provider; a random user ID for guests; sign-in times.

Purpose

Creating your account, signing you in, sending password reset and email verification links, protecting your account against unauthorised access.

Legal basis

Performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).

Retention

Until your account is deleted.

2.2 Profile

Data

Your display name (nickname), optional first and last name, the team you support, your language and, if you are a GolBil Plus member, the profile photo you upload. Photos are resized on your device to at most 512×512 pixels before upload.

Purpose

Showing you in the game, rankings and matches; making sure no two players share a display name.

Legal basis

Performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).

Retention

Until your account is deleted; a removed or replaced photo is deleted at once.

2.3 Gameplay data

Data

Quizzes you start, your answers and response times, scores, statistics, level and badges, ranking rows, duel, group and friend-room matches, friend invitations, Mystery Star guesses, hints, streak and daily ranking entry, the list of questions you saw recently and your daily free-play counters.

Purpose

Running and scoring quizzes fairly on our server, providing rankings and statistics, reducing repeated questions and applying free-play limits.

Legal basis

Performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).

Retention

Individual quiz sessions, match records, matchmaking requests, invitations and daily counters are deleted automatically within 30 days of the last activity. Mystery Star archive games are deleted when the archive window ends. Statistics, level, streak and ranking records are kept until your account is deleted.

2.4 GolBil Plus subscription

Data

The purchase record signed by Apple (product, transaction and original transaction IDs, start and end dates, environment), the GolBil account the subscription belongs to, and renewal, refund and cancellation notices from Apple. We never receive your card or payment details; Apple takes the payment.

Purpose

Verifying the subscription and linking it to your account, ending benefits after a refund or cancellation, preventing one subscription from being moved between accounts.

Legal basis

Performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)); legal obligation for financial records (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)).

Retention

Until your account is deleted; records required by tax and accounting law for the statutory period.

2.5 Community safety

Data

Reports you make and reports about you (reporting and reported account, reason, related match, the display name and photo version at the time of the report), the players you blocked, records of rejected photo uploads, enforcement decisions and a one-way hash (SHA-256) of the email addresses of banned accounts.

Purpose

Detecting, reviewing and stopping inappropriate content and behaviour; preventing banned people from returning with a new account; keeping records for possible legal claims.

Legal basis

Legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)); establishing, exercising or defending legal claims (KVKK Art. 5(2)(e)).

Retention

Open reports until reviewed, reviewed reports for 90 days after review; your block list until you unblock or delete your account; banned email hashes for as long as the ban lasts.

2.6 Security and anti-cheat

Data

App attestation tokens generated by Apple App Attest / DeviceCheck, a random session ID marking the one device your account is signed in on, request rate counters, and IP addresses and timestamps in our infrastructure provider's security logs.

Purpose

Confirming that requests come from the genuine GolBil app, keeping your account signed in on one device at a time, stopping automation and abuse, protecting the service.

Legal basis

Legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)); performance of a contract.

Retention

The session record until your account is deleted; counters and technical logs are short-lived and limited to the provider's log retention.

2.7 Notifications

Data

Your device's push notification token (Firebase Cloud Messaging), if you allow notifications.

Purpose

Delivering friend-room invitations to you.

Legal basis

Performance of a contract; you grant notification permission in iOS and can turn it off at any time.

Retention

Deleted when you sign out, when your account is signed in on another device or when your account is deleted.

2.8 Usage analytics (only with your consent)

Data

Events about screen and feature use (for example, a quiz was started or a mode was chosen), the random app instance ID of Google Analytics for Firebase, device model, operating system version, country and language. Your name, email, user ID, password or answer text are never added. This data is pseudonymous, not anonymous.

Purpose

Understanding how the App is used in order to improve it.

Legal basis

Your explicit consent (KVKK Art. 5(1); GDPR Art. 6(1)(a)). If you do not tap "Allow" on first launch, no analytics data is collected. You can withdraw consent at any time under Settings → Data Sharing → Usage Analytics; analytics data on the device is then reset.

Retention

Up to 14 months, depending on the Google Analytics data retention setting.

2.9 Crash and error reports

Data

When the App crashes or an operation fails: device model, operating system and app version, technical logs, the error type and code, and Crashlytics' random installation ID. No user ID, name, email or error message text is included.

Purpose

Finding and fixing crashes and errors so the service runs reliably.

Legal basis

Legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)). You can object by writing to us.

Retention

Up to 90 days in Crashlytics.

2.10 Contact and requests

Data

Your email address, the content of your message and our replies when you email us.

Purpose

Answering questions, bug reports and data protection requests.

Legal basis

Legal obligation (KVKK Art. 5(2)(ç) and Art. 13) and legitimate interests.

Retention

Up to 2 years after the request is closed.

3. What other players can see

• Public rankings (overall, category and level rankings and the Mystery Star daily ranking): your display name, profile photo, team, level, score, number of Mystery Star guesses and GolBil Plus badge.
• Matches (duel, group, friend room): players in the same match see your display name, profile photo, team, level, score and in-match results.
• Friend search and invitations: members can search for your display name and invite you to a friend room; players you blocked, or who blocked you, cannot find you.
• Sharing: if you choose to share your player card or a result, the information on the card is shared with the person or app you choose.

Your email address, first and last name and account ID are never shown to other players. Uploading a profile photo is optional; without one your initials are shown.

4. Community safety and automated checks

• Display name checks: Before a display name is saved, the app and our server check it for profane, sexual and hateful words (including look-alike spellings with numbers or symbols) and for names impersonating the GolBil team or moderators. Inappropriate names are refused.
• Profile photo checks: Before other players can see it, an uploaded photo is automatically checked for nudity, sexual content and violence with Google Cloud Vision SafeSearch. A photo found inappropriate is not published and is deleted; the attempt is recorded. The check only decides whether the photo is published and is not used for any other decision. If you think a photo was rejected by mistake, contact us.
• Reporting and blocking: You can report a player for their name, photo or behaviour and block them. Reports are reviewed by people on our team; sanctions are never decided automatically.
• Sanctions: If a violation is confirmed, content may be removed, the player may be taken off the rankings or the account may be banned permanently. A banned account can no longer sign in, and a one-way hash of its email address is kept to stop it from registering again.

5. Data kept on your device and notifications

• Widget: The daily state, streak and last-14-days summary shown by the Mystery Star widget are stored only in a shared app area on your device and are not sent to our server. They are cleared when you sign out.
• Reminders: Mystery Star reminders are scheduled on your device as local notifications; you can turn them off in Settings. They are removed when you sign out.
• Cache and preferences: Question media, catalogues and profile details are cached briefly so the App opens quickly; preferences such as "remember me" and your analytics choice are stored on your device.
• Camera: Used only when you choose to take a profile photo and have granted permission. The App does not ask for photo library access; only the photo you pick is passed to the App.

6. Recipients and international transfers

We do not sell your personal data or share it for advertising. Data is shared only with the following parties, limited to the stated purpose:

• Google (Google Ireland Ltd. / Google LLC): our infrastructure and service provider (Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Storage, App Check, Cloud Messaging, Crashlytics, Google Analytics for Firebase with your consent, and Cloud Vision for photo checks). Google processes this data on our behalf and under our instructions.
• Apple: for Sign in with Apple, App Attest / DeviceCheck, delivery of push notifications (APNs) and GolBil Plus payments, which Apple takes under its own terms.
• Google Sign-In: if you choose it, Google handles the sign-in.
• Other players: only the information listed in section 3.
• Competent authorities: where required by law or on a lawful request, to the extent requested.

Our database and server functions are hosted in the European Union (Google Cloud europe-west1, Belgium). Authentication, notification, analytics, crash reporting and image checking services may process data on Google's global infrastructure, including in the United States, so your data is transferred abroad. These transfers rely on the standard contract published by the Turkish Personal Data Protection Board under KVKK Art. 9 and, under the GDPR, on the European Commission's Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.

7. How data is collected

Data is collected electronically, wholly or partly by automated means: from what you enter in the App, your in-game actions, information passed by the sign-in provider you choose (Apple or Google), purchase records passed by Apple and, to the extent you allow, technical records the App generates automatically.

8. Retention

We keep data for the period stated for each group in section 2 and only as long as the purpose requires. When the period ends or the purpose no longer applies, data is deleted, destroyed or anonymised. Inactive accounts are not deleted automatically; you can delete yours by following section 9.

9. Account and data deletion

You can permanently delete your account and related data at any time in the App under Profile → Settings → Permanently Delete My Account. Deletion covers your account, profile, photo, statistics, ranking rows, Mystery Star records, session and notification records, subscription link and block list. Open or reviewed reports and banned email hashes are kept for community safety for the periods in section 2.5.

Deleting your account does not cancel GolBil Plus. To stop renewals, cancel the subscription separately in iOS Settings → Apple ID → Subscriptions. Details: Account and Data Deletion.

10. Your rights under KVKK and the GDPR

Under KVKK Article 11 you have the right to:

• learn whether your personal data is processed,
• request information about the processing,
• learn the purpose of processing and whether data is used accordingly,
• know the third parties in Türkiye or abroad to whom data is transferred,
• request correction of incomplete or inaccurate data,
• request deletion or destruction of data under KVKK Article 7,
• request that corrections, deletions and destructions be notified to the third parties data was transferred to,
• object to a result against you that arises solely from automated analysis of your data,
• claim compensation for damage caused by unlawful processing.

If you are in the European Economic Area, under the GDPR you also have the rights of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and to withdraw consent at any time.

Send requests from the email address registered to your account to golbil.tr@hotmail.com with the subject "Data Protection Request", or by the other methods set out in the Turkish Communiqué on applications to the data controller. Include your name, your request and the email address linked to your account; we may ask for more information to verify your identity. We answer free of charge within 30 days at the latest; if the request involves an additional cost, the fee set by the Board may be charged. If your request is refused, the answer is insufficient or we do not answer in time, you may complain to the Turkish Personal Data Protection Board or, in the European Economic Area, to your local data protection authority.

11. Children

The App is not directed at children under 13 and we do not knowingly collect data from them. If you are under the age required in your country in the European Economic Area, or under 18, use the App only with the knowledge and permission of a parent or guardian. If you learn that a child under 13 has opened an account, tell us and the account and its data will be deleted.

12. Data security

We protect your data with administrative and technical measures such as encrypted connections (TLS), server-side authorisation rules, account data readable only by its owner, app attestation (App Check), request limits, least-privilege access and automatic deletion periods. Scoring and answer checking happen on the server; answer keys are never sent to your device. No system is risk-free; if we discover a data breach we will notify the Board and the people affected as required by KVKK Art. 12 and the GDPR.

13. Changes

We may update this notice to reflect changes in the service or the law. We will change the version number and effective date and announce significant changes in the App. If a new purpose requires your explicit consent, we will ask for it separately.