Privacy Policy

This Privacy Policy explains how personal data is processed in the iOS and Android games published by Machware Games, the games unit of Machware Teknoloji A.Ş., and on the games.machware.com.tr website. It is written to meet both the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the EU General Data Protection Regulation (EU 2016/679, "GDPR"). The notice required by KVKK art. 10 is also provided separately in the KVKK Information Notice.

Each game also has its own game-specific privacy policy on its page, showing which SDKs it uses and which data it processes. The game-specific text supplements this policy; where they differ, the game-specific text prevails for that game.

Data controller

• Company: Machware Teknoloji A.Ş.
• Address: Maslak Mah. Maslak 42 B Blok İç Kapı 542, Sarıyer/İstanbul
• MERSIS number: [TO BE COMPLETED]
• Registered e-mail (KEP): [TO BE COMPLETED]
• VERBIS registration: [TO BE COMPLETED]
• Email: support@machware.com.tr
• EU representative (GDPR art. 27): [TO BE COMPLETED]

Machware is established in Türkiye. Because it offers its games to users in the EU/EEA, it is subject to the GDPR under GDPR art. 3(2). Users in the EU/EEA may also contact the EU representative above.

In short

• Our games have no username-and-password accounts and no mandatory sign-in. We do not ask for your name, email, phone number or other identity details in the games. Games with online features keep your progress in an anonymous player profile on our game server, tied to your installation; some let you optionally link your progress with Google Play Games or Apple. (If a game offers an optional account, that game's privacy policy explains it.)
• Game data is linked to technical identifiers of your device and game installation (installation ID, Firebase Installation ID, App Instance ID, advertising ID).
• In the games, analytics and personalised ads are off by default in every region. The game asks for your permission when it first starts; until you give it, only non-personalised ads are shown. In the EU/EEA, the UK and Switzerland a Google-certified consent screen is used. On iOS, a game that tracks you asks for Apple's App Tracking Transparency (ATT) permission separately; games that do not track do not ask for it and do not access your advertising identifier (IDFA). Each game's details are in its own privacy policy.
• On our website, analytics cookies are used only if you consent.
• We do not sell your personal data.

Personal data we process

In the games

• Device information: device model, operating system and version, language, country, app version.
• Device and app identifiers: Firebase Installation ID, App Instance ID, Crashlytics installation UUID and the Player ID or, depending on the game, the Support code shown in the game.
• Anonymous player profile on the game server (in games with online features): a random installation ID, an internal player number, an automatic nickname, country (from the device's region setting), platform, app version, game progress and virtual item balances, an optionally linked Google Play Games or Apple player ID, and server access logs with a shortened IP address.
• Advertising ID: on Android the Google advertising ID (GAID); on iOS the IDFA, only if you granted ATT permission.
• Usage and analytics data: sessions, screens viewed, in-game events and progress steps, approximate location (country/city) derived from the IP address.
• Crash logs: the technical trace (stack trace) and device state at the time of a crash.
• Game progress and settings: on your device; as a server-side backup if the game supports it.
• Purchase records: product, date, transaction number and whether the transaction is valid. Your card and payment details stay with Apple or Google and are never sent to us.
• Ad interactions: ads shown and clicked (processed by Google AdMob).

On the website

• Server logs: IP address, date/time, requested page, browser and operating system information (kept by our hosting provider for security and operation).
• Cookie choice: the mg_consent cookie, which stores your consent choice.
• Analytics data (only with your consent): pages visited, session and device information via Google Analytics 4.
• Spam protection: on forms, Cloudflare Turnstile processes technical signals from your browser (IP address, browser characteristics) to tell whether you are a bot.
• Trailers: YouTube videos load from youtube-nocookie.com only when you press play; no request is sent to YouTube before that.
• Fonts are served from our own server; no requests are made to Google Fonts.

Through forms

• Data deletion form: the selected game and platform, your Player ID or Support code and your email address.
• Support form: the subject, your message, your email address and, optionally, the game concerned.
• Data subject request form: your full name, email address, the right being exercised, your message and, optionally, your address and the game concerned.
• Every form also records the language, date and the reference number we issue.
• If you use the formal KVKK application channels (a signed written application, KEP, a secure electronic or mobile signature, or an email address you previously registered with us), the Communiqué requires your full name, signature, Turkish ID number (for foreign nationals, nationality and passport/ID number), address for notifications and email address.

Form information is delivered to support@machware.com.tr through our email service provider Resend, and you receive a confirmation email with the reference number.

Our games do not collect your name, email, phone number, precise location, contacts, photos or any special category of personal data (KVKK art. 6 / GDPR art. 9).

Purposes and legal bases

We process personal data for the purposes below, relying on the legal bases shown. KVKK art. 5 bases are listed next to their GDPR art. 6 counterparts.

Where processing is based on consent, you can withdraw it at any time in the game's Settings screen or through the Cookie preferences link at the bottom of the website. Withdrawal does not affect the lawfulness of processing before it. We do not take decisions that produce legal effects about you through automated decision-making; profiling by Google for personalised ads happens only with your consent.

Do you have to provide the data?

• Data needed to run the games: device information and device/installation identifiers (including the Player ID) are needed to run the game and, in games with ads, to serve ads. Without them the game cannot be provided.
• Optional data: your permission for analytics and personalised ads, and analytics cookies on the site, are entirely optional. Refusing them does not limit any feature of the games or the site.
• Form data: the fields marked as required in the forms are needed to handle your request; without them we cannot process it. You can leave optional fields empty.

Third parties and processors

We share data with the providers below only for the purposes above and only as needed. Each provider's own privacy policy applies.

Firebase, Google Analytics, Railway, Cloudflare, Resend and Vercel act as processors on our behalf. Google AdMob and the Apple/Google payment systems act as independent controllers for certain processing. We may also disclose data, as needed, to legally authorised public authorities on request (e.g. courts, the Turkish Personal Data Protection Board, tax offices) and to our legal advisers.

Ads, consent and tracking

In-game consent prompt and settings

In every region, analytics and personalised ads in our games are off by default. When a game first starts it shows a screen asking for your permission for both. Until you give it, no analytics data is collected and games with ads request only non-personalised (contextual) ads from Google AdMob. Every game's Settings screen has an analytics and personalised-ads permission, and you can change your choice at any time.

Consent screen in the EU, EEA, UK and Switzerland

Users in these regions see a Google-certified consent management platform (Google User Messaging Platform, "UMP") when the game first starts. It implements the IAB Europe Transparency and Consent Framework (TCF). In these regions the advertising permissions are collected through this screen. You can reopen it and change your choices in the game's Settings › Privacy Choices. This policy refers to that in-game consent screen, which lists the advertising partners and purposes.

iOS App Tracking Transparency (ATT)

On iOS, a game that tracks you across other companies' apps and websites requests Apple's App Tracking Transparency permission before your advertising identifier (IDFA) is accessed. Games that do not track (as stated in their own privacy policy) do not ask for it, do not access the IDFA and do not track you. If you decline, the IDFA is not shared and no tracking takes place; the game still works fully. Your ATT choice is separate from the in-game analytics and personalised-ads permission: allowing ATT does not grant the in-game permission, and the in-game permission does not replace ATT. You can change your decision in iOS Settings › Privacy & Security › Tracking.

Android advertising ID

On Android you can reset or delete your advertising ID in your device settings (Settings › Privacy › Ads). Once deleted, apps cannot access it.

International transfers

Our providers' servers are outside Türkiye (mainly in the US and the EU), so your personal data is transferred abroad. The game server for games that use online features is hosted on Railway in United States (US East, Virginia).

Under KVKK art. 9

Following the amendment made by Law No. 7499, in force since 1 June 2024, KVKK art. 9 requires a transfer abroad to rest on one of the conditions in art. 5 or art. 6 and follows this order:

1. Adequacy decision: if the Turkish Personal Data Protection Board has issued an adequacy decision for the destination country, sector or international organisation, the transfer relies on it.
2. Appropriate safeguards: without an adequacy decision, the Board's standard contract is used. A standard contract is notified to the Board within 5 business days of signing. Binding corporate rules, or a written undertaking approved by the Board, can also serve as appropriate safeguards.
3. Incidental transfers: in exceptional, non-regular cases with neither an adequacy decision nor appropriate safeguards, one of the cases in art. 9(6) may be relied on (e.g. your explicit consent after being informed of the possible risks, or necessity for performing a contract).

For the game server provider Railway: KVKK art. 9: the Board's standard contract (notified to the Board within 5 business days of signing). GDPR: the European Commission's Standard Contractual Clauses. On request, we will tell you which transfer tool (standard contract and date of notification to the Board) is used for each provider.

Under the GDPR

Data of EU/EEA users is transferred in line with Chapter V of the GDPR. As the European Commission has not adopted an adequacy decision for Türkiye, transfers from the EU/EEA to Türkiye and to other countries without an adequacy decision rely on the European Commission's Standard Contractual Clauses (Implementing Decision 2021/914), with supplementary measures where needed. For transfers to the US, Google relies on the Standard Contractual Clauses and its certification under the EU-US Data Privacy Framework. You can request a copy of the safeguards used at support@machware.com.tr.

Retention periods

We keep personal data only as long as the purpose requires, then delete, destroy or anonymise it.

Deleting your data

• Removing a game from your device deletes the game data stored on it.
• To delete server-side analytics, crash and (where applicable) progress data, use the Data Deletion Request page. Because there are no accounts, you only need the Player ID or, depending on the game, the Support code shown in the game. In games that keep a server profile you can also delete it with the delete option in the game's Settings screen. We confirm your request with a reference number. We complete it within 30 days at the latest, meaning we start the deletion and tell you. Google then fully removes the data of the deleted identifiers from its live and backup systems within the following 180 days.
• Records we must keep by law are deleted when the retention period ends.

Security

We take appropriate technical and organisational measures to protect your data: encryption in transit (HTTPS/TLS), access limited to authorised people, data processing agreements with providers and data minimisation. In case of a data breach we notify the competent authorities and, where required, you, in line with KVKK art. 12 and GDPR arts. 33–34.

Your rights

Rights under KVKK art. 11

Regarding your personal data you have the right to:

1. learn whether it is processed,
2. request information if it has been processed,
3. learn the purpose of processing and whether it is used for that purpose,
4. know the third parties in Türkiye or abroad to whom it is transferred,
5. request rectification if it is incomplete or inaccurate,
6. request erasure or destruction under the conditions of KVKK art. 7,
7. request that the actions under items 5 and 6 be notified to third parties to whom the data was transferred,
8. object to a result against you arising exclusively from analysis by automated systems,
9. claim compensation if you suffer damage because of unlawful processing.

Rights under GDPR arts. 15–22

Users in the EU/EEA also have the right of access (art. 15), rectification (art. 16), erasure (art. 17), restriction of processing (art. 18), notification of rectification, erasure or restriction to recipients (art. 19), data portability (art. 20), to object, in particular to processing based on legitimate interests and to direct marketing (art. 21), and not to be subject to decisions based solely on automated processing (art. 22). Where processing is based on consent you can withdraw it at any time (art. 7(3)).

How to apply

Send your request through the form on the Data Subject Request page, by email to support@machware.com.tr, to our KEP address ([TO BE COMPLETED]) or in writing to Maslak Mah. Maslak 42 B Blok İç Kapı 542, Sarıyer/İstanbul. The details required for a formal KVKK application are explained in the KVKK Information Notice; the web form is an additional convenience channel. You receive a reference number. We answer within 30 days at the latest, depending on the nature of the request, and as a rule free of charge; if the request involves an additional cost, a fee under the Board's tariff may be charged. We may ask for additional information to verify your identity; for game data, since there are no accounts, this is usually the Player ID.

Right to complain

• Türkiye: if your request is rejected, you find the answer insufficient or we do not answer in time, you may complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, www.kvkk.gov.tr) within 30 days of learning of our answer and in any case within 60 days of your request.
• EU/EEA: you may lodge a complaint with the data protection supervisory authority of the EU/EEA member state of your habitual residence, place of work or place of the alleged infringement.

Children

Our games are designed for users aged 13 and over and are not directed at children under 13; they are not part of the Google Play Families programme or Apple's Kids category. We do not knowingly collect personal data from children under 13. In some EU countries the age of digital consent is as high as 16 (GDPR art. 8). If you are under that age, ask a parent or guardian before giving consent for analytics or personalised ads. If you believe a child under 13, or someone under the age of digital consent, has shared data with us, write to support@machware.com.tr and we will delete it.

Changes

We update this policy when our services or the law change. Each update changes the version number and the last updated date; earlier versions are archived in the list at the bottom of this page. We announce significant changes in the games or on the website.

Contact and corporate policy

For any privacy question: support@machware.com.tr. The corporate privacy policy of Machware Teknoloji A.Ş. for its products and services other than games: machware.com.tr/privacy. For the games and this website, this policy and the game-specific policies apply.