إشعار الخصوصية

This Privacy Notice explains what personal data Conquiza ("we", "us") processes when you visit the website or play the game, why, for how long, who helps us, and what rights you have. It is written to meet the EU and UK General Data Protection Regulation (GDPR), Türkiye's Personal Data Protection Law No. 6698 (KVKK), and similar laws elsewhere.

Short version: we collect as little as possible. Your account is an e-mail address, a password and a generated in-game name. We have no advertising, no analytics trackers, we never sell your data and we do not send marketing e-mails.

1. Controller and contact

Conquiza is the controller of your personal data. Contact us through the Support page of the website and choose the topic "Question about my data" for anything about your data.

2. What we collect and why

Data	Purpose	Legal basis (GDPR art. 6 / KVKK art. 5)
Account: e-mail address, password (stored only as a secure hash by our authentication provider)	Creating your account, signing in, essential service e-mails (confirmation, sign-in links, password reset, e-mail change)	Performance of the contract
Profile: in-game name (made from preset words and a number), country, colour, emblem, time zone, interface and question language	Running the game, national rankings, showing your tiles on the map	Performance of the contract
Game activity: rounds, answers and answer times, tiles, duels, teams, tournaments, badges, statistics, question reports	Running the game and its rules, rankings, your statistics	Performance of the contract
Fair-play signals: accuracy and answer-time patterns on hard questions	Detecting cheating; accounts are only flagged for human review	Legitimate interest in a fair game
Consent records: which version of the Terms and Privacy Notice you accepted, when and in which language	Proving acceptance	Legal obligation and legitimate interest
Subscription: plan, status, billing period, Polar customer and subscription identifiers, and the payment notifications Polar sends us (which can include your e-mail and billing country)	Granting the plan you paid for, handling cancellations and refunds	Performance of the contract
Support requests: the topic you choose, the language, and for visitors without an account the e-mail address you give	Answering your request	Performance of the contract / legitimate interest
Technical data: IP address, browser and device information in requests	Delivering the website, security, preventing abuse (rate limiting). At sign-up the country of your IP address is used once to pre-select your country; it is not stored	Legitimate interest in a secure, working service
Guest play: a random token kept in your browser tab, stored by us only as a hash, linked to the rounds you play before signing up	Letting you try the game and keep your result if you sign up	Legitimate interest / steps before a contract

We do not ask for your real name, address, phone number, date of birth or payment card details. We do not process special categories of data (such as health or beliefs).

3. What other players can see

Your in-game name, country, colour, emblem, tiles on the map, rankings, badges, team membership and duel results are visible to other players. Your e-mail address is never shown to other players.

4. Automated decisions

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Fair-play checks only flag accounts; a person reviews every flag before any action.

5. Who processes data for us

We use carefully chosen service providers who process data only on our instructions under data processing agreements:

Provider	Role	Location
Supabase, Inc.	Database and authentication	Data stored in the EU (Stockholm, Sweden)
Cloudflare, Inc.	Website hosting, content delivery and security	Global network
Polar Software, Inc.	Merchant of record for payments (Polar uses Stripe to process cards)	United States
E-mail delivery provider	Sending account e-mails	EU or United States

Polar acts as an independent controller for the payment itself and its tax and accounting duties; see Polar's privacy policy. We may also disclose data where the law requires it, or to protect the rights and safety of our players and the service.

We do not sell personal data and do not share it for cross-context behavioural advertising.

6. International transfers

Some providers process data outside your country, including outside the EU/EEA, the UK and Türkiye (for example in the United States). Where this happens we rely on appropriate safeguards such as adequacy decisions and Standard Contractual Clauses, as required by GDPR chapter V and KVKK article 9.

7. How long we keep data

Data	Kept for
Account, profile and game data	Until you delete your account. Free accounts that have not been used for 12 months are deleted automatically
Consent records	As long as the account exists
Visitor e-mail in a support request	Deleted when the request is closed
Guest rounds that were never linked to an account	90 days
Payment notifications from Polar	180 days
Rate-limit counters (hashed)	1 hour
Administrative audit log	24 months
Hosting and security logs at our providers	Short periods set by the provider (typically days)

When you delete your account, your data is deleted immediately from our live database. Polar keeps payment records as required by tax law.

8. Your rights

Depending on where you live (for example under GDPR, UK GDPR, KVKK article 11, the California Consumer Privacy Act or Brazil's LGPD), you have the right to:

• access your data and receive a copy: use Account → Download my data (JSON) or ask us;
• correct it: change your details in Account;
• delete it: use Account → Delete account;
• port it to another service (the JSON export);
• restrict or object to processing based on our legitimate interests;
• learn whether your data is processed, for what purpose, to whom it is transferred, and ask for the consequences of unlawful processing to be remedied (KVKK article 11);
• not be discriminated against for exercising your rights.

Send requests through the Support page (topic "Question about my data"). We answer within 30 days at the latest. We may ask you to confirm the request from your account's e-mail address to protect your data.

You also have the right to complain to a data protection authority, for example the authority in your EU country, the UK Information Commissioner's Office, or Türkiye's Personal Data Protection Authority (KVKK Kurulu).

9. Children

Conquiza is not intended for children under 13 and we do not knowingly collect their data. Players under 18 need a parent's or guardian's acceptance. If you believe a child under 13 has an account, contact us and we will delete it.

10. Security

Data is encrypted in transit (HTTPS). Passwords are stored only as hashes by our authentication provider. Access to the database is restricted by row-level security, only the operator has administrative access, and administrative changes are logged.

11. Cookies and similar technologies

We only use what is strictly necessary to run the site and remember your choices; see our Cookie Notice.

12. Changes

We may update this notice. When we make a material change we will show the new version in the app before you continue playing. The version and date are shown at the top.