Privacy Policy

1. Data controller

The controller of your personal data is Yunus Enes İpek, who develops games under the GlitchFact brand. You can reach us at destek@glitchfact.com.

2. What data we process

Depending on how you use our games and the Services, we process:

• Account data: if you play as a guest, an identifier specific to your device (it stays the same if you delete and reinstall the game, so your guest account isn’t lost); if you sign in with Google, your Google account ID, name, email address and profile photo; if you sign in with Apple, your Apple ID and, if you choose to share it, your name.
• Profile and game data: your player name, avatar, level, in-game balances (such as gold and tea in Yatır Batır), task and progress records, match results, leaderboard positions and other in-game records (such as skill and chest use).
• Social data: your friends list, friend code, friendship levels (bonds in Yatır Batır), gifts you send and receive, and players you block or mute.
• Chat and reports: messages you write in in-game chat (table chat and friend messages in Yatır Batır) and the quick messages and stickers you send; reports you make and reports made about you; enforcement records such as warnings, chat bans and table bans.
• Voice chat: if you speak at a voice table, your voice is transmitted live to the players at that table; we don’t record conversations. If someone reports you, their phone attaches up to 60 seconds of your most recent speech to the report, and that recording is transcribed (section 9).
• Purchase data: the product you bought, the date, the store’s transaction ID and receipt. Your card and payment details stay with Google Play or the App Store and never reach us.
• Technical data: your IP address and session data when you connect to our server; technical information about the app and your device (such as device model, operating system and app version); and, when the app crashes or a serious error occurs, crash and error reports (device model, operating system, app version, technical details of the error and the app’s installation ID on that device).
• Ad and offer data: when you watch a rewarded ad or use the rewarded offerwall, our advertising partners (sections 5 and 8) collect your device’s advertising ID (the advertising ID on Android; on iOS, the IDFA only if you allow it), your approximate location derived from your IP address (country or city), device and connection information, your interactions with ads and offers (views, taps, offers you complete) and technical data about how the ads work. Your player number is also passed to the ad and offer infrastructure so the reward can be added to the right account.
• Ad consent record: your answer to the game’s ad permission question, the version of the text you saw at the time, the date, your device type (Android or iOS), the game’s language and where you made the choice (when the game started, in Settings, or in Apple’s tracking permission); the last 20 changes.
• Notification data: so that you can receive phone notifications, the identifier the notification service assigns to the game on your device (Firebase installation ID), your device type (Android or iOS) and when this registration was last refreshed.
• Support and contact correspondence: what you send us through the support or contact form or by email (your email address, your in-game code or, optionally, your name and organization, and your message). If you write to us from the support form inside a game, the game version, your device model, operating system and account ID are added to your message so we can solve the problem.
• Website: your IP address and browser information when you visit our site; if you allow it, the pages you view and your interactions with our ads (section 16).

3. How we collect data

We collect your data electronically, partly automatically: through the app when you install and play (including our advertising partners’ software in the app), from Google or Apple when you sign in with them, from Google Play or the App Store when you make a purchase, through the support or contact form or by email when you write to us, and through your browser when you visit our website.

4. Why we process data and our legal bases

We process your data only for the following purposes, relying on the legal bases in Article 5 of the KVKK:

• Creating your account, providing our games, saving your progress and running social features: establishing and performing our contract (Art. 5/2-c).
• Verifying your purchases and adding them to your account: performing our contract (Art. 5/2-c).
• Letting you know by phone notification about events in the game, such as friend requests, friend messages, table invitations and gifts, and about important matters concerning your account (for example, that it has been deleted): performing our contract (Art. 5/2-c). You can turn phone notifications off at any time in your phone’s settings; you can also turn off notifications about game events in the game’s Settings.
• Transmitting your voice to the players at a voice table: performing our contract (Art. 5/2-c).
• Preventing cheating, fraud and abuse; moderating chat and reviewing reports: our legitimate interests (Art. 5/2-f). Expressions such as swearing, insults, personal information and links are starred out automatically in chat. Reports are first reviewed by an AI-assisted system (Anthropic’s Claude model; no information identifying you is sent), which may apply an enforcement action automatically; if the system is not sure, a moderator decides, and a moderator also reviews serious actions. You can object to an automated result (sections 12 and 13).
• Showing rewarded ads and rewarded offers, adding the reward to your account and preventing ad fraud: performing our contract and our legitimate interests (Art. 5/2-c, f). For personalized ads in Türkiye we ask for your explicit consent (Art. 5/1); the rules for other countries are in section 8.
• Keeping your ad consent record so that we can demonstrate your consent: our legal obligation and legitimate interests (Art. 5/2-ç, f).
• Answering support requests and contact messages (partnerships, press, requests and suggestions): establishing or performing a contract and our legitimate interests (Art. 5/2-c, f).
• Reviewing crash and error reports to find and fix bugs in our games: our legitimate interests (Art. 5/2-f). We don’t collect usage analytics in our games.
• Measuring visits to our website and how our ads perform: your explicit consent (Art. 5/1). You can withdraw it at any time using the “Cookie preferences” link at the bottom of the site.
• Meeting our legal obligations and responding to competent authorities: required by law and legal obligation (Art. 5/2-a, ç).
• Protecting our rights in a dispute: establishing, exercising or protecting a right (Art. 5/2-e).

5. Who we share data with

We don’t sell your data for money. We only transfer data from our games to the following groups of recipients, limited to the purposes above. Our advertising partners also process the data they receive for rewarded ads and offers under their own policies; some US state laws may treat this as a “sale” or “sharing” (section 15). Information about your visits to our website goes to Google and Meta for ad measurement only if you allow it.

• The cloud hosting provider that runs our game servers.
• Google, for Sign in with Google, Google Play payments, hosting our support and contact mailbox and, if you allow it, analytics and ad measurement on our website; Apple, for Sign in with Apple and App Store payments. These companies are separate controllers for their own services.
• Google (Firebase Cloud Messaging) and, on iOS, Apple (Apple Push Notification service), on our behalf, to deliver phone notifications to your device. A notification carries its content as it passes through these services (for example, the sender’s name and the first 120 characters of the message in a friend message notification). We don’t use Firebase’s analytics feature; the usage data collection that comes with the notification framework is turned off in our games.
• Google (Firebase Crashlytics), on our behalf, to collect crash and error reports.
• Advertising partners: Unity Technologies and its group company ironSource (the Unity LevelPlay ad infrastructure and Unity Ads), Google (AdMob) and Tapjoy (Unity’s rewarded offerwall), to show, measure and prevent fraud in rewarded ads and offers. These companies are separate controllers for their own processing; their privacy policies are listed in section 8.
• Meta Platforms, only if you allow it, for ad measurement on our website (Meta Pixel).
• Unity Technologies, as the provider of our game engine and purchase infrastructure, receives the technical data needed to run it.
• Epic Games (Epic Online Services), on our behalf, to transmit voice chat live. Epic receives an identifier specific to your device and a fixed name, not your player name.
• Cloudflare, for serving our website, delivering game content (such as images and game areas) to your device, protecting the support and contact forms against abuse (Turnstile), forwarding messages from these forms and our support and contact emails to us, and storing and transcribing voice recordings attached to reports; for voice recordings, on our behalf.
• Anthropic, on our behalf, to review reports. A report file contains no information identifying you; only text goes to Anthropic, never voice recordings.
• Other players: your player name, avatar, level, leaderboard positions and what you write in public in-game chat (table chat in Yatır Batır) are visible to other players; what you say at a voice table is transmitted to the players at that table; what you write to your friends is seen only by them.
• Competent public authorities, only when required by law.

6. International transfers

Our game servers and some of the services we use (Google, Apple, Unity, ironSource, Tapjoy, Epic Games, Anthropic, Cloudflare and, if you allow it, Meta) are located outside Türkiye, mostly in the United States; ironSource may also process data in Israel. Your data is therefore transferred abroad. We carry out these transfers in line with Article 9 of the KVKK, with appropriate safeguards such as the standard contracts set by the Turkish Personal Data Protection Board.

7. How long we keep data

We keep your data only for as long as necessary:

• Account and game data: while your account is open. When you ask us to delete your account, it is closed right away and deleted after 25 days; during that time you can cancel by signing in with the same account. The process is completed within 30 days at the latest.
• Record of the account deletion (account number, dates, how it was requested and the outcome): 3 years, as required by law.
• Notification data: deleted when you sign out of the game; if you delete your account, deleted after the final notification telling you the deletion is complete. We don’t send notifications to a device on which you haven’t opened the game for more than a month.
• Chat: friend messages for 1 year; the record of starred (inappropriate) messages for 30 days. Table chat is not stored permanently on our server; so that it can be reported, it is kept in memory during the match and for at most 1 hour after it.
• Voice recordings attached to a report and their transcripts: 30 days. On your phone, voice recordings are kept only in memory and deleted at most 1 hour after you leave the table, or when the app closes.
• Report and enforcement records: up to 2 years to prevent abuse, even after an account is deleted. We keep report decisions that contain no information identifying anyone for 2 years to improve our moderation system.
• Purchase records: for the period required by law, for our legal obligations and possible disputes.
• Server logs (including IP addresses): up to 1 year for security and legal obligations.
• Support and contact correspondence: up to 2 years after your request is closed.
• Crash and error reports: 90 days.
• Ad and offer data: for the periods set out in our advertising partners’ own policies.
• Ad consent record: while your account is open (the last 20 changes); deleted when your account is deleted. The record on your phone is deleted when you delete the game; if you reinstall it, you’ll be asked again.
• Website cookies: analytics and advertising cookies you allow last up to 13 months; your cookie choice and language choice are stored in your browser.

9. Voice chat

Voice tables are optional; you need to give microphone permission to speak. With a guest account you can only listen at a voice table.

Your voice is transmitted live to the players at the table through Epic Online Services; we don’t record conversations.

So that a report can include evidence, your phone keeps the most recent speech of each speaker at the table (at most 10 short clips per person, 60 seconds in total) in memory only. These clips are never written to storage and are deleted at most 1 hour after you leave the table, or when the app closes.

When you report a player, your phone sends only that player’s clips to our server. The recording is stored at Cloudflare for 30 days and transcribed; the transcript is used to review the report, and a moderator may listen to the recording if needed. No automatic voice enforcement is applied based on a recording sent by a single player; in that case a moderator decides.

10. Security

Connections between our games and our servers are encrypted (TLS). Access to data is restricted and purchases are verified on the server. No system is perfect; in the event of a security incident we make the notifications required by law.

11. Children

Our games are not directed at children under 13. If you are under 18, play with your parent’s or guardian’s permission. If we find out that we have processed data of someone under 13, we delete it.

12. Your rights under the KVKK

Under Article 11 of the KVKK you can ask us:

• whether your personal data is processed,
• for information about the processing if it is,
• about the purpose of the processing and whether it is used accordingly,
• who the third parties are, in Türkiye or abroad, to whom it is transferred,
• to correct data that is incomplete or inaccurate,
• to delete or destroy it,
• to notify third parties to whom it was transferred of corrections and deletions,
• to object to a result against you arising solely from analysis by automated systems,
• for compensation if you suffer damage from unlawful processing.

13. How to make a request

Email your request to destek@glitchfact.com. If you signed in with Google, sending it from that account’s email address makes it easier for us to verify you; if you play as a guest or with Apple, include your in-game player code (in Yatır Batır, the 8-character code shown under “Your Code” on the Social screen’s Add tab). You can also use the other channels provided by the KVKK (registered electronic mail, secure electronic signature, mobile signature).

You can also send an appeal against an enforcement action to the same address; if an action is lifted on appeal, its points are removed too.

We respond free of charge within 30 days at the latest; if the request involves an additional cost, a fee may be charged under the Board’s tariff. If you are not satisfied with our answer you can complain to the Turkish Personal Data Protection Board.

14. Players in the European Union, the United Kingdom and Switzerland

If you are in the European Economic Area, the United Kingdom or Switzerland, we process your data under the GDPR and those countries’ equivalent laws on the bases of contract performance, legitimate interests, consent and legal obligation. You have the rights to access, rectify, erase, restrict, port and object to the processing of your data, and you can withdraw consent-based processing at any time. You can also complain to the data protection authority in your country.

Personalized ads are shown only with your consent; you can withdraw it in the game under Settings → Terms & Privacy → Ad Preferences.

15. Players in the United States

If you live in certain US states, your state’s laws may give you the rights to access your data, to ask for it to be corrected or deleted, and to opt out of the “sale” or “sharing” of your data for targeted advertising. To opt out of sale and sharing, use Settings → Terms & Privacy → Ad Preferences in the game; for other requests, write to destek@glitchfact.com. We won’t treat you differently for exercising these rights.

16. Our website

On glitchfact.com we only store your preferences in your browser by necessity: your light/dark theme choice, your cookie choice and, if you switch language yourself, your language choice (in a cookie, for 1 year). On your first visit the site opens in Turkish or English depending on your country; only the country derived from your IP address is used for this, and it is not stored.

If you allow it, the following also run: Google Analytics measures which pages are read; Google Ads and the Meta Pixel measure how our ads perform and help show you more relevant ads. In that case information about your visit (pages viewed, browser and device information, IP address) is transferred to Google and Meta and may be processed abroad. None of these cookies run until you agree, and you can withdraw your consent at any time using the “Cookie preferences” link at the bottom of the page.

The site is served through Cloudflare, which processes IP addresses for security and to protect the support form, and may set a strictly necessary security cookie.

17. Changes

We may update this policy when needed. The current version is always on this page, and we announce important changes in our games or on our website.