Privacy Policy

Last updated: 31 October 2026

This Privacy Policy explains how Mahalle Maçı ("the Game", "we") collects, uses, protects and shares your personal data in the game and services offered at mahallemaci.com and in the mobile app. Players in Türkiye can also read the statutory KVKK notice (Turkish).

1. Data We Collect

a) Data you provide

• Account details: if you register, your e-mail address, your password (stored securely and hashed by the identity provider; we never see it in plain text) and your username.
• Game choices: your country, city/county and district, club name, kit colours, squad and tactical choices, and your language preference.

b) Data created while you play

• Club/neighbourhood state, squad, in-game currency (coins), buildings, level, match results, league/points records and missions.
• Online status, match offers and notifications; if you allow notifications, your device's push token and its language (kept only to deliver notifications in your language; deleted when you turn notifications off or delete your account).

c) Technical data collected automatically (telemetry)

• A device identifier (random deviceId), browser (user agent), platform, device type, screen/window size, pixel ratio, colour depth, device memory, CPU core count, language and time zone, referrer and page address.
• Your IP address and an approximate location derived from it (country/region/city/district). We do not use your device's GPS location.

Telemetry is kept as a current snapshot only; no history is stored. It may also be collected for guest (anonymous) players. Nothing is sent before you confirm you are 13 or older.

2. Why We Use Your Data (and Legal Bases)

• To run the Game, manage your account and save and sync your progress (performance of our contract with you).
• To provide online matchmaking, live matches, leagues and notifications (contract; notifications only with your consent).
• For security and fair play: preventing cheating, fraud and abuse - the economy is verified on the server (legitimate interests).
• To improve the service, fix bugs and analyse device/browser compatibility (legitimate interests).
• To contact you and answer your requests (contract / legitimate interests), and to comply with legal obligations.

3. Cookies and Local Storage

The Game does not use advertising or tracking cookies. Instead it uses the browser's local storage (localStorage / IndexedDB) to keep your progress and session on your device, and a service worker cache so it can work offline. See the Cookie Policy for details.

4. Who We Share Data With

We do not sell your personal data or pass it to third parties for marketing. Data is shared only with service providers (processors) that run the service on our behalf, and with your match opponent where a live match technically requires it:

• Google Firebase (processor) - authentication, database, server functions and notification infrastructure (service region Europe / europe-west1).
• ip-api.com (processor) - to estimate an approximate location, our server sends your IP address to this service and stores the result (country/region/city/district). Your device never contacts it directly.
• Your online match opponents - when a live (P2P / WebRTC) duel connects directly, network address (IP) information is shared with the opposing player. This is a technical requirement of peer-to-peer connections.
• Competent authorities - only where required by law.

We serve fonts from our own server (no Google Fonts CDN), so loading fonts does not send your IP to a third party; there is no advertising or analytics SDK. The providers above may use servers outside your country, so your data may be processed abroad, including in Türkiye and the United States; where required we rely on appropriate safeguards such as the providers' standard contractual clauses. In the Google Play "Data safety" form and the Apple App Store privacy labels we honestly declare approximate location (ip-api) and network address (live match peer) as "shared"; all other data is handled only by our processors and is never sold.

5. Security

Your data is transmitted over secure connections (HTTPS) and protected by server-side access rules. Account and game data is written only by authorised server functions; the app cannot change it directly. No method is 100% secure, but we take reasonable technical and organisational measures to protect your data.

6. Retention

We keep your data while your account is active. Telemetry is kept as a current snapshot only (no history). You can ask for your account and data to be deleted at any time (Account Deletion). Limited exceptions after deletion: audit records kept to prevent fraud and abuse are deleted within 12 months at most, and match records shared by two players are deleted automatically after about 6 hours.

7. Your Rights

Depending on where you live (for example under the UK GDPR, the EU GDPR or Türkiye's KVKK) you have the right to access your data, correct it, have it deleted, restrict or object to its processing, receive it in a portable format and withdraw consent at any time. You can download your data in the app: Menu → "Download My Data" gives you an instant copy of the data linked to your account as a JSON file. To exercise any other right, write to iletisim@mahallemaci.com; we reply within 30 days. You also have the right to complain to your data protection authority - in the UK the Information Commissioner's Office (ico.org.uk), in the EU your local supervisory authority, in Türkiye the KVKK Board.

8. Age Limit and Children's Privacy

Mahalle Maçı is for users aged 13 and over; children under 13 may not use the Game and we do not knowingly collect data from them. Users aged 13-18 should use the Game with the consent of a parent or guardian. If you believe your child has given us data, contact us at iletisim@mahallemaci.com and we will delete it.

9. Changes

We may update this policy. The current version is always published on this page; the date at the top shows the version in force.

10. Contact

Data controller: Caner Güler · Kepez / Antalya, Türkiye · E-mail: iletisim@mahallemaci.com

This English version is a translation provided for convenience. If it conflicts with the Turkish original, the Turkish version prevails.