KVKK Privacy Notice

Under Article 10 of the Turkish Personal Data Protection Law No. 6698

Last updated: October 4, 2026

Identity of the data controller

The data controller is Faruk Büberci, who runs Timur Satrancı (tamerlanechess.online) on a non-profit basis. Contact: faruk.bubercii@gmail.com.

This notice is provided under Article 10 of the Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform. It explains for which purposes, by which method and on which legal grounds your personal data is processed, to whom it may be transferred, and your rights. For a general summary see the Privacy Policy.

Personal data processed, purposes and legal grounds

Your data is processed only for the purposes below, in a way that is connected with them, limited and proportionate.

Identity and account data

Data: Username, email address, an irreversible hash of the password, Google account ID and (when signing in with Google) name and profile photo, profile details (country, bio, photo), account and last sign-in times.
Purpose: Creating and managing membership, authentication, email verification, password reset.
Legal ground: Processing is directly related to the formation or performance of a contract (KVKK Art. 5/2-c).

Game and transaction data

Data: Games, moves, results, rating (Elo), statistics, matchmaking and room information, online status.
Purpose: Providing the game, matchmaking, rankings, game replays and statistics.
Legal ground: Directly related to the formation or performance of a contract (KVKK Art. 5/2-c).

Guest (account-less) use

Data: A random device ID kept in the browser, the records and statistics of completed computer games.
Purpose: Offering history and statistics to people who play without an account; preventing abuse.
Legal ground: Performance of a contract (Art. 5/2-c) and the controller's legitimate interest (Art. 5/2-f).

Communication and content data

Data: Friend requests, private messages, global chat messages, notifications, feedback and complaint texts, report records.
Purpose: Providing the social features, answering requests, reviewing rule violations and keeping the community safe.
Legal ground: Performance of a contract (Art. 5/2-c); legitimate interest for moderation (Art. 5/2-f); establishment, exercise or protection of a right in legal claims (Art. 5/2-e).

Transaction security data

Data: IP address, browser and device information (user agent), hashes of session tokens, rate-limiting records.
Purpose: Account and system security, preventing abuse and attacks, service continuity, meeting requests of competent authorities.
Legal ground: The controller's legitimate interest (Art. 5/2-f); legal obligation for requests of competent authorities (Art. 5/2-ç).

Consent and preference records

Data: Your cookie choice, the record of accepting the terms; with the record, the date, IP address, browser information and device ID.
Purpose: Applying your choices and being able to prove they were respected.
Legal ground: Establishment, exercise or protection of a right (Art. 5/2-e); legitimate interest (Art. 5/2-f).

Optional analytics measurement

Data: Through Vercel Web Analytics: page address, referrer, country/region, operating system, browser and device type. No cookies are used; a visitor is told apart by a hash made from the request, discarded after 24 hours.
Purpose: Measuring and improving use of the service with anonymous statistics.
Legal ground: Explicit consent (KVKK Art. 5/1). You can withdraw it at any time in Cookie preferences.

Storage on your device (cookies, local storage, cache)

Data: Listed one by one in the Cookie Policy.
Purpose: Keeping you signed in, security, remembering preferences, working offline.
Legal ground: For what is strictly necessary for the service you asked for: performance of a contract (Art. 5/2-c) and legitimate interest (Art. 5/2-f); for optional items: explicit consent.

How personal data is collected

Your data is collected electronically: directly from you (when you create an account, play, write messages or fill in forms), automatically (browser and device information, cookies, server logs) and, if you choose "Sign in with Google", from Google (only what it shares with your approval).

Parties to whom data is transferred, and why

Your data is not transferred to anyone for marketing. The following take part, as processors or recipients, in providing the service:

Hosting and infrastructure providers (Vercel Inc., Railway Corp.): running the web interface, application server, database and cache; secure storage.
Email infrastructure provider: delivering verification and password-reset emails.
Google LLC: authentication if you choose "Sign in with Google".
Competent public bodies and institutions: meeting obligations arising from legislation (for example a court order or an official request).

Transfers abroad

The servers of the hosting and infrastructure providers we use may be outside Türkiye (notably in the USA and Europe); this is a transfer abroad within the meaning of KVKK Art. 9. Transfers are carried out in line with KVKK Art. 9 and the Regulation on the Procedures and Principles for Transferring Personal Data Abroad; where the Board has made no adequacy decision, with appropriate safeguards such as the Board's standard contract.

For details about a transfer, write to faruk.bubercii@gmail.com.

Retention periods

Account data: while your account is open; permanently erased within 30 days after a deletion request.
Guest (account-less) records: deleted 24 months after the last activity.
Session refresh tokens: at most 7 days; deleted when they expire or at sign-out.
Global chat: only the last 500 messages. Private conversations: deleted when either person deletes their account.
Consent and preference records: to prove them, limited by the relevant limitation periods; those tied to an account are deleted with it.
Complaint and violation records: during the review and for the periods the law requires.
Data whose period has expired is deleted, destroyed or anonymised under KVKK Art. 7.

Your rights as a data subject (KVKK Art. 11)

By applying to the data controller you may:

Learn whether your personal data is processed,
Request information if it has been processed,
Learn the purpose of processing and whether it is used accordingly,
Know the third parties to whom it is transferred at home or abroad,
Request correction if it is incomplete or inaccurate,
Request erasure or destruction within the framework of KVKK Art. 7,
Request that corrections, erasures and destructions be notified to the third parties to whom the data was transferred,
Object to a result against you arising from analysis of the data exclusively by automated systems,
Claim compensation for damage you suffer through unlawful processing.

How can you exercise your rights?

You can make applications, in line with the Communiqué on the Procedures and Principles of Applying to the Data Controller, by: (a) downloading your data and deleting your account in Settings; (b) emailing faruk.bubercii@gmail.com from the email address registered to your account, with "KVKK application" in the subject line.

State your name and username and your request clearly; we may ask for information that helps us verify your identity. Applications are concluded free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request; if the process requires a separate cost, the fee in the tariff set by the Board may be charged (KVKK Art. 13).

If you find the answer to your application insufficient, you may complain to the Personal Data Protection Board within thirty days of learning the answer and in any case within sixty days of the application date (KVKK Art. 14).

Children's personal data

You must be at least 15 to create an account and use the social features; under-15s may only play the computer without an account. If an account belonging to someone under 15 is found, the account and its data are deleted. Legal guardians can send requests about their child's data to faruk.bubercii@gmail.com.

Entry into force and updates

This notice took effect on the date above and is updated as legislation or the service changes; the current version is always on this page.