KVKK Privacy Notice
Under the Turkish Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu, "KVKK"), the following explains how your personal data is processed by KickSage ("we", the "Operator").
1. Data Controller
The data controller is the team operating the KickSage application under the kicksage.com domain. Contact: [email protected].
2. Categories of Personal Data Processed
| Category | Data Types |
|---|---|
| Identity | First name, last name, username, year of birth (optional) |
| Contact | Email address, push notification device token |
| Location | Province/district/neighborhood information for the local league. You can enter this manually or (if you grant permission) let the app read your device location once and fill it in automatically. Converting your location into a region is done on your device; only the province/district/neighborhood text is stored on our servers — raw GPS coordinates are not stored. |
| Account Access | Password hash value, third-party provider identifiers (the "sub" or app-scoped id for Google/Apple/Facebook) |
| Transaction | Predictions, room entries, chip transfers, purchase records (store receipt id) |
| Technical / Device | IP address (logged during the session), device operating system, app version, session date |
| Chat | Room chat messages (retained for moderation) |
3. Purposes of Processing Personal Data
- Account creation, authentication, session management.
- Scoring prediction results, calculating the leaderboard.
- Running the chip economy, purchase verification, gifting flow.
- Sending push notifications (according to your preferences).
- Building the local league (province/district/neighborhood) leaderboard — only when the user enters their own location.
- Cheating/abuse detection, blocking fake accounts, chat moderation.
- Responding to customer support requests.
- Producing anonymous aggregate statistics (product development).
4. Legal Basis
Your data is processed on the following legal grounds (KVKK Art. 5):
- Formation and performance of a contract: Account, predictions, chip transfers, purchases.
- Legal obligation: Tax/accounting records, retention obligations relating to store purchases.
- Legitimate interest: Cheating detection, security, product improvement, fraud prevention.
- Explicit consent: Push notifications, location sharing (province/district/neighborhood), marketing communication (if any).
5. Recipients and Third Parties
Your data is shared with the following data processors in order to provide the service. These transfers are made on a necessary and proportionate basis; your data is not sold for marketing purposes.
- Apple Inc. and Google LLC — app distribution, purchase verification, push notification infrastructure (FCM / APNs). Transfer abroad may be involved.
- Google (OAuth/Firebase), Apple (Sign in with Apple), Meta Platforms (Facebook Login): If you use social login, only the identity (sub id) and email are obtained from the relevant provider.
- Cloud infrastructure providers (server hosting, PostgreSQL, Redis): Provide the infrastructure where data is stored. Access is granted only as far as necessary for processing.
- Match data providers (api-football etc.): Only publicly available match statistics are retrieved; no user data is sent.
6. Transfer Abroad
Most of the providers above process data abroad (in particular the US and the EU). These transfers are made under KVKK Art. 9, on the basis that the relevant provider is located in a country providing adequate protection and within the framework of standard contractual clauses.
7. Retention Period
- Active account data: For as long as the account is active.
- When the account is deleted: Personal data is deleted or anonymized within 30 days. Records subject to a legal retention obligation (store purchase receipts, etc.) are kept for the period required by the relevant legislation.
- Chat messages: Automatically anonymized or deleted after 90 days; this period may be extended if needed for moderation.
- IP / session logs: At most 12 months.
8. Data Subject Rights (KVKK Art. 11)
You have the following rights:
- To learn whether your personal data is processed.
- To request information about it if it has been processed.
- To learn the purpose of processing and whether it is used in line with that purpose.
- To learn the third parties, domestic or abroad, to whom data is transferred.
- To request correction of data that is processed incompletely/incorrectly.
- To request deletion, destruction, or anonymization within the conditions set out in the KVKK.
- To request that correction/deletion/destruction operations be notified to the third parties to whom the data was transferred.
- To object to an adverse outcome arising from analyses carried out exclusively by automated systems.
- To claim compensation if you suffer damage due to unlawful processing.
9. How to Apply
To exercise the rights above, you can apply in writing to [email protected] with information verifying your identity (registered email + username or user id). Your application is answered within at most 30 days.
10. Minors
The service is designed for those over 13 years of age. If it is found that the data of a user under 13 has been collected without our awareness, the data is deleted immediately. Please notify us.
11. Cookies and Similar Technologies
The mobile app does not use third-party analytics cookies. On the website kicksage.com, only essential cookies for site and session functionality are used.
12. Changes
This notice may be updated due to legal/technical requirements. The last update date is shown at the top of the page; significant changes are announced via in-app notification.