peaky numbers

Personal Data Notice (KVKK)

Last updated: 20 October 2026 · This English translation is for information; the Turkish text is the official version.

This notice is provided to users of the Peaky Numbers mobile game under Article 10 of Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It is an English translation for information; the Turkish version is the official notice. More detail is in the Privacy Policy.

1. Data controller

2. Personal data processed, purposes and legal bases

Identity and contact data

Google account email address, Google account ID, user ID (UID), name and profile photo link of your Google account, display name, unique username; once available, the random ID of a guest account and, for Sign in with Apple, the Apple user ID, email or "Hide My Email" relay address and name if shared.

  • Purpose: creating and managing your account, signing in, identifying players, delivering invites, answering data subject requests.
  • Legal basis: processing is directly related to the conclusion or performance of a contract (KVKK Art. 5(2)(c)).

Visual data

The profile photo optionally uploaded by Premium members.

  • Purpose: showing the photo on your profile and leaderboards at your choice.
  • Legal basis: performance of a contract (Art. 5(2)(c)).

Game and transaction data

Guesses, match and daily puzzle results, times, points, coins, statistics, badges, leaderboard records, invite, friend and referral data, settings; once available, quick-message records (sender, recipient, match and message ID, time; predefined messages only, no free text).

  • Purpose: running the game, calculating results, showing leaderboards and statistics, applying rewards and fees.
  • Legal basis: performance of a contract (Art. 5(2)(c)).
  • Purpose: preventing and detecting abuse such as cheating, match fixing and farming rewards with fake accounts.
  • Legal basis: our legitimate interests, provided your fundamental rights and freedoms are not harmed (Art. 5(2)(f)).

Report and block records

User IDs of the reporter and the reported player, reason for the report, a copy of the reported player's name and profile photo link at that moment, date; the blocked player's ID and a copy of their name.

  • Purpose: reviewing reports about user content, removing content that breaks the rules, applying block choices.
  • Legal basis: legitimate interests (Art. 5(2)(f)); performance of a contract for applying blocks (Art. 5(2)(c)).

Customer transaction (subscription) data

Google Play purchase token, order number, product (Premium, coin pack), subscription status and expiry date.

  • Purpose: verifying purchases and the Peaky Premium subscription, providing benefits, handling renewals, cancellations and refunds, answering support requests.
  • Legal basis: performance of a contract (Art. 5(2)(c)); legal obligation for tax and accounting records (Art. 5(2)(ç)).

Transaction security data

IP address, app/SDK version information, request time, error logs, and a one-way hash of the email address of deleted accounts, the app and device integrity check (Firebase App Check / Google Play Integrity, with user agent information); once available, review flags set for unusual daily puzzle results (they never lead to a sanction on their own; a person reviews them).

  • Purpose: information security, abuse prevention, fixing errors, preventing repeated rewards through deleted and re-created accounts.
  • Legal basis: legitimate interests (Art. 5(2)(f)); legal obligation regarding data security (Art. 5(2)(ç), KVKK Art. 12).

Legal transaction data

Correspondence on disputes, complaints and official requests.

  • Purpose: handling legal proceedings and responding to requests from competent authorities.
  • Legal basis: establishment, exercise or protection of a right (Art. 5(2)(e)); legal obligation (Art. 5(2)(ç)).

Your personal data is not processed on the basis of explicit consent, so we do not ask for separate consent. No special categories of personal data (health, biometric data, etc.) are processed. Profile photos are only displayed as images; no face recognition or biometric processing takes place.

3. Method of collection

Personal data is collected electronically and by automated means: from Google when you sign in with Google, from the information you enter in the app, from records created on our servers during play, and from Google Play for subscription information. Some app settings are stored only on your device and are not sent to us.

4. Recipients and purposes of transfer

  • Google (Google Ireland Limited / Google LLC and affiliates): as provider (processor) of the Firebase and Google Cloud services hosting the game, to provide the service, store data and keep it secure. All data, including profile photos, is stored in EU data centres (Belgium, europe-west1).
  • Google Play: to handle subscription purchases and payments and to verify subscriptions.
  • Apple (independent controller, with the iOS version): for Sign in with Apple and the "Hide My Email" relay service.
  • Other players: display name, points and statistics, profile photo for Premium members, and daily puzzle results are shown on leaderboards and in matches as an inherent part of the game. Email addresses and unique usernames are not shown.
  • Competent public authorities and courts: only where they are legally authorised and request it, to fulfil legal obligations.

Personal data is never shared with anyone for advertising or marketing purposes and is never sold.

5. Transfers abroad

Because Google's data centres are outside Türkiye, your personal data is transferred abroad. As the Board has not issued an adequacy decision for EU countries, the transfer relies on the standard contract announced by the Board under KVKK Art. 9(4) (the Turkish standard contractual clauses Google offers to customers in Türkiye under its Google Cloud Data Processing Addendum), and the standard contract is notified to the Board within 5 business days of signature. Once Sign in with Apple is available, sign-in data processed by Apple is processed on Apple's servers in various countries, including the US.

6. Retention

Data is kept for as long as needed for the purpose for which it is processed: account data until the account is deleted, unlinked guest accounts after 30 days of inactivity, daily puzzle records for 30 days, quick-message records for up to 30 days, report records for up to 90 days, block records until the block is removed or the account is deleted, technical logs for up to 30 days, tax records for the period required by law. After that, data is deleted, destroyed or anonymised. Details: Privacy Policy and Account and Data Deletion.

7. Your rights under KVKK Article 11

By applying to the data controller, you have the right to:

  1. Learn whether your personal data is processed,
  2. Request information if it has been processed,
  3. Learn the purpose of processing and whether data is used in line with that purpose,
  4. Know the third parties in Türkiye or abroad to whom data is transferred,
  5. Request rectification of incomplete or inaccurate data,
  6. Request erasure or destruction of data under the conditions in KVKK Art. 7,
  7. Request that the actions under (5) and (6) be notified to third parties to whom the data was transferred,
  8. Object to an adverse outcome resulting from analysis of your data exclusively by automated systems,
  9. Claim compensation if you suffer damage because of unlawful processing.

8. How to apply

In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can apply:

  • From the email address linked to your account (registered in our system) to developer@sevensdesign.com,
  • or by registered electronic mail (KEP), secure electronic signature or mobile signature,
  • or in writing with a wet-signed letter to our postal address.

Your application should include your name, (signature for written applications), information sufficient to verify your identity, an address or email for notifications, and your request. Applications are concluded free of charge within 30 days at the latest, depending on their nature; if the action requires an additional cost, the tariff set by the Board may apply. You can also delete your account and data yourself in the app (Settings › Delete Account and Data).

If your application is rejected, you find the answer insufficient, or no answer is given in time, you can file a complaint with the Turkish Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your application.