321 Football! — Privacy Policy

321 Football! is a football trivia game. This policy explains which personal data is processed when you play, why, who it is shared with, how long it is kept and what rights you have. It is based on the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Data controller

Korveon Global Bilişim ve Veri İşleme Teknolojileri Ltd. Şti. ("Korveon", "we")
Address: Kazımdirik Mah. 296/2 Sk. No:33 Bornova/İzmir, Türkiye
Tax ID: 5801000333 (Hasan Tahsin Tax Office)
Email: oguz@korveon.co

2. What we process

• Account: the account ID created automatically when you first open the app; the username and country you enter when creating your profile; your password if you set one (stored only as a hash — nobody, including us, can read it); the version of the Terms you accepted and when; your app language.
• Profile photo (optional): the photo you upload is resized and stored on our servers.
• Game data: your match and run results, scores, levels, ELO and other ratings, records and rankings; your coin balance and coin history; cosmetics you bought and use; trophies; daily quest progress and login streak; your stand (supported club) and Stand Wars points; your Treasure tables and results; who invited you (for the invite reward).
• Social data: your friends list, friend requests and match invites; your last-seen time (to show "online" to your friends); players you block; reports you send and reports about you, and moderation decisions.
• Match chat: the quick and typed messages you send in matches. Other players see them filtered (profanity, links, phone numbers and similar are hidden); the original message is also kept so reports can be reviewed.
• Bug reports: the description you send with "Report a bug", an optional screenshot, and the app version, operating system version, device model and language added automatically.
• Usage and measurement data: app opens, which game modes you start and finish, session length, and revenue from ads shown to you; recorded against your account.
• Crash reports: if the app crashes, the app version, device model, operating system and error log. These are not linked to your account.
• Notifications: if you allow notifications, your device's notification tokens (Expo, plus Google/Apple tokens) and the language notifications are sent in.
• Purchases: the store transaction ID, product and verification result of your in-app purchases. Apple or Google take the payment; we have no access to your card or payment details.
• Advertising: our ad provider Google AdMob may process the device advertising ID (on iOS only if you allow it), IP address and device information to show and measure ads.

3. What we do not collect

We do not ask for your real name, email address or phone number. We do not collect your precise location, contacts, camera, microphone, other apps on your device or your browsing history.

4. Why we process data and on what legal basis

• Running the game: creating your account; providing game modes, online matches, friends and invites, chat, leaderboards, coins and purchases. Legal basis: performance of a contract (KVKK art. 5/2-c, GDPR art. 6/1-b).
• Safety and community rules: preventing cheating and abuse, reviewing reports, removing content that breaks the rules, protecting players. Legal basis: legitimate interest (KVKK art. 5/2-f, GDPR art. 6/1-f).
• Measurement and improvement: understanding which features are used, finding and fixing bugs, improving the game. Legal basis: legitimate interest.
• Notifications: sending reminders, invites and announcements. Legal basis: the notification permission you give on your device; you can turn notifications off at any time in Settings.
• Advertising: showing ads so the game can stay free. Personalised ads are shown only with your consent: in the European Economic Area and the UK through Google's consent form, and on iOS additionally through Apple's tracking permission (App Tracking Transparency). You can change your choice in Settings → Privacy Options.
• Record keeping: keeping purchase records for the period required by law. Legal basis: legal obligation (KVKK art. 5/2-ç, GDPR art. 6/1-c).

5. What other players see

Your username, country, profile photo, the cosmetics you use, your ELO, records and rankings, your stand and your player room are visible to other players. Your friends can see whether you are online. Players in your match see the messages you write, filtered. If you delete your account, you appear as "Deleted player" in your opponents' match history.

6. Who we share data with

We do not sell your data. We share it only as needed with the providers we use to run the service:

• Supabase: database, authentication and file storage (server region: Zurich, Switzerland).
• Expo, Google Firebase Cloud Messaging, Apple Push Notification service: delivering notifications to your device.
• Google AdMob: showing and measuring ads. Google processes ad data under its own privacy policy: policies.google.com/privacy
• Apple App Store and Google Play: processing and verifying purchases.

We may share data with competent public authorities where required by law.

7. International transfers

The servers of the providers above are outside Turkey, so your data is transferred abroad. Our database is in Switzerland; the servers of our notification, advertising and store providers may be in other countries (mainly the United States). Transfers are based on data processing agreements with these providers that include standard contractual clauses.

8. How long we keep data

• Account and game data: for as long as your account exists. Deleted when you delete your account.
• Match chat messages: 30 days.
• Bug reports and screenshots: 180 days.
• Profile photos removed after reports: kept for 180 days in closed storage for review and appeals, then deleted.
• Weekly personal Stand Wars records: 26 weeks. Clubs' weekly totals and champions contain no personal data.
• Purchase records: for the period required by law even if you delete your account, unlinked from your account.
• Crash reports: not linked to your account; kept as long as needed for diagnosis.

9. Deleting your account and data

You can delete your account at any time in the app: Settings → Delete my account. Deletion happens immediately and cannot be undone. Your profile, coins (including purchased coins), cosmetics, profile photo, trophies, statistics, friendships, chat messages, bug reports and notification tokens are deleted. You appear as "Deleted player" in your opponents' match history; purchase records are kept for the legal period, unlinked from your account. If you cannot access the app: korveon.co/mobile/en/321-football/delete-account

10. Your rights

Under Article 11 of KVKK and, where applicable, the GDPR you have the right to learn whether your data is processed, to request information and a copy, to request correction or deletion, to object to processing, to ask about the parties your data is transferred to, to receive your data in a portable format and to request compensation if you suffer damage. Send your requests to oguz@korveon.co; we reply within 30 days at the latest. You also have the right to complain to the Turkish Personal Data Protection Board (or, in Europe, to your local data protection authority).

11. Security

Data is transmitted over encrypted connections (TLS); database access is restricted by permissions; passwords are stored in unreadable form; closed storage areas can only be accessed by authorised administrators with two-step verification.

12. Children

321 Football! is not intended for children under 13 and does not knowingly collect data from children under 13. If we become aware of an account belonging to someone under 13, we delete it.

13. AI-powered opponents

In online modes, if no opponent is found you may be matched with an AI-powered opponent. These opponents do not process any additional data about you.

14. Changes

We may update this policy. For significant changes we will let you know in the app and, where needed, ask for your consent again. The current version is always on this page.

15. Contact

For questions and requests: oguz@korveon.co