This Privacy Policy explains what data Word Arena collects, why, who it is shared with, and how you can control it. Turkish-language players should also read the KVKK Aydınlatma Metni, which is the statutory disclosure under Turkish data protection law (Law No. 6698).
In short: we never ask for your name, e-mail, phone number or location. We do not sell your data. The game servers and database are located outside Türkiye (Frankfurt). There is no free-text chat in the game — players communicate only through preset emoji and gifts.
| Controller | Tugay Acar |
|---|---|
| Address | BEŞİKKAYA MAH. 1972 CAD. MELEK APT NO: 23 İÇ KAPI NO:11 ALTINDAĞ/ ANKARA |
| [email protected] |
We do not collect special-category data (health, biometrics, beliefs), we do not collect location, and we do not access your contacts or photos.
To create and recognise your account and preserve your progress; to run matchmaking, matches, rewards and the in-game economy; to operate leagues, leaderboards, quests and the card collection; to provide friends and duel invitations; to prevent cheating, multi-accounting and abuse; to diagnose crashes and improve stability and balance; to answer your support requests; and — only if you opted in — to measure usage statistically and send campaign or announcement messages.
We do not sell your data. It is shared only with the providers needed to run the service: hosting (Render Services, Inc. (ABD merkezli)), database (MongoDB, Inc. — MongoDB Atlas (ABD merkezli)), push infrastructure (Google Firebase Cloud Messaging, only with your notification consent), app stores (Apple, Google), and competent authorities where legally required.
Your username, avatar, league points and statistics are visible to other players by design (leaderboards, matchmaking screen, friends list).
The servers and database are hosted outside Türkiye: Frankfurt / Frankfurt. This transfer occurs because the game is hosted on servers abroad and is necessary to provide the service. The process of establishing the appropriate safeguards set out in Article 9 of Law No. 6698 is ongoing; this text will be updated once it is completed. The transfer is not based on your consent, so withdrawing your optional consents never affects your account.
Account and gameplay data: for as long as your account exists; on a deletion request, erased or anonymised within 30 days except records we must keep by law. Error logs: at most 30 days. Purchase records: for the periods required by law.
Consent records are kept for up to 10 years as proof of consent. Even if you delete your account, a minimal consent record survives: which document version you accepted and when, when you changed your optional consents, and when the account was deleted. That record contains no IP address, no device information and no username — the account identifier left in it resolves to nothing once the account is gone.
All client-server traffic is encrypted with TLS. Sessions use signed, expiring tokens (JWT) and every request re-verifies that the account still exists. Match outcomes, coin balances and rewards are computed on the server only — client-supplied values are never trusted. No system is perfectly secure; if a breach occurs we will notify as required by law.
If you are under 18 you may use the game only with the approval of a parent or legal guardian. If you believe a child's data has been processed without such approval, write to [email protected] and we will delete the account and its data.
You may request access to, correction of, or deletion of your data, and object to processing. To delete your account and data, use the Account & Data Deletion page, or e-mail [email protected] with your username; requests are answered within 30 days. Optional consents can be managed by you in-game under Settings → Legal & Privacy → My Consent Preferences.
When this policy changes materially, the date and version above change and the game asks for your consent again on launch.