PICKBALLPrivacy Policy
Last updated: 11 October 2026
This policy explains how Pickball (pickball.fun) processes your personal data when you play. It is written to meet the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the EU General Data Protection Regulation ("GDPR"). The short version: we collect only what the game needs to run and to stay fair, we do not sell data, and we do not use advertising or tracking.
1. Who we are
The data controller is Pickball (pickball.fun). Contact: destek@pickball.fun
2. What we collect
- Account data: username, one-way hashes of your password and your account recovery words (we never store the password or the words themselves), account creation date, the time you accepted the Terms of Use, and your role.
- Security data: IP address, session data, last-seen time, the result of the bot check, and a random device ID kept in your browser to stop two accounts playing from the same computer in one room (not stored permanently on our server).
- Country: estimated from your IP address on our own server to show your flag. Your IP is not sent to any other service for this.
- Game data: match results and statistics (goals, assists, shots, passes, tackles, saves, distance run and similar), your position and formation choices, the game inputs sent to our server so matches can be checked for cheating, and the result of that check.
- Moderation records: cheating and stat-padding alerts, bans, and actions taken by staff with the reasons they gave.
Room chat travels directly between players' browsers and is not stored on our server. We do not collect your email address, real name, or payment details.
3. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account and running the game: rooms, matches, statistics, leaderboards | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2(c)) |
| Preventing cheating, bots, multi-account stat padding and abuse; keeping the service secure; enforcing the rules | Legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5/2(f)) |
| Keeping traffic records and answering lawful requests from authorities | Legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5/2(ç)) |
| Defending legal claims | Legitimate interests / establishment of a right (KVKK Art. 5/2(e)) |
We do not rely on consent, because we do no advertising, marketing or profiling. Anti-cheat checks can flag a match automatically, but a person reviews alerts before any account-level action is taken.
4. Who receives your data
- Hosting: the provider that runs the server the site and game are hosted on. Its servers may be located outside Turkey.
- Security and connection service (Cloudflare): for bot protection at sign-up and login (Turnstile) and for helping players connect to each other (STUN), your browser connects directly to Cloudflare's servers. Your IP address and technical browser data are processed by Cloudflare under its own privacy policy.
- Other players: game rooms run on the device of the player who creates them, and players connect to each other over peer-to-peer (P2P) connections. Due to the technical nature of these connections, the IP addresses of players in the same room may be shared with one another. Managing a room is the room host's responsibility (see Terms of Use, section 9).
- Authorities: when required by law.
We never sell or rent your data.
5. International transfers
Some of the services above (hosting and Cloudflare) may process data on servers outside Turkey, including in the United States. They are used only for the purposes described here: running the site, security and connecting players. Cloudflare states that it participates in the EU–US Data Privacy Framework.
6. How long we keep it
- Account data and statistics: until you delete your account.
- Visit records (IP address and date): 1 year.
- IP addresses in match records: 1 year (the match and statistics stay, the IP is removed).
- Anti-cheat records and closed alerts: 1 year.
- IP addresses in staff logs: 2 years.
- Sessions: deleted when they expire (30 days at most).
- Bans: until lifted.
Expired data is deleted or anonymised automatically. When you delete your account, your account data and statistics are deleted; records we must keep for security or legal reasons (such as bans and anti-cheat records) are kept for the periods above.
7. Cookies and browser storage
We only use what is strictly necessary for the game to work. There are no advertising, analytics or tracking cookies, so no cookie banner is needed.
| Name | Type | Purpose | Duration |
|---|---|---|---|
pb | Cookie | Keeps you logged in. Cannot be read by page scripts and is sent only over HTTPS. | 30 days or until logout |
pickball.settings | Local storage | Your settings: sound, zoom, language, player name. | Until you clear it |
pb-device | Local storage | Random device ID used against multi-account abuse. Contains nothing about you. | Until you clear it |
pickball.hintHidden | Local storage | Whether you hid the in-game key hints. | Until you clear it |
pb-ver-reload | Session storage | Makes sure the page reloads only once after a game update. | Until the tab closes |
Cloudflare Turnstile loads only on the sign-up and login forms; see the Cloudflare Privacy Policy. Fonts and all other files are served from our own server. You can delete cookies and site data in your browser settings at any time; you will be logged out and your settings will reset.
8. Security
We take appropriate technical and organisational measures to protect your data, including one-way hashing of passwords, encrypted connections (HTTPS) everywhere, session cookies closed to page scripts, admin access limited to authorised staff with every staff action logged, login rate limiting and bot checks. No transmission or storage over the internet can be guaranteed to be completely secure.
9. Your rights
You have the right to access your data, correct it, have it erased, restrict or object to its processing, receive it in a portable format, and object to decisions made solely by automated means. Under KVKK Article 11 you may also ask whether your data is processed, learn its purpose and recipients, and claim compensation for unlawful processing.
- Delete your account yourself at any time from the Account tab in the game.
- For any other request, email destek@pickball.fun with your name, username and request. To protect your account, we must confirm the request comes from the account owner; we may ask you to log in or give additional information, and requests we cannot verify cannot be completed. We reply free of charge within 30 days.
- You can complain to a data protection authority: in Turkey the Personal Data Protection Authority (KVKK), in the EU the authority of the country where you live.
10. Children
Pickball is not aimed at young children. If you are under 16 (or the age of digital consent in your country), please play only with a parent's or guardian's permission. If you believe a child has created an account without permission, contact us and we will delete it.
11. Changes
We may update this policy; the current version is always on this page. If there is any conflict between this English text and the Turkish KVKK Aydınlatma Metni, the Turkish text prevails.
Information you choose to share in chat, your username or a room name can be seen by other players; you are responsible for sharing it. We recommend not sharing personal details such as your real name, phone number or address in the game.
Country estimation runs on our own server using data compiled from public internet routing records and location feeds published by network operators; your IP address is not sent to any other service. Sources are listed on the About page. You can also pick your flag yourself in your account settings.