Worena Privacy Policy

Version: 2026-10-01Effective: 1 October 2026

This policy explains which personal data we process when you use the Worena mobile app and related services (the "Service"), why and how we process it, who we share it with, how long we keep it and how you can exercise your rights.

1. In short

• We process the data needed to run the game, operate chat and keep your account safe. We never ask for your location, contacts, microphone, camera, date of birth or phone number.
• Chat messages are stored encrypted on our servers; private messages are kept for 12 months and game chats for 90 days after the game ends.
• Worena currently shows no ads and offers no in-app purchases. We do not collect your advertising ID.
• We do not sell your data.
• The app is not open to anyone under 16; extra protections apply to users aged 16–17.
• You can download a copy of your data in the app and delete your account in the app or on the web. Deletion takes effect after 14 days; you can cancel during that time.

2. Data controller and contact

The data controller is Mustafa Ali Erdoğan, a natural person (address: Güneşli Mh., İstanbul 34212, Türkiye). You can send any privacy question or request to syzitech@gmail.com. "nupya" is the technical domain name of our servers.

Because the data controller is established in Türkiye, the Turkish Personal Data Protection Law No. 6698 ("KVKK") applies to our processing of personal data. This policy is also our privacy notice under KVKK article 10.

The same data controller also provides Kelimetrik, a Turkish-language word game. Both apps run on the same servers, but their accounts are separate (section 3.1).

3. What data we process

We collect personal data electronically and partly by automated means: directly from you (sign-up, age group, profile, games, chat, settings, support, reports and appeals, and e-mails you send us), automatically (the app's communication with our servers, server logs and technical information provided by your device) and from third parties (Google, when you sign in with Google, and other users, for example when they add you as a friend, play a game with you or report you).

3.1 Account and sign-in

• Sign in with Google: your Google account ID and e-mail address. We do not ask Google for your name. We store the profile photo address (link) that Google provides at sign-in together with your sign-in record and update it each time you sign in with Google; we only use it if you ask us to, that is, when you tap "Use my Google photo", to fetch the photo from Google and make it your profile photo (section 3.3). The address is deleted when Google sign-in is unlinked from your account or when your account is deleted.
• Guest use: you can practise against the bot without an account. We do not collect an e-mail address or sign-in account from guests; we only process device information, an automatic guest ID and practice games.
• Your e-mail address is stored encrypted on our servers; support staff only see a masked version.
• Separate from Kelimetrik: a Worena account is separate from any Kelimetrik account. If you use the same Google account in both apps, you have two separate accounts that are not linked. Worena players can only find, add, message and play against other Worena players.

3.2 Age group

Before creating an account we ask for your age group: "Under 16", "16–17" or "18 or older". We do not ask for your date of birth. If you state that you are under 16, no account is created and that answer is not stored on our servers. Your age group is never shown to other users and is never shared with third parties.

3.3 Profile

Username, display name (optional), bio (optional), avatar (a ready-made avatar or an optional profile photo) and profile theme. When you change your username, the previous one is kept for 180 days to investigate abuse.

Profile photo (optional): using a profile photo instead of a ready-made avatar is entirely up to you; if you do not add one, your ready-made avatar is shown.

• Source: a photo you choose from your device, or, if you tap "Use my Google photo", the profile photo of your Google account (in that case the photo is downloaded from Google's servers). Photos on your device are chosen with Android's system Photo Picker: the app does not ask for camera, gallery or storage permission and does not access your camera; only the photo you pick reaches us.
• Processing: the photo is processed on our servers: its actual file type is checked (only JPEG and PNG are accepted), it is cropped to a centred square and re-encoded as JPEG at 512, 256 and 128 pixels. All metadata, including location information (EXIF etc.), is removed in the process. The original file you upload is not kept; it is deleted immediately after processing, and uploads that are not completed are deleted within 24 hours at the latest. No face recognition, biometric processing or automated image analysis is applied to the photo, and it is not sent to any third-party image classification service.
• Moderator review: profile photos are reviewed by a moderator for compliance with the community rules in our Terms of Use, either before or after they are published. As a rule, a new photo is visible only to you until a moderator approves it; in the meantime other users see your ready-made avatar. A photo found inappropriate is rejected or removed, its files are deleted and you are notified in the app. Other users can also report your profile photo.
• Who can see it: once approved, your photo is visible to other users wherever your avatar appears (profile, game screen, chat, friends lists, league and leaderboard tables, search results) (section 7).
• Retention and deletion: the photo is kept for as long as it is your profile photo. When you change it, remove it and go back to a ready-made avatar, or when it is rejected or removed, its files are deleted; when your account is deleted, all your photo files and their records are deleted. Profile photos are stored on the same servers as your other account data; they are not shared with third parties, not sold and not used for advertising.

3.4 Gameplay

The games you play, your moves, words, scores, timings, results, team and placement information; your statistics, achievements, league and leaderboard positions, mission progress; matchmaking and "Rematch" records. If you submit a word appeal, the word and your explanation.

3.5 Social features

• Friends: adding a friend is one-way; the people you add are kept in your list. The list of people who added you is not shown to you or anyone else, and the person you add is not notified. When someone adds you, your account ID is stored in their record; this gives them no additional information about you or access to you. You can turn on "Don't let anyone add me as a friend" in Settings › Privacy.
• Blocking: the people you block, block from chat or mute. A blocked person is not told that they were blocked.
• Online status and read receipts: processed according to your settings; you can turn both off.

3.6 Chat

The content of game chats (general and private) and private messages, together with sender, time and read status. See section 6.

3.7 In-game rewards

Records of the in-game items and rewards you earn by playing, such as coins, jokers, badges and achievements, and how you use them. These items are earned only through gameplay; Worena does not sell them (section 9).

3.8 Notifications

Your device's push notification token, your in-app notifications and your notification preferences.

3.9 Support, reports and consents

Your support requests and correspondence; reports you make and reports made about you; enforcement records; the versions of the terms you accepted and the notices you saw, and the permissions you granted or withdrew (consent history); data export and account deletion requests.

3.10 Device, security and technical data

IP address; device model, operating system and app version; app installation ID; session records; server logs; security and fraud-prevention signals. IP addresses and device IDs are never written to our fraud-prevention tables in clear form; they are only kept briefly as keyed one-way hashes. The last part of the IP address is masked in server logs.

3.11 Usage analytics

To improve the app we process events about which screens and features are used, linked to a random analytics ID that is separate from your account. Message content, e-mail address, username, IP address, location and other users' identities are never added to these events. You can turn this off in Settings › Privacy › Usage analytics.

4. Data we do not process

We do not ask for location (GPS), contacts, microphone, camera, date of birth, phone number or your real name. We do not access your gallery or the files on your device; for a profile photo, only the photo you pick reaches us. We do not store your in-app search queries. We do not collect your advertising ID (Android advertising ID). We do not process payment or purchase data, because Worena currently offers no in-app purchases. We do not knowingly process special categories of personal data such as health, religion or political opinions; please do not include them in chats, your bio or support messages. We do not process your profile photo as a special category of personal data: no face recognition or other biometric processing is applied to photos.

5. Why we use your data

We do not sell your data and we do not use it for advertising.

6. Chat messages

• Who can message you: for adult accounts the default chat scope is "Everyone"; in Settings › Chats and invites you can narrow it to "My friends", "Friends and opponents" or "No one", or turn off all chats. For users aged 16–17 the "Everyone" option is not available, the default is "My friends" and private messages are only possible with mutual friends.
• Encryption: message content is stored on our servers with application-level encryption. Messages are not end-to-end encrypted; they pass through our servers and automatic filters for safety and moderation.
• Automatic filters: links cannot be shared in chat. Contact details such as phone numbers, e-mail addresses or social media handles are masked or the message is rejected (always rejected for new accounts and for users aged 16–17). Identical messages repeated in a short time are blocked.
• Retention: private messages are kept for 12 months from sending and game chats for 90 days after the game ends, then deleted. A message you delete is removed for everyone; its content is kept for 30 more days only for moderation.
• Reporting: when you report a message, the reported message and a few messages before and after it are stored as a separate evidence record so it can be reviewed. Only authorised moderators can access it and every access is logged.
• Blocking: when you fully block someone, your shared private message history is hidden for both of you; the messages are not deleted and expire under the normal retention period.
• No message text in notifications: message notifications only say something like "… sent you a message".

7. What other users can see

Only other Worena players can see the information below; Kelimetrik players cannot see your Worena profile.

8. Notifications

We use Google Firebase Cloud Messaging to deliver notifications to your device. For this, your device's notification token and the notification's title and text are passed to Google. You can turn off game, social and reward notifications by type in Settings › Notifications, or all notifications in your device settings. Promotional notifications are only sent if you explicitly opt in, are off by default and are never sent to users aged 16–17. We do not send commercial messages by SMS or e-mail.

9. No ads and no in-app purchases

Worena currently does not show ads and does not offer in-app purchases or subscriptions; playing is free. We therefore do not share your data with advertising services, we do not collect your advertising ID and we do not process payment or purchase records for Worena. Coins, jokers and other in-game items can only be earned by playing (section 3.7).

If we introduce ads or in-app purchases in the future, we will update this policy before they become available and tell you about it in the app.

10. Third-party services

Profile photos are processed and stored on our own infrastructure (the hosting service above); they are not sent to any third-party service for image analysis or classification.

The app currently contains no third-party analytics, crash-reporting or advertising component; usage analytics are processed on our own infrastructure. If we add such a service, we will update this policy beforehand.

Links to other websites: some screens may contain links to other websites, for example an online dictionary to look up a word or your Google Account settings. Such links open in your browser; we do not send your account data to these websites, and their own privacy policies apply.

11. International transfers

Our servers are in the European Union (Germany); the data processed in the Service, including profile photos, is stored on these servers. Google services use data centres in several countries, including the United States. Your personal data may therefore be processed outside your country and outside Türkiye. As the Turkish Personal Data Protection Board has not announced an adequacy decision, regular transfers of personal data abroad are based on the standard contracts announced by the Board under KVKK article 9, and these contracts are notified to the Personal Data Protection Authority within five business days of signature. For occasional (incidental) transfers, one of the exceptions in KVKK article 9(6) may apply. The recipients are listed in section 10.

12. Retention periods

13. Deleting your account

You can delete your account in the app via Profile › Settings › Delete account. If you cannot access the app, follow the steps on the account deletion page.

• There is a 14-day waiting period after your request; during that time you can open the app and cancel. After that, deletion is permanent.
• When you request deletion your active games end as abandoned, pending invitations and matchmaking are cancelled and your profile is hidden from other users.
• Your coins, jokers and other in-game items are lost and are not restored.
• Deleted: your profile, username, avatar, profile photo and all photo files, e-mail address and sign-in details (including the link to your Google account and the Google profile photo address), friend and block records, the content of the messages you wrote in game chats and private messages, your sessions, device and notification records, statistics and notifications. You can also review and remove the app's access in your Google Account settings.
• Kept, separated from your identity: the games and moves you played (as "Deleted user", for your opponents' history); league and leaderboard rankings of closed weeks; coin and in-game reward transactions (10 years); report and enforcement records (for the periods above); re-registration prevention hashes if the account was permanently banned (2 years); consent records and the record of your deletion request (3 years, as proof). Messages other people wrote to you remain in their accounts.

14. Your rights and how to exercise them

Under KVKK article 11 you have the right to learn whether your data is processed, request information, learn the purpose and whether it is used accordingly, know the recipients, request correction and deletion and notification of these to recipients, object to a result against you arising solely from automated processing, and claim compensation for damage.

• Access and copy: Settings › Download my data. Your data is packaged in machine-readable (JSON) form with a readable explanation; if you have a profile photo, its current version (512 pixels) is included. The package can be downloaded at most 3 times within 7 days. You can request this once every 7 days.
• Correction: you can change your profile (including changing or removing your profile photo), your username (once every 30 days) and your preferences in the app. Contact us to correct your age group.
• Deletion: see section 13.
• Objection and preferences: usage analytics, online status, read receipts, chat scope, who can add you and notifications can be changed in Settings. You can see your consent history in Settings › Privacy.
• Requests: syzitech@gmail.com (from the e-mail address registered to your account) or by post to Güneşli Mh., İstanbul 34212, Türkiye. We answer free of charge within 30 days at the latest. If you are not satisfied with our answer you can complain to the Turkish Personal Data Protection Board.

If you live outside Türkiye, the data protection law of your country may give you additional or different rights. You can exercise them through the same channels to the extent that law applies to our processing, and you may also be able to complain to the data protection authority where you live.

15. Children and users aged 16–17

The Service is not open to anyone under 16. No account is created for a person who states they are under 16, and that statement is not stored. If we learn that someone under 16 has created an account, we will delete it; parents who become aware of this can write to syzitech@gmail.com.

For users aged 16–17:

• The "Everyone" chat scope is not available; the default is "My friends" and private messages are only possible with mutual friends.
• Game chat in random matches is off by default; invitations come only from friends by default; online status is hidden by default.
• Sharing phone numbers, e-mail addresses or social media handles in chat is blocked.
• No promotional notifications or e-mails are sent.
• Reports involving young users are reviewed with priority.

16. Security

• All traffic between the app and our servers is encrypted with TLS.
• E-mail addresses and message content are additionally encrypted at application level; e-mail addresses are looked up through keyed hashes.
• We do not use passwords; only hashes of session tokens are stored. Sensitive actions (data download, account deletion) require re-authentication.
• Access to the admin panel is limited by role and permission; access to sensitive data requires a justification and is logged.
• Data such as e-mail addresses, message content and tokens are automatically redacted from logs; IP addresses are masked.
• In the event of a data breach we notify the Turkish Personal Data Protection Board and affected users as required by KVKK and any other law that applies to us.

No system is perfectly secure; if you notice anything suspicious on your account, sign out other sessions in Settings › Sessions and devices and contact us.

17. Changes

We update this policy when the Service or the law changes, for example before we add new features such as ads, in-app purchases or new sign-in methods. Each version is published with a date. We will inform you in the app about significant changes; if a change requires your consent we will ask for it before you continue to use the app.

18. Contact

Mustafa Ali Erdoğan · Güneşli Mh., İstanbul 34212, Türkiye · syzitech@gmail.com