Worena Privacy Policy

Version: 2026-10-06Effective: 6 October 2026Previous version: 2026-10-01

This policy explains which personal data we process when you use the Worena mobile app and related services (the "Service"), why we process it and on which legal bases, who we share it with, how long we keep it and how you can exercise your rights.

1. In short

• We process the data needed to run the game, operate chat and keep your account safe. We never ask for your location, contacts, microphone, camera, date of birth or phone number.
• Chat messages are stored encrypted on our servers; private messages are kept for 12 months and game chats for 90 days after the game ends.
• Worena currently shows no ads and offers no in-app purchases. We do not collect your advertising ID.
• We do not sell your data and we do not share it for advertising.
• Our servers are in the European Union (Germany); the data controller is in Türkiye (section 11).
• The app is not open to anyone under 16; extra protections apply to users aged 16–17.
• You can download a copy of your data in the app and delete your account in the app or on the web. Deletion takes effect after 14 days; you can cancel during that time.
• If you are in the European Union, the European Economic Area or the United Kingdom, the GDPR or the UK GDPR also protects you: section 5 sets out our legal bases and section 14 your rights, including the right to complain to your data protection authority.

2. Data controller, contact and applicable laws

The data controller is Mustafa Ali Erdoğan, a natural person (address: Güneşli Mh., İstanbul 34212, Türkiye). You can send any privacy question or request to syzitech@gmail.com. "nupya" is the technical domain name of our servers.

Which laws apply:

• Türkiye: because the data controller is established in Türkiye, the Turkish Personal Data Protection Law No. 6698 ("KVKK") applies to all our processing of personal data. This policy is also our privacy notice under KVKK article 10.
• EU/EEA and UK: because we offer the Service to people in the European Union and the European Economic Area ("EU/EEA") and in the United Kingdom ("UK"), the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") applies to the processing of personal data of users who are in the EU/EEA (GDPR article 3(2)), and the UK GDPR and the Data Protection Act 2018 apply to users who are in the UK. In this policy, "GDPR" also means the UK GDPR where you are in the UK. This policy contains the information required by GDPR articles 13 and 14.
• Other countries: if you live elsewhere, the data protection law of your country may also apply (sections 15 and 16).

The same data controller also provides Kelimetrik, a Turkish-language word game. Both apps run on the same servers, but their accounts are separate (section 3.1).

3. What data we process

We collect personal data electronically and partly by automated means: directly from you (sign-up, age group, profile, games, chat, settings, support, reports and appeals, and e-mails you send us), automatically (the app's communication with our servers, server logs and technical information provided by your device) and from third parties (Google, when you sign in with Google, and other users, for example when they add you as a friend, play a game with you or report you).

3.1 Account and sign-in

• Sign in with Google: your Google account ID and e-mail address. We do not ask Google for your name. We store the profile photo address (link) that Google provides at sign-in together with your sign-in record and update it each time you sign in with Google; we only use it if you ask us to, that is, when you tap "Use my Google photo", to fetch the photo from Google and make it your profile photo (section 3.3). The address is deleted when Google sign-in is unlinked from your account or when your account is deleted.
• Guest use: you can practise against the bot without an account. We do not collect an e-mail address or sign-in account from guests; we only process device information, an automatic guest ID and practice games.
• Your e-mail address is stored encrypted on our servers; support staff only see a masked version.
• Separate from Kelimetrik: a Worena account is separate from any Kelimetrik account. If you use the same Google account in both apps, you have two separate accounts that are not linked. Worena players can only find, add, message and play against other Worena players.

3.2 Age group

Before creating an account we ask for your age group: "Under 16", "16–17" or "18 or older". We do not ask for your date of birth. If you state that you are under 16, no account is created and that answer is not stored on our servers. Your age group is never shown to other users and is never shared with third parties.

3.3 Profile

Username, display name (optional), bio (optional), avatar (a ready-made avatar or an optional profile photo) and profile theme. When you change your username, the previous one is kept for 180 days to investigate abuse.

Profile photo (optional): using a profile photo instead of a ready-made avatar is entirely up to you; if you do not add one, your ready-made avatar is shown.

• Source: a photo you choose from your device, or, if you tap "Use my Google photo", the profile photo of your Google account (in that case the photo is downloaded from Google's servers). Photos on your device are chosen with Android's system Photo Picker: the app does not ask for camera, gallery or storage permission and does not access your camera; only the photo you pick reaches us.
• Processing: the photo is processed on our servers: its actual file type is checked (only JPEG and PNG are accepted), it is cropped to a centred square and re-encoded as JPEG at 512, 256 and 128 pixels. All metadata, including location information (EXIF etc.), is removed in the process. The original file you upload is not kept; it is deleted immediately after processing, and uploads that are not completed are deleted within 24 hours at the latest. No face recognition, biometric processing or automated image analysis is applied to the photo, and it is not sent to any third-party image classification service.
• Moderator review: profile photos are reviewed by a moderator for compliance with the community rules in our Terms of Use, either before or after they are published. As a rule, a new photo is visible only to you until a moderator approves it; in the meantime other users see your ready-made avatar. A photo found inappropriate is rejected or removed, its files are deleted and you are notified in the app. Other users can also report your profile photo.
• Who can see it: once approved, your photo is visible to other users wherever your avatar appears (profile, game screen, chat, friends lists, league and leaderboard tables, search results) (section 7).
• Retention and deletion: the photo is kept for as long as it is your profile photo. When you change it, remove it and go back to a ready-made avatar, or when it is rejected or removed, its files are deleted; when your account is deleted, all your photo files and their records are deleted. Profile photos are stored on the same servers as your other account data; they are not shared with third parties, not sold and not used for advertising.

3.4 Gameplay

The games you play, your moves, words, scores, timings, results, team and placement information; your statistics, achievements, league and leaderboard positions, mission progress; matchmaking and "Rematch" records. If you submit a word appeal, the word and your explanation.

3.5 Social features

• Friends: adding a friend is one-way; the people you add are kept in your list. The list of people who added you is not shown to you or anyone else, and the person you add is not notified. When someone adds you, your account ID is stored in their record; this gives them no additional information about you or access to you. You can turn on "Don't let anyone add me as a friend" in Settings › Privacy.
• Blocking: the people you block, block from chat or mute. A blocked person is not told that they were blocked.
• Online status and read receipts: processed according to your settings; you can turn both off.

3.6 Chat

The content of game chats (general and private) and private messages, together with sender, time and read status. See section 6.

3.7 In-game rewards

Records of the in-game items and rewards you earn by playing, such as coins, jokers, badges and achievements, and how you use them. These items are earned only through gameplay; Worena does not sell them (section 9).

3.8 Notifications

Your device's push notification token, your in-app notifications and your notification preferences.

3.9 Support, reports and consents

Your support requests and correspondence; reports you make and reports made about you; enforcement records; the versions of the terms you accepted and the notices you saw, and the permissions you granted or withdrew (consent history); data export and account deletion requests.

3.10 Device, security and technical data

IP address; device model, operating system and app version; app installation ID; session records; server logs; security and fraud-prevention signals. IP addresses and device IDs are never written to our fraud-prevention tables in clear form; they are only kept briefly as keyed one-way hashes. The last part of the IP address is masked in server logs.

3.11 Usage analytics

To understand how the Service is used and to improve it, our servers record on which days your account was active, together with your platform (Android or iOS) and app version, and count how often some features are used (for example, how many word meanings are viewed) as daily totals that do not identify anyone. These records are created from requests the app already sends to our servers: the app contains no analytics or advertising SDK and does not store or read anything on your device for analytics. Message content, e-mail address, username, IP address, location and other users' identities are never added to them. You can turn this off at any time in Settings › Privacy › Usage analytics; from then on, your activity is no longer recorded for usage analytics.

4. Data we do not process

We do not ask for location (GPS), contacts, microphone, camera, date of birth, phone number or your real name. We do not access your gallery or the files on your device; for a profile photo, only the photo you pick reaches us. We do not store your in-app search queries. We do not collect your advertising ID (Android advertising ID). We do not process payment or purchase data, because Worena currently offers no in-app purchases. We do not knowingly process special categories of personal data such as health, religion or political opinions; please do not include them in chats, your bio or support messages. We do not process your profile photo as a special category of personal data: no face recognition or other biometric processing is applied to photos.

5. Why we use your data and our legal bases

The table shows each purpose and the legal basis we rely on under the GDPR (for users in the EU/EEA and the UK) and under KVKK. The letters refer to GDPR article 6(1): (a) consent, (b) performance of the contract with you (the Terms of Use) or steps before entering into it, (c) a legal obligation and (f) our legitimate interests or those of others.

Legitimate interests: where we rely on legitimate interests, the interests are those named in the table: a secure, fair and safe Service, the protection of young users and the improvement of the Service. We have weighed them against your interests and rights and limited the data we use (for example, IP addresses and device IDs are kept only briefly as keyed one-way hashes for fraud prevention). You can object at any time (section 14) and ask us for more information about this assessment.

Consent: where we rely on consent, you can withdraw it at any time in Settings, with effect for the future; this does not affect processing carried out before you withdrew it.

Do you have to give us your data? To create an account you need to state your age group and accept the Terms of Use and this policy, and a registered account requires Sign in with Google; without this we cannot provide the Service, but you can still practise against the bot as a guest. Everything else, such as a display name, bio, profile photo, chat messages, promotional notifications and usage analytics, is optional.

Automated decisions: we do not make decisions based solely on automated processing that have legal or similarly significant effects on you (GDPR article 22). Automatic chat filters only mask or block a message; fraud and cheating signals alone never lead to an account being closed, because a person reviews them first (Terms of Use, section 5).

We do not sell your data and we do not use it for advertising.

6. Chat messages

• Who can message you: for adult accounts the default chat scope is "Everyone"; in Settings › Chats and invites you can narrow it to "My friends", "Friends and opponents" or "No one", or turn off all chats. For users aged 16–17 the "Everyone" option is not available, the default is "My friends" and private messages are only possible with mutual friends.
• Encryption: message content is stored on our servers with application-level encryption. Messages are not end-to-end encrypted; they pass through our servers and automatic filters for safety and moderation.
• Automatic filters: links cannot be shared in chat. Contact details such as phone numbers, e-mail addresses or social media handles are masked or the message is rejected (always rejected for new accounts and for users aged 16–17). Identical messages repeated in a short time are blocked.
• Retention: private messages are kept for 12 months from sending and game chats for 90 days after the game ends, then deleted. A message you delete is removed for everyone; its content is kept for 30 more days only for moderation.
• Reporting: when you report a message, the reported message and a few messages before and after it are stored as a separate evidence record so it can be reviewed. Only authorised moderators can access it and every access is logged.
• Blocking: when you fully block someone, your shared private message history is hidden for both of you; the messages are not deleted and expire under the normal retention period.
• No message text in notifications: message notifications only say something like "… sent you a message".

7. What other users can see

Only other Worena players can see the information below; Kelimetrik players cannot see your Worena profile.

8. Notifications

We use Google Firebase Cloud Messaging to deliver notifications to your device. For this, your device's notification token and the notification's title and text are passed to Google. You can turn off game, social and reward notifications by type in Settings › Notifications, or all notifications in your device settings. Promotional notifications are only sent if you explicitly opt in, are off by default and are never sent to users aged 16–17. We do not send commercial messages by SMS or e-mail.

9. No ads and no in-app purchases

Worena currently does not show ads and does not offer in-app purchases or subscriptions; playing is free. We therefore do not share your data with advertising services, we do not collect your advertising ID and we do not process payment or purchase records for Worena. Coins, jokers and other in-game items can only be earned by playing (section 3.7).

If we introduce ads or in-app purchases in the future, we will update this policy before they become available and tell you about it in the app.

10. Who we share data with

We share personal data only with the service providers below and only to the extent needed for the purposes in section 5. Our processors may use your data only on our instructions.

Profile photos are processed and stored on our own infrastructure (the hosting service above); they are not sent to any third-party service for image analysis or classification.

The app currently contains no third-party analytics, crash-reporting or advertising component; usage analytics are processed on our own infrastructure. If we add such a service, we will update this policy beforehand.

Links to other websites: some screens may contain links to other websites, for example an online dictionary to look up a word or your Google Account settings. Such links open in your browser; we do not send your account data to these websites, and their own privacy policies apply.

Google Play: you download Worena from Google Play, and Google processes the data it needs for this under its own privacy policy. Through Google Play Console we receive download and rating statistics and, from users who allowed this in their Android settings, crash reports that do not identify you by name or account.

Authorities and legal claims: we disclose personal data to courts, law enforcement or other public authorities only when the law requires it, when it is necessary to establish, exercise or defend legal claims, or to protect the safety of minors as described in our Terms of Use.

11. International transfers

Where your data is: our servers are in the European Union (Düsseldorf, Germany); the data processed in the Service, including profile photos, is stored on these servers. The data controller is in Türkiye and accesses the data from there to operate, support and moderate the Service. Google services use data centres in several countries, including the United States. Your personal data may therefore be processed outside your country. The recipients are listed in section 10.

Users in the EU/EEA and the UK: there is no adequacy decision of the European Commission or of the UK for Türkiye. When our hosting provider in the EU makes personal data of users in the EU/EEA or the UK available to us in Türkiye, the transfer is based on the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914, module 4, processor to controller) and, for UK data, the International Data Transfer Addendum issued by the UK Information Commissioner. [DOĞRULA] Transfers to Google LLC in the United States are based on the EU–US Data Privacy Framework and its UK Extension, under which Google LLC is certified, and on the standard contractual clauses in Google's data processing terms. [DOĞRULA] You can ask us for a copy of these safeguards at syzitech@gmail.com (commercial details may be removed).

KVKK: the transfer rules of KVKK article 9 also apply to all transfers from Türkiye. As the Turkish Personal Data Protection Board has not announced an adequacy decision, regular transfers of personal data abroad are based on the standard contracts announced by the Board under KVKK article 9, and these contracts are notified to the Personal Data Protection Authority within five business days of signature. For occasional (incidental) transfers, one of the exceptions in KVKK article 9(6) may apply.

Other countries: if you live elsewhere, your data is transferred to and stored in the EU (Germany), Türkiye and the United States, where it may be accessible to courts and authorities under the laws of those countries. We protect it as described in this policy wherever it is processed.

12. Retention periods

13. Deleting your account

You can delete your account in the app via Profile › Settings › Delete account. If you cannot access the app, follow the steps on the account deletion page.

• There is a 14-day waiting period after your request; during that time you can open the app and cancel. After that, deletion is permanent.
• When you request deletion your active games end as abandoned, pending invitations and matchmaking are cancelled and your profile is hidden from other users.
• Your coins, jokers and other in-game items are lost and are not restored.
• Deleted: your profile, username, avatar, profile photo and all photo files, e-mail address and sign-in details (including the link to your Google account and the Google profile photo address), friend and block records, the content of the messages you wrote in game chats and private messages, your sessions, device and notification records, statistics, notifications and usage analytics records. You can also review and remove the app's access in your Google Account settings.
• Kept, separated from your identity: the games and moves you played (as "Deleted user", for your opponents' history); league and leaderboard rankings of closed weeks; coin and in-game reward transactions (10 years); report and enforcement records (for the periods above); re-registration prevention hashes if the account was permanently banned (2 years); consent records and the record of your deletion request (3 years, as proof). Messages other people wrote to you remain in their accounts.

14. Your rights and how to exercise them

You can use many of your rights directly in the app:

• Access, copy and portability: Settings › Download my data. Your data is packaged in machine-readable (JSON) form with a readable explanation; if you have a profile photo, its current version (512 pixels) is included. The package can be downloaded at most 3 times within 7 days. You can request this once every 7 days.
• Correction: you can change your profile (including changing or removing your profile photo), your username (once every 30 days) and your preferences in the app. Contact us to correct your age group.
• Deletion: see section 13.
• Objection, consent and preferences: usage analytics, promotional notifications, online status, read receipts, chat scope, who can add you and notifications can be changed in Settings. You can see your consent history in Settings › Privacy.

14.1 Your rights under the GDPR (EU/EEA and UK)

• Access (art. 15): to know whether we process your data and to receive a copy of it together with information about the processing.
• Rectification (art. 16): to have inaccurate data corrected and incomplete data completed.
• Erasure (art. 17): to have your data deleted, for example when it is no longer needed or you withdraw your consent, unless a legal exception applies (the records we keep are listed in section 13).
• Restriction (art. 18): to have the processing of your data limited, for example while we check a correction you asked for or an objection you made.
• Data portability (art. 20): to receive the data you provided to us in a structured, commonly used and machine-readable format (Download my data) and to have it sent to another controller where technically feasible.
• Objection (art. 21): to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests; we then stop unless we have compelling legitimate grounds or need the data for legal claims. You can object to promotional notifications at any time without giving a reason.
• Withdrawing consent (art. 7(3)): at any time, with effect for the future.
• Automated decisions (art. 22): not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you; we do not make such decisions (section 5).

14.2 Your rights under KVKK

Under KVKK article 11 you have the right to learn whether your data is processed, request information, learn the purpose and whether it is used accordingly, know the recipients, request correction and deletion and notification of these to recipients, object to a result against you arising solely from automated processing, and claim compensation for damage.

14.3 How to make a request

Send your request to syzitech@gmail.com (preferably from the e-mail address registered to your account) or by post to Güneşli Mh., İstanbul 34212, Türkiye. To protect your account, we may ask you to confirm the request in the app or from your registered e-mail address before we act on it. We answer free of charge and without undue delay: within 30 days under KVKK and within one month under the GDPR. Where the GDPR applies and a request is complex, we may extend this by two further months and will tell you why within the first month. As the law allows, we may refuse manifestly unfounded or excessive requests or charge a reasonable fee for them.

14.4 Complaints to a data protection authority

• EU/EEA: you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement (GDPR article 77). Because we have no establishment in the EU, there is no lead supervisory authority for us and you can turn to the authority in your country. The authorities are listed on the website of the European Data Protection Board: edpb.europa.eu.
• UK: the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.
• Türkiye: the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), after you have first applied to us (KVKK article 14).
• Elsewhere: your local data protection authority (sections 15 and 16).

We would appreciate the chance to deal with your concern first, so please contact us; this does not limit your right to complain.

15. Users in the United States

We do not sell your personal information and we do not share it for cross-context behavioural advertising, as these terms are defined in the California Consumer Privacy Act (as amended by the California Privacy Rights Act) and similar US state laws. We use sensitive personal information, such as the content of your messages, only to provide the Service and keep it safe, so a right to limit its use does not apply. Because we do not sell or share personal information, opt-out preference signals such as Global Privacy Control have no further effect.

The categories of personal information we collect and their sources are described in section 3 (identifiers such as your e-mail address, account and device IDs and IP address; profile information and photo; gameplay and app activity; messages; age group), the purposes in section 5, the recipients in section 10 and the retention periods in section 12. We do not knowingly collect personal information from children under 13 (section 17).

Depending on the state you live in, you may have the right to know and access the personal information we hold about you, to receive a portable copy, to have it corrected or deleted, and not to be discriminated against for using these rights. You can use the in-app tools in section 14 or e-mail us; an authorised agent can also make a request for you, in which case we may ask for proof of the authorisation and verify your identity. If we decline your request, you can appeal by replying to our answer; if we deny your appeal, you can contact the attorney general of your state.

16. Users in Canada, Australia and other countries

• Canada: we handle your personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and its fair information principles. You can access and correct your information as described in section 14. Your information is stored and processed outside Canada (section 11) and may be accessible to courts and authorities there. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
• Australia: we handle your personal information consistently with the Australian Privacy Principles in the Privacy Act 1988. Your information is held overseas, in the EU (Germany), Türkiye and the United States (sections 10 and 11). You can ask to access or correct it (section 14); if you are not satisfied with our answer to a complaint, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).
• Other countries: if you live elsewhere, for example in New Zealand, India, Singapore, the Philippines, Nigeria or South Africa, the data protection law of your country may give you additional or different rights. You can exercise them through the same channels to the extent that law applies to our processing, and you may also be able to complain to the data protection authority where you live.

17. Children and users aged 16–17

The Service is not open to anyone under 16. No account is created for a person who states they are under 16, and that statement is not stored. If we learn that someone under 16 has created an account, we will delete it; parents who become aware of this can write to syzitech@gmail.com.

The same age limit applies in every country. Because nobody under 16 can create an account, we never rely on the consent of a child below the age of digital consent that applies in an EU/EEA member state (between 13 and 16 under GDPR article 8) or in the UK (13), and the Service is not directed at children under 13 (US Children's Online Privacy Protection Act). Some laws treat everyone under 18 as a child, for example the UK Age Appropriate Design Code; this is why the following high-privacy defaults and protections apply to users aged 16–17:

• The "Everyone" chat scope is not available; the default is "My friends" and private messages are only possible with mutual friends.
• Game chat in random matches is off by default; invitations come only from friends by default; online status is hidden by default.
• Sharing phone numbers, e-mail addresses or social media handles in chat is blocked.
• No promotional notifications or e-mails are sent.
• Reports involving young users are reviewed with priority.

18. Security

• All traffic between the app and our servers is encrypted with TLS.
• E-mail addresses and message content are additionally encrypted at application level; e-mail addresses are looked up through keyed hashes.
• We do not use passwords; only hashes of session tokens are stored. Sensitive actions (data download, account deletion) require re-authentication.
• Access to the admin panel is limited by role and permission; access to sensitive data requires a justification and is logged.
• Data such as e-mail addresses, message content and tokens are automatically redacted from logs; IP addresses are masked.
• In the event of a personal data breach we notify the competent authorities and affected users as required by KVKK, the GDPR and any other law that applies to us; under the GDPR, the competent supervisory authority is notified within 72 hours where required.

No system is perfectly secure; if you notice anything suspicious on your account, sign out other sessions in Settings › Sessions and devices and contact us.

19. Changes

We update this policy when the Service or the law changes, for example before we add new features such as ads, in-app purchases or new sign-in methods. Each version is published with a date. We will inform you in the app about significant changes; if a change requires your consent we will ask for it before you continue to use the app.

20. Contact

Mustafa Ali Erdoğan · Güneşli Mh., İstanbul 34212, Türkiye · syzitech@gmail.com