Worena Privacy Policy

Version: 2026-10-09Effective: 9 October 2026Previous version: 2026-10-06

This policy explains which personal data we process when you use the Worena mobile app and related services (the "Service"), why we process it and on which legal bases, who we share it with, how long we keep it and how you can exercise your rights.

What changed in this version: Worena now offers optional in-app purchases and a Premium subscription through Google Play and shows ads through Google AdMob. This version adds the purchase, coin and ad reward data we keep (section 3.7), how purchases, ads and ad consent work (section 9), the legal bases for them (section 5), Google Play and Google AdMob as recipients (section 10), the retention periods (section 12) and what this means for users in the United States (section 15).

1. In short

• We process the data needed to run the game, operate chat and keep your account safe. We never ask for your location, contacts, microphone, camera, date of birth or phone number.
• Chat messages are stored encrypted on our servers; private messages are kept for 12 months and game chats for 90 days after the game ends.
• Worena is free to play. It offers optional in-app purchases and a Premium subscription through Google Play, and shows ads through Google AdMob. Google Play handles payments; your card and payment details never reach us (section 9).
• Ads are never personalised: the app always asks Google for non-personalised ads, and it does not have access to your advertising ID (section 9.2). In the EU/EEA, the UK and Switzerland, Google stores or reads information on your device for ads, so the app asks for your consent in Google's consent window before any ad is loaded; you can change your choice at any time in the ad privacy options in Settings (section 9.3).
• We do not sell your data, we do not use it for targeted advertising, and we do not give advertisers your e-mail address, username, messages or age group (section 15).
• Our servers are in the European Union (Germany); the data controller is in Türkiye (section 11).
• The app is not open to anyone under 16; extra protections apply to users aged 16–17.
• You can download a copy of your data in the app and delete your account in the app or on the web. Deletion takes effect after 14 days; you can cancel during that time.
• If you are in the European Union, the European Economic Area or the United Kingdom, the GDPR or the UK GDPR also protects you: section 5 sets out our legal bases and section 14 your rights, including the right to complain to your data protection authority.

2. Data controller, contact and applicable laws

The data controller is Mustafa Ali Erdoğan, a natural person (address: Güneşli Mh., İstanbul 34212, Türkiye). You can send any privacy question or request to syzitech@gmail.com. Our website is worena.cloud, and the app connects to our servers at api.worena.cloud.

Which laws apply:

• Türkiye: because the data controller is established in Türkiye, the Turkish Personal Data Protection Law No. 6698 ("KVKK") applies to all our processing of personal data. This policy is also our privacy notice under KVKK article 10.
• EU/EEA and UK: because we offer the Service to people in the European Union and the European Economic Area ("EU/EEA") and in the United Kingdom ("UK"), the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") applies to the processing of personal data of users who are in the EU/EEA (GDPR article 3(2)), and the UK GDPR and the Data Protection Act 2018 apply to users who are in the UK. In this policy, "GDPR" also means the UK GDPR where you are in the UK. This policy contains the information required by GDPR articles 13 and 14. The national rules implementing the EU ePrivacy Directive (Directive 2002/58/EC) and, in the UK, the Privacy and Electronic Communications Regulations 2003 also apply when information is stored on or read from your device for ads (section 9.3).
• Other countries: if you live elsewhere, the data protection law of your country may also apply (sections 15 and 16).

The same data controller also provides Kelimetrik, a Turkish-language word game. Both apps run on the same servers, but their accounts are separate (section 3.1).

3. What data we process

We collect personal data electronically and partly by automated means: directly from you (sign-up, age group, profile, games, chat, settings, support, reports and appeals, and e-mails you send us), automatically (the app's communication with our servers, server logs and technical information provided by your device) and from third parties (Google, when you sign in with Google, when you buy something through Google Play and when Google AdMob confirms a rewarded ad, and other users, for example when they add you as a friend, play a game with you or report you).

3.1 Account and sign-in

• Sign in with Google: your Google account ID and e-mail address. We do not ask Google for your name. We store the profile photo address (link) that Google provides at sign-in together with your sign-in record and update it each time you sign in with Google; we only use it if you ask us to, that is, when you tap "Use my Google photo", to fetch the photo from Google and make it your profile photo (section 3.3). The address is deleted when Google sign-in is unlinked from your account or when your account is deleted.
• Guest use: you can practise against the bot without an account. We do not collect an e-mail address or sign-in account from guests; we only process device information, an automatic guest ID and practice games.
• Your e-mail address is stored encrypted on our servers; support staff only see a masked version.
• Separate from Kelimetrik: a Worena account is separate from any Kelimetrik account. If you use the same Google account in both apps, you have two separate accounts that are not linked. Worena players can only find, add, message and play against other Worena players.

3.2 Age group

Before creating an account we ask for your age group: "Under 16", "16–17" or "18 or older". We do not ask for your date of birth. If you state that you are under 16, no account is created and that answer is not stored on our servers. Your age group is never shown to other users and is never shared with third parties.

3.3 Profile

Username, display name (optional), bio (optional), avatar (a ready-made avatar or an optional profile photo) and profile theme. When you change your username, the previous one is kept for 180 days to investigate abuse.

Profile photo (optional): using a profile photo instead of a ready-made avatar is entirely up to you; if you do not add one, your ready-made avatar is shown.

• Source: a photo you choose from your device, or, if you tap "Use my Google photo", the profile photo of your Google account (in that case the photo is downloaded from Google's servers). Photos on your device are chosen with Android's system Photo Picker: the app does not ask for camera, gallery or storage permission and does not access your camera; only the photo you pick reaches us.
• Processing: the photo is processed on our servers: its actual file type is checked (only JPEG and PNG are accepted), it is cropped to a centred square and re-encoded as JPEG at 512, 256 and 128 pixels. All metadata, including location information (EXIF etc.), is removed in the process. The original file you upload is not kept; it is deleted immediately after processing, and uploads that are not completed are deleted within 24 hours at the latest. No face recognition, biometric processing or automated image analysis is applied to the photo, and it is not sent to any third-party image classification service.
• Moderator review: profile photos are reviewed by a moderator for compliance with the community rules in our Terms of Use, either before or after they are published. As a rule, a new photo is visible only to you until a moderator approves it; in the meantime other users see your ready-made avatar. A photo found inappropriate is rejected or removed, its files are deleted and you are notified in the app. Other users can also report your profile photo.
• Who can see it: once approved, your photo is visible to other users wherever your avatar appears (profile, game screen, chat, friends lists, league and leaderboard tables, search results) (section 7).
• Retention and deletion: the photo is kept for as long as it is your profile photo. When you change it, remove it and go back to a ready-made avatar, or when it is rejected or removed, its files are deleted; when your account is deleted, all your photo files and their records are deleted. Profile photos are stored on the same servers as your other account data; they are not shared with third parties, not sold and not used for advertising.

3.4 Gameplay

The games you play, your moves, words, scores, timings, results, team and placement information; your statistics, achievements, league and leaderboard positions, mission progress; matchmaking and "Rematch" records. If you submit a word appeal, the word and your explanation.

3.5 Social features

• Friends: adding a friend is one-way; the people you add are kept in your list. The list of people who added you is not shown to you or anyone else, and the person you add is not notified. When someone adds you, your account ID is stored in their record; this gives them no additional information about you or access to you. You can turn on "Don't let anyone add me as a friend" in Settings › Privacy.
• Blocking: the people you block, block from chat or mute. A blocked person is not told that they were blocked.
• Online status and read receipts: processed according to your settings; you can turn both off.

3.6 Chat

The content of game chats (general and private) and private messages, together with sender, time and read status. See section 6.

3.7 Purchases, coins and rewards

• Coins, jokers and other items: your coin and joker balances and every transaction in them (the amount, the source, such as a purchase, a mission or league reward, a rewarded ad or spending, and the resulting balance); the jokers, feature passes, permanent packs and cosmetic items you own; your badges and achievements.
• Purchases: for each purchase made through Google Play, the Google order ID (it starts with "GPA."), the product, the quantity, the price and currency where available, the time of purchase, the status (pending, completed, cancelled, refunded or revoked), whether it was a test or a real purchase, and a one-way hash (SHA-256) of the purchase token issued by Google Play. We do not store the purchase token itself.
• Premium subscription: the plan, the start and end of the current period, whether it renews automatically and its status (active, grace period, on hold, expired or cancelled).
• Rewarded ads: records of the rewarded ads you chose to watch: the time, where in the app the ad was offered, the reward and the transaction ID confirmed by the ad provider (section 9.4).
• Payment details: payments are processed by Google Play. We never receive your card number, bank details or billing address.

3.8 Notifications

Your device's push notification token, your in-app notifications and your notification preferences.

3.9 Support, reports and consents

Your support requests and correspondence; reports you make and reports made about you; enforcement records; the versions of the terms you accepted and the notices you saw, and the permissions you granted or withdrew (consent history); data export and account deletion requests.

3.10 Device, security and technical data

IP address; device model, operating system and app version; app installation ID; session records; server logs; security and fraud-prevention signals. IP addresses and device IDs are never written to our fraud-prevention tables in clear form; they are only kept briefly as keyed one-way hashes. The last part of the IP address is masked in server logs.

3.11 Usage analytics

To understand how the Service is used and to improve it, our servers record on which days your account was active, together with your platform (Android or iOS) and app version, and count how often some features are used (for example, how many word meanings are viewed) as daily totals that do not identify anyone. These records are created from requests the app already sends to our servers: no analytics SDK is used for this (the Google AdMob component described in section 9.2 is not used for our usage analytics), and nothing is stored on or read from your device for analytics. Message content, e-mail address, username, IP address, location and other users' identities are never added to them. You can turn this off at any time in Settings › Privacy › Usage analytics; from then on, your activity is no longer recorded for usage analytics.

4. Data we do not process

We do not ask for location (GPS), contacts, microphone, camera, date of birth, phone number or your real name. We do not access your gallery or the files on your device; for a profile photo, only the photo you pick reaches us. We do not store your in-app search queries. We do not collect your advertising ID (Android advertising ID): we have removed the permission to access it from the app, so Google's ads component in the app does not receive it either (section 9.2). We do not receive or store your card or other payment details; Google Play processes payments (section 9.1). We do not knowingly process special categories of personal data such as health, religion or political opinions; please do not include them in chats, your bio or support messages. We do not process your profile photo as a special category of personal data: no face recognition or other biometric processing is applied to photos.

5. Why we use your data and our legal bases

The table shows each purpose and the legal basis we rely on under the GDPR (for users in the EU/EEA and the UK) and under KVKK. The letters refer to GDPR article 6(1): (a) consent, (b) performance of the contract with you (the Terms of Use) or steps before entering into it, (c) a legal obligation and (f) our legitimate interests or those of others.

Legitimate interests: where we rely on legitimate interests, the interests are those named in the table: a secure, fair and safe Service, the protection of young users, the improvement of the Service, funding the free Service with ads and preventing purchase and ad fraud. We have weighed them against your interests and rights and limited the data we use (for example, IP addresses and device IDs are kept only briefly as keyed one-way hashes for fraud prevention). You can object at any time (section 14) and ask us for more information about this assessment.

Consent: where we rely on consent, you can withdraw it at any time in Settings (for ads, in the ad privacy options), with effect for the future; this does not affect processing carried out before you withdrew it.

Do you have to give us your data? To create an account you need to state your age group and accept the Terms of Use and this policy, and a registered account requires Sign in with Google; without this we cannot provide the Service, but you can still practise against the bot as a guest. Everything else, such as a display name, bio, profile photo, chat messages, promotional notifications and usage analytics, is optional. Making purchases is optional; if you make one, the purchase data in section 3.7 is needed to complete it, give you what you bought and keep the records the law requires. In the EU/EEA, the UK and Switzerland, consent for ads is optional: if you refuse, you may still see limited ads, and you can play exactly as before. Watching rewarded ads is optional.

Automated decisions: we do not make decisions based solely on automated processing that have legal or similarly significant effects on you (GDPR article 22). Automatic chat filters only mask or block a message; fraud and cheating signals alone never lead to an account being closed, because a person reviews them first (Terms of Use, section 5).

We do not sell your data, and we do not use it to target ads: all ads in the app are non-personalised, and we never use your account data, such as your games, messages or age group, for ads. Ads are delivered by Google AdMob as described in section 9.

6. Chat messages

• Who can message you: for adult accounts the default chat scope is "Everyone"; in Settings › Chats and invites you can narrow it to "My friends", "Friends and opponents" or "No one", or turn off all chats. For users aged 16–17 the "Everyone" option is not available, the default is "My friends" and private messages are only possible with mutual friends.
• Encryption: message content is stored on our servers with application-level encryption. Messages are not end-to-end encrypted; they pass through our servers and automatic filters for safety and moderation.
• Automatic filters: links cannot be shared in chat. Contact details such as phone numbers, e-mail addresses or social media handles are masked or the message is rejected (always rejected for new accounts and for users aged 16–17). Identical messages repeated in a short time are blocked.
• Retention: private messages are kept for 12 months from sending and game chats for 90 days after the game ends, then deleted. A message you delete is removed for everyone; its content is kept for 30 more days only for moderation.
• Reporting: when you report a message, the reported message and a few messages before and after it are stored as a separate evidence record so it can be reviewed. Only authorised moderators can access it and every access is logged.
• Blocking: when you fully block someone, your shared private message history is hidden for both of you; the messages are not deleted and expire under the normal retention period.
• No message text in notifications: message notifications only say something like "… sent you a message".

7. What other users can see

Only other Worena players can see the information below; Kelimetrik players cannot see your Worena profile.

8. Notifications

We use Google Firebase Cloud Messaging to deliver notifications to your device. For this, your device's notification token and the notification's title and text are passed to Google. You can turn off game, social and reward notifications by type in Settings › Notifications, or all notifications in your device settings. Promotional notifications are only sent if you explicitly opt in, are off by default and are never sent to users aged 16–17. We do not send commercial messages by SMS or e-mail.

9. Purchases, subscriptions and ads

Worena is free to play. To fund it, the app offers optional in-app purchases and a Premium subscription and shows ads. The commercial terms, such as prices, renewal, cancellation, refunds and your right of withdrawal, are in section 9 of the Terms of Use; this section explains what happens to your data.

9.1 In-app purchases and Premium

• Google Play Billing: coin packs, joker packs and the Premium subscription are sold through Google Play Billing. Before you buy, the app shows a confirmation page; you then pay in the Google Play window. Google Play processes the payment under its own terms and privacy policy, and your card number, bank details and billing address never reach us.
• Verifying the purchase: after you pay, the app sends our server the purchase token issued by Google Play. Our server checks it with Google through the Google Play Developer API and only then adds what you bought to your account. We keep the records listed in section 3.7, with the purchase token only as a one-way hash.
• Linking the purchase to your account: when you start a purchase, the app gives Google Play a one-way hash of your Worena account number, never your e-mail address or username. This lets Google and us tell which account a purchase or subscription belongs to, for example after you reinstall the app, and helps Google detect fraud.
• Updates from Google Play: Google Play tells our server when a subscription renews, enters a grace period, is put on hold, is cancelled or expires, and when a purchase is refunded, cancelled or charged back. We then update your account; for example, we remove the coins or items provided by a refunded purchase.
• Spending coins: when you use coins for jokers, feature passes, permanent packs or cosmetic items, the transaction is recorded in your coin history.

9.2 Ads (Google AdMob)

We show ads through Google AdMob, the mobile advertising service of Google (Google Ireland Limited for users in the EEA and Switzerland, Google LLC for other users). We have not added any other ad network to the app (no mediation).

• Rewarded ads are shown only when you choose to watch one, in return for coins (section 9.4).
• Interstitial ads (full-screen ads) are shown only when you leave the end-of-game screen, with limits on how often they appear. Premium members do not see them.
• No personalisation: the app always asks Google for non-personalised ads, for every user and whatever you choose in the consent window (section 9.3). Non-personalised ads are chosen from context, such as the app and your approximate location (for example, your city), not from a profile of you. We have removed the permission to access the Android advertising ID from the app, and we do not build interest profiles. Ads are limited to content rated suitable for teens.
• What AdMob collects: even for non-personalised ads, Google's ads component in the app collects from your device your IP address (which may be used to estimate your approximate location), device and app information (such as the device model, operating system and app version), the app set ID, ad interactions (such as which ads were shown and tapped) and diagnostic data, for ad delivery, frequency capping, measurement and fraud prevention.
• Google's own use: Google decides how it uses this data for its advertising services and processes it under its own privacy policy: How Google uses information from sites or apps that use its services.
• What we do not give advertisers: apart from the one-way hash used to verify rewarded ads (section 9.4), we do not send Google or advertisers your e-mail address, username, messages, games, age group or other account data.

9.3 Consent and your ad choices

• EU/EEA, UK and Switzerland: as Google's EU user consent policy requires, the app shows Google's consent window (Google's User Messaging Platform, which uses the IAB Europe Transparency and Consent Framework) before any ad is loaded. It asks whether Google and its ad partners may store or read information on your device and use limited data for ads, for example to cap how often an ad is shown, to measure ads and to prevent fraud. The window is Google's standard form and may also list purposes such as personalised advertising, but the app always asks for non-personalised ads, so your ads are not personalised whatever you choose. You can accept, refuse, or choose by purpose and by partner. If you refuse, Google may still show limited ads that do not use information stored on your device. Where consent is required, no ad is requested until you have made a choice. Your choice does not affect the game.
• Changing your mind: you can change or withdraw your consent at any time in the ad privacy options in Settings (shown where consent is required), with effect for the future.
• Other countries: outside the EU/EEA, the UK and Switzerland, the consent window is not shown, and ads are non-personalised there too.
• Advertising ID: the app cannot access your Android advertising ID (section 9.2). If you want to reset or delete it for other apps, you can do so in your device settings (on most devices under Settings › Privacy › Ads, or Settings › Google › Ads).
• Children: Worena and its ads are not directed at children (section 17).

9.4 Rewarded ads and reward verification

Watching rewarded ads is optional, and the number per day is limited. So that a reward is only given for an ad that was actually watched, the app passes Google a one-way hash (SHA-256) of your account number and a random session ID when it loads the ad. After the ad, Google sends our server a signed confirmation (server-side verification) containing the ad transaction ID, the hash and the session ID, and only then are the coins added to your account. We keep these reward records for 12 months to prevent abuse (section 12).

If we add new ad networks or payment methods, we will update this policy beforehand.

10. Who we share data with

We share personal data only with the service providers below and only to the extent needed for the purposes in section 5. Our processors may use your data only on our instructions.

Profile photos are processed and stored on our own infrastructure (the hosting service above); they are not sent to any third-party service for image analysis or classification.

Apart from Google AdMob, the app contains no third-party analytics, crash-reporting or advertising component; usage analytics are processed on our own infrastructure. If we add such a service, we will update this policy beforehand.

Ad partners: Google may make ad space in the app available to other advertisers and ad technology providers. In the EU/EEA, the UK and Switzerland they are listed in the consent window, and they only receive information that requires your consent, such as information stored on or read from your device, if you give it [DOĞRULA]. Their own privacy policies apply.

Links to other websites: some screens may contain links to other websites, for example an online dictionary to look up a word or your Google Account settings. Such links open in your browser; we do not send your account data to these websites, and their own privacy policies apply.

Google Play: you download Worena from Google Play and pay for purchases through it, and Google processes the data it needs for this under its own privacy policy. Through Google Play Console we receive download and rating statistics and, from users who allowed this in their Android settings, crash reports that do not identify you by name or account.

Authorities and legal claims: we disclose personal data to courts, law enforcement or other public authorities only when the law requires it, when it is necessary to establish, exercise or defend legal claims, or to protect the safety of minors as described in our Terms of Use.

11. International transfers

Where your data is: our servers are in the European Union (Düsseldorf, Germany); the data processed in the Service, including profile photos, is stored on these servers. The data controller is in Türkiye and accesses the data from there to operate, support and moderate the Service. Google services use data centres in several countries, including the United States. Your personal data may therefore be processed outside your country. The recipients are listed in section 10.

Users in the EU/EEA and the UK: there is no adequacy decision of the European Commission or of the UK for Türkiye. When our hosting provider in the EU makes personal data of users in the EU/EEA or the UK available to us in Türkiye, the transfer is based on the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914, module 4, processor to controller) and, for UK data, the International Data Transfer Addendum issued by the UK Information Commissioner. [DOĞRULA] Transfers to Google LLC in the United States are based on the EU–US Data Privacy Framework and its UK Extension, under which Google LLC is certified, and on the standard contractual clauses in Google's data processing terms. [DOĞRULA] Google Play and Google AdMob process data as separate controllers; Google is responsible for its own transfers of that data and relies on the same frameworks [DOĞRULA]. You can ask us for a copy of these safeguards at syzitech@gmail.com (commercial details may be removed).

KVKK: the transfer rules of KVKK article 9 also apply to all transfers from Türkiye. As the Turkish Personal Data Protection Board has not announced an adequacy decision, regular transfers of personal data abroad are based on the standard contracts announced by the Board under KVKK article 9, and these contracts are notified to the Personal Data Protection Authority within five business days of signature. For occasional (incidental) transfers, one of the exceptions in KVKK article 9(6) may apply.

Other countries: if you live elsewhere, your data is transferred to and stored in the EU (Germany), Türkiye and the United States, where it may be accessible to courts and authorities under the laws of those countries. We protect it as described in this policy wherever it is processed.

12. Retention periods

13. Deleting your account

You can delete your account in the app via Profile › Settings › Delete account. If you cannot access the app, follow the steps on the account deletion page.

• There is a 14-day waiting period after your request; during that time you can open the app and cancel. After that, deletion is permanent.
• When you request deletion your active games end as abandoned, pending invitations and matchmaking are cancelled and your profile is hidden from other users.
• Your coins, jokers, packs, feature passes and cosmetic items are lost and are not refunded, except where mandatory law requires. Deleting your account does not cancel a Premium subscription; cancel it separately in Google Play › Payments & subscriptions › Subscriptions, or Google Play will keep charging you.
• Deleted: your profile, username, avatar, profile photo and all photo files, e-mail address and sign-in details (including the link to your Google account and the Google profile photo address), friend and block records, the content of the messages you wrote in game chats and private messages, your sessions, device and notification records, statistics, notifications and usage analytics records. You can also review and remove the app's access in your Google Account settings.
• Kept, separated from your identity: the games and moves you played (as "Deleted user", for your opponents' history); league and leaderboard rankings of closed weeks; coin and joker transactions, purchase and subscription records (10 years); rewarded ad reward records (12 months); report and enforcement records (for the periods above); re-registration prevention hashes if the account was permanently banned (2 years); consent records and the record of your deletion request (3 years, as proof). Messages other people wrote to you remain in their accounts.

14. Your rights and how to exercise them

You can use many of your rights directly in the app:

• Access, copy and portability: Settings › Download my data. Your data is packaged in machine-readable (JSON) form with a readable explanation; if you have a profile photo, its current version (512 pixels) is included. The package can be downloaded at most 3 times within 7 days. You can request this once every 7 days.
• Correction: you can change your profile (including changing or removing your profile photo), your username (once every 30 days) and your preferences in the app. Contact us to correct your age group.
• Deletion: see section 13.
• Objection, consent and preferences: usage analytics, promotional notifications, consent for ads in the EU/EEA, the UK and Switzerland (the ad privacy options), online status, read receipts, chat scope, who can add you and notifications can be changed in Settings. You can see your consent history in Settings › Privacy.

14.1 Your rights under the GDPR (EU/EEA and UK)

• Access (art. 15): to know whether we process your data and to receive a copy of it together with information about the processing.
• Rectification (art. 16): to have inaccurate data corrected and incomplete data completed.
• Erasure (art. 17): to have your data deleted, for example when it is no longer needed or you withdraw your consent, unless a legal exception applies (the records we keep are listed in section 13).
• Restriction (art. 18): to have the processing of your data limited, for example while we check a correction you asked for or an objection you made.
• Data portability (art. 20): to receive the data you provided to us in a structured, commonly used and machine-readable format (Download my data) and to have it sent to another controller where technically feasible.
• Objection (art. 21): to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests; we then stop unless we have compelling legitimate grounds or need the data for legal claims. You can object to promotional notifications at any time without giving a reason.
• Withdrawing consent (art. 7(3)): at any time, with effect for the future.
• Automated decisions (art. 22): not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you; we do not make such decisions (section 5).

14.2 Your rights under KVKK

Under KVKK article 11 you have the right to learn whether your data is processed, request information, learn the purpose and whether it is used accordingly, know the recipients, request correction and deletion and notification of these to recipients, object to a result against you arising solely from automated processing, and claim compensation for damage.

14.3 How to make a request

Send your request to syzitech@gmail.com (preferably from the e-mail address registered to your account) or by post to Güneşli Mh., İstanbul 34212, Türkiye. To protect your account, we may ask you to confirm the request in the app or from your registered e-mail address before we act on it. We answer free of charge and without undue delay: within 30 days under KVKK and within one month under the GDPR. Where the GDPR applies and a request is complex, we may extend this by two further months and will tell you why within the first month. As the law allows, we may refuse manifestly unfounded or excessive requests or charge a reasonable fee for them.

14.4 Complaints to a data protection authority

• EU/EEA: you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement (GDPR article 77). Because we have no establishment in the EU, there is no lead supervisory authority for us and you can turn to the authority in your country. The authorities are listed on the website of the European Data Protection Board: edpb.europa.eu.
• UK: the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.
• Türkiye: the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), after you have first applied to us (KVKK article 14).
• Elsewhere: your local data protection authority (sections 15 and 16).

We would appreciate the chance to deal with your concern first, so please contact us; this does not limit your right to complain.

15. Users in the United States

We do not sell your personal information, we do not share it for cross-context behavioural advertising and we do not use it for targeted advertising, as these terms are used in the California Consumer Privacy Act (as amended by the California Privacy Rights Act) and similar US state laws: Worena shows ads through Google AdMob (section 9.2), but the app always asks for non-personalised ads and has no access to your advertising ID [DOĞRULA]. To deliver, cap, measure and secure these ads, Google's ads component in the app collects your IP address, device and app information, the app set ID and information about your interactions with ads, and Google processes it under its own terms. If we ever start showing personalised ads, we will update this policy beforehand and tell you how to opt out. The app cannot receive browser-based opt-out preference signals such as Global Privacy Control; if you have questions, e-mail us. We use sensitive personal information, such as the content of your messages, only to provide the Service and keep it safe, so a right to limit its use does not apply.

The categories of personal information we collect and their sources are described in section 3 (identifiers such as your e-mail address, account and device IDs, IP address and, through Google AdMob, the app set ID; commercial information such as purchase and subscription records; profile information and photo; gameplay, app activity and ad interactions; approximate location estimated by Google from your IP address for ads; messages; age group), the purposes in section 5, the recipients in section 10 and the retention periods in section 12. We do not knowingly collect personal information from children under 13 (section 17).

Depending on the state you live in, you may have the right to know and access the personal information we hold about you, to receive a portable copy, to have it corrected or deleted, to opt out of "sharing", targeted advertising or "sales" (we do none of these, as described above), and not to be discriminated against for using these rights. You can use the in-app tools in section 14 or e-mail us; an authorised agent can also make a request for you, in which case we may ask for proof of the authorisation and verify your identity. If we decline your request, you can appeal by replying to our answer; if we deny your appeal, you can contact the attorney general of your state.

16. Users in Canada, Australia and other countries

• Canada: we handle your personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and its fair information principles. You can access and correct your information as described in section 14. Your information is stored and processed outside Canada (section 11) and may be accessible to courts and authorities there. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
• Australia: we handle your personal information consistently with the Australian Privacy Principles in the Privacy Act 1988. Your information is held overseas, in the EU (Germany), Türkiye and the United States (sections 10 and 11). You can ask to access or correct it (section 14); if you are not satisfied with our answer to a complaint, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).
• Other countries: if you live elsewhere, for example in New Zealand, India, Singapore, the Philippines, Nigeria or South Africa, the data protection law of your country may give you additional or different rights. You can exercise them through the same channels to the extent that law applies to our processing, and you may also be able to complain to the data protection authority where you live.

17. Children and users aged 16–17

The Service is not open to anyone under 16. No account is created for a person who states they are under 16, and that statement is not stored. If we learn that someone under 16 has created an account, we will delete it; parents who become aware of this can write to syzitech@gmail.com.

The same age limit applies in every country. Because nobody under 16 can create an account, we never rely on the consent of a child below the age of digital consent that applies in an EU/EEA member state (between 13 and 16 under GDPR article 8) or in the UK (13), and the Service is not directed at children under 13 (US Children's Online Privacy Protection Act). Some laws treat everyone under 18 as a child, for example the UK Age Appropriate Design Code; this is why the following high-privacy defaults and protections apply to users aged 16–17:

• The "Everyone" chat scope is not available; the default is "My friends" and private messages are only possible with mutual friends.
• Game chat in random matches is off by default; invitations come only from friends by default; online status is hidden by default.
• Sharing phone numbers, e-mail addresses or social media handles in chat is blocked.
• No promotional notifications or e-mails are sent.
• Reports involving young users are reviewed with priority.

Ads and purchases: Worena and its ads are not directed at children, and nobody under 16 can create an account. Ads are never personalised for anyone, including users aged 16–17, and are limited to content rated suitable for teens. Users under 18 must have their parent's or guardian's permission before buying anything (Terms of Use, section 2), and Google Play's family and parental control tools can be used to approve purchases.

18. Security

• All traffic between the app and our servers is encrypted with TLS.
• E-mail addresses and message content are additionally encrypted at application level; e-mail addresses are looked up through keyed hashes.
• We do not use passwords; only hashes of session tokens are stored. Sensitive actions (data download, account deletion) require re-authentication.
• Access to the admin panel is limited by role and permission; access to sensitive data requires a justification and is logged.
• Data such as e-mail addresses, message content, tokens and purchase receipts are automatically redacted from logs; IP addresses are masked. Purchase tokens are stored only as one-way hashes, and we never receive payment card details.
• In the event of a personal data breach we notify the competent authorities and affected users as required by KVKK, the GDPR and any other law that applies to us; under the GDPR, the competent supervisory authority is notified within 72 hours where required.

No system is perfectly secure; if you notice anything suspicious on your account, sign out other sessions in Settings › Sessions and devices and contact us.

19. Changes

We update this policy when the Service or the law changes, for example before we add new ad networks, payment methods or sign-in methods. Each version is published with a date. We will inform you in the app about significant changes; if a change requires your consent we will ask for it before you continue to use the app.

20. Contact

Mustafa Ali Erdoğan · Güneşli Mh., İstanbul 34212, Türkiye · syzitech@gmail.com