Privacy Notice
Version: 1.0 — Effective from: 11 November 2026
This notice describes the processing the service performs (game catalogue and membership, no prices, no email). It is information given to you under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where it applies, Articles 13 and 14 of the GDPR. You are not asked to accept or consent to it.
1. Who is responsible
Data controller: Mehmed Sinan Kömek, a private individual based in Türkiye. Contact for privacy and data rights requests: admin@oyunfiyattakip.com
The service is the same at oyunfiyattakip.com (Turkish by default) and gamepricepilot.com (English by default). One controller, one database, one notice.
2. What the service does in this release
A game catalogue with membership through Google sign-in only; signing up with an email address and a password is not open. It shows no prices, sends no email, sends no price alerts, has no forum, shows no advertising, uses no analytics or tracking tools, has no affiliate links and takes no payments. Processing that belongs to those features does not take place.
3. What we process, why, and on which legal basis
How it is collected. Electronically: from the forms you fill in (registration, account settings, lists), from Google when you sign in with it (your Google account identifier and verified email address), and automatically when your browser requests a page (the IP address of the request, the session cookie).
3.1 Every visitor
| Data | Why | KVKK Art. 5(2) | GDPR Art. 6(1) |
|---|---|---|---|
| IP address, while your request is handled | Delivering the page; protecting the service against abuse | (f) legitimate interest | (f) |
| A SHA-256 hash of your IP address, in rate-limit counters | Limiting repeated sign-in, registration and similar requests from one place | (f) legitimate interest | (f) |
The hash has no secret key, so it can be matched back to an address; we treat it as personal data. Each counter is deleted as soon as its time window, and any block it triggered, has passed. The application does not write visitors' IP addresses to its own logs.
3.2 Account
| Data | Why | KVKK Art. 5(2) | GDPR Art. 6(1) |
|---|---|---|---|
| Email address (as verified by Google), display name, account status, role | Creating and running your account | (c) contract | (b) |
| Google account identifier (a number Google assigns; not your password) | Signing you in with Google | (c) contract | (b) |
| Session records: token hash, start, expiry, revocation, browser and operating system name | Keeping you signed in; letting you see and end your sessions | (c) contract; (f) for security | (b); (f) |
| Sign-in and account events: type, browser and operating system name, time | Account security | (f) legitimate interest | (f) |
| Record of the terms you accepted and the privacy notice shown to you: document, version, SHA-256 hash of the text, language, declared minimum age, time | Proving what you agreed to and what you were told | (c) contract; (e) establishing, exercising or protecting a right | (b); (f) |
| Deletion request time | Carrying out the deletion you asked for | (c) contract | (b) |
No IP address is stored with a session or an account event. We do not ask for your date of birth, your real name or your phone number.
Signing up with Google. You sign in on Google's page. Google then tells us three things: your Google account identifier, your email address and that the address is verified. We ask for nothing else — not your name, photo, contacts or anything in your Google account. Until you accept our terms (at most 15 minutes), the identifier and address are held only in an encrypted cookie in your browser and no account exists; if you do not finish, nothing is kept. Email-and-password sign-up is not open in this release, so no password is stored.
3.3 What you do with your account
| Data | Why | KVKK Art. 5(2) | GDPR Art. 6(1) |
|---|---|---|---|
| Library, wishlist, lists and their items; games you follow, own or ignore | The features themselves | (c) contract | (b) |
| Playtime records and settings; game page layout; profile visibility | Showing your library and pages the way you set them | (c) contract | (b) |
You can export your data and delete your account yourself in your account settings.
Reviews, recommendations, friends, library import from a file and personal access tokens are not offered in this release, so none of their data is processed.
3.4 Nothing is based on consent
None of the processing above relies on explicit consent (KVKK Art. 5(1)) or on GDPR Art. 6(1)(a). That is why there is no consent box anywhere on the site. We process no special categories of personal data.
4. Who receives it
- Netlen İnternet Hizmetleri Ltd. Şti. — hosting. The server is rented from Netlen and located in İstanbul, Türkiye (Datacasa data centre). Netlen acts as our data processor under a data processing agreement (
DPA-FGPSVJUL, in force from 9 November 2026), which fixes İstanbul as the service location. - Netlen's DDoS protection. When an attack is detected, network traffic to the site — which carries visitors' IP addresses — may be routed through Netlen's protection infrastructure outside Türkiye (Netlen names locations in Amsterdam and the provider Voxility) before it reaches our server. The pages themselves travel encrypted (HTTPS) and are not stored there by us. Netlen's view is that this network-level filtering is not data processing. Whether it is a transfer abroad under KVKK Art. 9 has not been settled; until it is, we tell you that it can happen.
- Tres Teknoloji A.Ş. — off-site storage of database backups in İstanbul, Türkiye. Each backup is encrypted on our server before it is sent, and only we hold the key, so Tres stores data it cannot read. Our arrangement with Tres is its general service agreement; there is no separate data processing agreement.
- Google LLC (United States), when you choose to sign in with Google. Your browser goes to Google, and you sign in there under Google's own terms and privacy policy; Google learns that you are signing in to this site. Google sends our server your account identifier, email address and whether it is verified. Our server sends Google only the one-time code from that sign-in and this site's own client credentials — no personal data about you.
- YouTube (Google), only if you press play on a trailer. A game page can show a trailer. Nothing is loaded from YouTube until you press play; then the video is loaded from
youtube-nocookie.com, and Google receives your IP address and browser details and may store data on your device, under Google's own privacy terms. Google is in the United States. If you do not press play, nothing is sent. - Stores you choose to visit. A store link opens the store's own website, which then sees your visit as it sees any visitor's. The link sends no referrer, and nothing about you is passed to the store by us.
- Public authorities, only when the law requires it.
In this release, we do not sell personal data, share it for advertising, produce commercial user-interest reports, or collect behavioural analytics. Future versions may offer advertising, affiliate links or statistics derived from suitably anonymised, aggregated game-interest data. Those are not active now. Before adding them, we will assess the relevant lawful basis, additional collection, recipient disclosures, device-storage consent, international transfers and user rights, implement required controls, and publish an updated notice. A policy update by itself does not authorise new processing. We will not sell identifiable account records or individual behavioural profiles.
Where the game information comes from. Game descriptions and cover art come from IGDB (Twitch Interactive, Inc., United States). Our server fetches them; your browser never contacts IGDB and no personal data about you is sent to IGDB. Cover images are cached on our server for at most 24 hours and served from our own address. IGDB is a source, not a recipient.
5. Transfers abroad
We store our application database and off-site backups in Türkiye. Some interactions nevertheless involve services or infrastructure abroad, as described in section 4: the DDoS routing, which only occurs during an attack and which we do not control; signing in with Google, where your browser connects to Google in the United States and Google processes your account data there under its own policy, while the identifier and address it returns are stored by us in Türkiye; and a YouTube trailer, which only loads when you press play and then connects your browser to Google directly. Whether any of these is a transfer abroad by us under KVKK Art. 9 has not been settled; we tell you about them so that you can decide. If we ever start a transfer abroad ourselves, this notice is updated first.
6. How long we keep it
| Data | Kept for |
|---|---|
| Rate-limit counters (hashed IP) | until their time window and any block end |
| A Google sign-up you have not finished (encrypted cookie in your browser) | at most 15 minutes |
| Session records | 90 days after the session expires or is ended |
| Sign-in and account events | 365 days |
| Your account and everything listed in 3.2 and 3.3 | until you delete the account; then see section 7 |
| Database backups | at most 14 days |
| Server and application logs | at most 14 days |
A session expires 30 days after you sign in. The cookie that carries it ends sooner — when you close the browser — unless you ticked "remember me" (see the cookie notice). Because the record is kept 90 days after the session expires, an unused session can exist as a record for about 120 days in total. Each period in the first rows is enforced by an automatic daily clean-up job.
7. Deleting your account
- When you ask: the account is closed at once and all sessions end.
- For 30 days: signing in again cancels the deletion.
- After 30 days: the next daily clean-up removes the account and everything linked to it — identity, the link to your Google account, sessions, lists, library, follows, playtime, settings, and the record of the terms you accepted. Your Google account itself is not affected; it is Google's.
What remains without you:
- Sign-in and account events stay, without the link to you, until their 365-day period ends.
- Records of administrative actions taken about your account keep the account's internal identifier for their own retention period (12 months to 5 years by type), so that moderation stays accountable.
Backups taken before the deletion still contain your data until they expire (at most 14 days). They are used only to recover the whole service after a failure.
A specific record can be kept longer only under a documented legal hold for a concrete legal reason, limited to the records it names and to at most 12 months unless renewed.
8. Your rights
Under KVKK Article 11 you may ask whether your data is processed and for information about it, learn the purpose and whether it is used for that purpose, know the recipients in Türkiye and abroad, ask for incomplete or inaccurate data to be corrected, ask for deletion or destruction and for those changes to be notified to recipients, object to a result against you produced solely by automated analysis, and claim compensation for unlawful processing. Write to the contact address; we answer free of charge within 30 days. If your application is refused, the answer is insufficient or we do not answer in time, you may complain to the Personal Data Protection Board within 30 days of our answer, and in any case within 60 days of your application (KVKK Art. 14).
Where the GDPR applies to you, you have the rights of access, rectification, erasure, restriction, portability and objection, and you may complain to the supervisory authority where you live. We answer within one month.
9. Age
Accounts are for people aged 18 or over. If we learn that an account belongs to someone younger, we close it and delete its data.
10. Automated decisions
We make no decisions about you by automated means that have legal or similarly significant effects.
11. Security
No password is stored (accounts use Google sign-in), session tokens are stored only as hashes, the Google sign-in is protected by one-time state, PKCE and nonce values and a signature check on what Google returns, connections are encrypted, off-site backups are encrypted, and access to the server is limited to key-based administrator access.
12. Changes
A new version of this notice is published on the site, with its version and effective date, before the processing it describes changes.