Privacy Notice

Who is responsible

The controller of the data described here is the operator named at the foot of this page, and the address there is where every request in this notice goes. The operator is one person: there is no data protection officer, there is no representative in the European Union or the United Kingdom, and the game sits inside the exemption from the Turkish controllers' registry (VERBİS) for controllers of that size.

What we store

An account consists of a generated username, a hashed password, a hashed single-use recovery code, the position you prefer to play, and a record of which version of the terms and of this notice you accepted and when. We do not ask for or store an email address, a telephone number, a postal address or any other contact detail.

If you make a footballer, we store what you chose for it: its name, a country picked from a list, the physical details on the form — height, weight, position, foot, shirt number and colours — and the two things that decide how the figure on the pitch is drawn, a body type and a skin tone. Those last two describe the footballer you drew, and nothing reads them as a fact about you. The name is the one other players read in a lobby, on the pitch and on a scoreboard. Unless you have said you are 13 or over, the game gives the footballer its name — one the server generated, never yours; if you have, you type it, and then nothing checks whether it is your real name, so pick one you are happy for strangers to see. The form used to ask for a town as well. It no longer does, and the column that held it has been dropped.

The trials keep the score of each drill from your best attempt, because your attributes are computed from them and can be recomputed if the mapping is ever retuned.

For each match you finish we store the result — including the lobby's name and both teams' names — and your line in it: goals, assists, shots, passes, tackles, saves, distance covered, your rating and the experience and gold you earned. We also keep lifetime totals and your character's attributes and level.

Everything the game gives you for playing is stored so that it is still there tomorrow: your level, skill points, and gold with a ledger of what earned and spent it; the equipment you bought and what you are wearing; your training sessions and what they improved; and, if you started a Career, its save — the club, the fixtures, the tables and the seasons behind you. If you played as a guest first, a note that your guest experience was transferred to the account, once.

Your browser's IP address is used for a few minutes at a time to slow down repeated sign-in, sign-up and lobby-creation attempts: it is kept, keyed to the attempt, in the server's memory or in Redis for at most ten minutes and then discarded. It is not written to our access log, which records only the path, status, size and duration of a request, and it is not linked to your account.

If you switch notifications on, we store what your browser gives us in order to send them: the address that your browser's own push service assigned to that device, the two keys that encrypt a message so only that device can read it, which of the two languages to write in, how many minutes your clock is ahead of UTC, and the two times at which the subscription was stored and last refreshed. The address is an identifier for a browser on a device, so switching notifications on is a thing we hold about you, and switching them off deletes it. The offset is the coarsest location there is — it says what hour it is where you are and nothing whatever about where that is — and it exists so that nothing arrives at three in the morning.

Guest play

You can play without registering, at any age. A guest account is a real account row flagged as a guest, with a generated username and no password you ever see.

A guest has no footballer profile and types nothing anybody else reads: the server names their lobby for them, refuses to let them rename a team, and shows them to other players as "Guest". That is what makes guest play safe to open to a child, and it is why the section on children below can say what it says.

Experience earned as a guest is held in a server-side cache (Redis) for 24 hours so that it can be claimed if you register. Guest accounts that have not been used for 30 days — no finished match and no change to the account in that time — are deleted automatically, along with everything attached to them.

Why we store it

Everything we hold comes from you — typed into a form or produced by playing — and from your browser, which is where the IP address comes from; nothing is bought, scraped or received from anybody else. We keep it to let you sign back in, to run matches and show scoreboards, to keep your progression between sessions, and to stop abuse such as automated sign-ups.

The legal ground for each of those

Article 10 of the Turkish Personal Data Protection Law (KVKK) asks a controller to name the ground it processes on, not only what it processes and why. Almost none of this rests on your consent, and that is deliberate: consent can be withdrawn at any moment, and processing that can be switched off on request is a poor foundation for the account you asked us to keep. Where the law already permits something, asking for consent as well would make the consent meaningless. The single exception is notifications, which stay off until you turn them on and are covered further down.

Your account — the generated username, the password hash and the recovery code hash — is processed under KVKK Article 5(2)(c), directly related to the conclusion and performance of a contract, and GDPR Article 6(1)(b). The contract is this one: you asked for an account, and these three things are what an account is.

For a child, who cannot make a contract, that ground does not hold, and we do not pretend otherwise: their account and their matches are processed under KVKK Article 5(2)(f) and GDPR Article 6(1)(f) instead, our legitimate interest in running the game they asked to play. We do not ask your age, so we do not know which of the two applies to you; both cover the same processing and give you the same rights, and the balancing in the section on children below is written as if you were a child.

Your matches — results, your line in each of them, lifetime totals, and your character's attributes and level — sit on the same ground, as does the footballer you made. Keeping them between sessions is not a side effect of the service; it is the service.

Your IP address, used for a few minutes to rate-limit sign-ins and sign-ups, is processed under KVKK Article 5(2)(f), our legitimate interest in keeping the game standing against automated sign-ups and abuse, and GDPR Article 6(1)(f). Because that ground is a balance rather than a permission, you may object to it; write to the address below.

The jwt and preferred_language cookies are strictly necessary to deliver the game you asked for, so they are set without consent — and, equally, there is nothing about them to opt out of. Everything a consent banner normally guards is absent here except notifications, which the next paragraph covers and which stay off until you turn them on.

Notifications are the one thing here that does rest on your consent, and they rest on it because they are the one thing you can do without: KVKK Article 5(1) and GDPR Article 6(1)(a). You give that consent by switching them on and withdraw it by switching them off in the same place, which deletes the subscription rather than merely silencing it. What you are agreeing to is bounded: at most four times in any seven days — and if you have switched them on in more than one browser, each of those hears the same four — never less than twenty hours apart, never between ten at night and nine in the morning by the clock your browser last reported, and never about anything but your own game — a Career fixture you have not played, a run of days about to end, gold the weekly table has paid you, or a lobby with somebody waiting in it.

Apart from notifications, nothing in this notice rests on your consent — not even the transfer abroad described below, which stands on the safeguard the law provides for it. The one consent there is to withdraw is therefore the notification one, and the switch that gave it takes it back; beside it are the right to object, above, and the right to delete your account, which ends all of it at once.

Children

Nothing here has a minimum age — not guest play, and not an account. Rather than put up a bar that a ten year old would step over without pausing, we assume some of the people playing are children and build for that.

Nothing is sold here and nothing is advertised. There is no analytics, no profiling, no tracking of any kind, and no way for one player to send another a message. A guest is asked for no email address, no name, no telephone number and no location, and cannot type anything another player reads: their lobby is named for them by the server, renaming a team is refused, and on the pitch they are "Guest". A child playing as a guest therefore has no way to tell anybody who they are, which matters more than any age box, because the guardrail that screens public text can refuse an email address and a phone number but cannot refuse a true sentence.

The only identifiers guest play involves are the sign-in cookie, the language preference and the IP address. Each is used solely to support the internal operations of the game: the cookie signs you in, the language preference is a setting you chose, and the IP address holds off automated sign-up floods for a few minutes at a time. None of the three is used to build a profile, to recognise anybody across other websites, or for any other purpose, and none is disclosed to anyone. Under the United States Children's Online Privacy Protection Act that is the support-for-internal-operations basis, which is why guest play asks for no verifiable parental consent — there is nothing being collected that would need one.

For a child in the European Union or the United Kingdom, we rely on our legitimate interest in running the game they asked to play, rather than on a contract a child is too young to make or a consent they are too young to give. The balancing is short because the processing is: what is handled is the minimum needed to put somebody on a pitch, none of it is used for anything else, and a guest account is deleted after thirty days without use.

An account keeps more and keeps it longer — a footballer, a level, a career, held until you delete them — so the things on it that could be about a person are closed the same way. A footballer's name is given by the server, a lobby is named after the footballer, a team keeps its default name, and anything typed in their place is refused, unless the player has said they are 13 or over. The server checks the name against the ones it generated and remembers the declaration on the profile, rather than trusting what a form claimed, so the declaration is a gate rather than a decoration. An account therefore collects nothing that is contact information and no child's own name, which is what keeps it, like guest play, inside the support-for-internal-operations basis under COPPA.

For a child's account the ground is legitimate interest, as it is for a guest, because a child cannot make the contract the adult version of that account rests on. The balancing is the same short one: what is kept is a footballer, their level and what happened in their matches, none of it is used for anything but showing it back to them, and all of it goes the moment the account is deleted.

If you are a parent and would rather a guest's records went sooner, they can be deleted from the data rights page without a password — a guest has no password to have.

Who we share it with

No analytics provider, no advertising network, no crash reporter and no third-party font or script. The only company that touches your data is the hosting provider that runs our servers, described in the next section. Other players see your display name, your position, your rating and your match statistics — in the lobby list, on the pitch and on the scoreboard — which is the point of a multiplayer game.

Switching notifications on adds one more company, and only for as long as they are on: the push service run by whoever made your browser — Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge. It carries the message to your device and cannot read it, because it is encrypted before it leaves our server with keys that only your browser holds. What it can see is that this game sent something to that device, and when.

Where it is stored, and transfer abroad

The game runs on a rented server outside Türkiye, in the European Union, and the database sits on that same server. Your account row and your match records are therefore stored and processed abroad by our hosting provider, who processes them only to run the service for us.

Under Article 9 of the Turkish Personal Data Protection Law (KVKK) that is a transfer abroad, and we would rather tell you plainly than let you discover it. What travels is the short list above: a generated username, a password hash, and what happened in your matches. There is no identity document, no address, no telephone number, no payment detail and no special category of personal data, because the game never asks for any of it.

That transfer does not rest on your consent. Since Article 9 was amended in 2024, consent can carry a transfer that happens once in a while, not one that happens on every request; this one stands on the safeguard the article provides for instead — the standard contract published by the Personal Data Protection Board, concluded between the operator and the hosting provider and notified to the Board. The hosting provider processes the data only to run the service for us; it is not a recipient in its own right. Nothing is sold, shared for advertising, or handed to anyone else.

Seen from the European Union or the United Kingdom, the operator reading that data from Türkiye is a transfer as well. Only the operator does it, only to run the game you asked for, and there is no way to run the account you opened and the matches you played without it.

A notification is a transfer abroad as well. The push service that carries it belongs to the company that made your browser and runs outside Türkiye, so every notification tells that company the address of your device and that this game wrote to it; the message itself is encrypted before it leaves our server, so what crosses the border in readable form is that address, the time of the request, and our own contact address, which the push service needs in order to tell us when something is wrong at our end. Because it happens every time rather than once in a while, your consent to receiving notifications is not what carries it — the same 2024 amendment says so — and it stands on the same safeguard as the hosting above: the standard contract published by the Personal Data Protection Board, concluded with the push service and notified to the Board. Until you switch notifications on, nothing at all goes to that company, and switching them off stops it again.

How long we keep it

Registered accounts are kept until you delete them. Guest accounts are deleted after 30 days of inactivity. Deleting your account removes your attributes, progression, lifetime statistics and match lines from the live database immediately and permanently, and replaces your name on the scoreboards of finished matches with "Deleted player".

There is no scheduled copy of the database, so a row you delete is not sitting in one waiting to be cleared. A guest's cached experience expires 24 hours after their last match, and the rate-limit counters that carry an IP address last at most ten minutes.

The servers' own logs hold no IP address and no name; they record what the server did, and they are rotated once they reach ten megabytes.

A notification subscription is kept until you switch notifications off, until your browser's push service tells us it no longer exists — a browser reinstalled, a permission revoked, an app deleted — until a message to it can no longer be encrypted or signed, which means the same thing, or until you delete your account, whichever comes first. Beside it we keep one line per notification we decide to send: which kind it was, what it was about and when. The line is written before the message goes out, so it is there even when the sending fails. Those lines are deleted after 30 days, and they exist to stop the same news being sent twice and to hold the four-a-week limit to its word.

Your rights

Under Article 11 of the KVKK you may learn whether we process data about you and ask for it; learn why, and whether it is used for that; know who it is passed to, here or abroad; have it corrected if it is incomplete or wrong; have it erased; have a correction or an erasure passed on to anyone we passed the data to; object to a decision about you taken purely by a machine (there are none here); and claim compensation for damage from unlawful processing. Under the GDPR and the UK GDPR you have the matching rights of access, rectification, erasure, restriction, portability and objection.

Most of them you exercise yourself, without writing to anyone: your data is on the character and Online Match screens, a full copy can be downloaded from the data rights page, a footballer can be edited on the character page, and the account can be deleted on the data rights page. For anything else, write to the address below from within reach of the account: we hold no email address, so the only way we can tell that a request is yours is that you can sign in, or that you know the username and the recovery code.

We answer within 30 days and free of charge, as Article 13 of the KVKK asks; if the answer is no, we say why.

If you think we have got something wrong, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) — after writing to us first, as the law asks — and, in the European Union or the United Kingdom, to your data protection authority.