Privacy
Last updated: 10 November 2026 · version 2026-11-10
Draft: this text is awaiting legal review. This note will be removed when the final version is published.
This Privacy Policy explains, in plain language, what information we process when you use the Wunderstrike game and the wunderstrike.com website (including the beta sign-up form), why we process it, how long we keep it and how you can use your rights. We try to collect as little as possible.
1. Who we are
Wunderstrike is developed and published by the company that is the data controller for your personal data:
- Karga Yazılım Ticaret Ltd. Şti. (kar.ga), Türkiye
- Address: [ADRES — sonra eklenecek]
- MERSİS No: [MERSİS — sonra eklenecek]
- General contact and data protection requests: hello@wunderstrike.com
- Support and account deletion: destek@wunderstrike.com
For the detailed notice under Turkey's Personal Data Protection Law No. 6698, see the KVKK Information Notice.
2. What we collect
2.1 Website and beta sign-up
| Data | Where / when | Why | How long |
|---|---|---|---|
| E-mail address | Beta sign-up form | To verify your address and send your beta invitation | 30 days if not verified; if verified, until the beta ends or you ask us to delete it |
| Platform (Android / iPhone) | Beta sign-up form | To send the right test invitation | With the beta record |
| Age bracket declaration (18+ / 13–17 / under 13) | Beta sign-up form | To apply parental consent / parental awareness rules for children | With the beta record |
| Parent's e-mail and parental consent box (under 13); "my parent knows" box (13–17) | Beta sign-up form | To obtain and record parental consent | With the beta record |
| Where you heard about us (optional) | Beta sign-up form | To understand our outreach | With the beta record |
| Acknowledgement of the KVKK notice and its version | Beta sign-up form (required) | To show that we informed you | With the beta record |
| Marketing consent (optional, separate box) | Beta sign-up form | To send news and launch e-mails | Until you withdraw it |
| Site language, sign-up time, status (pending / invited / error) | Automatically, at sign-up | To e-mail you in the right language and manage the process | With the beta record |
| Browser/device signals (Cloudflare Turnstile) | Beta page only | To protect the form from bots | Not stored by us; processed by Cloudflare |
| Language choice (in your browser, key "dil") | On your own device when you pick a language | To remember your language | Until you clear it; never sent to us |
2.2 The game app
| Data | Where / when | Why | How long |
|---|---|---|---|
| Random device ID (a UUID created on first launch; not a hardware ID) | First launch | To log in to our game server | Until the account is deleted |
| Device model name (e.g. "iPhone15,2"), first-added and last-seen times | At login | To manage devices linked to the account and fix problems | Until the account is deleted |
| Server user ID, auto-generated username, profile ID | Automatically | To keep your account and save game | Until the account is deleted |
| E-mail address (optional) | PROFILE → protect your account / link e-mail, or "I already have an account" | To restore your account on another device; to send a 6-digit verification code | Until the account is deleted |
| Display name (optional, max 16 characters), avatar | Profile | So your friends recognise you | Until the account is deleted |
| Team name, 3-letter short code, city, player shirt names | Typed by you in the game | To personalise your team; cloud save | Until the account is deleted |
| Birth year, age declaration (under 13 / 13+), time of declaration | Before first using friends features or the photo feature | To apply parental consent rules for children | Until the account is deleted |
| Parent link (parent's user ID, consent and withdrawal times) | During under-13 parental consent | To prove and manage consent | Until the account is deleted |
| Country and province (13+ only) | From the region information Cloudflare adds to the connection | To show region-appropriate sponsors on in-game billboards | Until the account is deleted. Never stored for under-13s; used only for that request |
| 64×64 pixel portrait made from a photo | Photo-to-player feature | To give your player a pixel portrait | Until the account is deleted (also in your cloud save) |
| Friends list, friend codes, match invites, preset messages | Friends features | To play with friends | Codes 24 hours; list until the account is deleted |
| Save game, stars ledger, rate-limit timestamps | While playing | To keep your progress and prevent abuse | Until the account is deleted |
| Inputs, team choices and display names during a match | Online match with a friend | To relay the match between two devices | Only relayed during the match |
About the photo feature: from the photo you pick, the game crops only the face area to at most 128×128 pixels and sends it to our server. The server keeps the photo in memory only, scales it to 64×64 and sends it to PixelLab to generate the portrait. The photo is not written to disk or logs and is discarded straight away. Only the generated pixel portrait is kept. The photo is not used for face recognition or identification.
3. What we do not collect
- No advertising ID (IDFA/AAID); no advertising, analytics or crash-reporting SDKs in the game.
- No location (GPS), contacts or microphone. The camera is not used at the moment.
- No real names, passwords or phone numbers. No Apple, Google, Facebook or Steam login.
- Our game server code does not read or store your IP address, coordinates or postcode. On the website we do not store IP addresses in our database.
- No push notifications.
- No cookies on the website (details: Cookie Policy).
4. Who we share it with
We do not sell your data and do not share it for advertising. We share it only with the following service providers, and only as much as needed to run the service:
| Provider | What for | Location |
|---|---|---|
| Cloudflare, Inc. | Website hosting, beta form and database (Pages, Functions, D1), Turnstile bot protection, Web Analytics, game server connection (tunnel/CDN), backup storage (R2) | US company, global network |
| Markahost | Hosting of the game server | [doğrulanacak: veri merkezi ülkesi, muhtemelen Türkiye] |
| Amazon Web Services (Amazon SES) | Sending verification links and 6-digit code e-mails | Germany (EU, eu-central-1); US company |
| PixelLab (api.pixellab.ai) | Generating pixel portraits from photos (a 64×64 image is sent) | [doğrulanacak: PixelLab ülkesi ve saklama süresi] |
| Google LLC (Firebase App Distribution) | Android beta only: your e-mail is added to the tester group and Google sends the invitation e-mail | USA |
| Apple Inc. (TestFlight) | iPhone beta only: we e-mail you the public TestFlight link; TestFlight is run by Apple | USA |
For the iPhone beta we do not receive your Apple ID data, other than what Apple shows us about testers in TestFlight [doğrulanacak: TestFlight'ta görünen test eden bilgileri]. Google and Apple process this data under their own privacy policies.
We may also disclose data to competent authorities where the law requires it.
5. International transfers
Some of the providers above are located outside Türkiye or are foreign companies, so your data may be transferred abroad. We carry out these transfers in line with Article 9 of Law No. 6698, relying on legal mechanisms such as standard contracts and, where needed, your explicit consent [hukukçu doğrulayacak: her sağlayıcı için aktarım dayanağı ve Kurum'a bildirim]. See the KVKK Information Notice for details.
6. How long we keep data
- Unverified beta sign-ups are deleted after 30 days.
- Beta records are kept until the beta programme ends or until you ask us to delete them, and are then deleted.
- Marketing consent is valid until you withdraw it.
- Game account data is kept until you delete your account. Daily database backups are kept for 7 days on our server and 30 days on Cloudflare R2, so deleted data disappears from backups within 30 days at the latest.
- Session refresh tokens are valid for 60 days.
- For deletions we keep only the user ID and the time of deletion.
- How long Cloudflare keeps its own system logs: [doğrulanacak: Cloudflare kayıt saklama süresi].
7. Security
Connections are encrypted (HTTPS). We do not use passwords; account recovery works with a 6-digit code sent to your e-mail and valid for 10 minutes. The sign-up form is protected against bots and the game server uses rate limits. Only people who need access for their work can access data. No system is 100% secure; if a data breach happens we will notify you and the competent authority as the law requires.
8. Your rights
You have the right to know whether your data is processed, to ask for information, and to request correction or deletion, to object, and other legal rights (full list: KVKK Information Notice). To use them:
- Delete your game account: in the game, PROFILE → delete account (two steps). Your server account and data, and the data on your device, are deleted; if you are offline, the request is queued and completed when you reconnect.
- Deletion request outside the app: e-mail destek@wunderstrike.com.
- Delete your beta record or other requests: e-mail hello@wunderstrike.com.
- Stop marketing e-mails: use the link in the e-mail or write to hello@wunderstrike.com.
We may ask for additional information to verify your identity. We reply within 30 days at the latest. If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Board (KVKK Kurulu) or, where applicable, to your local data protection authority.
9. Children
Wunderstrike is suitable for players of all ages. Children under 13 need parental consent for online and social features (friends, messages, match invites, the photo feature) and for beta sign-up. There is no free chat and no matching with strangers. Details: Children's Privacy.
10. Changes
We may update this policy from time to time (for example when purchases are added). The current version is always on this page and the "last updated" date above will change. We will also announce important changes in the game or by e-mail.
11. Contact
Questions: hello@wunderstrike.com · Support: destek@wunderstrike.com · Post: Karga Yazılım Ticaret Ltd. Şti., [ADRES — sonra eklenecek].
Other documents: Terms of Use · Cookie Policy.