Privacy Policy and KVKK (Turkish Personal Data Protection Law) Information Notice
Last updated: 8 October 2026
This English translation is provided for convenience. If it differs from the Turkish version, the Turkish version prevails.
This notice explains which of your personal data is processed when you use the ChallengeGoal mobile app (the "app"), why it is processed, who it is shared with and what your rights are. By using the app you accept the processing described in this notice.
1. Data controller
The controller of your data is the developer of the ChallengeGoal app. For any question or request: destek@challengegoal.app
2. What data we process
| Data | When | Why |
|---|---|---|
| Username | When you create an account (generated automatically for guest accounts) | To show you to your opponents and on the leaderboard |
| Email address and a hash of your password | When you create an account with email | To sign you in and to reset your password. The password itself is not stored; only its irreversible hash is kept |
| Google or Apple account ID and email address | When you sign in with Google or Apple | To recognise your account. No other information is taken from these providers |
| Game data: your matches, results, points, level, goal balance and goal transactions, and your daily puzzle answers | As you play | To run the game, match you with opponents, and show your history and the leaderboard |
| Purchase records (product, date, the store's transaction ID) | When you make an in-app purchase | To credit the goals you buy to your account and to stop the same transaction being counted twice. Your card details do not reach us; the App Store or Google Play takes the payment |
| Notification token and your device's language | When you allow notifications | To send notifications such as the daily puzzle, the weekly result and streak reminders. You can turn the permission off in your phone's settings whenever you like |
| Technical data: IP address, request time, app version | When the app connects to the server | Security, preventing abuse and debugging |
| Advertising ID and ad interactions | When you watch a rewarded ad | To show the ad and give you your reward. This data is processed by the ad provider (Google AdMob) |
The app does not use your location, contacts, photos or microphone.
3. Legal grounds
We process your data under Article 5 of Law No. 6698, the Kişisel Verilerin Korunması Kanunu (Personal Data Protection Law), on the following grounds: the formation and performance of the usage agreement between you and us, compliance with our legal obligations, and our legitimate interests (security and the prevention of abuse), provided that they do not harm your fundamental rights and freedoms. Processing that requires explicit consent, such as personalised advertising, takes place only when you give consent; you can withdraw your consent whenever you like.
4. Who your data is shared with
- Other players: your username, level, points and match results are visible to your opponents and on the leaderboard. Your email address is never shown.
- Hosting provider: our servers run in Germany, on the infrastructure of Contabo GmbH.
- Google and Apple: to verify your identity when you sign in with these providers; to take the payment for in-app purchases.
- Google AdMob: to show rewarded ads. How AdMob processes data is explained on Google's page on the subject.
- Notification services: the notification services of Expo, Google (Firebase Cloud Messaging) and Apple, to deliver notifications to your device; only your notification token and the text of the notification.
- Email delivery provider: only your email address, to deliver the password reset email.
- Competent authorities: when a legal obligation arises.
Your data is not sold.
5. Transfers outside Türkiye
Because our servers are in Germany and some of the service providers above are based outside Türkiye, your data is processed outside Türkiye. The transfer is carried out in line with the conditions in Article 9 of Law No. 6698.
6. How long it is kept
- Your account and game data is kept for as long as your account stays open.
- When you delete your account, your account, email address, points, goal balance, goal transactions and puzzle records are permanently deleted. In matches that appear in your opponents' history, your name stays as "Deleted player".
- Server logs (including IP address) are kept for at most 90 days, and backups for at most 14 days.
- Purchase records may be kept for as long as legal retention obligations last.
7. Your rights
Under Article 11 of Law No. 6698, you have the right to:
- find out whether your data is processed and, if it has been, request information about it,
- find out the purpose of the processing and whether the data is used in line with that purpose,
- know the third parties, in Türkiye or abroad, to whom it is transferred,
- ask for it to be corrected if it has been processed incompletely or inaccurately,
- ask for it to be deleted or destroyed,
- object to an outcome against you that arises from analysis by automated systems,
- claim compensation for the damage if you suffer damage because of unlawful processing.
You can send your requests to destek@challengegoal.app; they are answered within 30 days at the latest. If you are in the European Economic Area, you can also exercise your rights of access, rectification, erasure, portability and objection under the GDPR through the same address.
8. Deleting your account
You can delete your account instantly in the app under Account → Delete account. If you cannot open the app, follow the steps on the account deletion page.
9. Children
The app is not aimed at children under 13 and does not knowingly collect data from them. If you think a child has created an account, write to us; we will delete the account.
10. Security
The connection between the app and the server is encrypted. Passwords are stored as irreversible hashes, and session tokens are stored only as their hashes. Because no system is completely secure, absolute security cannot be guaranteed.
11. Changes
This notice may be updated. We announce important changes in the app or on this page; the current version is always published at this address.