Privacy notice

1. Data controller

Data controller: Ahmet Melih Afşar. Contact: [email protected]. Address: Istanbul, Türkiye.

Kelime Masası is a free word game. You do not need an account to play as a guest; signing in with Google is optional.

2. Data we process

Guest players: the nickname you type, a random player key generated in your browser (only its SHA-256 hash is stored on the server), table codes, moves, words, scores, turn and timer information, connection status (online/offline) and emoji reactions. Your nickname is visible to your opponent and to people watching the table.

Persistent device profile: to show your game history and statistics across games, and to measure return visits only in aggregate, a random secret key is generated on this device and kept in your browser’s local storage (no cookies or fingerprinting); this key is never sent to the server. A “profile ID” derived from it is sent when you create a table, join one or start a rematch; our server stores not the ID itself but only a one-way hash of it, with the game record and in the room_profiles table together with the table code and player seat. The “All my games” screen shows only aggregate statistics and opponent nicknames from your own last 100 games. The ID is not shared with other sites. You can renew it at any time with “Reset profile ID” in the statistics screen or by clearing your browser data; later games are then no longer linked to earlier ones. If you copy the profile code to move it to another device, it works like a password; use it only on your own devices.

Account (if you sign in with Google): the name, email address, email-verification status and profile image link provided by Google; the Google account ID and encrypted access, refresh and ID tokens; a session record (session token, expiry, IP address and browser information). Your email address is never shown to other players. Tables, tournaments and scores you link to your account are associated with it.

Optional features: friend profile (nickname and friend code), friend requests, blocks, challenges, the matchmaking queue, player reports (a reason chosen from a fixed list, the reporter and the reported player), the word notebook (words you save and your review schedule), word reports, the daily table leaderboard (nickname, score), tournament records and spectator links.

Notifications: if you enable turn notifications, the web push subscription issued by your browser (push endpoint address and encryption keys), a device ID, the notification language and the next deadline are stored. Notification permission is granted in your browser and can be withdrawn at any time.

Word of the day notification (optional): only if you turn it on, we send at most one word per day at about 10:00 (Istanbul time). To do so we use your browser’s web push subscription (endpoint and encryption keys), your interface language, the fact that this notification is switched on, and whether a word in your word notebook is due for review; that notebook word is shown only to you in the notification text. We use this data for nothing else. You can opt out at any time with the switch in the menu or the “Turn these off” button on the notification; the record is deleted. It is independent of turn notifications.

Technical data: to prevent abuse, the IP address of your requests is passed only transiently to Cloudflare’s rate-limiting service as a key; it is not written to our database or logs (except the Google session and sign-in rate-limit records, see Retention). For friend, word-notebook, matchmaking and player-report actions, daily action-limit counters are stored in the database together with a pseudonymous identifier derived from a SHA-256 hash of the player or account key, and the day; other general usage-limit counters contain no personal data.

3. Purposes

To provide the game and run tables (move validation, turns, scores, replay); to let you return to your tables; account sign-in and continuing across devices; friends, challenges, matchmaking and tournaments; turn notifications; the word notebook and learning features; reviewing dictionary errors and misbehaviour; service security and prevention of abuse and overload (IP-based and identity-based rate and daily limits, bot verification); troubleshooting and continuity of the service (backups and disaster recovery); product measurement (anonymous aggregate visit counts and aggregate usage measurements computed locally from backups).

Your data is not used for advertising or profiling and is not sold to third parties.

4. Legal bases

Under KVKK Art. 5/2: establishment or performance of a contract to the extent needed to provide the game (c); the controller’s legitimate interests in service security and preventing abuse (f); compliance with legal obligations (ç). Web push notifications rely on the permission you give in your browser (explicit consent); you can withdraw it at any time.

5. Transfers and service providers

Cloudflare, Inc.: hosting (Workers, Pages, static assets), the database (D1, including its point-in-time history), rate limiting, logging/observability (Workers Observability) and bot verification (Turnstile). Turnstile is active in production: when verification is required your browser loads Cloudflare’s script from challenges.cloudflare.com, which gathers browser and environment signals to tell whether you are a bot; our server sends the verification token and the visitor’s IP address to Cloudflare to check the result. The purpose is to prevent automated abuse; this data is processed under Cloudflare’s Turnstile privacy addendum and terms. Cloudflare’s documentation does not describe cookies or local storage for the Turnstile widget (only its pre-clearance feature, which we do not use, uses a cookie). As a result, data may be processed on servers outside Turkey.

Google LLC: involved only if you sign in with Google, for authentication; data is exchanged with Google during sign-in and under Google’s own terms.

Browser notification services: if you enable notifications, they are delivered to your device through your browser vendor’s web push service (for example Google, Mozilla or Apple); the content only says that it is your turn and gives the table code, or, for the word of the day, the title and the word shown.

Your personal data is not otherwise shared with or sold to third parties.

Transfer abroad: Cloudflare’s and Google’s servers may be located outside Türkiye (for example in the United States and the European Union), so your data is processed abroad by these providers. The standard contract published by the Board under KVKK Art. 9 has not yet been signed with these providers; for now the data is processed under the providers’ own data processing terms and security measures. This section will be updated once a standard contract is signed.

6. Retention

Deleted automatically (by a nightly clean-up job): table presence/last-seen records (after 30 days); spectator invitations (1 day after they expire); notification subscriptions (when you turn notifications off, when the table ends, or when not renewed for 60 days and the table is not an ongoing game); word-of-the-day subscriptions (when you turn them off or when the browser subscription becomes invalid); the IP address and browser details of Google sessions (removed after 30 days; the session record itself is deleted once it expires; a session lasts at most 30 days); verification records (when they expire); sign-in rate-limit counters (after 24 hours); usage-limit counters, including daily action counters with a pseudonymous player or account identifier (2 days after they expire); word reports (30 days); player reports (90 days); challenges (30 days after they expire); the matchmaking queue (1 day after it expires); the notification queue (when it expires or after 3 failed attempts); only the last 20 emoji reactions per table; aggregate visit counts (after 400 days); error reports (after 90 days).

Kept without an automatic deletion period: your game history, meaning table records (including nicknames, moves, words and the profile ID hash; finished, archived and abandoned tables too), daily leaderboard scores, tournaments, friend profiles, friendships, blocks, the word notebook, and account and Google profile/link records. We keep them so we can show you your game history and statistics back to your very first game. They are kept for as long as the service runs, until you delete your account or request deletion; deletion requests are carried out within 30 days at the latest. Finished tables are compressed and archived after 7 days; archiving is not deletion, and an unfinished table is never deleted or closed by the system.

Backups and recovery: database backups taken before releases, and the full copies produced from them that can be restored into a remote D1, are kept on the operator’s computer as files readable and writable only by their owner (0600), outside the code repository; they contain every table, including the personal data listed above. Disaster recovery works by creating a new remote D1, and the old database is kept for a while after the cutover instead of being deleted immediately. Backups and the copies made from them are kept for at most 30 days and then deleted automatically (if scheduled backups stop, only the most recent backup is kept until a new one is taken); after a recovery, the old database is also deleted no later than 30 days after the cutover. In addition, Cloudflare D1 keeps its own point-in-time (Time Travel) history for Cloudflare’s retention period (according to Cloudflare’s documentation, 7 days on the free plan and 30 days on the paid plan). Product measurement reports are computed locally from these backups and contain only aggregate counts. After a deletion request, your data may remain in backups for up to 30 more days; it is deleted together with those backups when that period ends.

7. Cookies and local storage

We use no advertising or tracking cookies. There are only essential cookies: if you sign in with Google, the kelime.session_token session cookie (HttpOnly, up to 30 days) and short-lived technical cookies during sign-in; the km_bot verification cookie when bot verification is required (HttpOnly, 15 minutes; for Cloudflare Turnstile see section 5); a 15-minute admin cookie on administrator sign-in (operator only).

Your browser’s local storage (localStorage/sessionStorage) stays on your device: a random guest key, the secret key of the persistent device profile, the notification device ID, saved table codes and player tokens, your nickname, language/theme/sound/game settings, statistics and decisions, draft moves, hidden tables and tutorial/install preferences. The service worker caches only game files and your language preference. You can remove all of this by clearing your browser data; if your guest key is deleted, you lose access to your tables from this device.

8. Logs and anonymous visit counts

The service runs on Cloudflare Workers and Workers Observability logs are persistently enabled (per-invocation request logs are disabled). The log lines the application itself writes are: for API requests the route (table codes masked as :code), method, status code and wall-clock duration (durationMs); for request failures the route and method; and error class names. Headers, cookies, player tokens, request bodies, query strings, IP addresses and table codes are not written to these lines. Cloudflare also keeps its own platform-level request and infrastructure logs and analytics (which may include IP addresses); their scope and retention are governed by Cloudflare’s own policy.

Anonymous, cookieless, aggregate visit counting: each time the game page is opened, once, unless your browser sends a Do Not Track (DNT) or Global Privacy Control (GPC) signal, it sends a small notification to /api/v. Only an aggregate counter is incremented: day (UTC), channel (direct/unknown, room invitation, social or campaign), entry type (home page or joining via an invitation), interface language and, if present, a campaign name from an allowlist. The counters are kept in the visit_counts table in the database and deleted after 400 days. If the daily counter cap (20,000) is reached, a single marker row without any identifier is added for that day and later visits that day are not counted. No cookie, identifier, user agent, address, referrer or table code is stored, and the count cannot be linked to a person. Like other API requests, this request passes the general IP-based rate limit: the IP address is passed only transiently to Cloudflare’s rate-limiting service as a key and is not written to the counter table.

Error reports: if an error occurs on the game page, your browser tells us the type of error, a short description of it stripped of anything that could contain personal data (numbers, quoted text, addresses, emails, table codes, words), at most three locations in our own code, the release number, the page type (home, game, guide or other) and the interface language. This is kept in the error_fingerprints and error_counts tables of the database, as one record per error plus daily counters, and deleted after 90 days. Your address, table code, nickname, IP address, browser information or any identifier is not sent or stored; no cookie is used and a report cannot be linked to a person. Reports are used only to keep the game working and to fix bugs. If your browser sends a Do Not Track (DNT) or Global Privacy Control (GPC) signal, no error report is sent. Like other API requests, this request passes the general IP-based rate limit; the IP address is passed only transiently to Cloudflare’s rate-limiting service as a key and is not written to the counter tables.

9. Your rights and how to apply

Under KVKK Art. 11 you have the right to: learn whether your data is processed; request information if it is; learn the purpose and whether it is used accordingly; know the third parties it is transferred to in Turkey or abroad; request correction if incomplete or inaccurate; request erasure or destruction under KVKK Art. 7; request that these actions be notified to third parties to whom data was transferred; object to a result against you arising from analysis by automated systems; and claim compensation for damage caused by unlawful processing.

Requests and deletion: write to [email protected] stating your nickname, the email address of your Google account if any, and the relevant table codes. There is currently no automatic account-deletion or data-download screen; requests are handled manually and answered within 30 days at the latest. For guest data (the key exists only on your device) we may ask for details such as table codes and nickname to verify identity. You may also complain to the Personal Data Protection Board.

10. Changes and effective date

This notice took effect on 18 October 2026. Changes are published on this page and the update date above is revised.