Modular MMORPG

Privacy Policy

Last updated: · Version 1

This policy explains which personal data we process, why and how, when you use the Modular MMORPG game (iOS, Android and PC) and the modularmmorpg.com website. Data controller: {{LEGAL_NAME}} ("Asmir", "we"), address: {{LEGAL_ADDRESS}}, {{COUNTRY}}. The policy is written with the Turkish Personal Data Protection Law no. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR) in mind.

1. Data we collect

DataSourceDetails
Account detailsYouUsername (login ID), e-mail address, a hashed form of your password. We never store your password in clear text.
Sign in with Apple identifierApple / youIf you use Sign in with Apple: the stable user identifier Apple gives us and, if you choose to share it, your e-mail address or Apple's private relay address.
Device identifiersDeviceOn iOS the "identifierForVendor", plus a random install ID the app generates on first launch. Advertising identifiers (IDFA / GAID) are not collected.
Device and connection dataDeviceDevice model, operating system version, app version, language, screen size; your IP address while connected (in server logs).
Gameplay dataIn-gameYour characters, level, items, quest progress, clan/party memberships, in-game currencies, login times and session lengths, report and block records.
Chat messagesYouWhat you write in in-game chat channels and private messages. Kept for a limited time for moderation and report review; the last messages attached to a report are kept with that report.
Purchase historyStoresThere are currently no in-app purchases. When they are added we will store the transaction ID and product supplied by the store (Apple / Google); your payment card details never reach us.
AnalyticsAppUsage analytics are disabled by default. If enabled in the future, only aggregated usage events (screen opens, session length, crash reports) will be processed and this policy will be updated.
Support correspondenceYouYour e-mail address and the content of your message when you write to [email protected].

The website uses no cookies and does not track visitors. It is served through Cloudflare for delivery and protection; Cloudflare may process your IP address for connection security. Google Fonts is used for headings; your browser sends your IP address to Google when it downloads the font.

2. Purposes and legal basis

  • Providing the service (account creation, login, storing characters and progress, running the multiplayer game) — performance of a contract (KVKK art. 5/2-c, GDPR art. 6(1)(b)).
  • Security and anti-cheat (multi-account detection, bot and cheat detection, keeping banned accounts out, matching device identifiers) — legitimate interest (KVKK art. 5/2-f, GDPR art. 6(1)(f)).
  • Moderation (reviewing chat messages after a report, preventing harassment and scams) — legitimate interest and enforcement of the terms of service.
  • Support (answering your questions, resolving account problems) — performance of a contract.
  • Legal obligations (requests from authorities, accounting records) — legal obligation (KVKK art. 5/2-ç, GDPR art. 6(1)(c)).
  • Analytics and product improvement — only if enabled, based on legitimate interest or explicit consent.

We do not sell or rent your data for advertising and do not share it with third-party ad networks.

3. Retention

  • Account and gameplay data: for as long as your account exists. After deletion, personal data is erased or anonymised within 30 days at the latest (see Account and data deletion).
  • Chat messages: at most 90 days; messages attached to a report are kept until the report is resolved and any resulting sanction has expired.
  • Server and connection logs (including IP): at most 90 days, unless needed for a security investigation.
  • Ban / sanction records: to prevent repeat abuse, at most 2 years even after account deletion, in a form that does not directly identify you (hashed device identifier and sanction reason).
  • Support correspondence: at most 2 years.
  • Legal retention: records required by law (e.g. future purchase invoices) for the statutory period.

4. Third parties and international transfers

We share your data only with providers needed to run the service, and only as far as needed:

  • Apple Inc. — Sign in with Apple, App Store distribution and (in the future) in-app purchases. Apple's privacy policy: apple.com/legal/privacy.
  • Google LLC — Google Play distribution and (in the future) in-app purchases; Google Fonts on the website.
  • Cloudflare, Inc. — delivery of the website and configuration files, DDoS protection.
  • OVH SAS — the data centre hosting the game and web servers (European Union).
  • Authorities — only where legally required.

Our servers are located in the European Union. Providers such as Apple and Google may process data on their own infrastructure (including the USA); these transfers are protected by standard contractual clauses and the provider's own commitments. Under KVKK, transfers abroad are made in accordance with article 9 of the Law.

5. Children

Modular MMORPG is not designed for children under 13 and we do not knowingly collect data from anyone under 13. If we learn that a child under 13 has created an account, we delete the account and its data. If you are a parent or guardian and suspect this has happened, please write to [email protected]. Where your country sets a higher age of digital consent (up to 16 under the GDPR), that age applies.

6. Your rights

Under KVKK art. 11 and GDPR arts. 15–22 you have the right to:

  • learn whether your data is processed and request a copy (access),
  • have inaccurate or incomplete data corrected,
  • have your data erased ("right to be forgotten"),
  • restrict processing and object to processing based on legitimate interest,
  • receive your data in a structured, machine-readable format (portability),
  • withdraw consent at any time where processing is based on consent,
  • lodge a complaint with the Turkish Personal Data Protection Authority (KVKK) or the supervisory authority of your EU country.

Send requests to [email protected] from the e-mail address registered on your account. We may ask for additional information to verify your identity. Requests are answered within 30 days at the latest and are free of charge.

7. Account and data deletion

You can delete your account in two ways:

  1. In the app: Settings → Display → DELETE ACCOUNT. After confirming with your password (or by signing in with Apple again for Apple accounts) the account is closed immediately.
  2. By e-mail: send a message with the subject "Account deletion request" to [email protected] from the address registered on your account.

Deletion permanently removes your characters, items, in-game currencies, clan memberships, account details and the Sign in with Apple link. It cannot be undone and there is no waiting period. Sanction records and records we must keep by law may be retained for the periods in section 3, in a form not directly linked to your identity. Details: Account deletion.

8. Security

Passwords are stored as one-way hashes; client–server traffic and the website are encrypted (TLS); server access is limited to authorised staff and logged. No system is completely secure; in the event of a data breach we will inform you and the relevant authorities within the statutory deadlines.

9. Changes

We may update this policy. For significant changes you will be asked to accept the new version the next time you open the game; the policy version number and "last updated" date appear at the top of this page.

10. Contact

Data controller: {{LEGAL_NAME}}
Address: {{LEGAL_ADDRESS}}, {{COUNTRY}}
E-mail: [email protected]