TürkçePrivacy Policy
Last updated: October 19, 2026
This policy explains what personal data Landwar Games collects when you use landwargame.com and the games on it, why we collect it, who receives it, how long we keep it and which rights you have. It is written for the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK).
Who is responsible
The data controller is Ema Bilişim Sağlık Hizmetleri Ticaret Ltd. Şti., Şifa Mah. İnönü Cad. Tuzla Kıptaş 1. Etap Konutları B5 Blok No: 75 K İç Kapı No: 28, Tuzla, İstanbul, Türkiye (authorised person: Muhammet Arslantaş). For anything about your data, write to [email protected].
Credits are sold and charged by The Revolution of Technology LLC (United States), which receives the order details needed to take the payment and handle refunds and disputes (see "Payments" below).
What we collect
- Account: your email address, display name, preferred language and, if you sign in with Google, your Google account ID, name and profile picture. Passwords are stored only as a one-way hash (argon2id); nobody can read them.
- Sign-in session: a cookie with a random token. We store only a hash of the token.
- Activity records: when you create an account, confirm your email, sign in or out, ask for or use a password reset link, change or delete your account, start or leave a game while signed in, start a checkout, accept the sales terms, buy credits or get a refund, we record the time, your IP address, the country it belongs to and your browser's user agent.
- Purchases and credits: the pack, price, currency, time and status of each order, the Stripe payment references and a ledger of credits added and spent. You enter your card on Stripe's payment page; card numbers never reach our servers.
- Messages: the emails you send to us and our replies.
- Game progress: the games save your progress in your browser's storage on your own device; it is not sent to us. If a game later offers saves or scores on your account, they are stored with your account and covered by this policy.
- Analytics and advertising: with your consent, Google Analytics measures how the site is used and Google AdSense shows ads (see the Cookie Policy).
We collect this data electronically: through the forms on the site, your browser (cookies and similar technologies), our server records and Stripe's payment page.
Why we use it and on which legal basis
- To provide your account, the games and the credits you buy. GDPR Art. 6(1)(b), performance of a contract; KVKK Art. 5(2)(c).
- To keep the service secure, prevent fraud, cheating and abuse, and to establish, exercise or defend legal claims, including payment disputes and chargebacks. This is what the activity records are for. GDPR Art. 6(1)(f), legitimate interests; KVKK Art. 5(2)(e) and 5(2)(f).
- To keep accounting and tax records of purchases. GDPR Art. 6(1)(c), legal obligation; KVKK Art. 5(2)(ç).
- To answer your messages. GDPR Art. 6(1)(b) and (f); KVKK Art. 5(2)(c) and (f).
- Analytics and personalised advertising, only with your consent. GDPR Art. 6(1)(a); KVKK Art. 5(1). You can withdraw consent at any time under "Cookie settings" at the bottom of every page.
We do not sell your personal data and we do not make decisions about you based solely on automated processing.
Who receives data
We use these service providers. Each receives only what it needs for its task:
- Hostinger International Ltd.: the server that runs the site and stores the databases (United States).
- Cloudflare, Inc.: network, security and delivery of the site; sees your IP address and requests (global network).
- Google LLC and Google Ireland Ltd.: Sign in with Google, and with your consent Google Analytics and Google AdSense; also the inbox where we read support email.
- Stripe, Inc. and its group companies: card payments, refunds, fraud checks and disputes, on behalf of The Revolution of Technology LLC.
- Resend (Plus Five Five, Inc.): sending account and purchase emails and receiving the email you send to our addresses (United States).
- Telegram: short internal notices to us about new support emails (sender, subject and the start of the message) and purchases.
- Cloudflare R2: encrypted off-site copies of our databases for disaster recovery.
We may also disclose data to courts and authorities when the law requires it, and to card networks and banks through Stripe when a payment is disputed.
Transfers abroad
Several of these providers process data outside Türkiye and outside the European Economic Area, mainly in the United States. For transfers from the EEA we rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. For transfers from Türkiye we rely on the grounds set out in KVKK Article 9.
How long we keep it
- Account data: until you delete your account.
- Sign-in sessions: 30 days after your last visit.
- Email confirmation and password reset links: 48 hours and 1 hour.
- Activity records: 2 years, also after an account is deleted, so that security incidents and payment disputes can still be answered.
- Orders and the credit ledger: 10 years, as commercial and tax law requires.
- Support emails: up to 2 years after the matter is closed.
- Backups: up to 30 days.
- Google Analytics: according to the retention set in Google Analytics, at most 14 months.
Your rights
Under the GDPR you can ask for access to your data, correction, erasure, restriction of processing and a portable copy, object to processing based on legitimate interests and withdraw consent at any time. You can also complain to the data protection authority where you live.
Under KVKK Article 11 you can learn whether your data is processed, request information about it, learn the purpose and whether it is used for that purpose, know the third parties in Türkiye or abroad that receive it, ask for correction, deletion or destruction and for these to be passed on to those third parties, object to a result against you that comes solely from automated analysis, and claim compensation for damage caused by unlawful processing. You can also complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
Send requests to [email protected] from the address of your account, or in writing to the address above. We answer within 30 days and free of charge. You can delete your account yourself at any time on the account page.
Children
Accounts are for people aged 13 or older. Anyone under 18 needs a parent or guardian's permission to buy credits. If we learn that a child under 13 has created an account, we delete it.
Security
The site is served only over HTTPS. Passwords and sign-in tokens are stored as hashes, access to the servers is limited, and off-site backups are kept in encrypted storage. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.
Changes
When this policy changes we update this page and the date at the top. If a change matters for how we use your data, we will also tell signed-in users or email them.