App Name: Time Heroes
Operated by: Timelands Teknoloji Anonim Şirketi (Timelands Teknoloji A.Ş.)
Description: A free-to-play, browser-based idle/gacha pet-collecting game.
Last Updated: October 8, 2026
This Privacy Policy (the "Policy") explains how your personal data is collected, used, shared, and protected when you use Time Heroes, a browser-based (Progressive Web App) idle/gacha pet-collecting game operated by Timelands Teknoloji Anonim Şirketi ("Timelands Teknoloji A.Ş.", "Timelands", "we", "us", or "our"). In this Policy, "you" and "player" mean the individual using the game and whose personal data we process (the data subject); "Services" and "Game" mean Time Heroes together with its related features, screens, and functionality.
This document has a dual legal status. For players in the Republic of Türkiye, it also serves as our KVKK Aydınlatma Metni — the transparency/clarification notice we are required to provide as Data Controller under Article 10 of Law No. 6698 on the Protection of Personal Data (6698 Sayılı Kişisel Verilerin Korunması Kanunu, "KVKK"). For players in the European Union, EEA, and the United Kingdom, it also serves as our privacy notice under Articles 13 and 14 of the General Data Protection Regulation ("GDPR"). For California residents, Section 16 sets out your rights under the California Consumer Privacy Act (CCPA), as amended by the CPRA. For all other players worldwide, it is our general privacy notice. Time Heroes is built Türkiye-first but is globally applicable, and this Policy is written to satisfy KVKK, GDPR, and generic international privacy expectations at the same time.
Our promise here is a simple one: this Policy describes only what the Game actually does. We do not describe practices we do not follow, and we do not sell your personal data. Where a practice depends on your choice (such as analytics or push notifications), we say so plainly.
Your use of the Game is also governed by our Terms of Service, which sit alongside this Policy. Where this Policy refers to purchases, refunds, virtual items, or account rules, the detailed terms are in the Terms of Service, and the two documents should be read together.
The Data Controller responsible for your personal data — the "Veri Sorumlusu" under KVKK and the "controller" under GDPR — is:
Timelands determines the purposes and means of processing your personal data and is accountable for that processing under both KVKK and GDPR. If you have any question about this Policy, or wish to exercise your data-protection rights, please use the contact channel described in Section 17 (Contact & KVKK Data Controller Channel), which is the same channel used for KVKK Article 11 requests.
We collect only the personal data the Game actually needs to work. The categories below reflect what the Game genuinely processes — nothing more.
Sensitive data in chat: our chat features are free-text. We ask you not to share sensitive personal data (special-category / özel nitelikli data — such as health, religious, political, philosophical, trade-union, biometric, genetic, or sexual-orientation information) about yourself or others in chat. We do not seek this data. If it nonetheless appears in chat, it may be processed by our moderation and AI systems as described in Sections 5 and 6, and the lawful basis for that limited processing is set out in Section 4.
Location, stated precisely: we derive and store your COUNTRY, and nothing narrower. When your device connects, our network provider Cloudflare determines the country your connection comes from and passes it to our server as a two-letter ISO country code (the CF-IPCountry header); our server records that code — server-attested, so it cannot be spoofed by the app on your device — and uses it for the country-dependent rules described above. The app also tells our server your device's time zone setting (for example Europe/Istanbul). We use it so that notifications respect your local night, and for one check that works in your favour: if the country code from your connection names a country where the Services are not offered, but your device's clock is set to Türkiye's time zone, we record Türkiye instead, because a VPN or a similar service can make a connection from Türkiye look as if it comes from abroad. When that happens we also keep the two-letter code of the country your connection appeared to come from, as a record of how the decision was made. We do not derive, request, or store your precise location: no GPS, no device location permission, no street-level or city-level lookup, and no location history. We do not persist your IP address as a stored field on your account or use it to profile you. As with any internet service, our hosting, security, and delivery providers (such as Convex, Cloudflare, OneSignal, and PostHog) necessarily receive the IP address your device connects from in order to route and secure traffic. Your billing country, separately, comes from our payment provider's billing data (see Section 7).
Signing in with Google is optional: you can also play as a guest or sign in with a one-time email code. If you choose Google, this section is the complete account of what Time Heroes does with the data Google shares with us.
Time Heroes' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
We advertise Time Heroes on Google and YouTube. This section is the complete account of the data we use to measure those ads.
We process your personal data for the purposes below, each on a specific lawful basis under KVKK (the processing conditions in Articles 5 and 6) and GDPR (Article 6).
Where our processing relies on your consent, you may withdraw that consent at any time (see Section 11, Your Rights). Withdrawing consent does not affect the lawfulness of processing we already carried out before you withdrew it. Where our processing relies on legitimate interest, you have the right to object to it (see Section 11).
We share personal data only with the service providers we need to run the Game. We do not sell your personal data. The categories of recipients are: hosting and backend infrastructure, payment processing, analytics and error monitoring, ad measurement, communications, safety and moderation, and player support. The specific providers we use as of the effective date of this Policy, their location, and the data each one receives, are:
Most of these providers act as our processors under a data-processing agreement, on our instructions, and may use your data only to provide their service to us. Two act differently, as independent controllers of the data you give them: Xsolla acts as an independent controller (Merchant of Record) for the payment transaction and applies its own privacy policy to the payment data you provide; and Google acts as an independent controller for the Google sign-in it operates. For those two, we recommend you also read their own privacy policies: Xsolla's is published at xsolla.com/privacypolicy, and Google's at policies.google.com/privacy. Because Xsolla is an independent controller and not our processor, requests about the payment data it holds — access, correction, or deletion — should be made to Xsolla through help.xsolla.com; we will help you route a request if you contact us first.
Several of the providers above are located outside Türkiye and the EEA (primarily in the USA); Section 8 (Cross-Border Data Transfers) explains how those transfers are safeguarded.
We may also disclose your personal data where we are required to do so by law, or where reasonably necessary to protect the rights, property, or safety of Timelands, our players, or others. If Timelands is involved in a merger, acquisition, or other business transfer, your personal data may be transferred as part of that transaction, subject to continued protection consistent with this Policy.
Some Game features are powered by a third-party AI provider, OpenAI (USA). To make these features work, certain data is sent to OpenAI. We want to be specific and honest about exactly what and why.
In plain terms, these features exist for four purposes: (a) personalized live game events, (b) chat moderation and safety, (c) in-game support, and (d) chat translation, so players who speak different languages can read each other.
Because chat is a shared, social feature, messages and usernames sent in global, colony, and group chat may be transmitted to our AI provider even where you personally did not trigger an AI feature. Specifically: (a) when The Mind generates events for a colony, recent chat logs for that colony and for global chat — which include the messages and usernames of everyone who posted, not only the colony owner — are sent to OpenAI; (b) when AI-assisted moderation is active, any chat message and the username of its sender may be sent to OpenAI to detect abusive content; and (c) when chat translation is on and a reader uses another language, the text of a message (without the sender's username) is sent to OpenAI to translate it for that reader, including in direct messages. This applies to every player who chats, regardless of colony rank. Because chat is shared, messages sent to these features may also contain other players' usernames and words; that content is processed only to run moderation, support, live events, and translation, on the same legitimate-interest basis.
Profiling and your right to object: The Mind builds a behavioral profile of you (stored as mindPlayerMemory) from the signals listed above in order to personalize your in-game experience. This personalization is a form of profiling — automated analysis of your gameplay and behavior. Because it relies on our legitimate interest, you may object to it and request that it stop, you may ask us not to base your experience on this automated analysis, and you may delete this memory by deleting your account or by contacting us using the channel in Section 17 — see also your Article 11 rights in Section 11.
Minors are excluded: if your account is under 18, The Mind does not build or use a behavioral profile of you at all. Minor accounts are also excluded from behavioral analytics and from any advertising or sponsorship segmentation. This is not a setting you have to find and switch on — it is applied automatically from the age on your account (see Section 12). Adult accounts are not individually profiled for advertising either — Section 9A explains what "advertising or sponsorship segmentation" would and would not mean if sponsored content ever launches.
Human review of significant decisions: our AI-assisted moderation may flag content, but decisions that significantly affect you — such as suspensions or bans — involve human review or a right to object and to obtain human review under Section 11. Where any restriction is applied automatically, you may request human review and contest the outcome. In short, we do not use these AI features to make decisions producing legal or similarly significant effects about you without a route to human review.
Model training: data we send to our AI provider is used only to deliver these features to us and is not used by the provider to train its general-purpose models, consistent with our data-processing terms with it.
When you delete your account, the AI behavioral memory (mindPlayerMemory) and your TimeBot conversations are among the data we delete along with your other user-owned data (see Section 10, Data Retention; TimeBot support chats are also auto-purged after 90 days under their own retention timer).
Because OpenAI is based in the USA, sending this data to it is a cross-border transfer — see Section 8.
Separately from the AI features above, we run an automated safety check over messages sent in the Game — including direct messages — to protect players, and especially minors, from grooming, sexual content involving children, threats, and similar serious harm.
How narrow it is: the check is keyword-triggered. A message is matched against a short list of high-risk terms and patterns. Messages that do not match are not read, not stored for safety purposes, and not sent anywhere for review. There is no general monitoring of your conversations, no human reads your direct messages routinely, and the check is not used for advertising, personalization, or any commercial purpose.
What happens on a match: the matched message, the sender, and the recipient are recorded as a safety case for review by our trained staff, who decide whether to act (warn, restrict, ban, or — where the law requires it — report to the competent authorities). Our internal alerting carries only the case identifier; the content stays in our own admin tools (see Section 5, Discord).
Legal basis: this scanning is not based on your consent. It runs on our legitimate interest in child safety and in keeping the Game safe — KVKK Article 5(2)(f) and GDPR Article 6(1)(f) — balanced against your privacy by keeping the trigger list narrow and the human review limited to matched cases. Where a report to authorities is legally required, the basis is our legal obligation (KVKK Article 5(2)(a) / GDPR Article 6(1)(c)).
Retention: safety-case records are kept for 180 days and then deleted, unless a specific case is still open, is needed to establish, exercise, or defend a legal claim, or must be kept longer by law. You may object to this processing under Section 11; because it protects other players and children, we will weigh your objection against those interests and tell you the outcome.
In-app purchases in Time Heroes are processed by Xsolla, acting as our Merchant of Record. When you make a purchase, your payment is a transaction with the payment provider under the provider's own terms, and Xsolla acts as an independent controller for that payment data (see Section 5).
We receive and store purchase records — what you bought and when — and your billing country. We do NOT store your full card number or your full payment credentials; those are handled entirely by the payment provider.
The currencies we support for purchases are the Turkish Lira (TRY), the US Dollar (USD), and the UAE Dirham (AED).
Your billing country is derived only from the payment provider's webhook data — it is not obtained from device location or IP tracking. This reinforces the position stated in Section 3: we do not derive your location from your IP address.
Financial records — invoices, purchases, and subscription/season-pass records — are retained even after you delete your account, so that we can meet our tax and accounting obligations. They are kept for the statutory period required by Turkish tax and commercial law — up to 5 years under the Tax Procedure Law (Vergi Usul Kanunu, VUK) and up to 10 years under the Turkish Commercial Code (TTK), after which they are deleted or anonymised. See Section 10 (Data Retention) for how this fits with account deletion.
Refunds are handled by the payment provider and through our back office; there is no self-service refund button in the Game. You may raise a refund or billing request either with the payment provider at help.xsolla.com — it is the seller of record and operates its own published refund policy at xsolla.com/refund-policy — or with us at [email protected]. Our own refund rules are set out in Section 9 of our Terms of Service, which explains how the two sit together.
Several of the providers we rely on are located outside Türkiye and the EEA — primarily in the USA. These include Convex, OpenAI, Sentry, OneSignal, Google, Resend, Cloudflare, Xsolla, Discord, Giphy, and Axiom. Because of this, your personal data is transferred to and processed in those countries. Our product analytics provider, PostHog, is the exception: it is hosted in the EU.
These transfers happen because the providers listed above host or power core parts of the Game — the database, sign-in, payments, crash diagnostics, AI features, push notifications, and bot protection cannot run without them. These transfers are necessary for the performance of our contract with you and to operate the Game; we do not rely on your consent as the basis for these infrastructure transfers. The measurement of our Google ads (Section 3B) is not one of these infrastructure transfers: data reaches Google for it only if you have accepted analytics.
Because the Republic of Türkiye has not issued an adequacy (yeterlilik) decision for the United States, these transfers must rest on one of the safeguards permitted by Article 9 of the KVKK — principally the standard contract (Standart Sözleşme / SS-2) adopted by the Turkish Data Protection Authority, which has to be concluded with each such processor and notified to the Authority. We want to be honest about status rather than claim more than is true: these standard contracts and the accompanying data-processing agreements are being executed and filed provider by provider, and that work is in progress at the date of this Policy. Until a given filing is complete, we limit what that provider receives to what the Game genuinely needs, and you may ask us where a specific provider stands using the channel in Section 17.
For transfers of personal data from the EEA or UK to countries without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) with each such provider; where a provider is certified under the EU-US Data Privacy Framework, we may also rely on that certification. You may request a copy of the relevant safeguards by contacting us at [email protected].
This section describes the technologies that store or read information on your device, and how consent applies to each.
Strictly-necessary storage (no consent required): some storage is essential to deliver the service you request and runs without analytics consent. This includes your authentication/session token (which keeps you signed in), the Cloudflare Turnstile challenge used for bot and abuse protection, and the local record of your cookie-consent choice. We rely on the strictly-necessary exemption only for storage that is essential to deliver the service you ask for (signing you in, and protecting the Game from bots and abuse).
Consent-gated analytics (off by default): product analytics in Time Heroes are provided by PostHog and are OFF by default. PostHog boots in an opted-out state and stores nothing on your device for analytics until you affirmatively accept through our cookie/consent prompt. In other words, analytics are opt-in and, for KVKK purposes, run on your açık rıza (explicit consent). When you do enable analytics, PostHog uses local storage on your device and receives your hero_id, colony_id, timelands_account_id, and platform (a pseudonymous account identifier — not your username, email, or name). PostHog is hosted in the EU. For players outside Türkiye, this analytics consent also covers the performance measurement described below. For players 18 or older, it also covers the measurement of our Google ads described in Section 3B.
Crash diagnostics (strictly necessary, not consent-based): our crash reporting (Sentry) uses a pseudonymous heroId with no IP address, email, or name, and it runs whether or not you accept analytics. We treat it as strictly necessary for the security and integrity of the service — it is how we learn that something broke or that the Game is being attacked, and we cannot keep your account and data safe without it. Its legal basis is our legitimate interest in service security (KVKK Article 5(2)(f) / GDPR Article 6(1)(f)), not your consent, so it is deliberately not offered as an analytics toggle. It is not used for product analytics, personalization, or advertising.
Performance measurement (not consent-based for players in Türkiye; you can turn it off): to find and fix slow screens, the Game's code running in your browser times how each game screen performs: load time, frame rate, stalls and which game script caused them, and how quickly the screen responds to your taps and clicks. It also reads a few coarse device facts: the number of CPU cores, a memory range, pixel ratio, screen size, connection type, and browser brand.
What is sent: a random session ID that lives only in memory while the Game is open (it is never stored and never linked to your account), the Game build, a device class (a coarse group, not your exact device), and the timings for each screen. These records never contain your user ID, hero, name, email, IP address, the page address (URL), or cookies, and nothing is written to your device. They are sent to our backend, Convex (USA), and stored in Axiom (USA / EU) for at most 90 days, then deleted (see Section 5). We use them only to find and fix slow screens, never for profiling, personalization, or advertising.
Who is measured: players whose country our servers identify as Türkiye are measured on the basis of our legitimate interest in a Game that runs properly (KVKK Article 5/2-f). Players in any other country, or whose country we cannot identify, are measured only if they have accepted analytics. Players under 18 (including accounts we treat as under 18 until their age is confirmed) and browsers that send a Global Privacy Control signal are never measured. For players in Türkiye, declining analytics does not turn performance measurement off, because it has its own switch. You can object at any time by turning it off in Settings → Account → Your Data → Performance Measurement. It is on by default, and once you turn it off no further measurement is sent.
You can decline analytics at the cookie/consent prompt, and — importantly — you can withdraw your analytics consent at any time; it is as easy to withdraw as to give, from Settings → Privacy → Analytics (or the cookie/consent prompt), and withdrawal takes effect going forward. Declining or withdrawing analytics consent does not stop you from using the Game.
The Game does not use advertising cookies or cross-site/third-party advertising trackers, and we do not use your data to track you across other companies' apps or websites. We describe only the analytics behavior the Game actually has. The sponsored-content program described in Section 9A, if and when it becomes active, does not change this: it involves no cookies, no trackers, and no personal data leaving the Game. One exception applies to this paragraph: the measurement of our Google ads described in Section 3B, which runs only if you have accepted analytics and are 18 or older.
We plan to let brands and sponsors place clearly labeled sponsored content — such as in-game banners or branded events — inside the Game at some point after launch. This section describes that program in advance so you are not surprised later. As of the effective date of this Policy, the program is NOT active: no sponsored content is shown, and none of the data processing described in this section takes place. It will only begin on a future date, and before it does we will update this Policy's "last updated" date and tell you in the Game.
When the program becomes active, here is the whole of what it will mean for your data. Advertisers and sponsors will receive only aggregated, anonymized statistics — for example, "how many players in a given country saw this banner this week". They will never receive your name, username, email, device identifier, or any other personal data, and they will never receive information about you as an individual. Aggregate statistics are only reported for groups large enough that no one can be singled out: any segment smaller than ten players is masked and not reported at all.
Minor accounts (under 18) are excluded from advertising and sponsorship measurement entirely, including from the aggregate counts — applied automatically from the age on your account (see Section 12). Adult accounts are not individually profiled for advertising either: the only processing is the aggregate counting described above, on the basis of our legitimate interest (KVKK Article 5/2-f, GDPR Article 6(1)(f)) in measuring the reach of sponsored content.
If we ever want to go beyond aggregate measurement — for example, personalized sponsored content — we will not do it under this section. Any such processing would require your separate, explicit opt-in consent, off by default, asked in the Game before anything starts; refusing it will never affect your ability to play.
We keep personal data only as long as it is needed for the purposes described in this Policy. After that, we either delete it or continue to retain it only where a lawful basis requires us to, and for the periods (or according to the criteria) set out below.
When you delete your account (see Section 11, Your Rights), the request runs through three steps. Immediately: your account is restricted — you are signed out, your profile stops being visible to other players, and the account can no longer be used to play, chat, or purchase. For the next 7 days: a grace period, during which you can cancel the deletion simply by signing back in; that one action restores the account. After the 7 days: irreversible erasure — we hard-delete the data you own across approximately 130+ user-owned tables (your game state, chat messages, direct messages, your AI behavioral memory (mindPlayerMemory), your TimeBot conversations) and we erase your email address as well. That step cannot be undone by you or by us; for very large accounts it completes through a scheduled processing chain. One narrow exception survives it: your purchase and invoice records are kept in pseudonymous form — stripped of your email and name, tied only to a transaction reference — for the statutory accounting period required by Turkish tax and commercial law.
By design, certain categories are retained even after you delete your account, because a lawful basis requires it:
Chat messages have their own automatic retention timers: direct and group messages are automatically purged after 180 days, and TimeBot AI support chats are automatically purged after 90 days, both handled by an automated process. Safety-scanning cases (Section 6A) are kept for 180 days. Operational server logs streamed to Axiom (Section 5) are redacted of direct identifiers and kept for a limited operational window of 90 days, after which they expire automatically. Google ad click identifiers (Section 3B) are deleted as soon as they have been sent, and in any case 90 days after the click.
We do not promise that everything is instantly and totally erased. We are honest that the lawfully-required records and the identity/security data described above persist after account deletion for the periods stated.
You have strong rights over your personal data, and — importantly — the Game gives you real tools to use them.
Under Article 11 of KVKK, you have the right to: learn whether your personal data is being processed; request information about that processing; learn its purpose and whether it is used accordingly; know the third parties to whom your data is transferred, in Türkiye or abroad; request that incomplete or inaccurate data be corrected; request that your data be deleted or destroyed; request that any correction, deletion, or destruction be notified to third parties to whom your data was transferred; object to a result that arises solely from automated analysis of your data; and claim compensation if you suffer damage due to unlawful processing.
Under GDPR, you have the parallel rights of access, rectification, erasure, restriction of processing, data portability, objection (including the right to object to profiling and to direct-marketing processing), and withdrawal of consent.
Right to object to profiling: because our personalization by "The Mind" relies on our legitimate interest, you have the right to object to that profiling at any time. There is a real switch for it: Settings → Account → the profiling toggle. Turning it off stops this profiling going forward and takes effect without you having to write to anyone; you can also use the channel in Section 17 if you prefer. See Section 6 for what The Mind does. If your account is under 18, this profiling never runs in the first place (Section 12).
The Game lets you exercise the core rights directly:
Requests about payment data go to Xsolla. Xsolla is an independent data controller for the payment transaction, not our processor (Sections 5 and 7). A request about the payment data it holds — the card details you entered, the billing address and identity data you gave it, its own fraud-prevention records — must be made to Xsolla, at help.xsolla.com and under its privacy policy (xsolla.com/privacypolicy); we cannot access, correct, or delete data held in its systems. If you send such a request to us, we will tell you so and help you route it, and we will still answer the part that concerns the purchase records WE hold (what you bought, when, and your billing country).
You may also contact us to exercise any of these rights, using the channel in Section 17 (Contact & KVKK Data Controller Channel). You may use an authorized agent to submit a request on your behalf; we may ask for proof of authorization and for information to verify your identity. There is no fee unless your request is manifestly unfounded or excessive. We will respond to KVKK Article 11 requests within 30 days of receipt, and to GDPR requests within one month (which we may extend by up to two further months for complex or numerous requests, telling you why). KVKK Article 11 requests should be addressed to us as the Data Controller (Veri Sorumlusu).
You also have the right to lodge a complaint. In Türkiye, you may complain to the Turkish Data Protection Authority (Kişisel Verileri Koruma Kurumu / KVKK). If you are in the EU, EEA, or UK, you may complain to your local supervisory authority (you can find the list of EU/EEA authorities at edpb.europa.eu).
Time Heroes is not directed to children under 13, and the minimum age to use the Services is 13.
When you sign up, you self-attest your age and confirm you are at least 13; accounts that do not meet the minimum age are not permitted. Being 13 or older is a condition of using the Game.
No under-13 accounts, and no parental-consent path: we do not operate a mechanism for a parent to consent on behalf of a child under 13, and we do not offer one. An under-13 account is simply not permitted — the age step at sign-up blocks it, and there is no route, form, or approval by which a parent can bring a child under 13 into the Game.
Higher local ages of digital consent: in countries where the age of digital consent is higher than 13 (for example 14, 15, or 16 in parts of the EU/EEA — such as 16 in Germany and the Netherlands, or 15 in France), you must meet that higher local age before we process any personal data that relies on your consent (such as analytics or push notifications). Below that local age, we do not rely on the user's own consent: instead of asking a child to consent, we simply keep the consent-based features switched off. We determine the applicable age from the country code described in Section 3.
Protections that apply automatically to players aged 13-17 (minor mode). If the age on your account is under 18, the following apply by default, without you having to find a setting: private-by-default social settings (direct messages and friend requests are restricted rather than open to everyone, and your presence/location within the Game is not shown); no behavioral analytics, no advertising or sponsorship segmentation, and no profiling by The Mind — the behavioral memory described in Section 6 is not built for minor accounts at all; no sale and no sharing of personal information, in the CCPA/CPRA sense, ever; a monthly spending cap for minor accounts, which we are introducing as a protection against unsupervised spending, alongside the parent/guardian consent required for a minor's purchases under our Terms of Service; and paid random-item mechanics unavailable to players under 18 where the law requires it.
If we learn that we have collected personal data from a child under 13 without a proper legal basis, we will delete that data.
If you are a parent or guardian and you believe a child under 13 has provided us with personal data, please contact us using the channel in Section 17 so we can address it.
We apply appropriate technical and organizational measures to protect your personal data, consistent with our obligations under Article 12 of KVKK and Article 32 of GDPR. These measures include access controls, pseudonymization where feasible, rate limiting, bot protection, and security and audit logging.
Where we use diagnostics, we keep them pseudonymized — for example, our crash reporting (Sentry) uses a pseudonymous heroId with personally identifying information disabled — to reduce how much personal data is exposed.
We want to be honest rather than make marketing claims: no online service can be guaranteed to be completely secure, and we do not claim to be. We work continuously to protect your data, but we cannot promise absolute security.
We work only with service providers that offer appropriate security safeguards for the data they handle on our behalf.
In the event of a personal-data breach, we will notify the competent supervisory authority — the Turkish Data Protection Board (Kişisel Verileri Koruma Kurulu) and/or the lead EEA supervisory authority — without undue delay and, where feasible, within 72 hours of becoming aware of it, and we will notify affected users without undue delay where the breach is likely to result in a high risk to your rights and freedoms, as required by Articles 33 and 34 of the GDPR and by the KVKK.
This is not an aspiration: we maintain a written internal breach-response runbook that names who is on call, how a suspected breach is triaged and contained, how the 72-hour clock is started and tracked, what the notification to the authority must contain, and how affected players are told. It is rehearsed and kept up to date, so that the commitment above has a procedure behind it rather than a promise.
We may update this Policy from time to time. When we do, we will post the updated version in the Game and/or on our website and revise the "Last Updated" date at the top of the document.
If a change is material, we may ask you to re-accept this Policy before you continue using the Game. This is tied to our consent/version mechanism (the Privacy Policy version, PRIVACY_VERSION): when the version is updated for a material change, you may be prompted to accept the new version.
The "Last Updated" date shown for this Policy is a single, consistent date that matches the current Privacy Policy version constant. Where re-consent is not required, your continued use of the Game after an update means you accept the updated Policy.
This document continues to serve as our KVKK Aydınlatma Metni (transparency notice under Article 10 of Law No. 6698) through each update.
Time Heroes is built Türkiye-first but is available globally, and this Policy is written to meet KVKK, GDPR/UK GDPR, and generic international privacy expectations at the same time.
Where your local law grants you rights beyond those described here, those rights continue to apply to you.
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you specific rights over your personal information.
Your rights: you have the right to know the categories and specific pieces of personal information we collect, use, and disclose; to request deletion of your personal information; to request correction of inaccurate personal information; to opt out of the sale or sharing of personal information; and to limit the use of sensitive personal information. You will not be discriminated against for exercising any of these rights.
No sale or sharing: we do NOT sell your personal information, and we do NOT share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We do not knowingly sell or share the personal information of consumers under 16 years of age. The sponsored-content program described in Section 9A does not change this: advertisers receive only aggregated, de-identified statistics that cannot be linked to you, which are not "personal information" and are neither a "sale" nor a "share" under the CCPA/CPRA.
Categories we collect: the categories of personal information we collect are described in Section 3 (which include identifiers such as email and account ids, commercial/purchase information, internet or game-activity information, and user-generated content). Section 5 describes the categories of recipients.
How to exercise your rights: use the self-service tools in Section 11 (Download My Data, Delete Account) or contact us at [email protected]. You may use an authorized agent to submit a request on your behalf; we may take steps to verify your identity and the agent's authorization.
For any privacy or data-protection matter — including exercising your rights and reaching us as the Data Controller — please use the contact details below.
Representatives outside Türkiye. Where we are required to designate a representative, we are doing so; until each appointment is complete we say so plainly rather than print a name that does not yet exist.
Our full controller details, for KVKK written applications, are:
To make a request under Article 11 of KVKK, please submit it to us in writing as the Data Controller, using the contact and address above. We respond to KVKK Article 11 / data-subject requests as soon as possible and in any event within 30 days of receipt, as required by the Communiqué on Application to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ). We respond to GDPR requests within one month, extendable by up to two further months for complex or numerous requests.
As noted in Section 11, you also have the right to lodge a complaint with the Turkish Data Protection Authority (Kişisel Verileri Koruma Kurumu / KVKK) or, if you are in the EU, EEA, or UK, with your local supervisory authority (list available at edpb.europa.eu).