Padooko — Privacy Notice

This is an English translation for convenience. If it differs from the Turkish original, the Turkish version prevails.

1. Data controller

İlkin Reha Öztürk (a natural person; Küçükçiğli Mahallesi, Çiğli/İzmir) operates Padooko and is the data controller for the data listed in this notice. For questions and requests: [email protected].

2. What data we process

In Padooko, the account is kept on the server; only small preferences (sound, server address, session key) remain on the phone and in the browser. Data processed on the server:

• Account: stable name (chosen by you), email address (if you registered with email), an irreversible hash of your password (the password itself is not stored), and, if you signed in with Apple or Google, the user identifier that account provides to us and (if you chose to share it) your email address.
• Session and device: the list of your open sessions — device model (e.g. "iPhone16,2"), app version and platform, and the session's opening and last-seen time. Not the session key itself but its hash is stored.
• Notifications: if you allowed notifications, your device's push notification address (APNs/FCM token) and its registration time; one address per device, at most five per account.
• Purchases: for purchases made through the store (App Store / Google Play), the store-side transaction or subscription identifier, product identifier, date, trial-period information, and renewal status; for purchases made through the website, Xsolla's order number, product identifier, amount, and date. Your card, bank, and billing information never reach us; payment takes place in the store or on Xsolla's payment page.
• Game data: your horses, your virtual-currency account ledger, race results and rankings, your daily login streak, notification and event history, the status and events of your Plus membership, and the first- and last-seen times and count of store/paywall screens you have viewed (product interaction).
• Technical and security: the IP address of your requests — for rate limits (too many registration/login attempts from the same address) and for logging rejected, slow, or failed requests; error reports sent by the app itself (error message, stack trace, which screen it occurred on, platform and version, and, if you are signed in, your account identifier).
• Country: only the country code (e.g. TR) is derived from the IP address of your requests and kept on your account — to see which countries the game is played from through aggregate counts. The IP address itself is not stored for this purpose; no city or sensitive location is derived. Source: address allocation data published by the regional internet registries (NRO, CC BY 4.0).
• Email codes: the hash of the one-time codes sent for registration, verification, and password reset, and their expiry time (30 minutes).

• Rewarded video: for rewarded videos you choose to watch, the app uses the Google AdMob ad SDK; if you consent, the SDK sends the device's advertising identifier (the App Tracking Transparency prompt on iOS, Google's consent form in the EU/UK) and ad interaction data to Google. Only Google's signed "reward earned" notification (your account identifier, the reward type, the transaction identifier) and the day's counters reach our server.

Sensitive location (GPS), contacts, and photo data are not processed; no location is derived other than the country code above; there is no analytics SDK.

3. Why, and on what legal basis

4. Who we share with

We do not sell your data. The following providers take part in processing to deliver the service:

• Apple (Sign in with Apple, App Store purchases and subscriptions, iOS push notifications — APNs).
• Google (Sign in with Google, Google Play purchases and subscriptions, Android push notifications — Firebase Cloud Messaging; AdMob rewarded videos — advertising identifier and ad interaction, only with your consent; when ads are switched on, the app loads the next video in advance; Google's privacy policy and consent/ATT settings apply). Firebase is used only for notifications.
• Resend (sending registration/verification/reset emails): only the email address and code.
• Xsolla (USA), Inc. (the store on the website; as the seller — merchant of record — it collects payment, calculates tax, and handles refund and payment support): when you make a purchase on the website, your name, email address, country, IP address, part of your payment method (e.g. the last digits of the card), and order information pass to Xsolla; Xsolla processes these under its own privacy policy as an independent data controller. Only Xsolla sees the full card information. In-app purchases do not go through Xsolla.
• Hetzner Online GmbH (server hosting, Falkenstein/Germany): everything on the server resides here.
• Cloudflare, Inc. (domain name, DNS, DDoS protection and content delivery in front of the server): all traffic between the app/website and the server passes through Cloudflare; IP address and request headers are processed, and cookieless page-performance measurement (Cloudflare Web Analytics) is done on the website.

Some of these providers are located abroad (the server is in Germany). Data is not shared with anyone else except under a legal requirement (a court order, a request from a competent authority).

5. How long we keep it

• Account and game data: for as long as your account is open.
• Open sessions: a device session unused for 90 days is automatically dropped.
• Ledger entries: entries older than 30 days are folded per account into a single "carry-forward" entry; the balance does not change.
• Records of finished races: deleted 48 hours after the season table is frozen.
• Email codes: 30 minutes.
• Backups: taken at most once an hour, with the last 24 copies kept (roughly one day); a deleted account also drops out of the backups within this period.
• Server logs (request and error records containing IP address): until the log space on the server fills up; when it fills, the oldest records are automatically deleted. When you delete your account, the data tied to your account is deleted immediately as described in Section 6; the lines remaining in the logs carry only the random account identifier and the IP address, and are deleted once the space fills up.

6. Deleting your account

You can delete your account yourself from within the app (Profile → Delete account) or on the web (Settings → Delete account); for accounts opened with Apple/Google, for security you will be asked to have signed in again within the last 10 minutes. Deletion cannot be undone: horses, sessions, notification addresses, email, and identity information are deleted; the remaining virtual balance falls to the game's treasury and is not paid out in any form. For the consistency of the ledger, ledger entries written with the account identifier (a random string), along with race results and frozen rankings, remain under the name "Deleted stable"; these do not identify you. If your horse is in a race that is running or has been called, deletion waits until the race finishes.

7. Your rights

Under KVKK Art. 11, you have the right to: learn whether your data is being processed, request information if it has been, learn whether it is used in accordance with its purpose, know the third parties it has been transferred to, request correction if it has been processed incompletely or incorrectly, request its erasure or destruction, request that these actions be notified to the third parties it was transferred to, object to a result against you arising from analysis by automated systems, and claim compensation if you have suffered damage. Requests are made to [email protected]; they are answered within 30 days at the latest. Your right to complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) is reserved.

In Padooko, decisions (race results, rewards, rankings) are calculated automatically by the game's rules; these are not profiling based on your personal data, but the game itself.

8. Children

Padooko is intended for ages 13 and up; this limit matches the App Store's age rating (13+). Those under 13 must not use the game. The app sells virtual currency for real money; those under 18 must make purchases with the permission of a parent or guardian. Parents can require purchases to be approved through the device's store settings ("Ask to Buy" in Apple Family Sharing, parental controls in Google Play).

9. Cookies and local storage

The web version does not use its own cookie; Cloudflare in front of it may leave a strictly necessary cookie (cf_clearance) that remembers when a security check was required. Only the sound preference, server address, and session key are kept in the browser's local storage. These are not sent to third parties; "Log out" deletes the session key. In the app version, the session key resides in the device's secure storage (iOS Keychain; on Android, encrypted with an Android Keystore key).

10. Changes

When this notice changes, the new version is published at the same address, and significant changes are announced within the app. Last updated: 26 September 2026.