MindoraX KVKK (Law No. 6698) Information Notice

This notice explains the purposes for which your personal data is processed in the MindoraX mobile application, with whom it may be shared, the retention and deletion practices, and your rights under KVKK.

Yürürlük tarihi / Effective date: 2026-10-19

1. Data Controller and Contact

The data controller for your personal data in the MindoraX mobile application is Parantik Yazılım LTD ŞTİ (Türkiye). You can send requests concerning your personal data to [email protected].

2. Personal Data Processed

The following data may be processed when you use the application:

• Account and sign-in information: username, e-mail address, display name, avatar, language, registration time and last sign-in time. If you choose password sign-in, your password is stored in hashed form. Firebase Authentication, Google Play Games or Apple Game Center may be used for sign-in. Firebase Authentication sends verification and password reset e-mails.
• Session and security information: the IP address and device user-agent information associated with sessions. This information is shown to you in your active sessions.
• Game information: game sessions and results, levels and XP, streaks, quests, training programs, tournaments, rankings, multiplayer rooms, invitations, in-game currencies and inventory.
• Preferences: sound, music, vibration, language, theme, preference to turn notifications on or off, and daily reminder time.
• Device and notification information: push notification token, platform, language and time zone; in-app notification inbox.
• Purchase information: Apple or Google store transaction ID and product ID, and purchase event type, currency, amount and environment information received from RevenueCat. The RevenueCat user ID is your MindoraX account ID. We do not process your payment card data.
• AI coach information: chat message text is sent to the AI provider to generate a response; we do not store the message text. Only the daily request count is retained. The usage limit is 20 messages per day and 1000 characters per message. If you enable the optional setting, which is off by default, a summary of your game performance over the last 30 days may also be sent.
• Family feature information: family name, description, icon and color, members' display names and parent/child roles, and invitations. Family members can see each other's levels and stars.
• Technical crash information: technical crash data processed by Firebase Crashlytics in production releases of the application.

The application is designed for people aged 13 and older. Those under 18 should use it only with the permission of a parent or guardian. Age verification is not performed.

3. Purposes and Legal Bases for Processing

Data necessary to create and manage accounts, sign in, provide game features and manage purchases is processed for the performance of a contract. Ensuring security, preventing fraud, investigating technical crashes and improving the service are based on legitimate interests. Where applicable, fulfilling legal obligations is also a basis for processing.

Sending the optional 30-day game performance summary to the AI coach depends on your explicit consent. Your explicit consent to push notifications is obtained through the operating system's permission dialog; you can withdraw this consent at any time in the app settings or device settings. No marketing messages are sent.

4. Collection and Sharing of Data

Data is collected electronically through your account, game, chat, purchase and settings activities in the application; the device and sessions you use; and sign-in and store services. Relevant data may be shared with the following recipients to provide the service:

• Google LLC: for Firebase Authentication, Firebase Cloud Messaging and Firebase Crashlytics services.
• Google Cloud Vertex AI (Gemini): to generate AI coach responses; this service is used in the EU region.
• RevenueCat: for subscription and purchase management.
• Apple App Store and Google Play: for payments and sign-in with Game Center or Play Games.
• Cloudflare: for DNS, security, proxy and CDN services.
• Application server and database hosting provider: for operation of the service.

Because some of these providers may process data outside Türkiye, international data transfers may occur. These transfers rely on appropriate safeguards under KVKK and applicable GDPR rules.

5. Retention and Deletion

You can request deletion of your account through the Profile/Settings section of the application or at https://mindoraxgame.com/account/delete/. Upon request, your sessions are terminated immediately. Data is deleted after a 30-day waiting period; during this period, the support team may cancel the deletion request.

During deletion, your account, sessions, settings, device information, game progress, in-game wallet, purchase records and family/invitation data belonging to you are deleted. Your Firebase account is also deleted. Administrator audit records are pseudonymized; game results remain only as anonymous aggregate statistics.

Administrator audit records are retained for at most 730 days, and server logs for at most 90 days. Backups are currently not enabled.

6. Your Rights Under KVKK

You can contact [email protected] regarding your rights under Article 11 of KVKK and, where applicable, GDPR. You can submit requests to learn whether your data is processed, the purpose of processing and its recipients, to access your data, to have incorrect information corrected or your data deleted, to restrict processing, and to object to processing. Data export requests are also handled by e-mail; there is no separate export feature in the application. You can lodge a complaint with the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu). Users in the EU can also contact the relevant supervisory authority.