Datenschutzerklärung

This policy explains what personal data we process when you use fiplay.app, why we process it, and your rights. It is our privacy notice under the EU General Data Protection Regulation (GDPR) and our information notice under Turkey’s Personal Data Protection Law No. 6698 (KVKK).

Who we are

Phitime İnternet Teknolojileri Limited Şirketi (“Fiplay”, “we”). You can reach us at [email protected].

What we collect

When you play without an account

• Guest ID: a random identifier stored in your browser (the fp_gid cookie). It has no name or email attached; we use it only to link your results to this device.
• Your games: the puzzles you play, your scores and times, your level progress, and when you started and finished.

When you play an embedded game on another site

• Some sites put the daily puzzle on their own pages. That game uses no cookies and no Google Analytics; to match your results to you, it stores a random guest ID in the frame’s own storage (localStorage). That storage belongs only to the game on that site, so each site counts as a separate guest. Your game records are the same as above and appear on the daily leaderboard as a guest.
• If you follow the link at the end of the game to fiplay.app, a short-lived, single-use code moves those records to your guest ID or account here. The code travels in the part of the link after #, so it isn’t sent to the embedding site or anywhere else.

When you sign in with Google or Apple

• Account details: the name, email address, email verification status, profile picture URL and account ID that your sign-in provider shares with us. If you choose to hide your email with Apple, we get Apple’s relay address instead.
• Sign-in tokens: tokens your provider gives us to confirm the sign-in. We never post anything on your behalf; we only ask for your name and email.
• Session details: the IP address and browser information (user agent) of your active sessions, kept to protect your account and prevent abuse.
• Display name: the name shown on leaderboards and on result cards you share. By default it is the first word of your name; your full name and email are never shown publicly. When you share a result, anyone who opens the link sees that day’s game, your time, your rank and your display name.

When you sign in, anything you played as a guest on that device moves to your account.

Usage statistics (Google Analytics)

Google Analytics measures which pages you open, how long you stay, your device and browser type, your approximate location (country, city) and where you came from. Google Analytics doesn’t store IP addresses.

• If you allow it: it stores cookies in your browser, so repeat visits by the same visitor can be told apart.
• If you don’t: no cookies are stored and no identifier that recognises you is used. Only limited, anonymous signals such as page views are sent to Google, which doesn’t show them as people in reports and uses them only to estimate overall statistics.

Technical logs

Our servers and providers keep short-lived technical logs, such as IP address, request time and browser information, to run the site and protect it from attacks.

Why we use it and our legal basis

• To run the games, save your results, show leaderboards and manage your account: performance of a contract (GDPR Art. 6(1)(b), KVKK Art. 5(2)(c)).
• To prevent cheating and abuse and keep the site secure: legitimate interests (GDPR Art. 6(1)(f), KVKK Art. 5(2)(f)).
• To meet legal obligations: GDPR Art. 6(1)(c), KVKK Art. 5(2)(ç).
• Cookie-based usage statistics to improve the site (Google Analytics): with your consent (GDPR Art. 6(1)(a), KVKK Art. 5(1) and 9(1)). You can withdraw it at any time with the “Cookie settings” link at the bottom of the page.
• Anonymous, cookie-free measurement when you don’t consent: our legitimate interest in improving the site (GDPR Art. 6(1)(f), KVKK Art. 5(2)(f)).

We don’t show ads and we don’t sell your data. The only analytics tool we use is Google Analytics; its advertising features are turned off.

Cookies

• fp_gid: guest ID, 400 days.
• better-auth.*: your sign-in session; removed when you sign out or after 90 days of inactivity.
• NEXT_LOCALE: your language choice.
• fp_theme: your light or dark theme choice, 1 year.
• fp_consent: whether you allowed Google Analytics, 180 days.
• Cloudflare security cookies (for example for bot protection).
• _ga, _ga_*: Google Analytics, only if you allow it; up to 2 years.

Apart from the Google Analytics cookies, all of them are needed for the site to work. There are no advertising cookies.

Who we share it with

We share data only with providers that help us run the site, and only as much as that work needs:

• DigitalOcean: database (Amsterdam, the Netherlands).
• Hostinger: application server.
• Cloudflare: domain, security and content delivery.
• Google and Apple: only if you choose to sign in with them, to confirm your sign-in.
• Google Fonts: the site’s typeface; your browser downloads it from Google when you open a page.
• Google Analytics (Google Ireland Limited and Google LLC): usage statistics.

Some of these providers operate outside your country, so your data may be transferred abroad. These transfers are necessary to provide the service and are made with the safeguards required by the GDPR and KVKK Art. 9. We may also share data with authorities when the law requires it.

How long we keep it

• Account details and game records: for as long as your account exists.
• Guest records: while the cookie is valid; we may delete guest records unused for 400 days.
• Session details: until the session ends, at most 90 days.
• Usage statistics in Google Analytics: up to 14 months after your last visit.

When you delete your account from your profile page, or ask us to, your account details, sessions and game records are deleted permanently.

Your rights

You have the right to know whether we process your data, get a copy, have it corrected or deleted, object to processing, and ask for compensation if you were harmed. If you’re signed in, you can download your data, change your display name and delete your account from your profile page. For anything else, email [email protected]; we reply within 30 days. You can also complain to your local data protection authority or, in Turkey, to the Personal Data Protection Authority (KVKK).

Children

Fiplay is a simple game site for everyone. Children under 13 should not create an account; if you learn that one has, email us and we’ll delete it.

Changes

We may update this policy. If a change is significant we’ll announce it on the site. The date of the last update is shown at the top of this page.