Privacy policy

Last updated November 1, 2026

This policy explains what personal data we process when you use fiplay.app, why we process it, and your rights. It is our privacy notice under the EU General Data Protection Regulation (GDPR) and our information notice under Turkey’s Personal Data Protection Law No. 6698 (KVKK).

Who we are

Phitime İnternet Teknolojileri Limited Şirketi (“Fiplay”, “we”). You can reach us at [email protected].

What we collect

When you play without an account

• Guest ID: a random identifier stored in your browser (the fp_gid cookie). It has no name or email attached; we use it only to link your results to this device.
• Your games: the puzzles you play, your scores and times, your level progress, and when you started and finished.

When you sign in with Google or Apple

• Account details: the name, email address, email verification status, profile picture URL and account ID that your sign-in provider shares with us. If you choose to hide your email with Apple, we get Apple’s relay address instead.
• Sign-in tokens: tokens your provider gives us to confirm the sign-in. We never post anything on your behalf; we only ask for your name and email.
• Session details: the IP address and browser information (user agent) of your active sessions, kept to protect your account and prevent abuse.
• Display name: the name shown on leaderboards. By default it is the first word of your name; your full name and email are never shown publicly.

When you sign in, anything you played as a guest on that device moves to your account.

Technical logs

Our servers and providers keep short-lived technical logs, such as IP address, request time and browser information, to run the site and protect it from attacks.

Why we use it and our legal basis

• To run the games, save your results, show leaderboards and manage your account: performance of a contract (GDPR Art. 6(1)(b), KVKK Art. 5(2)(c)).
• To prevent cheating and abuse and keep the site secure: legitimate interests (GDPR Art. 6(1)(f), KVKK Art. 5(2)(f)).
• To meet legal obligations: GDPR Art. 6(1)(c), KVKK Art. 5(2)(ç).

We don’t show ads, we don’t sell your data, and we don’t use analytics or tracking tools.

Cookies

• fp_gid: guest ID, 400 days.
• better-auth.*: your sign-in session; removed when you sign out or after 90 days of inactivity.
• NEXT_LOCALE: your language choice.
• Cloudflare security cookies (for example for bot protection).

All of them are needed for the site to work. There are no advertising or tracking cookies.

Who we share it with

We share data only with providers that help us run the site, and only as much as that work needs:

• DigitalOcean: database (Amsterdam, the Netherlands).
• Hostinger: application server.
• Cloudflare: domain, security and content delivery.
• Google and Apple: only if you choose to sign in with them, to confirm your sign-in.
• Google Fonts: the site’s typeface; your browser downloads it from Google when you open a page.

Some of these providers operate outside your country, so your data may be transferred abroad. These transfers are necessary to provide the service and are made with the safeguards required by the GDPR and KVKK Art. 9. We may also share data with authorities when the law requires it.

How long we keep it

• Account details and game records: for as long as your account exists.
• Guest records: while the cookie is valid; we may delete guest records unused for 400 days.
• Session details: until the session ends, at most 90 days.

When you ask us to delete your account, your account details and game records are deleted.

Your rights

You have the right to know whether we process your data, get a copy, have it corrected or deleted, object to processing, and ask for compensation if you were harmed. Email your request to [email protected]; we reply within 30 days. You can also complain to your local data protection authority or, in Turkey, to the Personal Data Protection Authority (KVKK).

Children

Fiplay is a simple game site for everyone. Children under 13 should not create an account; if you learn that one has, email us and we’ll delete it.

Changes

We may update this policy. If a change is significant we’ll announce it on the site. The date of the last update is shown at the top of this page.