Privacy Notice

Version 6 · Effective date: 03.11.2026 (3 November 2026)

This notice explains how your personal data is processed when you play the Valor of Kingdoms game (“the game”). It is prepared under Article 13 of the EU General Data Protection Regulation ((EU) 2016/679, GDPR) and Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK). It applies to the game, the game's web pages (including the account page) and support correspondence.

1. Data controller

The controller of your personal data is the individual who develops and publishes the game. In this notice they are called “we”.

You can use this email address for all questions and requests about your personal data. The same address applies if you live in the European Union.

2. What data we process

2.1 Account information

• Google account number: the permanent number Google gives your account. It is used to recognise your account.
• Email address: your email address as verified by Google. It is updated each time you sign in to the game with Google; signing in to the account page does not update it. If Google has not verified it, it is not stored. It is stored encrypted in the database; next to it we keep a one-way, keyed hash so that an administrator can search for the full address (see Security).
• Age group: “13-15” or “16+”. Your year and month of birth are used only to work out your age and are not stored (see Children and age).
• Your in-game account number and name: the name is assigned at random when you first sign in; you can change it from your profile. Your name cannot be the same as another player's.
• Name history: each time your name changes, the old and new name, when it changed and who changed it (you; the system, because two accounts had the same name; or the administration, resetting a name that breaks the rules).
• Terms of Use acceptance: which version of the Terms of Use and this notice you accepted, when, and where (at sign-in or in the game).
• Times: when your account was created and when you last signed in.
• Account status: if your account has been banned, the duration and the reason (the reason is shown to you in the game); if you have been muted, only the time the mute ends (the reason for a mute is not kept).

The sign-in token Google sends may also contain your name and the address of your profile picture. We do not store or use them.

2.2 Game data

• Your game progress: your city, buildings, troops, resources, Diamonds, commanders, items, quests, achievements and in-game mail.
• Gift codes: the gift codes you used and when you used them.

2.3 Sign-in and connection records

• Each time you sign in to the game or the account page, and each time you connect to or leave the game server: time, IP address, device model and operating system type (e.g. “samsung SM-A515F - Android”; “web” on the account page) and the type of event (sign-in, connected, left).
• Your open session: only an irreversible hash of the session key, the time the session was opened and will end, and the IP address and device it was opened from.

IP addresses are stored encrypted in the database. Next to each one we keep a one-way, keyed hash of the IP address so that, in future, accounts signing in from the same IP address can be found.

2.4 Cheating and abuse flags

The server automatically flags requests that break the game's rules or do not match the state of the game. The record contains the time, the type of flag and a short technical detail (e.g. which game command).

2.5 Server system log

The server's technical log keeps error and event records. Game events record only the account number; failed sign-in attempts may also record the IP address.

All connections to the game and the web pages pass through a proxy server running on our server (software that encrypts the connection and passes it on to the game server). If a connection error occurs, the proxy server may write the IP address and device information (e.g. device model, browser or app information) to its own error log. This log is also deleted within at most 90 days, together with the server system log.

2.6 Administrator action log

Administrator actions that change your account (e.g. gifts, corrections, mutes, bans, removal from the game, account deletion) are logged: time, the administrator who acted, the type of action, your account number and, if any, the reason or a note (e.g. the duration, the ban reason). Administrators looking at your personal data is also logged: opening your account details and exporting your data (only the time, the administrator, the type of action and your account number are written) and the developer searching for a player by email address (the searched address is not written, only how many results were found). Your name, email address and IP address are not written to this log.

When your account is deleted, the reasons and notes written up to then in the records about your account are deleted; the type of action, the time, the administrator who acted and your account number remain until 2 years have passed.

2.7 Ban evasion record

Kept only if a banned account is deleted: a one-way, keyed hash of the Google account number (made with the server's secret key), the time the ban ends and the time the record was created. Your Google account number or email cannot be recovered from this hash; it only matches when someone tries to sign in again with the same Google account.

While the ban lasts, no new account is opened with the same Google account: the sign-in is refused with a message that the ban is still running and when it ends. Your Google account number and email are not stored during that sign-in. The record is kept until the ban ends, for at most 2 years (2 years for a permanent ban); it is then deleted and a new account can be opened with the same Google account.

2.8 Purchase records

Real-money purchases are not open in the game yet, so no purchase records are kept. Once purchases open, they will be made only through Google Play and the following will be kept: the Google Play order number, the product bought, the time of purchase and the status of the purchase (e.g. refunded). The order number will also be kept in your game save so the same product is not delivered twice. Google Play will take the payment; your card or other payment details will not reach us. This notice will be updated before purchases open.

2.9 Notifications

The game's notifications (e.g. when a building upgrade finishes) are local notifications set up on your device. The game schedules them on your device; no data is sent to us or to Google for this. You can turn notifications off in the game under Settings › Notifications, and the notification permission in your phone's settings.

If push notifications from the server are added, the following will be kept only if you are 16 or over and give permission: the device token issued by Google's Firebase Cloud Messaging service so that notifications can be sent to your device.

2.10 Support messages, surveys and support correspondence

In-game support messages: if you send us a message from the game under Settings › Support › Support and feedback, we keep: the topic of the message (suggestion or request, complaint, bug, purchase, account or player report), its text, when you sent it, the game version, your device model and operating system, your City Center level and your account number. Our reply arrives in your in-game mail; the reply is kept together with your message. Your message and the reply are encrypted in the database. Do not write personal information (phone number, address, password) in your message.

Surveys: taking part in in-game surveys is optional. If you answer a survey, we keep the answers you chose, the texts you wrote, when you answered and your account number; your answers are encrypted in the database. We review survey results in aggregate to improve the game; the administrator can see written answers together with your account number and in-game name. The survey reward does not depend on your answers. We never give rewards in exchange for a store rating or review.

Email: if you email us, we receive your email address, your message and any attachments; the messages are stored with our email service provider (see section 5). The email buttons in the game add the following to the email draft: the player ID on your device (starting with “VK-”), your in-game name, the game version, your device model and operating system, your City Center level and your power (your VIP level with the VIP support button). You can see, change or delete this information before sending.

2.11 Data we do not collect

We do not collect your real name, phone number, location, contacts, photos, advertising ID or payment details. We do not store your date of birth: the year and month of birth you choose in the age question are used only to work out your age and are not saved anywhere.

2.12 Data that stays only on your device

Your game settings, the player ID on your device, a copy of your age group, the number of the Terms of Use version you accepted on this device and the game's local measurement and error logs are stored only on your device; apart from the information added to your support email, they are not sent to us. Your session key is also stored on your device; the game sends it only when connecting to the server, to prove who you are (the server keeps only an irreversible hash of it).

The game's Android backup is turned off: this data is not included in Google's cloud backup, and it is not copied to a new phone by Android's device-to-device transfer tool either.

When your account is deleted or your session expires, your session key, the player ID on your device, your age group and the local measurement logs are also deleted from your device. Everything is deleted when you uninstall the game.

3. Purposes and legal bases

Our legitimate interest: keeping the game fair, secure and running for all players. We have weighed this interest against your rights: we keep the records for a short time, make them available only to authorised administrators and do not use them for any other purpose. You can object to this processing (see Your right to object).

We do not use your data for advertising, marketing or profiling. We do not send marketing emails.

4. Retention periods

When the period ends, the data is deleted or destroyed. For records on the server, this happens through an automatic clean-up that runs several times a day.

5. Who receives your data

We do not sell or rent your data, and we do not use it for advertising. The game has no ad networks, third-party analytics or tracking tools; the analytics, diagnostics and hardware statistics reporting of the Unity engine the game is built with is also turned off. Your data may go only to the following recipients:

• Google: Sign-in with Google and Google Play (downloading the game and, once they open, purchases) are Google services. When you use them, Google processes your data under its own privacy policy (policies.google.com/privacy). During sign-in our server sends no data about you to Google; it only checks the signature of the sign-in token Google sends, using keys that Google publishes openly. Once purchases open, Google Play will be asked about each purchase to verify it. If push notifications from the server are added and you give permission, notifications will be sent through Google's Firebase Cloud Messaging service using your device token.
• Hosting provider: Our server runs at a hosting provider in a data centre in Türkiye. The provider supplies only the infrastructure (server and network); it may not use your data for its own purposes.
• Email service provider: messages sent to destek@valorofkingdoms.com are stored on [DESTEK E-POSTASININ TUTULDUĞU HİZMET VE ÜLKE].
• Competent public authorities: If required by law (e.g. by a court or prosecutor's order), only the data requested may be given to the competent public authorities.
• Other players: In the parts of the game shared with other players (e.g. rankings, alliances), your in-game name and game information (e.g. your power, your city) may be visible to other players. On the shared world map, your player name, alliance tag, City Center level, civilization and your city's location on the map are visible to other players. Your email address, IP address and Google account number are never visible to other players.

On our side, only the developer and the administrators (moderators) they authorise can access your data, and only as far as their work requires. Moderators cannot see email addresses and see only part of IP addresses (e.g. 203.0.113.*). Only the developer can see full IP addresses and email addresses. The developer and moderators can read in-game support messages in order to answer them; only the developer can see survey answers.

Community pages opened from the game (e.g. Discord, YouTube) do not belong to us and are subject to their own privacy rules.

6. Storage location and international transfers

• Your data is stored and processed on our server in Türkiye.
• If you live in the EU or EEA: when you play, you send your data directly to our server in Türkiye. The European Union has not adopted an adequacy decision for Türkiye. We process your data with the safeguards described in this notice, and your rights under the GDPR apply in full.
• Google: Google may process data on its servers outside Türkiye (e.g. in the USA). With Sign-in with Google and Google Play, data passes directly between you and Google. For the data we will transfer to Google ourselves (purchase verification once purchases open; the notification token if push notifications from the server are added and you give permission), we will put in place the safeguards required by KVKK Art. 9 and the GDPR's international transfer rules before these transfers start.
• Support emails: messages you send to destek@valorofkingdoms.com are stored on [DESTEK E-POSTASININ TUTULDUĞU HİZMET VE ÜLKE]. If this service stores the messages outside Türkiye, your messages and email address are transferred to that country; for this transfer we put in place the safeguards required by KVKK Art. 9 and the GDPR's international transfer rules (e.g. a standard contract with the provider).

7. How we collect data and what is required

We collect your data automatically and electronically: through the game app and our server (in-game actions, sign-in and connection, the age question), from Google when you sign in with Google (Google account number and email), by email when you write to us, and from Google Play once purchases open.

• A Google account number is required to create an account; without it you cannot play.
• You need to answer the age question; without answering it you cannot enter the game (the server does not let an account with an unknown age group into the game). If you never answer it, your account is deleted 30 days after your last sign-in.
• The game is online; your IP address is technically required for the connection.
• Notifications are optional; if you turn them off, the game works the same way.

8. Automated decisions

We do not profile you. Cheating flags are created automatically, but penalties, mutes and bans are decided by an administrator. The server applies only the following rules on its own; they follow from the Terms of Use:

• If your connection sends a large number of invalid requests, your connection is closed; you can reconnect.
• If your age group is not known, you cannot connect to the game; you are first asked to answer the age question.
• If you state in the age question that you are under 13, your account is deleted immediately. After you choose your year and month of birth, your choice is shown to you once more and you are asked to confirm it; a deleted account cannot be restored, so choose carefully.
• An account whose age question you never answered is deleted 30 days after your last sign-in.
• If a banned account was deleted, no new account is opened with the same Google account while the ban lasts. The ban itself was decided earlier by an administrator.
• An account that has not been signed in to for 3 years is deleted (see Retention periods).

If you think your connection was closed by mistake or the ban evasion rule was applied to you wrongly, write to us: a person will review the case and take your view into account. An account deleted under the deletion rules (under 13, age never given, not signed in to for 3 years), however, cannot be restored: its data is deleted permanently.

9. Your rights and how to use them

Your rights under the GDPR

• Access: to learn what data we process about you and get a copy.
• Rectification: to have incorrect or incomplete data corrected. You can ask for your in-game name or other data to be corrected by writing to the support address. Your email comes from your Google account and is updated the next time you sign in to the game with Google.
• Erasure: to have your account and data deleted.
• Restriction: to have the processing of your data stopped in certain cases.
• Portability: to receive your data in a structured, machine-readable file (JSON).
• Objection: to object, on grounds relating to your particular situation, to processing based on legitimate interests (see Your right to object).
• Withdrawing consent: to withdraw at any time the permission you gave for processing based on your permission (e.g. if push notifications from the server are added). Withdrawal does not make earlier processing unlawful.
• Complaint: to complain to a data protection authority (see below).

Your rights under KVKK Article 11

• to learn whether your personal data is processed;
• if it is, to request information about it;
• to learn the purpose of processing and whether it is used for that purpose;
• to know the third parties in Türkiye or abroad to whom it is transferred;
• to request correction if it is incomplete or incorrect;
• to request deletion or destruction under the conditions in KVKK Article 7;
• to request that correction, deletion and destruction be notified to the third parties to whom the data was transferred;
• to object to a result against you that arises from analysing the processed data solely by automated systems;
• to claim compensation if you suffer damage because of unlawful processing.

How to use them

• To download your data and delete your account: in the game under Settings › Account, or at https://oyun.valorofkingdoms.com/hesap (you sign in with your Google account). The account page also works while the server is under maintenance. Deletion happens immediately.
• The downloaded file (JSON) contains: your account information (your in-game account number and name, sign-in type, Google account number, email, age group, when your account was created and when you last signed in, ban and mute information), your open session (when it was opened and will end, IP address, device), your sign-in and connection records, your cheating flags, your gift code use, your in-game support messages and replies, your survey answers and your game progress. The email and IP addresses, messages and survey answers that are stored encrypted appear in readable form in the file.
• For your data in the administrator action log and for all other requests: write to destek@valorofkingdoms.com, if possible from the email address registered to your account. You can also send your request in writing to [POSTA ADRESİ]. We may ask for additional verification to make sure the request comes from the account owner.
• We answer your request within 30 days at the latest and, as a rule, free of charge.

Complaints

• Türkiye: you can complain to the Personal Data Protection Board (www.kvkk.gov.tr). Under KVKK Article 14 you must first apply to us. If we reject your request, you find our answer insufficient or we do not answer in time, you can complain to the Board within 30 days of learning our answer and in any case within 60 days of the date of your request.
• EU and EEA: you can complain to the data protection authority of the country where you live, work or where you believe the infringement took place (list of authorities).
• If you live in another country, the rights your local law gives you also remain unaffected.

10. Account deletion

You can delete your account in the game under Settings › Account, or at https://oyun.valorofkingdoms.com/hesap. Deletion happens immediately and cannot be undone. If you are in the game, your session is closed. We recommend downloading a copy of your data before deleting.

Your account is also deleted in the same way in these cases: if you state in the age question that you are under 13 (immediately), if you never answer the age question (30 days after your last sign-in), and if you do not sign in to the game for 3 years.

Deleted immediately: your account information (your Google account number, email, age group, in-game name), your game progress and everything in it (including Diamonds), your gift code use, your in-game support messages and replies, your survey answers, your name history, your Terms of Use acceptance records, your open session, your sign-in and connection records and your cheating flags. The database also overwrites the content of deleted records in its file with zeros (secure delete); old copies that may remain in the database's temporary file are removed during regular clean-up.

What remains (only for the reasons below; deleted when the periods end):

• Administrator action log: the type and time of administrator actions taken on your account and of administrators looking at your account, and the administrator who acted, with the account number only (without your name, email or IP address), until 2 years have passed. Reasons and notes written to these records before your account was deleted are deleted at the time of deletion.
• Ban evasion record: only if your account was banned when it was deleted; until the ban ends, for at most 2 years (2 years for a permanent ban).
• Purchase records: if you made purchases after purchases opened, for the period required by tax and accounting law.
• Server system log (including the proxy server's error log): deleted automatically within at most 90 days.
• Support correspondence (email): until its retention period ends.

The session key, player ID, age group and local measurement logs on your device are also deleted: immediately if you delete in the game, and the next time you open the game if you delete on the account page.

Deleting your account does not delete your Google account or your history on Google Play; use Google's tools for those. If you sign in again with the same Google account, a new, empty account is created. If your account was banned when it was deleted, no new account can be created with the same Google account until the ban ends, for at most 2 years (2 years for a permanent ban).

11. Children and age

The game is not intended for children under 13. If the law of your country sets a higher age limit and you have not reached it, you may play only with the consent of your parent or guardian.

• Age question: If your age group is not known yet (e.g. on your first sign-in), you are asked for your year and month of birth before you enter your city; the day is not asked. You cannot enter the game without answering: the server does not let an account with an unknown age group connect to the game. Before it is sent, the month and year you chose are shown to you once more; you confirm them if they are right, or change them if not. Your age is worked out on the server; your year and month of birth are not saved anywhere. When in doubt, the younger age is chosen: if it is your birth month, your birthday is treated as not yet reached.
• What is stored: only your age group, “13-15” or “16+”. Because your date of birth is not stored, your age group does not change on its own later.
• If you are under 13: your account and all its data are deleted immediately; you cannot play the game.
• If you never answer the age question: your account and all its data are deleted 30 days after your last sign-in.
• If you are under 16 (13-15): you are not offered features based on your permission (consent); for example, if push notifications from the server are added, you will not be asked for that permission. At the moment the game has no processing based on your permission: the game's notifications are local notifications set up on your device and send no data to us (see 2.9).

We do not knowingly collect data from anyone under 13. If we become aware of an account of someone under 13, or of someone below the age limit in their country without parental consent, we delete the account and its data. If you think your child opened an account without permission, write to us.

12. Security and data breaches

• All connections between the game, the web pages and the server are encrypted (HTTPS/TLS).
• The database is not exposed to the internet; only the server itself can access it.
• Your email address, IP addresses, in-game support messages and survey answers are stored encrypted in the database (AES-256-GCM). The encryption key is kept in a settings file separate from the database, with restricted access; someone who gets hold of the database file cannot read them without the key.
• For searching and matching, only one-way, keyed hashes (HMAC-SHA256) of the email address, the IP address and (in the ban evasion record) the Google account number are used. Without the key, nobody can find the original data from these hashes.
• Only an irreversible hash of your session key is stored. The web key you receive on the account page is valid for only 15 minutes and is kept only in the server's memory.
• The content of deleted records is overwritten with zeros in the database file (secure delete).
• Only authorised administrators can enter the admin panel, using two-step verification; every administrator action is logged. Opening a player's account details, exporting their data and searching for a player by email are also logged. Moderators cannot see email addresses and see IP addresses only in partly hidden form.
• Records are deleted automatically when their retention periods end.

No system is completely secure, but we take the technical and organisational measures needed to reduce the risks.

Data breaches: If a security breach affects your data, we will notify the Turkish Personal Data Protection Board and, if players in the EU are affected, the competent data protection authority within 72 hours of becoming aware of it. We will also inform affected players as soon as possible, by an in-game announcement or by writing to their registered email addresses.

13. Web pages

Our web pages do not use advertising or tracking cookies. The account page saves nothing in your browser; the web key stays only in the page's memory while the page is open. The “Sign in with Google” button on the account page loads Google's script; Google may use its own cookies at that point.

14. Changes

We may update this notice as the game or the law changes. The number and effective date of each version are shown at the top of the page. We will announce updates that significantly change how your data is processed in the game before they take effect; if the Terms of Use or this notice change significantly, you will be asked in the game to read and accept the new version. If new processing requires consent, we will ask for your permission separately.

This notice is available in Turkish and English (Gizlilik ve Aydınlatma Metni).

15. Contact