1. Data controller
RUBİNUM TEKNOLOJİ TİCARET LİMİTED ŞİRKETİ, the developer and operator of the game MASAL, is the data controller under Turkish Personal Data Protection Law No. 6698 (KVKK).
For all questions, requests and applications: [email protected]
2. Data we process
Account: your email address, an irreversible hash of your password, the account name derived from your email, language preference, registration and last-login times, and the version of the agreements you accepted.
Game: character names, class, level, experience, Gold, inventory and item movements, quest progress, hunting and combat records, crafting sessions, market listings and trades, and ranking records.
Communications: chat messages, private messages, mailbox, friend and block lists, reports you submit, support requests and responses to them.
Device and connection: platform (Android/iOS), device model, operating-system version, app and patch versions, device language, last IP address and last-seen time.
Notifications: if you allow notifications on your device, your push notification token and platform information.
Avatar (optional): if you upload a photo for your character, a square crop of the image. The photo is converted on the server to a 512×512 JPEG and all EXIF metadata, including location, is removed during this conversion; the original file you uploaded is not retained.
Security: rate-limit counters for sign-in and registration attempts, bot-suspicion indicators arising from gameplay pace, administrative actions applied to your account and the record of the official who performed them.
Data we do not process: location, contacts, calendar, microphone, identity and address information, or payment-card details. Your photo library is accessed only when you initiate an avatar upload and grant permission. The game does not use third-party advertising networks or advertising identifiers.
3. Purposes and legal grounds for processing
- Formation and performance of a contract (KVKK Art. 5(2)(c)): creating the account, operating the game, saving progress and providing support.
- Legitimate interests (KVKK Art. 5(2)(f)): combating cheating and bots, preventing abuse, securing the service and diagnosing failures.
- Explicit consent (KVKK Art. 5(1)): sending notifications and uploading an avatar. You may withdraw your consent at any time by disabling notifications in Settings or removing your avatar.
- Legal obligation (KVKK Art. 5(2)(ç)): duly made requests from competent authorities.
4. Parties with whom we share data
We do not sell your personal data or share it with anyone for advertising purposes. We use the following service providers to operate the service:
- Server and database hosting.
- Content-delivery network and file storage for the game's art and data packages.
- Notification-delivery infrastructure, receiving only the notification token and the content of the notification sent.
- App stores for distribution of the app and, if enabled in the future, purchase processing.
We also share data with competent authorities where legally required.
5. Information visible to other players
Your character name, class, level, avatar, ranking position, market listings and messages posted in chat channels are visible to other players.
Your email address, device information and IP address are never shown to other players.
6. Retention periods
- Chat messages: 48 hours.
- Activity stream: 7 days.
- Mailbox: 1 month.
- Item-movement records: 90 days.
- Account and game progress: while the account remains open.
- Device records, bot-suspicion indicators and administrative actions: for a reasonable period for security and audit purposes.
When you delete your account, your account, characters and associated records are permanently deleted, your avatar files are removed from storage and all session tokens are revoked.
7. Deleting your account
You may delete your account from within the game: Settings → Delete Account. You will be asked to confirm your password.
Deletion cannot be undone; your characters, items and all progress will be lost.
8. Your rights
Under Article 11 of the KVKK, you have the right to:
- Learn whether your personal data is processed and, if so, request information about its processing.
- Learn the purpose of processing and whether the data is used in accordance with that purpose.
- Know the third parties in Türkiye or abroad to whom data is transferred.
- Request correction if data is incomplete or inaccurate.
- Request deletion or destruction under the conditions set out by law.
- Request that correction, deletion and destruction be communicated to third parties to whom the data was transferred.
- Object to a result against you arising from analysis of processed data exclusively by automated systems.
- Claim compensation if you suffer damage due to unlawful processing.
Send your application to [email protected]; we will respond within 30 days at the latest. Your right to lodge a complaint with the Turkish Personal Data Protection Board remains reserved.
9. No automated decisions
The bot and cheating monitor only collects indicators; an indicator is not an accusation.
A human always decides whether a sanction will be imposed on your account. Your account is not closed solely by a decision of an automated system.
10. Security
- All traffic between the game and server is encrypted with TLS.
- Your password is not stored as plain text; an irreversible hash is retained.
- Access to the administration panel is IP-restricted and two-factor authentication is mandatory; every administrative action is logged.
- The administration panel's direct write access to player accounts, characters and items is disabled at database level.
11. International transfers
The servers of service providers we use for hosting, content delivery and notification delivery may be located outside Türkiye.
Such transfers are made within the framework of Article 9 of the KVKK and only to the extent necessary to provide the service.
12. Children's privacy
Persons under 13 may not use the game or create an account.
Persons under 18 may use the game only with the consent of a parent or legal guardian. If we learn that an account belongs to a person under 13, we will close the account and delete the data. You may report such a situation to [email protected].
13. Changes
This document may be updated. The current version and effective date are shown at the top of this page.
If a material change is made, you will be notified in the game and your consent will be requested again where necessary.