1. Controller and contact
The controller is Yusuf Samed AYDIN; TechDevAYDIN is the brand name. Contact techdevaydin@gmail.com. This policy describes the website, optional Pyramidion analytics and privacy communications that you initiate.
2. Website operation
Vercel serves pages; the TURKTICARET.NET account serves assets at cdn.techdevaydin.com. Fonts are served locally with no automatic Google Fonts connection. Optional Vercel Web Analytics is disabled in this release. Browser storage can remember language and website analytics preferences, as explained in the cookies/storage notice. Necessary delivery and language functions are assessed for proportionate service necessity and legitimate interests.
Vercel website delivery and Gmail correspondence that you initiate are separate from gameplay events. These providers can process connection/communication data on their international service infrastructure. Steam, Discord, YouTube and WhatsApp apply their own practices when you follow their links; sending a prepared WhatsApp message is your separate action.
3. Optional game analytics
Events can include checkpoint arrival and game-clock time; attempt start/end/duration and success, failure or incomplete/invalid outcomes; retries and resets; and stone-break game-world coordinates, defined reason codes and obstacle relationships. Build, map, settings version, difficulty and party size accompany them. Defined active-pusher counts, strong-push or buff states may provide limited necessary context. Coordinates are game-world centimetres, not real-world location. Client game-clock times and durations use milliseconds and are separate from server receipt time.
The permitted fields exclude SteamID, username, real name, email, account/profile links, persistent device/advertising identifiers, fingerprinting, chat, voice, images/video, unnecessary hardware information and file paths. Free-form text/logs and unlimited metadata are rejected, as are unexpected fields. Fixed technical identifiers must not encode player identity or text.
Optional balance and level-difficulty analytics relies on consent under KVKK Article 5(1) and, where applicable, GDPR Article 6(1)(a). Reading a notice or accepting a general privacy policy does not authorize analytics. Refusal or withdrawal must not prevent play. Short-lived application security and rate limiting are separate from analytics consent and rely on necessity and rights balancing under KVKK Article 5(2)(f) and, where applicable, GDPR Article 6(1)(f).
Sharing is off by default and optional; events are sent only after an affirmative choice for the current notice and separate scope text. This webpage does not create a consent record. Withdrawing through the game preference must stop further sending and allow deletion using the relevant session authority. A shared team session must respect everyone’s current choice; deleting it removes the entire team’s contribution within that session. A declaration received by the API alone does not prove a real informed choice; the game integration must implement that flow.
4. Sessions and data classification
Random session identifiers group observations for a short period, deduplicate retries and support deletion. A verification digest is stored instead of the raw session credential; credentials must not enter URLs, logs or reports. Sessions are not linked through a persistent person/device identifier. Random identifiers and gameplay context alone do not guarantee anonymity and can constitute personal data together with connection information.
No persistent player profile or public individual gameplay history is created. Data is used to understand balance and level difficulty, not to target advertising.
5. Providers and recipients
The game API and MySQL/MariaDB database run on the TURKTICARET.NET Web Eko account. Its official hosting statement identifies Türkiye. Account support also stated that the offered JetBackup service is in Türkiye and that there is no overseas support team; that backup service is not active on this account. These are provider statements, not an independent country guarantee for every infrastructure copy or administrative access. Gameplay events are not automatically forwarded to Vercel or Gmail.
Events and reports are restricted to authorized administration and provider access necessary for hosting/database service. Vercel/Google provide website and correspondence services. Data may be provided to competent authorities where an obligation requires it, within that scope; no unlimited gameplay archive is created for this purpose.
6. Retention, deletion and recovery
Raw events and session context are retained for no more than thirty days from session creation, or deleted sooner on request. Upload authority lasts twenty-four hours; authority to delete that session lasts until its original thirty-day deadline. Expired records are excluded from reports and physically removed by cleanup scheduled at least hourly. Deletion removes events, attempt relationships and their report contribution. Minimal revocation entries and the local deletion journal may remain until new sessions’ original expiry to reject retries; they contain no raw token or gameplay event. Reports use retained raw records; there is no indefinite player profile or separate aggregate store.
No new application analytics backups have been created since 15 October 2026. Earlier encrypted copies contain synthetic data only; they expire within their original maximum seven-day limit and are not restored. Recovery initializes an empty analytics database and new journal while the service is in maintenance; old session credentials become invalid. This application policy does not eliminate possible provider infrastructure copies or statutory/security records.
7. Connection and infrastructure records
During a connection the server can see the IP address, requested address, time and technical headers. The application does not log raw IP addresses, tokens or request bodies. A seven-day retention setting is saved for account access-log archives in cPanel; the panel reports a 24-hour raw-log processing interval. This setting does not control the provider’s separate security, system or control-panel records. Their retention follows the provider’s published statutory and purpose-based criteria; an account-specific numerical maximum has not been confirmed for every category. We therefore do not promise deletion of all infrastructure records within seven or thirty days.
The provider’s general notice adds six to twelve months for disputes to statutory or purpose-based retention. This is not an exact period for every API log category or a deletion guarantee from us. Privacy-request correspondence is not automatically assigned the gameplay thirty-day limit; handling the request and applicable rights/obligations are considered.
8. Limits of international flows
Gameplay events are sent directly to the API hosted in Türkiye. A person supplying data directly to this service is distinct from subsequent transfers to a different recipient. The gameplay sharing choice is not used as blanket permission satisfying website/email transfer requirements. We do not give an absolute country or full-compliance guarantee for every copy/access beyond the provider’s statements.
9. Age and preferences
Pyramidion is intended for ages sixteen and over. An age rating does not verify a player’s age. Applicable age/capacity requirements and any necessary parental conditions must be handled by the game integration; analytics must not be sent without an eligible valid choice. The API does not request age or birth date, and refusing analytics must not block play.
10. Rights and requests
Contact techdevaydin@gmail.com to ask whether data is processed, request information/access, correction, erasure or recipient notification, and exercise applicable rights to object, restrict processing, portability or complain to a supervisory authority. KVKK requests are answered within thirty days; where GDPR applies, normally within one month, with any applicable extension explained. The appropriate submission method and proportionate verification depend on the request. Never email a raw session token or put it in a URL. Since we do not link sessions to accounts or names, we may be unable to locate a record by your identity if session authority is lost. We do not request unnecessary SteamIDs, birth dates or identity copies.
Optional checkpoint journey and departure observations
The 2026-10-16.2 scope adds observed starts, terminals, outcomes and active durations of checkpoint attempts and visits when a supporting client has this feature enabled. Observed attempt, failure and incomplete counts, failed active time and visit active time are cumulative counters. These count active gameplay independently of a rewound game timer; reset/loading waits, connection pauses and wall-clock time are excluded. Missing origins or traces are not treated as complete history.
A random run_id links API sessions only within one continuous game context, team and consent scope. A random checkpoint_visit_id links the effort to pass one checkpoint pair; sequence is shared across both new event types. These are not person/device identifiers and must not create a persistent player profile. Linking another transport session also requires a previously associated session's valid authority; run_id alone grants no access or deletion authority. An earlier sharing choice is not silently extended to this new scope.
An observed host main-menu or quit request may be reported as main_menu/quit_game. This does not prove that menu travel or operating-system exit completed. Roster changes, world closure, game completion and other technical boundaries have separate reasons. Silence is not confirmed departure or gameplay failure, and one member leaving does not prove the entire team abandoned the course.
Administrator reports derive attempt distributions, active durations and departure boundaries by checkpoint pair and game conditions. Rule-based indicators such as high observed failures/time followed by a host exit request, if shown, are labelled inferred candidates with thresholds and missing-observation limits. They are not psychological motives or verified rage quits. No player profiles or exit survey are added.
The linked run retention deadline is the original 30-day deadline of its first associated session; transport rotation cannot extend it. A valid, unexpired bearer of any associated session deletes raw events, links and report contributions across that run's associated sessions. Unrelated runs/sessions are unaffected. Limited run revocations prevent late revival until that same original deadline. Application backups remain disabled and recovery starts empty.