Patikafe — 101 Okey & Kart
Privacy Policy
This policy explains how we handle your personal data when you play on paticafe.com.tr (the “Site”) and in the Patikafe game apps (web, Android, iOS). The game is free and no sign-up is required, yet playing it technically requires us to process a limited set of data.
1. Data controller
Under Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the EU General Data Protection Regulation (“GDPR”), the data controller is Patikafe.
- Data controller
- Patikafe
- Website
- https://www.paticafe.com.tr/
- Contact e-mail
- [email protected]
To access, correct or delete your data, or to object to this policy, write to [email protected]. We answer every request within 30 days.
2. Data we collect
We process only the data the game needs. The Site runs no advertising, profiling or third-party tracking scripts.
- Account identity: the anonymous user id (UID) created the first time you open the game. If you sign in with e-mail/password or Google, your credentials are stored by Firebase Authentication; we never see your password.
- Player profile: the nickname you choose (max. 20 characters), the character you pick and your appearance preferences.
- Game progress: your hand wins, daily bonus timestamp, coin balance and the list of items you bought.
- Leaderboard data: the nickname, character and win count that appear on the public global leaderboard.
- In-room data: the nickname, character and chat messages shared with the people at your table. Your private hand (your tiles or cards) is sent only to you and to the server, never to other players.
- Purchase data: for in-app purchases we verify the transaction id, product id and amount through Apple's and Google's servers. Card details never reach us; payment happens entirely in the store's own checkout.
- Technical data: server logs hold the request time, path, HTTP status code and your IP address (for rate limiting and security). Our hosting provider keeps similar technical records in its own infrastructure logs.
- Data on your device: your session state, accessibility preferences and nickname are kept in your browser's or app's local storage (localStorage). This data never leaves your device.
We do not collect payment card numbers, national identity numbers, full names, addresses or phone numbers. No special-category personal data is processed.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Playing the game: creating rooms, enforcing the rules, scoring and the leaderboard | KVKK art. 5/2 (b) / GDPR art. 6/1 (b) — performance of a contract |
| Account creation, sign-in, and keeping your coin balance and purchased items | KVKK art. 5/2 (b) / GDPR art. 6/1 (b) |
| Daily bonuses, coin rewards and anti-cheat against bots | KVKK art. 5/2 (b) and 5/2 (f) / GDPR art. 6/1 (b) and (f) |
| Verifying in-app purchases and detecting refunds | KVKK art. 5/2 (b) / GDPR art. 6/1 (b) |
| Preventing fraud, spam and abuse, rate limiting and server security | KVKK art. 5/2 (f) / GDPR art. 6/1 (f) — legitimate interests |
| Debugging and measuring service quality (anonymised, aggregate logs) | KVKK art. 5/2 (f) / GDPR art. 6/1 (f) — legitimate interests |
We never use your personal data for marketing profiling, sale, or to share it with advertising networks. When you switch on a specific feature, we process data strictly to the extent that feature requires, and we never start consent-based processing without your prior approval.
4. Third parties and processors
Your data is shared only with the following providers, and only to deliver the service:
- Google Firebase (Authentication and Cloud Firestore): sign-in, coin balance, purchased items and the global leaderboard. Google's own processing terms apply.
- Apple App Store / Google Play: in-app purchases. Transactions are verified through the App Store Server API and the Google Play Developer API.
- Our hosting provider: server infrastructure for the game server, HTTP and WebSocket traffic.
- App stores and distribution channels (browser, OS vendor): limited to app updates pushed to your device and store transactions.
None of these providers resell advertising data or profile your data for their own purposes.
6. International transfers
Parts of the data processed by Firebase, the App Store and Play Store may be processed on servers outside Turkey. These transfers are carried out under KVKK art. 9 and GDPR art. 44-49 with corporate agreements providing adequate safeguards and supplementary measures; where a transfer depends on your consent, we ask for it.
7. Security
Data is transmitted over TLS/WSS encrypted connections. The game server verifies authentication tokens and grants access to your own account data only. Access is limited to the people who need it to operate the service. If we detect a personal data breach, we notify the affected users as required by law.
8. Retention
- Game data (nickname, leaderboard entries, coin balance, purchased items): kept for as long as your account exists.
- Room and game state: held in server memory and discarded when the room closes; it does not survive a server restart.
- Technical logs: kept for a short period (about 30 days) for security and debugging.
- Purchase verification records: kept for the periods required by tax and commercial law.
- Account deletion or erasure requests: completed within 30 days; all data is deleted except records we must retain by law.
9. Your rights
Under KVKK art. 11 and GDPR art. 15-22 you have the right to:
- Access your data and request information about it
- Request rectification or erasure of your data
- Request restriction of processing
- Request portability of your data to another processor
- Object to decisions based solely on automated processing (we use no such decision-making outside matchmaking and scoring)
- Object to processing based on consent, or withdraw that consent
Send your requests to [email protected]. If we refuse a request, you receive a reasoned written response. You may lodge a complaint with the Turkish Personal Data Protection Board (KVKK Kurumu) whose contact details are published on its own website. If you are in the European Union, you may also complain to your local data protection authority.
10. Children's privacy
The Site is not directed at children under 13. If a child under 13 used the game, a parent or guardian can write to [email protected] and ask for the data to be deleted. Players aged 13 to 17 need parental approval to open an account.
11. Changes to this policy
This policy may be updated when game features or the law change. The current version is always published on this page, and material changes are announced in the game.
12. Contact
Questions about how we handle data, or to exercise your rights: [email protected].
Last updated: 30 September 2026