Privacy Policy

1. Data Controller and Contact

The data controller for your personal data under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") is Guess League.

Our single contact channel for any question, request or data protection application relating to this notice is support@guessleague.net. This document fulfils our disclosure obligation under Article 10 of the KVKK and is at the same time our privacy policy and our cookie notice.

2. Personal Data We Process

The list below is the complete set of data Guess League actually processes. If a type of data is not on this list, we do not process it.

2.1 Identity and contact data

• Email address — the identity of your account; used for sign-in, verification and password reset.

2.2 Account and profile data

• Username — the unique name of your account; visible to other users.
• Display name — the name shown in standings and rooms.
• Avatar selection and avatar colour — the visual choice shown on your profile. No photograph is uploaded; you pick one of the ready-made options.

2.3 Authentication data

• Password hash — your password is not stored in plain text; only an irreversible hash of it is kept.
• Google account identifier — if you use the sign-in with Google route, the persistent identifier Google assigns to your account is stored.
• Email verification time — when you verified your address.
• Session refresh tokens — an irreversible hash of the tokens created so that you are not asked for your password every time, together with their validity period and whether they have been revoked. The token itself is not stored.

2.4 Usage and gameplay data

• Sign-in times — when you last signed in.
• Activity day and streak counters — the last day you were active and how many consecutive days you have played.
• Predictions — which prediction you entered for which match and when, and the points you received.
• Room and league memberships — which rooms and leagues you joined, and the rooms you created.
• Trophies — the symbolic achievement marks you won and when you won them.
• Match comments — what you wrote about a match, in which league or room, and when. Your comment is visible together with your username to the other users who can see it. If you delete your comment, the record becomes hidden.
• Comment likes — which comments you liked.

2.5 Consent and permission records

• Consent records — which document, which version of it, when and by which route (registration form, post-sign-in acceptance screen) you accepted.
• Marketing consent and withdrawal times — if you consented to announcement emails, the timestamp on which consent was given, and if you withdrew it, the timestamp of withdrawal.

2.6 Security data

• Failed sign-in counter and account lockout time — used to temporarily lock the account after repeated incorrect password attempts.
• Suspension time — the time a measure was applied to your account, if any.
• IP address — the IP address your requests come from is processed for rate limiting (throttling excessive requests from the same source) and abuse prevention. Rate limiting uses that address momentarily, in short-lived in-memory counters. The IP address may also appear in server logs at warning and error level; those logs are held in the technical log table in the database and are deleted automatically. We do not keep your IP address as a persistent record attached to your profile: there is no history list showing the addresses your account connected from.

2.7 Data we do not process

Guess League does not process your full name, national identification number, telephone number, postal address, date of birth, location data, payment or card details, biometric data, health data or advertising identifiers. Because no payment is taken within the Service, no financial data is ever created. We use no advertising or analytics trackers.

3. Purposes of Processing and Legal Bases

Below we set out, category by category, why we process each type of data and which legal basis we rely on.

• Creating and managing your account (email address, username, display name, avatar selection and colour) — Purpose: to open an account for you and display your profile. Legal basis: necessity for the conclusion and performance of the contract (KVKK Art. 5/2-c).
• Authentication and session management (password hash, Google account identifier, email verification time, sign-in times, session refresh tokens) — Purpose: so that only you can access your account and so that your open session can be maintained. Legal basis: performance of the contract (KVKK Art. 5/2-c); for email verification also our legitimate interest (KVKK Art. 5/2-f) in preventing accounts being opened with addresses that do not exist.
• Operating the game, scoring and standings (predictions, room and league memberships, trophies, activity day and streak counters) — Purpose: to record and score your predictions, build league and room standings, and award trophies. Legal basis: performance of the contract (KVKK Art. 5/2-c). Processing this data is the Service; without it the game does not work.
• Match comments and comment likes (comment text, the match and context, time, likes) — Purpose: to run the social part of the Service; to show your comment to the users in the same league or room and to count likes. Legal basis: performance of the contract (KVKK Art. 5/2-c) — comment areas are part of the Service, and whether you write is up to you. For reviewing and hiding comments that breach the rules we additionally rely on our legitimate interest (KVKK Art. 5/2-f).
• Security, abuse prevention and rate limiting (failed sign-in counter, lockout time, suspension time, IP address) — Purpose: to block account takeover attempts, multiple accounts and bot use, and attempts to overload the Service. Legal basis: legitimate interest (KVKK Art. 5/2-f) in protecting your account, other users and the infrastructure. The data processed for this purpose is kept to a minimum and is not retained permanently.
• Essential service communication (email address) — Purpose: verification codes, password resets and notices that directly affect your account. Legal basis: performance of the contract (KVKK Art. 5/2-c). These messages are not marketing and cannot be switched off while your account is open.
• Marketing and announcement emails (email address) — Purpose: to send announcements about new features and events. Legal basis: your explicit consent only (KVKK Art. 5/1). This consent is optional and withholding it does not prevent you from using the Service. You may withdraw it at any time by writing to support@guessleague.net; your permission is switched off upon your request. Once we start sending marketing emails, every marketing email we send will also carry an unsubscribe link. Withdrawal does not affect messages lawfully sent before it.
• Keeping consent and permission records (which document, which version, when and by which route you accepted; marketing consent and withdrawal timestamps) — Purpose: to be able to prove that we met our disclosure and consent obligations and when consent was given or withdrawn. Legal basis: necessity of processing for the establishment, exercise or protection of a right (KVKK Art. 5/2-e) and our legal obligation under applicable legislation (KVKK Art. 5/2-ç).

We do not rely on your consent when processing your account data — because processing it is necessary for the performance of the contract, the legal basis is the contract itself. Explicit consent is collected only for the marketing email item above. This means that when you withdraw your consent your account keeps working; only the announcement emails stop.

4. Transfers of Personal Data

4.1 Our service providers

Guess League does not sell, rent or share your personal data for advertising purposes. Your data is shared only with the following service providers, and only as far as necessary for the Service to operate:

• Google (Google Ireland Limited / Google LLC) — if you use the sign-in with Google route, authentication is performed through Google. In that flow Google discloses your email address and account identifier to us; the data we transfer to Google consists of the sign-in request itself. If you do not use the Google route, no data goes to Google.
• Cloudflare (Cloudflare, Inc.) — Cloudflare Turnstile is used for bot protection on the registration and sign-in forms. During this check Cloudflare processes the IP address of your request and browser/session signals. Purpose: to block automated account creation and password-guessing attacks.
• Amazon Web Services (AWS) — our servers and database are hosted in the AWS eu-central-1 (Frankfurt, Germany) region. All data listed in section 2 above is stored on that infrastructure.
• Amazon SES (AWS) — verification codes, password resets and, if you have consented, announcement emails are sent through AWS SES. For this purpose your email address and the content of the message are transferred to SES.

Apart from these, your personal data may be disclosed only to competent public authorities where required by applicable law and upon a duly made request.

4.2 Transfers Abroad

This section is set out separately because part of your data is processed outside Türkiye. Under Article 9 of the KVKK, transfers abroad are as follows:

• AWS eu-central-1 (Frankfurt, Germany) — all of your account, gameplay and security data is hosted here. In other words, the data listed in section 2 is stored on servers located in Germany. Reason: hosting the Service.
• AWS SES — email is sent through the same infrastructure; your email address and message content are processed abroad in that context.
• Cloudflare — bot protection runs on a global network, so during the check your IP address and browser signals may be processed on servers outside Türkiye. Reason: security and abuse prevention.
• Google — if you use the sign-in with Google route, authentication takes place on Google's global infrastructure. Reason: providing the sign-in method you requested.

These transfers abroad are technically necessary in order to provide the Service, and the data transferred is limited to the purpose in each item. Transfers are made in accordance with the conditions in Article 9 of the KVKK and within the framework of the standard contractual commitments of the relevant providers. To obtain further information about a transfer abroad or the basis relied upon, write to support@guessleague.net.

4.3 Third parties we transfer no personal data to

We receive data from a football data provider (api-football) for fixtures and results, and from Open-Meteo for weather information. No personal data is transferred to these services; we only ask them for data about a given league or match. Who our users are, what they predicted or where they are is never disclosed to these services.

5. Retention Periods and Account Deletion

As a rule we keep your data for as long as your account is open. Item by item:

• Account, profile and authentication data — while your account is open; deleted as described below when you delete your account.
• Predictions, room and league memberships, trophies — kept for the integrity of league and room history (see below).
• Match comments and comment likes — kept for the integrity of the discussion they belong to; if you delete your comment, the record becomes hidden.
• Security counters and lockout time — reset once their purpose is served (when the lockout expires).
• Server logs — technical logs are kept for as long as is necessary for security and debugging purposes, and are deleted once that purpose no longer exists.
• Consent and permission records — kept for evidentiary purposes for the applicable limitation period.
• Session refresh tokens — for their validity period; deleted when you sign out or delete your account.

5.1 What happens when you delete your account

You may delete your account yourself at any time from the Delete account section inside the application. To prevent accidental deletion you are asked to confirm by typing your username. The action cannot be undone.

We describe what happens plainly, without making a promise we cannot keep:

When you delete your account, your email address, username, profile images, and login information are deleted; your account can never be accessed again.

Your past prediction and standings records are kept disconnected from your identity, so the past results of other users playing in the same league don't change.

The legal basis for that retention is our legitimate interest (KVKK Art. 5/2-f): ensuring that the past standings and trophies of the other users who competed in the same league and rooms are not broken retroactively.

In concrete terms, deletion does the following:

• Your email address, username, display name, avatar selection and colour, password hash, Google account link, email verification and sign-in times, activity day and streak counters, and security counters are deleted.
• All three sign-in routes (password, Google, email) are closed; your open sessions end immediately.
• Your past predictions, trophies and room memberships remain, disconnected from your identity; where your name appeared in standings, "Deleted user" is shown instead.
• Rooms you created are not deleted, because deleting them would also destroy the history of the other users in those rooms; the creator field shows "Deleted user".
• The match comments you wrote and the likes you gave are not deleted either, for the same reason; the author of the comment is shown as "Deleted user". If you want a particular comment of yours removed, you can delete it yourself before deleting your account.
• Consent and permission records remain in place as proof of which document version you accepted and when; they no longer contain information identifying you. Your marketing permission is switched off.
• The email address and username become available again, so you may register anew in the future; the new account has no access to the old account's data.

A closure with the same effect may also be applied by us in the cases described in section 8 of the Terms of Service. If you believe your expectations regarding deletion have not been met, you may write to support@guessleague.net.

6. Your Rights under Article 11 of the KVKK

Under Article 11 of the KVKK you have the right to apply to the data controller and:

1. learn whether your personal data is being processed;
2. request information if it has been processed;
3. learn the purpose of processing and whether the data is used in line with that purpose;
4. know the third parties in Türkiye or abroad to whom your data is transferred;
5. request rectification of data that is incomplete or inaccurate;
6. request erasure or destruction of your data within the conditions of Article 7 of the KVKK;
7. request that rectification, erasure and destruction be notified to the third parties to whom the data was transferred;
8. object to an adverse outcome produced solely by analysis carried out through automated systems;
9. claim compensation if you suffer damage as a result of unlawful processing.

How to apply: send your requests to support@guessleague.net from the email address registered to your account; we may ask for further information to verify your identity. We conclude applications free of charge within thirty days at the latest; if the process entails an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your request is refused, your right to complain to the Personal Data Protection Board is reserved.

Some of these rights can be exercised inside the application without any application to us: you can correct your profile details, delete your comments and delete your account. To withdraw your marketing consent, it is enough to write to support@guessleague.net.

7. Cookies and Local Storage

Guess League contains no advertising cookies and no analytics trackers. Everything we use is strictly necessary for the operation and security of the Service:

• Session tokens (local storage) — after you sign in, session and refresh tokens are held in your browser's local storage (localStorage) so that you are not asked for your password on every page. They are removed when you sign out.
• Language and interface preferences (local storage) — stored in your browser so that your chosen language is remembered; they are not sent to the server.
• Cloudflare Turnstile security cookie — placed by Cloudflare so that bot protection can work during registration and sign-in. Its only purpose is to answer the question "is this request coming from a human"; it is not used for advertising or profiling.

Because all of these items are strictly necessary and no personalised advertising or tracking takes place, no separate cookie consent is collected and no cookie banner is shown. If you block local storage and cookies in your browser settings, you may not be able to sign in to the Service.

8. Age Limit and Children's Data

The Service is intended for users aged 18 and over. We do not knowingly process the personal data of anyone under 18. If we learn that a user under 18 holds an account, we close the account and delete the data in line with section 5. If you become aware of such a situation, please let us know at support@guessleague.net.

9. Changes to This Notice and Renewed Acceptance

This notice is updated whenever our processing activities change. Every update is published under a new version label; earlier versions remain accessible in the archive, and a record is kept of which version you accepted and when.

When a material change is published, you will be asked to accept the new version when you next open the application. You cannot continue into the application without accepting; if you do not wish to accept, you may delete your account. The current text of this notice is always shown from the same single source in the application and on the promotional website — there is no second copy that can fall out of date.

10. Not Gambling

Guess League is a free game of skill and entertainment: there are no cash prizes, no prizes in kind, no deposits and no withdrawals; trophies and badges are symbolic. The Service is not a game of chance, gambling or a betting service. For our detailed explanation see the Not Gambling page, and for the full set of your rights and obligations see the Terms of Service.

11. Language

The Turkish version of this notice prevails. The English version is a translation provided for convenience only. In the event of any difference or conflict between the two texts, the Turkish text applies.