Privacy Policy and KVKK Information Notice
This notice explains how personal data is processed when you use the Tribün mobile app, tribun.store, and the related services (“Tribün”). The data controller is Fırat Kaplan. Contact: fyrat91@gmail.com. Processing is governed primarily by Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”).
Data we process
- Account and profile: username, favourite team, optional display name, avatar, title, chat style, and—only if you add it—your email address for account protection and sign-in.
- Device and security: a random device key whose hash lets you return without a password; on Android, an irreversible hash of the Android identifier to prevent mass account creation and ban evasion; and one-time Apple App Attest or Google Play Integrity results when a new account is created.
- Transfer code: only a hash of the code you create. We cannot read the original code.
- Game and participation: predictions, Career XP and Match XP activity, streaks, matches and stands joined, stage turns, votes, reputation, rankings, and badges.
- Content and social data: stand and private-room messages, reactions, goal ratings, room challenges, friendships, blocks, and reports.
- Audio and video: transmitted in real time only when you enable your microphone or camera. Stage audio is never recorded. A private room is recorded only when the owner starts recording and you expressly consent; a visible recording indicator is shown.
- Purchases: product, purchase and renewal dates, store transaction identifier, price, and currency supplied through RevenueCat. Apple or Google takes payment; we never receive card details.
- Notifications and technical data: push token, platform and preferences if enabled; short-lived IP data for abuse prevention and rate limiting; and hashed session credentials.
We do not process your location, contacts, advertising identifier, or photo library. We use no third-party advertising, analytics, or tracking tools and offer no real-money betting.
Purposes and legal bases
- Creating and protecting your account, signing you in, sending verification codes, and providing predictions, XP, rankings, stage, rooms, friendships, purchases, restores and refunds: performance of the user agreement (KVKK Art. 5/2-c) and, for sales records, legal obligation (Art. 5/2-ç).
- Sending match, goal, stage-turn and friendship notifications you enable: performance of the agreement. You can turn them off in Profile or device settings.
- Moderation, filtering abuse and hate speech, reviewing reports and appeals, preventing fraud, mass accounts and ban evasion, and maintaining security: legitimate interests (Art. 5/2-f) and legal obligations.
- Recording a private room so its owner can make clips after the match: your explicit consent (Art. 5/1). You may withdraw from recording at any time; future audio and video will not be captured.
Service providers and international transfers
We share only what is necessary with Google Cloud (hosting and Frankfurt storage), Vercel (website), Resend (email codes), LiveKit (real-time calls and optional room recordings), RevenueCat, Apple and Google (purchases and device verification), and Expo, Apple and Google (notifications). Their servers may be abroad; transfers use the safeguards required by KVKK Art. 9. Match data comes from a sports-data provider to which we send no personal data. We do not sell or rent data.
Retention and deletion
Core data is retained while your account is open. Deleting it in Profile → Permanently delete my account or on the web immediately removes your profile, predictions, XP history, messages, reactions, friendships, stage records and push tokens; backups are cleared within 30 days. Purchase records are de-linked and retained only as required for financial, legal, refund and store obligations.
Login codes last 10 minutes; IP rate-limit data up to 1 hour; accounts without a username 7 days; device hashes for permanently moderated accounts 1 year; blocked unpublished messages 30 days for appeals. Private-room recordings are permanently deleted 60 minutes after the match, or 90 minutes after the owner’s one extension, or immediately when the owner deletes them. Only the owner can view the recording. Clips are downloaded directly and are not kept by Tribün.
Website
tribun.store uses no cookies, analytics or tracking. Vercel may keep short technical logs for security and delivery. Information entered on the account-deletion page is sent directly to the Tribün API solely to perform deletion.
Your rights
Under KVKK Art. 11 you may ask whether and how your data is processed, request access and correction, learn recipients, request erasure or destruction and notification to recipients, object to adverse automated results, and seek compensation for unlawful processing. Email fyrat91@gmail.com; we respond within 30 days.
Children, security and changes
Tribün is not intended for anyone under 13. Connections are encrypted; codes, device keys and session keys are stored as hashes and session keys rotate. We change the date above when this notice is updated and announce material changes in the app.