Privacy Policy
Effective date: 30 September 2026 (box orders tracked in the admin panel, payment receipts read; previous version 29 September 2026)
This is a translation. The Turkish Gizlilik Politikası ve KVKK Aydınlatma Metni is the legally binding version.
- We use no cookies, analytics, advertising or tracking code.
- Our server logs do not record visitors' IP addresses. The only exception is requests to known attack paths, which are kept for 7 days for security.
- Fonts and images are served from our own server; your visit is not passed to third parties.
- Profiles (name, avatar, age group) and favourites created in the web game stay on your own device and are never sent to us.
- When you order a box, the details needed for invoicing and delivery are stored on our own server so we can track the order; the Turkish ID / tax number is encrypted (section 3.6).
1. Data controller
The data controller under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") is:
- Company
- THINKIPLAY TEKNOLOJİ ANONİM ŞİRKETİ ("Thinkiplay")
- Address
- Kazımdirik Mah. Üniversite Cad. Yaşar Üniversitesi No: 37-39A, Bornova / İzmir, Türkiye
- Tax ID number
- 8430905523
- Trade registry
- İzmir Trade Registry · 266960
- MERSİS number
- 0843090552300001
- info@duygudedektifi.com
2. Scope
This policy covers the duygudedektifi.com website, the Duygu Dedektifi web game under this domain, the Duygu Dedektifi Android app on Google Play and the box order form on this site. The app is published on Google Play by Thinkiplay, and Thinkiplay also sells the board game through the order form on this site. Thinkiplay (section 1) is the data controller for all of these.
3. What we process and why
3.1 When you visit the website
To operate the site and diagnose errors, our server keeps a technical record of each request: date and time, requested address, response code and bytes sent. No IP address, browser information or referring page is written to this log. A record in this form does not identify you.
3.2 Security log
When a request is made to well-known addresses that do not exist on our site and are probed by
automated attack tools (for example /.env, /wp-admin or addresses ending
in .php), we record that request's IP address, date and time, requested address
and response code. Repeated requests from the same IP address within a short time are
automatically blocked for 24 hours. Ordinary visitors never request these addresses, so this log
contains only attack attempts.
- Purpose: keeping the site and server secure
- Legal basis: KVKK Art. 5(2)(f) — legitimate interest of the data controller, provided it does not harm your fundamental rights and freedoms
- Retention: 7 days, then deleted automatically
3.3 Web game
The game requests card content from our server by sending only the selected age group (3-6 or 7+). The following information created by the game is stored only in your browser's local storage (localStorage) and is never sent to us:
| Information | Why |
|---|---|
| Profile name, avatar, age group | Telling players apart and showing age-appropriate content |
| Favourite cards | Returning to cards you liked |
| Randomly generated device identifier | Keeping profiles on the same device separate; never leaves the device |
| Music on/off preference | Remembering your choice |
You can use a nickname instead of the child's real name. To delete this information, clear the site data for duygudedektifi.com in your browser settings. Because we have no access to it, you do not need to contact us to have it deleted or provided to you.
3.4 Android app
The app creates no account and does not ask for a name, email, phone number, location, photos or an advertising ID. The profile name, avatar, age group, favourites and game progress are stored only on the device; device backup and device-to-device transfer are disabled for this data. Only the following is sent to our server:
| Data | When and why | Retention |
|---|---|---|
| Age group and card language | On launch, to fetch the latest cards. Contains no identifier. | Not stored |
| Device code — a random number the app generates on first launch; not a hardware identifier | To check whether the full-version licence is active on this installation | For the life of the licence record (below) |
| Trial start — the device code and the date the trial started; nothing else | If the app runs as the full version for a set period after first launch (trial period), so that the period does not restart when the app is deleted and reinstalled | Up to 12 months after the trial ends; then deleted automatically |
| Google Play purchase token and product ID | When the full version is purchased, to verify the purchase with Google and restore the licence after reinstalling. The token does not contain your name, email or payment details. | For the life of the licence record |
| Institution code | When a code provided by an institution (school, nursery, clinic) is entered or its QR code is scanned, to match it to the institution's licence | The code itself is not stored; the link between the device code and the institution licence is kept for the life of the licence record |
- Legal basis: KVKK Art. 5(2)(c) — performance of the full-version service (a purchased or institution-provided licence); Art. 5(2)(f) legitimate interest for limiting code attempts.
- Licence record retention: while the licence is valid; deleted within 12 months at the latest after a refund, cancellation or the end of an institution licence. The trial start record is deleted automatically within 12 months after the trial ends.
- Payment: Purchases are handled entirely by Google Play; your card and payment details never reach us. Google's privacy policy applies to Google's processing.
- QR scanning: the Google Play services code scanner is used; the app does not request camera permission and does not receive or store camera images. Only the scanned code text is passed to the app.
- Security: to limit code attempts, the requesting IP address is kept in server memory only as a counter for 15 minutes and is not written to any log. Licence request addresses are not written to the server access log.
- Deleting the licence and trial records: email info@duygudedektifi.com with the first 8 characters of the device code shown in the app's Parent section. Deleting the licence record switches off the full version on that device.
3.5 Institution panel (for institution administrators)
The administrator of a licensed institution (school, preschool, clinic, etc.) manages the institution's licences in the panel at duygudedektifi.com/kurum. The panel is only for institution administrators; no accounts are created for children or app users.
| Data | Why | Retention |
|---|---|---|
| The institution administrator's username and the email address registered with the licence | To identify the panel account; to send invitation and password reset links | While the account exists; deleted when the account is deleted or at the latest 12 months after the institution licence ends |
| An irreversible hash of the password (scrypt), last sign-in time | Secure sign-in | For the life of the account. The password itself is never stored. |
| Staff email address (to which the institution sends a licence code) | To deliver the licence code to that person by email | Not written to the database; the panel keeps only the time a code was sent. So that delivery can be traced, the address stays in the mail server's sending log for 7 days and is then deleted automatically. |
- Legal basis: KVKK Art. 5(2)(c) — performance of the licence agreement with the institution; codes are sent to staff on the institution's instruction and on its behalf (the institution is the data controller for its staff's data).
- Security: to limit sign-in and password reset attempts, the IP address is kept in server memory only as a counter for at most one hour and is not written to any log. Institution codes are stored encrypted.
- Email: messages are sent from a duygudedektifi.com address by our own mail server (the same server, in Germany); no third-party email service is used (see section 5).
3.6 Ordering a box
When you order the board game with the form at duygudedektifi.com/siparis (shipping within Türkiye only), we ask for:
| Data | Why |
|---|---|
| Name, email, phone | To take the order, send payment details and contact you about delivery |
| Billing address; for personal invoices the Turkish ID number, for company invoices the company name, tax office and tax number | To issue an invoice as required by tax law |
| Delivery address and recipient's name (if different) | To ship the box |
| Order note (optional) | To meet your request |
| Details read from the bank transfer receipt: payer's name, amount, description, date | To find which order a transfer belongs to |
- How it is kept: the order is stored in the database on our own server for payment and delivery tracking and is visible only in the admin panel, which only authorised administrators can access. The Turkish ID and tax number are stored encrypted. The order is also emailed to the siparis@duygudedektifi.com mailbox on our own mail server.
- Payment check: the holder of the receiving account forwards the bank's transfer receipt to dekont@duygudedektifi.com. Our server reads the payer's name, amount, description and date and matches them to the order; the receipt file itself is not kept. For a paid order, the shipping and invoice details are emailed to the people preparing the shipment; when it ships, you receive the tracking number by email.
- Legal basis: KVKK Art. 5(2)(c) — conclusion and performance of the sales contract; for invoice data Art. 5(2)(ç) — compliance with a legal obligation (Tax Procedure Law No. 213).
- Transfers: name, address and phone go to our contracted courier for delivery; invoice data go to our e-invoice service provider and accountant, only for this purpose. The shipping and invoice notification for a paid order is read through the seller's staff email service (Google Gmail).
- Retention: unpaid or cancelled orders are deleted automatically after 90 days, completed orders two years after delivery (the limitation period for defective goods under Consumer Protection Law No. 6502, Art. 12). Receipt details that match no order are deleted after 90 days. Invoices and accounting records are kept separately for the statutory period (Turkish Commercial Code Art. 82 and Tax Procedure Law Art. 253).
- Security: to prevent abuse of the form, the sender's IP address is held in server memory only as a counter for at most one hour and the email address for at most one day; neither is logged. No third-party CAPTCHA service is used.
- Payment: by bank transfer; the site never asks for or processes card details.
3.7 When you contact us
If you contact us by email, post, phone or social media, the contact details and message you share are used only to respond to your request (KVKK Art. 5(2)(c) and 5(2)(f)) and are kept afterwards only as long as legal retention obligations require.
4. Cookies and similar technologies
duygudedektifi.com does not use cookies. There is no analytics (such as Google Analytics), advertising, social media plug-in or tracking pixel. The local storage used by the web game works only for the functions above and only on your device, so we do not show a cookie consent banner.
5. Transfers
We do not sell, rent or share personal data for marketing. The website and game are hosted on our server in a Hetzner Online GmbH data centre in Germany; the security log in section 3.2 and the app's licence records are therefore processed on that server abroad. When the full version is purchased, the purchase token is sent to Google's (Google LLC / Google Ireland Ltd.) Play Developer API for verification. Emails sent by the institution panel (invitations, password resets and licence code messages) are sent by our own mail server on the same machine directly to the recipient's email provider. Order records and order emails are kept on the same server; the shipping and invoice notification for a paid order is sent to the seller's staff Google (Gmail) addresses. These transfers are made under Article 9 of the KVKK. Data may be disclosed to competent public authorities where legally required.
6. Children's privacy
Duygu Dedektifi is designed to be used with children in the company of an adult. The website is intended for parents, teachers and professionals. We keep no child accounts, profiles, play history or audio/video recordings on our servers. The app has no ads or advertising ID, and the purchase and institution code screens sit behind an adult check. The game and app do not request microphone, camera or location permission.
7. Linked sites
Our site links to other sites such as Instagram. Their own privacy policies apply once you follow those links.
8. Your rights under the KVKK
Under Article 11 of the KVKK you may apply to the data controller to:
- learn whether your personal data is processed,
- request information about the processing,
- learn the purpose of processing and whether data is used accordingly,
- know the third parties in Türkiye or abroad to whom data is transferred,
- request correction of incomplete or inaccurate data,
- request deletion or destruction under the conditions of Article 7,
- request that corrections and deletions be notified to third parties to whom data was transferred,
- object to a result against you arising exclusively from automated analysis,
- claim compensation for damage caused by unlawful processing.
9. How to apply
In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, send an application containing your name and surname, Turkish ID number (or nationality and passport number for foreign nationals), address for notifications, email address if any, and your request:
- signed in wet ink to the address in section 1 by post, courier or notary, or
- by email to info@duygudedektifi.com, signed with a secure electronic or mobile signature, or sent from an email address you have previously provided to us.
We may ask for additional information if we cannot verify your identity. Applications are concluded free of charge as soon as possible and within 30 days at the latest; where the process involves an additional cost, the fee set by the Personal Data Protection Board may apply.
10. Changes
We may update this policy as our services change. The current version is always published on this page with its effective date at the top.