PERSONAL DATA

Privacy notice

This page explains what Koyland processes and why.

Controller and scope

Semih Silistre is identified as Koyland's publisher. This notice covers the web game and clients using the same game account. Reading this notice when registering does not itself mean giving separate consent.

Data and collection

Registration and login collect your email, player name and password; the password is stored as a hash rather than plain text. The game creates village names and locations, progress, resources, transaction records, clan links, chat and direct messages. Copies of reported messages and moderation actions may be stored. A salted digest of your network address is created at registration to limit excessive signups from one network. Requests and session information are processed to provide and secure the service.

Purposes and legal grounds

Account creation, login, saving game state and multiplayer functions support performance of the user agreement (Turkish KVKK article 5(2)(c)). Abuse prevention, account security and community moderation rely on legitimate interests balanced against your rights (article 5(2)(f)). Where required by law, responding to requests and keeping records rely on legal obligations (article 5(2)(ç)). This notice is neither marketing permission nor a request for explicit consent.

Visibility and recipients

Other players can see your player name, village, some game progress and public chat. Direct messages are visible to their participants; authorized moderators may inspect relevant records to enforce the rules. Hosting infrastructure may process data to operate the service. Map and weather information is fetched through the server from outside sources; the page may load Google Fonts and some Wikimedia images directly. If AI-run game events are enabled, game data such as player name, village name, score and clan may be sent to the configured external AI provider. The active provider and details of cross-border transfers must be verified against deployment settings.

Cookies and browser storage

The necessary sid cookie identifies a signed-in session. It is sent with HttpOnly and SameSite=Strict; Secure is added over HTTPS. It can remain valid for up to 30 days. Your language choice is saved in local storage, and whether you have seen the opening video is saved in session storage. These store game experience preferences.

Retention and deletion

Account and game data are kept while the service runs. In-game account deletion requires your current password and removes many records linked to your account. The signup abuse-prevention network digest may remain after account deletion; records older than 24 hours are cleared during a later registration. Some audit and aggregate game records may also remain under separate rules. Exact retention periods and backup deletion must be checked against operating settings.

Your rights

Under Turkish KVKK article 11, you may ask whether your data is processed, request information, learn the purposes and recipients, request correction or deletion when the conditions apply, object to adverse results based solely on automated analysis, and claim compensation for unlawful processing. You can delete your account in the game.