Privacy notice

This page explains what Koyland processes and why.

Controller and scope

Semih Silistre is identified as Koyland's publisher. This notice covers the web game and clients using the same game account. Reading this notice when registering does not itself mean giving separate consent.

Data and collection

Registration and login collect your email, player name and password; the password is stored as a hash rather than plain text. Google, Steam or Apple sign-in processes the provider’s stable account identifier. Google and Apple may supply your verified email; Apple’s Hide My Email option uses a relay address. Your provider password is not shared with Koyland. An Apple refresh token is stored for Apple-linked accounts so authorization can be revoked when deleting the account. The game creates village names and locations, progress, resources, transaction records, clan links, chat and direct messages. Copies of reported messages and moderation actions may be stored. A salted digest of your network address is created at registration to limit excessive signups from one network. Requests and session information are processed to provide and secure the service. While you play, device and performance information linked to your account (graphics card name, frame rate, quality setting, processor cores and memory, screen size, browser and operating system) is collected to fix performance problems and kept for 30 days.

Purposes and legal grounds

Account creation, login, saving game state and multiplayer functions support performance of the user agreement (Turkish KVKK article 5(2)(c)). Abuse prevention, account security and community moderation rely on legitimate interests balanced against your rights (article 5(2)(f)). Where required by law, responding to requests and keeping records rely on legal obligations (article 5(2)(ç)). This notice is neither marketing permission nor a request for explicit consent.

Visibility and recipients

Other players can see your player name, village, some game progress and public chat. Direct messages are visible to their participants; authorized moderators may inspect relevant records to enforce the rules. Hosting infrastructure may process data to operate the service. Map and weather information is fetched through the server from outside sources; the page may load Google Fonts and some Wikimedia images directly. If AI-run game events are enabled, game data such as player name, village name, score and clan may be sent to the configured external AI provider. The active provider and details of cross-border transfers must be verified against deployment settings.

Cookies and browser storage

The necessary sid cookie identifies a signed-in session. It is marked HttpOnly; Secure is added over HTTPS. It can remain valid for up to 30 days. Normal and native-app sessions use SameSite=Strict; web social-login callbacks use SameSite=Lax. Social-login verification may also use an auth_state cookie valid for up to five minutes. Your language choice is saved in local storage, and whether you have seen the opening video is saved in session storage. These store game experience preferences.

Retention and deletion

Account and game data are kept while the service runs. In-game account deletion removes many records linked to your account. Email/password accounts confirm the current password. Social-login accounts require a login within the last ten minutes and confirmation of the player name. For Apple-linked accounts, deletion completes after Apple authorization is revoked. The signup abuse-prevention network digest may remain after account deletion; records older than 24 hours are cleared during a later registration. Some audit and aggregate game records may also remain under separate rules. Exact retention periods and backup deletion must be checked against operating settings.

Your rights

Under Turkish KVKK article 11, you may ask whether your data is processed, request information, learn the purposes and recipients, request correction or deletion when the conditions apply, object to adverse results based solely on automated analysis, and claim compensation for unlawful processing. You can delete your account in the game.