Privacy Policy and Personal Data Processing Agreement
Last updated: October 8, 2026 · Effective on publication · The Turkish text prevails if there is any difference
This text explains how your personal data is processed through the HalfReal mobile app, the halfreal.wtf website and all related services, social rooms, mini games and voice features (together the "Service"), in accordance with the Turkish Personal Data Protection Law No. 6698 ("KVKK"), Law No. 5651, the Law on the Regulation of Electronic Commerce No. 6563, the Consumer Protection Law No. 6502 and related secondary legislation. By using the Service or creating an account you confirm that you have read and understood this text. Where the law requires explicit consent, we ask for it separately on the relevant screen; accepting this text is not by itself explicit consent for those operations.
- Data controller
- Personal data we process
- Purposes and legal bases
- Photos, facial images and AI generation
- Voice and speech moderation
- Automated processing and moderation
- What other users can see
- Trading between users and Partner transactions
- Who we share data with
- Transfers abroad
- Retention and deletion
- Security and breach notification
- Children and teenagers
- Device permissions and consent
- Cookies and similar technologies
- Your obligations
- Scope of our responsibility
- Your rights and how to apply
- Changes, severability and governing law
1. Data controller
Company: WDG Ltd
Address: halfreal.wtf
Company number (Companies House): 14424600 · ICO registration no.: [ICO no.] · MERSIS (if any in Türkiye): [MERSIS]
Data controller representative (Türkiye): [Representative name and address] · VERBIS: [Registration status / number]
KEP address (if any): [KEP address]
Email: [email protected]
Infrastructure, payment, AI and notification providers act as "data processors", or, to the extent they process for their own purposes, as independent controllers (see Section 9).
2. Personal data we process
| Category | Data | Source |
|---|---|---|
| Identity and account | Account ID; the identity and email address Google shares when you sign in with Google; a random technical ID for guest sign-in; nickname; country and language preference; registration and last-seen times | You, your sign-in provider |
| Visual data | Your chosen character; photos you upload for avatar or item generation and images generated from them; profile images | You |
| Game and profile data | Level, XP, health, location and room information, inventory, items, pets, cosmetics, SVIP status, achievements, rankings, friend/club/room memberships, profile bio | Your use |
| Transaction (ledger) data | Coin and diamond movements, stall/trade records, gifts, reward and refund records | Your use |
| Content and communication | Public/room chat messages, private messages and attached media, gift notes, reports, blocks and support correspondence | You |
| Voice data | Live voice stream in voice rooms (not recorded); where moderation is enabled, text produced from speech fragments (audio is not stored) | Microphone |
| Security | IP address, country derived from the IP, anonymised device identifier, device model, platform and OS version, app version, root/emulator signals, sign-in times, security alerts, sanction records | Automatic |
| Payment and payout | Purchase amount, pack, status, payment provider session/transaction ID; card details never reach us. For user-to-user real-money transactions, the payment method and payee/payment details you enter | You, the payment provider |
| Notifications | Push notification token, notification preferences | Your device, with your permission |
| Usage and technical | In-app event records, error and performance logs, browser/device information | Automatic |
We do not ask for special categories of personal data (health, religion, race, sex life etc.). We recommend that you do not write such information in free-text fields such as chat, bio, nickname or photos; information you choose to share may be visible to other users.
3. Purposes and legal bases
| Purpose | Legal basis (KVKK Art. 5/6) |
|---|---|
| Registration, sign-in, account management, game world, chat, trading and rewards | Performance of a contract (Art. 5/2-c) |
| Taking payments, refunds, dispute resolution, accounting and tax obligations | Contract, legal obligation (Art. 5/2-c, ç), establishment of a right (Art. 5/2-e) |
| Information security, preventing fraud, cheating and abuse; preventing banned users from returning; moderation | Legitimate interest (Art. 5/2-f), legal obligation (Art. 5/2-ç) |
| Record keeping, notices and responding to authorities under Law No. 5651 and other legislation | Provided by law, legal obligation (Art. 5/2-a, ç) |
| Processing photos that may contain a face for avatar/item generation | Performance of a contract; additionally explicit consent when you upload (Art. 5/1) |
| Speech moderation (when enabled) | Legitimate interest; explicit consent where required |
| Push notifications | Device permission and explicit consent |
| Commercial electronic messages (marketing) | Prior permission under Law No. 6563 |
| Improving the Service, statistics and debugging (aggregated and, as far as possible, anonymous) | Legitimate interest (Art. 5/2-f) |
| Establishing, exercising or defending legal claims | Establishment, exercise or protection of a right (Art. 5/2-e) |
Where we rely on legitimate interest, we balance our interest against your rights and freedoms. We do not use your data for advertising profiling and we do not sell or rent it.
4. Photos, facial images and AI generation
- Uploading a photo is optional. A photo you upload is processed, and sent to AI service providers, only for the avatar or item generation you start.
- We do not perform face recognition, identification or biometric template extraction. Because a face in a photo can legally amount to biometric data, we ask for your separate explicit consent to upload a photo containing a face; if you decline you can keep using the Service with the ready-made characters.
- Upload only photos that are your own or that you are authorised or have consent to use. Do not upload photos of others, especially children. You are responsible for unlawfully uploading third parties' data, and we may remove such content if we receive a claim.
- Generation passes through automated content checks; inappropriate photos are rejected.
- We take care not to send AI providers information that directly identifies your account, but the photo itself may contain personal data. You accept that generated images are AI products and may be wrong or unexpected.
5. Voice and speech moderation
- In voice rooms your microphone stream is delivered to other participants in real time. We do not record audio.
- When moderation is enabled for safety, only short 0.5–12 second fragments of your own speech are turned into text by a speech recognition service; the text enters the same moderation process as typed messages. Audio fragments are not stored or recorded. Speech moderation does not run during a music/DJ broadcast or while your microphone is muted.
- What you say in a voice room can be heard, and may be recorded, by other users; HalfReal is not responsible for others' recordings. Do not share secret or sensitive information.
6. Automated processing and moderation
For the safety of the Service we use automated processes such as rate limiting, profanity/prohibited-content filters, AI-assisted content checks, and cheating and multi-account detection. As a result, content may be removed, your account restricted, or access to features limited. If you face a decision based solely on automated processing that has a negative result for you, you can object under KVKK Art. 11/1-(g) and ask for human review at [email protected]. For security reasons some detection methods are not disclosed in detail.
7. What other users can see
Your nickname, avatar, level, frame and badges, chat and room messages, your place in rankings, gifts and some game events (such as reward announcements) can be seen by other users. You share these because of the nature of the Service. We recommend choosing a nickname that contains no personal information. Private messages are delivered only to the recipient, but the recipient can copy or share the content.
8. Trading between users and Partner transactions
- HalfReal provides a platform where users can buy and sell in-game items, coins and similar virtual products among themselves. In-game trade takes place inside the Service. HalfReal does not pay real money directly to users.
- Any exchange of virtual products between users for money (for example through approved "Partner" users) takes place between users and over payment channels outside the Service. In these transactions HalfReal is not a buyer or seller, does not hold funds, does not guarantee payment and does not provide escrow; it provides a technical platform that helps the parties find each other and keeps in-game records.
- For this purpose your buyer or seller nickname, the amount and status of the transaction, the payment method and payment/payee details you write, and your messages are visible to the other party (including the Partner) and in the relevant records to the extent needed to carry out the transaction. Sharing this information is your choice; the other party acts as an independent controller for that information and HalfReal is not responsible for what they do with it.
- Write your payment details (IBAN, wallet address etc.) only to the person you are transacting with and only as far as the transaction needs. Losses, fraud, taxes and legal obligations arising from payments made outside the Service are the responsibility of the parties. See the Terms of Use.
- The users concerned are fully responsible for fraud and other unlawful acts. We reserve the right to stop transactions that breach the rules or raise suspicion of fraud, breach of trust, cybercrime or money laundering, to keep the related records, to share those records (including identity, account, transaction, message, payment/payout request, device and IP information) directly with the competent authorities and to file criminal complaints; this sharing rests on KVKK Art. 5/2-(a), (ç), (e) and (f) and related legislation.
9. Who we share data with
| Recipient group | Examples | Purpose |
|---|---|---|
| Infrastructure and hosting | Supabase, Cloudflare | Authentication, database, storage, servers, content delivery, real-time voice, speech-to-text |
| Payments | Stripe; Google Play; Apple App Store | Taking payments, refunds, fraud prevention |
| Authentication | Sign in with Google | |
| AI | OpenRouter and the model providers behind it | Avatar/item image generation, content checks |
| Notifications | Google FCM, Apple APNs | Delivering push notifications |
| Other users | Players in your room or game, the other party of a transaction | Visibility inherent in the Service (Sections 7–8) |
| Professional advisers | Lawyers, accountants, auditors | Legal and financial obligations |
| Competent authorities | Courts, prosecutors, law enforcement, the ICTA (BTK), MASAK, the KVKK Board and other public bodies | Requests under law; reporting suspected crime, fraud or unlawfulness; protecting our rights |
| Corporate transactions | Parties to a merger, transfer or acquisition | Continuity of the Service; the new owner remains bound by this policy |
10. Transfers abroad
Because our infrastructure, payment and AI providers' servers are outside Türkiye, providing the Service technically requires transferring your data abroad. Transfers are made under KVKK Art. 9 and related regulations: to countries with an adequacy decision, otherwise with standard contractual clauses, binding corporate rules, an undertaking or other safeguards the law provides (and, where required, a notification to the Board). Where the law allows, we may also rely on your explicitly informed consent. You can request information on the countries and safeguards at [email protected].
11. Retention and deletion
| Data | Period |
|---|---|
| Account, profile and game data | While the account is open. If nobody signs in within 7 days of a deletion request it is deleted (Delete Account) |
| Uploaded photos and generation inputs | As long as needed for generation and objections; at most until the account is deleted |
| Sign-in, device and IP records | Detailed records 30 days; summary records archived for security up to 1 year; the period the law requires where an official request exists |
| Access logs (Law No. 5651) | The period the law prescribes (currently between 6 months and 2 years) |
| Usage events and statistics | Detailed for a short time; afterwards only as anonymous daily totals |
| Payment and invoice records | The period tax and commercial law prescribe (generally up to 10 years), at the payment provider |
| Moderation, sanction and appeal records | As needed to prevent repetition and protect rights, depending on the violation |
| Legal dispute records | For the limitation period |
Data whose period has ended is deleted, destroyed or anonymised in periodic destruction processes. Data in backups is deleted when the backup cycle completes.
12. Security and breach notification
Under KVKK Art. 12 we take appropriate technical and administrative measures such as encryption in transit, role-based access, row-level authorisation in the database, separation of duties, rate limiting, logging and processor agreements. No system can be guaranteed absolutely secure. If personal data is unlawfully obtained by others, we notify the Personal Data Protection Board within the period the law prescribes (72 hours) and, where needed, affected data subjects. For your account security please use a strong device lock, do not share your sign-in details, and tell us about anything suspicious.
13. Children and teenagers
The Service is not designed for children under 13; they may not open accounts, and accounts of users we learn are under 13 are deleted with their data. Users aged 13–18 may use the Service only with the knowledge and permission of a parent or guardian; paid transactions and the processing of personal data need the parent's or guardian's approval. If you are a parent or guardian and think your child's data is being processed, you can request access, correction or deletion at [email protected]. Uploading photos of children is not recommended; a user who uploads a child's photo promises to hold the necessary parental permission.
14. Device permissions and consent
- Microphone: when you join voice rooms and allow it. You can mute at any time or withdraw the permission in device settings.
- Camera/photos: only when you choose a photo.
- Notifications: only if you allow; you can turn them off in Settings or in device settings.
- Location (GPS): we do not collect it. Your country is your own choice; only country-level information is derived from the IP.
- Withdrawing consent: you can withdraw consent for operations that need it at any time; withdrawal does not affect the lawfulness of earlier processing and may make the related feature (for example photo-based generation or voice rooms) unavailable.
15. Cookies and similar technologies
This website (halfreal.wtf) does not use cookies or tracking technologies. The app uses local storage on your device for essential settings such as keeping your session and your language and sound preferences; it is not used for advertising or cross-site tracking. If we add new tracking technologies covered by this policy, we will inform you in advance and obtain the necessary permission.
16. Your obligations
- The information you give us must be accurate and up to date.
- You must not unlawfully share or upload other people's personal data (photos, phone numbers, addresses, ID or payment information etc.). Responsibility for processing such data lies with the user who shared it.
- You are responsible for the security of your account and sessions.
- You must not use data you obtained in breach of the Service's rules or Turkish law.
17. Scope of our responsibility
Subject to mandatory law, and unless we acted with intent or gross negligence, we are not responsible for damage arising from: (i) information you chose to make public or visible to other users being copied, recorded or misused by others, (ii) money and value transfers between users made outside the Service, and the other party's use of the payment information you share in those transactions, (iii) outages, breaches or practices in the systems of third-party providers, (iv) your device or account being taken over through your negligence. This clause does not limit your statutory consumer rights or mandatory provisions (Turkish Code of Obligations Art. 115, Consumer Protection Law Art. 5).
18. Your rights and how to apply
Under KVKK Art. 11 you have the right to: learn whether your personal data is processed; request information if it is; learn the purpose of processing and whether it is used accordingly; know the third parties it is transferred to in Türkiye or abroad; request correction of incomplete or incorrect data; request deletion or destruction under Art. 7; request that these operations be notified to the third parties the data was transferred to; object to a result against you arising from analysis exclusively by automated systems; and claim compensation if you suffer damage from unlawful processing.
Send your application in writing under the Communiqué on Procedures and Principles of Application to the Data Controller, with information that identifies you, to the postal address above, our KEP address or [email protected]. Requests are answered free of charge as soon as possible and at the latest within thirty days; where the operation needs extra cost, the fee in the Board's tariff may be charged. If you are not satisfied with the answer you can complain to the Personal Data Protection Board within thirty days of learning the answer and in any case within sixty days of applying (kvkk.gov.tr). We may ask for extra verification if your request does not contain enough information to confirm you are the right holder. To delete your account: Delete Account.
19. Changes, severability and governing law
- Changes: we may update this text for changes in legislation or the Service. We announce important changes in the app or on this page; the effective date of the current version is at the top. Continuing to use the Service after a change means you accept the current text; for new operations that need consent, we ask for your consent separately.
- Severability: if a provision is held invalid, the others remain valid.
- Governing law: the laws of the Republic of Türkiye apply. If the two language versions differ, the Turkish text prevails. The mandatory rights and competent court/arbitration rules for consumers are reserved; for other disputes the courts and enforcement offices of [City] have jurisdiction.
For a short summary see the KVKK Privacy Notice; for the rules see the Terms of Use.