Privacy Policy

This policy explains how [LEGAL COMPANY NAME] ("we"), a company registered in Germany ([REGISTERED ADDRESS]), processes personal data when you use iddaakolik.com. We are the data controller. For any privacy request, contact bilgi@iddaakolik.com.

1. What we collect

• Account data — username, email address, and a securely hashed password.
• Sign-in provider data — if you choose to sign in with Google or Microsoft, we receive your name, email address and a provider account identifier from that provider. We never receive or store your provider password, and you can disconnect the provider at any time from My Account.
• Usage data — matches you open (including approximate time spent on a match page), Match Studio analyses you run, coupon selections you make, sign-in times, and subscription tier. We log these server-side to operate your account, understand how the Service is used, and enforce fair-use limits. We do not track individual clicks or mouse movement.
• Technical data — IP address (including the IP address an account was registered from), browser/device information and log data, for security, abuse prevention and to keep the Service working.
• Push notifications — only if you turn them on: we store the push endpoint and keys your browser gives us, your chosen topics and your time zone, so we can send the picks and results you asked for. We never read your notifications. Turn them off at any time from the same button, from My Account, or in your browser settings.
• Device characteristics (abuse prevention only) — when you register, sign in, or use a signed-in session, we record technical characteristics of the device you use: operating system and version, device model, browser and version, screen size, timezone, language, processor/memory class, and a hashed signature derived from how your device renders graphics and audio. We use this solely to detect one person operating multiple accounts to bypass the fair-use limits described in our Terms.
  We do not collect this while you browse the site signed out, and we never use it for advertising, personalisation, profiling or analytics, and never share it. The rendering signatures are stored salted-hashed, so they cannot be matched against any other website's records. See section 4 for how long we keep it.
• Cookies / local storage — a login session cookie, and small preference values for your chosen theme (iddaakolik-theme), display time zone (tz) and language. These are essential or preference cookies; we do not use them for advertising.

We do not store your payment-card details. Payments are handled by Paddle.com as Merchant of Record; Paddle processes your payment information as a separate controller under its own privacy policy.

2. Why we process it, and our legal basis

Purpose	Legal basis (GDPR Art. 6)
Create and run your account; provide the subscription	Performance of a contract
Process payments & prevent fraud	Contract / legitimate interest
Keep the Service secure and reliable	Legitimate interest
Enforce fair-use limits and prevent multi-account abuse	Legitimate interest
Send account and transactional emails	Contract
Comply with legal and tax obligations	Legal obligation

3. Who we share it with

We do not sell your data. We share it only with service providers who help us run iddaakolik, under contract: Paddle (payments & billing), our hosting provider, and our email provider (account confirmation). Some providers may process data outside the EEA under appropriate safeguards (e.g. Standard Contractual Clauses).

If you sign in with Google or Microsoft, that provider acts as your identity provider under its own privacy policy; we receive only your name, email address and an account identifier from it.

4. Retention

We keep account data for as long as your account is active and for a reasonable period afterwards, and keep billing/tax records for as long as the law requires. You can ask us to delete your account and data (subject to legal retention duties).

Device characteristics (section 1) are kept for 180 days and then deleted automatically.

5. Your rights

Under the GDPR you have the right to access, correct, delete, restrict, or port your personal data, to object to certain processing, and to withdraw consent. To exercise any of these, email bilgi@iddaakolik.com. You also have the right to complain to a supervisory authority in your country.

6. Children

iddaakolik is for adults (18+) and is not directed at children. We do not knowingly collect data from anyone under 18.

7. Changes

We may update this policy; material changes will be posted here with a new "last updated" date.