Privacy Policy

1. Who operates Keddy Works

Keddy Works is a brand operated by Oğuzhan Dere, a sole proprietorship registered in Türkiye. Keddy Works is the data controller for the processing described in this policy, except where a Keddy product provides a separate notice stating otherwise.

2. Scope of this policy

This is a platform-level policy. It applies to:

• the Keddy Works website;
• Keddy accounts and the identity services behind them;
• Keddy products and services that reference this policy, including Keddy Games;
• shared platform services used across Keddy products, such as authentication, entitlements and abuse prevention.

Individual Keddy products may publish additional product-specific notices where a feature needs its own explanation. Those notices supplement this policy rather than replace it.

The Keddy Works website itself does not currently offer a standalone login. Accounts are created and used inside supported Keddy products, and authentication happens there.

Keddy products may link to third-party websites and services that we do not control. Their own privacy notices apply to what they collect.

3. Information we collect

The categories below describe what may be collected across Keddy products. Not every category is collected in every product, and what is actually collected depends on the product you use and the features you choose.

4. Why we process this information

We process personal data in order to:

• create and maintain accounts;
• authenticate users and keep sign-in working;
• operate Keddy products and their features;
• create and run game sessions;
• personalize product behaviour where a feature depends on it;
• maintain subscriptions and entitlements;
• provide customer support;
• prevent fraud, abuse and security incidents;
• diagnose technical failures;
• comply with legal obligations, including accounting and tax obligations;
• improve products using aggregated or appropriately de-identified information.

Depending on the situation, processing rests on performing our contract with you, our legitimate interest in operating and securing the services, your consent where a feature asks for it, or a legal obligation.

5. Social and relationship data

Some Keddy Games features ask participants for input describing how they know or perceive one another. This can include familiarity, personal depth, or personal attraction. We treat this as sensitive input and want to be precise about what happens to it.

This information:

• is used to operate and personalize the relevant game experiences;
• is not sold as personal profile data;
• is not disclosed to unrelated third parties for their own independent advertising;
• may be processed internally to generate game content and improve how the product behaves;
• may be used in aggregated or de-identified analysis, where identifying individual users is not the purpose;
• may be shown to other participants only where the game's mechanics explicitly require it, and the product interface indicates when that is the case.

We describe such analysis as aggregated, de-identified or pseudonymized rather than anonymous. Removing direct identifiers reduces risk but does not eliminate it, and no method of de-identification can be presented as absolutely risk-free.

Keddy Games is a social product played among people who are together. Please consider what you are comfortable submitting about yourself and about others, and decline any prompt you would rather not answer.

6. Service providers

We rely on infrastructure providers to run the services. They process information on our behalf, or under their own applicable role and terms:

• Google Firebase — authentication and related identity infrastructure;
• Apple — Sign in with Apple;
• Supabase — databases, backend services and product infrastructure;
• Vercel — web hosting and content delivery;
• Paddle — payment processing, merchant-of-record services, tax handling and subscription transactions, where and when it is used;
• Resend — transactional email, where it is used.

Telecommunications providers are also involved when a product sends an SMS verification code.

We do not currently operate a third-party product-analytics or crash-reporting service. If we introduce diagnostics or analytics providers later, we will update this policy first and implement any consent mechanism that applies before those providers are enabled.

Information may also be disclosed where we are legally required to do so, or where it is necessary to establish, exercise or defend legal claims.

7. International transfers

Our service providers operate globally, so personal data may be processed on infrastructure located outside Türkiye, including in the European Union and the United States.

Where a transfer requires a legal basis or additional protection, we use the contractual, technical and organizational safeguards available to us under applicable law, and we select providers that offer such safeguards. If you would like to know how a specific transfer is handled, contact us at the address in section 14.

8. Retention

We keep personal data for as long as the purpose it was collected for still applies. In practice, this means data is retained:

• while your account is active;
• as long as needed to provide the services you use;
• as required for security, dispute resolution, accounting, tax or other legal obligations;
• for a limited period after deletion, where retention is legally required or necessary for fraud prevention, and while backups cycle out on their normal schedule.

When a purpose no longer applies, the data is deleted or de-identified.

9. Your rights

Subject to applicable law — including Turkish personal-data-protection legislation, and other data-protection rules where they apply to you — you may request:

• access to your personal data;
• correction of inaccurate or incomplete data;
• deletion of your data;
• restriction of, or objection to, certain processing;
• information about how your data is processed and to whom it has been disclosed;
• withdrawal of consent, where processing is based on consent.

You can delete your account using the account-deletion flow inside the Keddy product you use. For any other request, write to dereo@keddyworks.com.

We may need to verify your identity before acting on a request, so that we do not disclose or delete someone else's data. We respond within the period required by applicable law.

This policy is written to be clear and accurate for the people who use Keddy products. It is not a legal opinion, and it does not limit any right you have under applicable law.

10. Account deletion

Keddy products provide an account-deletion flow. Deleting your account removes or de-identifies the account-linked product information associated with it.

Some information may remain after deletion where it is still necessary or legally required, in particular:

• records we must keep under legal retention requirements;
• transaction and accounting records;
• information needed for fraud prevention;
• security logs;
• copies held in backups until they cycle out on their normal schedule;
• information that has already been validly aggregated or de-identified and can no longer be linked back to you.

We cannot claim that deletion erases every copy from every backup instantly. Backups expire on their own schedule, and restored systems are re-processed so that deletions are reapplied.

11. Security

We use reasonable technical and organizational measures to protect personal data, including encrypted transport, access controls, provider-managed authentication, restricted administrative access and security logging.

No online service can be described as completely secure, and we do not make that claim. If we become aware of a security incident affecting personal data, we act on it and notify affected users and authorities where the law requires.

Please protect your own account as well: keep your devices secure and never share verification codes with anyone.

12. Children

The Keddy products covered by this policy are intended only for users aged 18 or older. Keddy Works does not knowingly offer these services to children and does not knowingly collect personal data from them.

If you believe an account belongs to someone under 18, write to dereo@keddyworks.com and we will review the account and take appropriate action.

13. Cookies and local storage

The Keddy Works website and Keddy products use only storage that is necessary for them to work:

• essential cookies;
• local storage used by the application;
• authentication storage that keeps you signed in inside a product;
• security and session mechanisms;
• preference storage, such as the language you select on this website.

We do not currently operate non-essential advertising or analytics cookies, so there is no consent banner to show. If that changes, we will update this policy and add the consent mechanism required by applicable law before any such storage is used.

14. Changes and contact

We may update this policy as products, providers or legal requirements change. The effective date at the top of this page always reflects the current version. Where a change is material, we may communicate it through the website, inside the affected product, or using the contact information associated with your account.

For any privacy question or request, contact us: