Version: 2026-09-24 · Effective date: 24 September 2026
When you play Sezono you trust us with some information about you. This policy explains what we collect, why, who else sees it, how long we keep it, and what you can ask us to do about it. We have tried to write it so you can actually read it.
It also serves as the information notice required by the Turkish Personal Data Protection Law No. 6698 ("KVKK", Art. 10) and by Articles 13–14 of the EU General Data Protection Regulation ("GDPR").
| Controller | İskender Kalkan |
| Data requests and contact | gfbiskender85@gmail.com |
In this policy, "we" means the controller above and "you" means the person who holds a Sezono account.
Sezono is run by one person, so the e-mail address above is the single, direct way to reach us: wherever you live — in Türkiye, in the European Union or anywhere else — you exercise the rights in §11 by writing to it.
It covers the Sezono League mobile game, its servers, and the e-mails we send about the game. There is a single shared game world: your club, your matches and your ranking live in it alongside other players.
It does not cover what the app stores (Apple App Store, Google Play) do with your data — they act under their own privacy policies.
| Data | Where it comes from |
|---|---|
| E-mail address | Sign-up form, or Sign in with Apple / Google |
| Username | Sign-up form; derived from your e-mail if you don't pick one |
| Password hash (bcrypt) | Sign-up form — your plain password is never stored |
| Date of birth | Sign-up form — used only for the age gate (§10) |
Apple / Google user identifier (sub) |
If you sign in with Apple or Google |
| Whether your e-mail is verified | System |
| Interface language | Your choice in settings |
If you use Apple's "Hide My Email", we receive Apple's relay address, not your real one.
Your club, your manager profile (in-game name, portrait, character, attributes), your squad, transfers, matches, finances, training, scouting reports, achievements and standings. This is the game itself, and it is tied to your account.
Some of it is visible to other players: your club's name and look, your manager name, your position in the standings, your match results, your transfer activity, and in-game news about you.
| Data | Why |
|---|---|
| Push token (Firebase Cloud Messaging) | So we can deliver notifications |
| Platform (iOS / Android) | To format the notification correctly |
| App version | Debugging and compatibility |
| Device UTC offset | So we don't send notifications in the middle of your night |
| Your notification preferences | Which kinds of notification you want |
Like any request to any server, yours carries an IP address. We use it transiently to rate-limit abuse (for example dozens of login attempts a minute from one address); we do not write players' IP addresses to our database. It is technically visible in our hosting provider's server logs (§8).
Your session uses a short-lived access token plus a refresh token of which only a hash is stored.
We never see, receive or store your card details. Payment happens entirely inside the Apple App Store. What we keep is:
originalTransactionId),If you e-mail us, we receive your message and your address. For e-mail verification and password resets we store only a hash of the one-time code, never the code itself.
We record which version of this policy and of the Terms of Service you accepted and when: your account, the document type, the document version, the timestamp. We keep this because we have to be able to prove that consent was given.
If you signed up on our website for launch news or for the closed test: your e-mail address, your preferred language, which channel you came from, whether you want to join the test, and your device preference. Every announcement e-mail contains an unsubscribe link.
We do not collect your real name, phone number, postal address, location, contacts, photos, advertising identifier (IDFA / GAID) or any cross-app tracking data. The game contains no analytics or crash-reporting SDK. There is no free-form player-to-player chat in the app.
| # | Purpose | Data | KVKK Art. 5 basis | GDPR Art. 6 basis |
|---|---|---|---|---|
| 1 | Creating your account and identifying you | 3.1 | Necessary for the contract | Contract (6(1)(b)) |
| 2 | Running the game: your club, matches, the season | 3.1, 3.2 | Necessary for the contract | Contract (6(1)(b)) |
| 3 | Session security, password reset, e-mail verification | 3.1, 3.4, 3.6 | Contract; legitimate interest | Contract (6(1)(b)); legitimate interest (6(1)(f)) |
| 4 | Fighting cheating, multi-accounting and abuse | 3.2, 3.3, 3.4 | Legitimate interest | Legitimate interest (6(1)(f)) — fair play |
| 5 | Push notifications about in-game events | 3.3 | Explicit consent (device permission) | Consent (6(1)(a)) |
| 6 | Verifying purchases and running your subscription | 3.5 | Contract; legal obligation | Contract (6(1)(b)); legal obligation (6(1)(c)) |
| 7 | Answering support requests | 3.6 | Contract; legitimate interest | Contract (6(1)(b)); legitimate interest (6(1)(f)) |
| 8 | Enforcing the age gate and protecting children | Date of birth | Legal obligation; legitimate interest | Legal obligation (6(1)(c)); legitimate interest (6(1)(f)) |
| 9 | Proving that you accepted the legal documents | 3.7 | Legal obligation | Legal obligation (6(1)(c)) |
| 10 | Legal duties (tax, lawful requests from authorities) | 3.1, 3.5 | Legal obligation | Legal obligation (6(1)(c)) |
| 11 | Announcement e-mails (waiting list) | 3.8 | Explicit consent | Consent (6(1)(a)) |
| 12 | Verifying the reward for a rewarded ad you chose to watch | Your account identifier, a one-time verification number | Necessary for the contract | Contract (6(1)(b)) |
Where we rely on legitimate interests (rows 4, 3, 7) we weighed that interest against your rights: without a fair league and working account security the game has no meaning, and the data we use for it is data the game already produces.
Marketing. We do not send promotional e-mail from inside the game. If we ever do, we will ask for your permission separately and clearly, and you will be able to withdraw it at any time.
We do not sell your data. The service providers below process it only on our behalf, on our instructions, and only as much as their job requires:
| Recipient | What it receives | What for | Where |
|---|---|---|---|
| Railway (hosting + database) | All account and game data | Server and database infrastructure | USA (San Francisco, California) |
| Resend (e-mail) | Your e-mail address, the verification/reset code, the message text | Verification and password-reset e-mails | USA / EU |
| Google — Firebase Cloud Messaging | Your push token, the notification's title and body | Delivering push notifications | USA |
| Apple — Sign in with Apple | The user identifier Apple issues for you | Verifying Apple sign-in | USA |
| Apple — App Store | Transaction identifier, product identifier | Verifying purchases, subscription events | USA |
| Google — Google Sign-In | The user identifier Google issues for you | Verifying Google sign-in | USA |
| Google AdMob | Technical ad-delivery data, a one-time number and an account identifier used to match your reward | Only for rewarded ads you chose to watch, and verifying the reward | USA |
We also use an alerting service (ntfy.sh) that pings our team when something breaks on the servers; those alerts are technical status messages and contain no player personal data.
Apart from that, we share data only where there is a legal obligation or a lawful request from an authority; to establish or defend a legal claim; or in a merger or transfer of the business (in which case you will be told in advance).
Things we do not use: third-party analytics, crash reporting, advertising-ID based targeting, data brokers, social-media pixels or SDKs.
The game may offer short sponsor videos that you can choose to watch in exchange for income for your club's budget. These come from Google AdMob and work like this:
AdMob's own processing is governed by Google's privacy policy.
Sezono's servers and database run in the United States: on Railway infrastructure in the San Francisco, California region. Most of our other providers are in the United States as well. That means all of your account and game data leaves Türkiye and leaves the European Economic Area.
You can ask for a copy of the transfer instruments we rely on at gfbiskender85@gmail.com.
| Data | Period |
|---|---|
| Account and game data | As long as your account exists |
| Long-dormant accounts | Kept until you delete the account; we do not delete accounts automatically for inactivity |
| Refresh tokens | 60 days; revoked immediately on logout or account deletion |
| E-mail verification / password reset code (hash) | Valid 15 minutes; cleared shortly after use |
| Push token | Until you remove the device or log out |
| In-game notifications and task cards | Deleted automatically after a short period (roughly one to two in-game weeks) |
| Purchase records (transaction id, product, period) | As long as tax and bookkeeping law requires (in Türkiye, as a rule 10 years) — kept de-identified even if you delete your account |
| Consent records | Kept de-identified even if you delete your account (we must be able to prove consent) |
| Support correspondence | Two years after the request is closed |
| Waiting-list entry | Until you unsubscribe, or until the launch announcement period ends |
| Server access logs | Governed by the retention policy of our hosting provider, Railway; we keep no separate copy of them |
When a period ends we delete the data or anonymise it irreversibly.
You can delete your account from inside the app at any time: Settings → Delete My Account. To prevent accidents we ask you to type your club's name. Deletion is immediate and permanent — there is no waiting period and no way to undo it.
Deleted: your e-mail address, username, password hash, Apple/Google link, date of birth, sessions, notifications and push tokens, manager profile, scouting and observation notes, mastery records, wage history, club seat, ad reward records, and your user row itself.
Kept — and why:
Deleting your account does not cancel your Apple subscription. You have to cancel that separately in your Apple account's subscription settings.
Sezono is not directed at children under 13. We ask for your date of birth at sign-up and no account is created for anyone under 13 — neither through e-mail sign-up nor through Apple/Google sign-in.
If we learn that someone under 13 created an account by misstating their age, we close the account and delete their personal data. A parent who believes their child has an account can write to gfbiskender85@gmail.com and ask for deletion.
If the country you live in sets a higher age or requires parental consent for online services (in the EU this age is between 13 and 16 depending on the member state), that rule applies too.
Under KVKK Art. 11 and GDPR Art. 15–22 you can:
Some of these you can exercise directly in the app: deleting your account (Settings → Delete My Account), changing your notification preferences, changing your interface language.
For everything else: write to gfbiskender85@gmail.com. A formal application under KVKK Art. 13 can be sent to the same address.
We answer within 30 days at the latest (under GDPR, normally one month, extendable by two more with notice for complex requests). Requests are free of charge as a rule.
Right to complain. If you are not satisfied with our answer you can complain to the Turkish Personal Data Protection Board (kvkk.gov.tr) or, in the EU/EEA, to the data protection authority of your country.
No system is perfectly secure. If a breach affects your personal data we will notify the authority within the period the law requires (72 hours under GDPR Art. 33; without undue delay under KVKK) and we will inform you as well when the risk to you is high.
We may update this policy. For any material change we will tell you in the app and by e-mail at least 30 days before it takes effect.
Every version has a number (this one: 2026-09-24). When the version goes up you are asked to accept the new version before you continue playing, and we record which version you accepted and when. Your earlier consent records are kept as an audit trail.
Data requests, questions about this policy and game support all go to one address:
gfbiskender85@gmail.com
Wherever you live, this is where you exercise the rights in §11.