KVKK Privacy Notice

This notice is given under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and explains the personal data processed when you use the LuckyNumberz mobile app and the luckynumberz.com website. The Turkish version of this notice is the binding one. More detail is in the Privacy Policy: luckynumberz.com/legal/privacy

1. Data controller

The data controller is Emre Yılmaz, the individual developer based in Türkiye who builds and operates LuckyNumberz. Contact: luckyn0mberz@gmail.com

2. What we process, why, and on what legal basis

Account (only if you sign in): e-mail address, optional display name, the sign-in identifier Apple or Google gives us, the date the account was created, the time of the last sign-in and the type and model of the device a session was opened on (for example "ios iPhone"). One synced document is kept per account: region and language, default game, notification preferences, the name, birth date and lucky number you entered for Personal and Zodiac numbers, and your saved lines. Purpose: to provide the account and carry your settings and lines across devices. Legal basis: necessary to conclude and perform a contract (KVKK Art. 5(2)(c)).

Sign-in security: a one-way hash of the 6-digit code sent by e-mail (valid for 10 minutes) and a keyed, irreversible hash of the IP address that requested it. Both are deleted within 75 minutes at most. Session tokens are stored only as hashes. Purpose: protecting your account against unauthorised access and abuse. Legal basis: our legitimate interest and our data security obligation (KVKK Art. 5(2)(ç) and 5(2)(f)).

Draw notifications (only if you turn them on): the device push token, the games and notification types you chose, app language and platform (iOS/Android). Purpose: telling you the result of the games you chose. Legal basis: KVKK Art. 5(2)(c).

Marketing e-mail consent (only if you tick the box): the fact and date of your consent. Legal basis: your explicit consent (KVKK Art. 5(1)). Sending marketing e-mail is currently switched off and will not start before registration with the Turkish Message Management System (İYS). You can withdraw the consent from the Profile tab at any time.

Technical data: when the app or the website connects to our servers, your IP address and request details (address, browser or app version) reach our hosting provider. Apart from the sign-in security hash above, we do not store IP addresses. Purpose: running the service and protecting it against attacks. Legal basis: KVKK Art. 5(2)(f).

Advertising: the app shows Google AdMob ads and the website shows Google AdSense ads. Google processes data such as the advertising ID, IP address and device and browser details under its own privacy policy and as an independent controller. On the website, visitors in Türkiye (browsers set to the Türkiye time zone) are asked for consent before ads load; if you decline, no ads and no advertising cookies are loaded and the site works in full. In the iOS app personalised ads are shown only if you allow "Tracking". On Android you can turn off personalised ads in the device settings (Settings → Google → Ads). Legal basis: your explicit consent (KVKK Art. 5(1)).

We do not collect phone numbers, contacts, precise location, photos, payment details, identity documents or special categories of personal data. Without an account, the name and birth date you enter for Personal and Zodiac numbers stay on your device and are never sent to us.

3. How data is collected

Electronically and by automated means: from what you enter in the app or on the website (e-mail, name, lines), from the identity token Apple or Google sends us when you sign in with them, and from the technical details your device sends when it connects.

4. Who receives the data (including abroad)

Data is transferred to the following providers we use to run the service. All of them are headquartered in the United States and process data on servers outside Türkiye:

Cloudflare, Inc. — servers and database (account, synced document, notification record); every request.

Expo (650 Industries, Inc.) — relays notifications to your phone; push token and message text.

Google LLC — delivery of Android notifications (Firebase Cloud Messaging), verification of "Sign in with Google", AdMob and AdSense ads.

Apple Inc. — delivery of iOS notifications (Apple Push Notification service) and verification of "Sign in with Apple".

Resend, Inc. — delivers sign-in code e-mails; e-mail address and message text.

For these regular transfers abroad, the process of concluding the standard contracts published by the Personal Data Protection Board and notifying the Board under KVKK Art. 9 is under way. Data is not shared with anyone else and is never sold. It may be disclosed to authorised public bodies where the law requires (KVKK Art. 8(2)(a)).

5. Retention

The account and synced document are kept while your account exists; "Delete account" in the Profile tab deletes the account, its sessions, the synced document and any pending codes immediately. Notification record: When you turn notifications off in the app, the app asks our service to delete the record and it is deleted at once. If your phone is offline at that moment, or notification permission was already revoked in the system settings, the request cannot be sent; turn notifications on and off again in the app, or e-mail us. If you uninstall the app without turning notifications off first, the record is deleted when the notification service tells us, while sending a notification, that the device is no longer registered. This depends on the notification service and has no fixed time; to remove it right away, turn notifications off before uninstalling or e-mail us. Sign-in codes and IP hashes are deleted within 75 minutes at most. Signing out removes the session from our service and keeps the account; if your phone is offline when you sign out, the session is deleted automatically after 180 days without use, and in any case 365 days after it was created. Deleted data can remain for up to 30 days in our hosting provider’s automatic database recovery history (Cloudflare D1 Time Travel), which is used only to recover from a failure; after that it is gone.

6. Your rights (KVKK Art. 11)

You have the right to learn whether your personal data is processed; to request information about it; to learn the purpose of processing and whether it is used accordingly; to know the third parties it is transferred to in Türkiye or abroad; to request correction of incomplete or inaccurate data; to request erasure or destruction under KVKK Art. 7; to request that third parties who received the data be notified of a correction or erasure; to object to a result against you arising solely from automated analysis; and to claim compensation for damage caused by unlawful processing.

Send your request to luckyn0mberz@gmail.com from the e-mail address registered to your account. Without an account, write to the same address; you may ask us for a postal address for a written request. We answer within 30 days, free of charge. If you are not satisfied with our answer you may complain to the Personal Data Protection Board.

7. Data breaches

If we learn that your data has been obtained by unauthorised persons, we will notify the Personal Data Protection Board within 72 hours and inform the people affected as soon as possible. To report a security vulnerability: luckynumberz.com/.well-known/security.txt