Privacy Policy

1. Who is responsible for your data

The data controller is Leda Yazılım, Türkiye. For any privacy question or request, write to privacy@ledayazilim.com.

2. Data we collect

Account data — when you register: e-mail address, username (display name) and password. Passwords are handled by our self-hosted identity service (Keycloak) and stored only as salted hashes; we never see or store them in plain text.

Gameplay data — your collection, decks, currencies and their transaction history, progress, quests, ratings and ladder rank, match results and match replays (the moves played in a match), story and arena progress, settings and preferences.

Social data — friends and friend requests, blocked players, direct messages, guild membership and guild chat messages, and replay links you choose to share.

Moderation data — reports you file or that are filed about you (including the reported message or context), and any warnings, mutes or bans applied to your account.

Feedback and support — messages you send us through the in-game feedback form, together with the game version, platform and, where relevant, the match it refers to.

Purchase data — when you buy gems with real money, the App Store or Google Play sends us a purchase receipt (product, transaction identifier, date). We never receive your card or bank details; payment is processed entirely by Apple or Google.

Device and technical data — device model, operating system, game version, language, crash reports and error logs, and a log of in-game actions (for example logins, purchases, pack openings and matches) used for security, fraud prevention, balancing and fixing bugs.

Network data — your IP address, which our servers record in security and access logs and use for rate limiting (for example, to stop password-guessing attacks).

3. How we use your data and legal bases

• To create and run your account and provide the Game, including matchmaking, saving progress and delivering purchases (performance of a contract — GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• To keep the Game fair and safe: preventing cheating, fraud and abuse, enforcing our Terms of Use and handling reports (legitimate interests — GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• To fix crashes, improve performance and balance gameplay using technical and aggregated gameplay data (legitimate interests).
• To keep purchase and accounting records required by tax and commercial law (legal obligation — GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).
• To answer your feedback and support requests and to send account e-mails such as password resets (contract / legitimate interests).

We do not use your data for automated decisions that have legal or similarly significant effects on you. Matchmaking and anti-cheat checks are automated, but bans are reviewed by a person.

4. What other players can see

Your display name, hero, rank, guild and match history (opponent names and results) are visible to other players. Messages you send are visible to their recipients or to your guild. Replays you share can be watched by anyone who has the link. Your e-mail address is never shown to other players.

5. Who we share data with

We share personal data only with service providers that help us run the Game, under contracts that limit their use of it, and with authorities when the law requires it:

• Hosting — netcup GmbH, Karlsruhe, Germany (EU): our servers, databases and backups are located in Germany.
• Apple (App Store) and Google (Google Play) — app distribution and in-app payments; they act as independent controllers under their own privacy policies.
• Unity Technologies — the Game is built with the Unity engine, which may send technical diagnostics (such as engine crash data and device type) to Unity.
• E-mail delivery provider — used only to send account e-mails such as password resets.

Game art is generated with AI tools during development; no player data is sent to those services.

6. International transfers

Our servers are in Germany, so if you play from Türkiye your data is transferred abroad. We rely on the safeguards permitted by KVKK Article 9 (such as standard contractual clauses) for these transfers. Apple and Google may process purchase data in other countries under their own safeguards.

7. How long we keep data

• Account, gameplay and social data — for as long as your account exists. When you delete your account, it is deleted or anonymised straight away (see section 8).
• Security, access and action logs, including IP addresses, and crash reports — up to 90 days, then deleted or aggregated.
• Purchase and currency transaction records — kept in anonymised form for up to 10 years to meet tax and commercial-law obligations.
• Records of bans for serious violations — kept as long as necessary to prevent the banned person from returning.
• Backups — overwritten on a rolling basis, within 30 days.

8. Deleting your account

You can delete your account at any time inside the Game: Settings → Privacy & account → Delete account. You can also ask us by e-mail at privacy@ledayazilim.com from the address registered to your account.

Deletion is permanent and cannot be undone. We delete your login identity, collection, decks, progress, friends, direct messages, feedback and settings. Your guild messages are replaced with "[deleted]", and in other players' match history your name is replaced with "Deleted player". Purchase records are kept only in anonymised form, as described above. Unused currency and items are lost and are not refunded.

From the same Settings page you can also download a copy of your data.

9. Your rights

Under KVKK (Article 11) and the GDPR you have the right to: learn whether we process your data and get a copy of it; have inaccurate data corrected; have your data deleted; restrict or object to processing based on our legitimate interests; receive your data in a portable format; and learn who it has been shared with. You can withdraw any consent at any time.

To exercise a right, write to privacy@ledayazilim.com. We answer within 30 days. If you are not satisfied, you can complain to the Turkish Personal Data Protection Authority (KVKK Kurumu) or, in the EU/UK, to your local data protection authority.

10. Children

Duskfall Legends is rated for players aged 12 and over and is not directed to children under 13. We do not knowingly collect personal data from children under 13 (or under the minimum age for consent in your country without a parent's consent). If you believe a child has created an account, contact us and we will delete it.

11. The website and cookies

The Website does not use cookies, analytics or advertising trackers and does not ask you to log in. Like every web server, ours briefly logs technical request data (IP address, browser type, page requested) to keep the site secure and working; these logs are kept for up to 90 days.

12. Security

All traffic between the Game, the Website and our servers is encrypted (HTTPS/TLS). Access to production systems is limited to authorised staff, passwords are hashed and databases are protected by access controls. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.

13. Changes to this policy

We may update this policy as the Game changes. We will show the new date at the top and, for significant changes, tell you in the Game before they take effect.

14. Contact

Leda Yazılım — privacy@ledayazilim.com