NTROY
TR
Log inSign up
  1. Home
  2. Legal

Privacy Policy

Last updated: 06.10.2026

This Privacy Policy explains how Ntroy Development Studios ("we", the "Company") collects, uses, discloses, and protects your personal data on the websites, games, mobile applications, and digital services it operates (including Football Mates, Basketball Mates, and our other products), in accordance with the GDPR (General Data Protection Regulation), Law No. 6698 on the Protection of Personal Data (KVKK), and other relevant data protection legislation.

By using our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use our services.

1. Data Controller

The data controller responsible for your personal data:

NTROY OYUN TEKNOLOJİLERİ ANONİM ŞİRKETİ Address: Çınarlı Mah. 1572 Sk. No: 33 Konak / İzmir / Türkiye Email: [email protected] Tax Office: Karşıyaka Vergi Dairesi Tax No: 6321515015

2. Personal Data We Collect

We collect the following categories of personal data:

2.1 Account Information

  • First and last name
  • Email address
  • Phone number (optional)
  • Password (stored as a bcrypt hash — passwords are never kept in plain text)
  • Profile photo (if uploaded)
  • Country information

2.2 Game Data

  • Player ID — your unique player identifier in our games
  • In-game nickname and team name
  • Game level (main level, season level)
  • Referral ID
  • VIP tier and web points balance

2.3 Payment Information

  • In-app purchases in our mobile games are processed by Apple (App Store) and Google (Google Play). We do not receive or store your card details; refunds for in-app purchases are handled by Apple or Google under their policies.
  • To deliver what you bought, our servers verify each in-app purchase with Apple or Google using the transaction information the store issues (receipt or purchase token).
  • The data we store about in-app purchases: the store's transaction identifiers, the product, the price, the date, and the purchase status.
  • Purchases on our websites are described separately in Section 14.

2.4 Technical Data

  • IP address
  • Browser type and version (User-Agent)
  • Device information
  • In our mobile apps: in-app events and — only under the conditions described in Section 6 — your advertising identifier (IDFA on iOS, Google Advertising ID on Android)
  • Login timestamps
  • Cookies (see our Cookie Policy)

2.5 Communication Data

  • In-app chat messages
  • Support request contents
  • Marketplace listings and offers

2.6 Social Login Data

If you choose to sign in using a third-party login provider, we receive the following information from that provider:

  • Facebook Login (Meta) — your Facebook user ID (app-scoped), your first and last name, your profile picture, and — only if you grant the email permission — your email address.
  • Sign in with Google — your Google account ID and — only if you grant the email permission — your email address.
  • Sign in with Apple — your Apple user ID and — if you choose to share it — your email address (which may be a relay address created with Apple's "Hide My Email").

We use this information solely to identify you and sign you in to your account. We never receive your password, friend list, posts, or messages from the provider, and we do not post anything to your account on your behalf. The data we receive from the login provider is not used for advertising or profiling. Advertising measurement and analytics in our mobile apps are described separately in Section 6.

You can revoke our access at any time from your Facebook settings (Settings > Apps and Websites). Revoking access stops future logins but does not by itself delete your account or your game data — see our Data Deletion Request page for that.

3. Legal Bases for Processing (GDPR Article 6 / KVKK Articles 5-6)

We process your personal data on the following legal bases:

  • Account creation, management, and sign-in (including sign-in via third-party social login providers) — Performance of a contract
  • Processing payments — Performance of a contract
  • Security (login attempts, fraud prevention) — Legitimate interest
  • Email notifications and password reset — Performance of a contract
  • Analytics and service improvement (other than the mobile app analytics and advertising measurement in Section 6) — Legitimate interest
  • Mobile app analytics and advertising measurement (Section 6) — Explicit consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)); in regions where consent is not requested, legitimate interest
  • Chat message translation and AI avatar/logo creation at your request — Performance of a contract
  • Legal compliance — Legal obligation

4. How We Use Your Data

  • To create and manage your account
  • To carry out in-game purchases and marketplace transactions
  • To synchronize your game data between the game and the web portal
  • To send transactional emails (verification, password reset, purchase confirmation)
  • To provide customer support
  • To detect and prevent fraud, abuse, and security threats
  • To display leaderboards, statistics, and publicly available game data
  • To operate the referral and VIP reward system
  • To measure the effectiveness of our advertising campaigns and to improve our mobile apps through analytics (Section 6)
  • To translate chat messages and to create an AI avatar or team logo when you ask us to
  • To verify in-app purchases with the relevant app store

5. Data Sharing and Third Parties

We share your personal data only to the extent necessary with the following third parties:

  • Apple (App Store) and Google (Google Play) — In-app purchase verification — Data shared: the purchase/transaction information issued by the store (receipt or purchase token), sent to the relevant store for verification.
  • SendGrid (Twilio) — Transactional emails — Data shared: email address, name
  • Hetzner Online GmbH (Germany) — Server and database hosting (Basketball Mates game servers and our web services) — Data shared: the data processed in these services
  • Microsoft Azure — Football Mates cloud hosting and database — Data shared: Football Mates data (encrypted)
  • Cloudflare — CDN and DDoS protection — Data shared: IP address, request metadata
  • Meta Platforms Ireland Ltd. — Facebook Login authentication and advertising measurement — Data shared: for login, the access token issued by Facebook, sent back to Meta for verification; for advertising measurement (Section 6), in-app events, device and app information and — if you have allowed it — your advertising identifier, via the Facebook SDK.
  • Google Ireland Ltd. (Google Firebase / Google Analytics) — Mobile app analytics and advertising measurement (Section 6) — Data shared: in-app events (e.g. registration, tutorial completion, level, match, store view, purchase), device and app information.
  • Tenjin, Inc. — Mobile measurement partner: determining which ad network, campaign or ad an install came from (attribution) (Section 6) — Data shared: your player ID, advertising identifier (if you have allowed it), device information, IP address, in-app events and purchase information.
  • OpenAI — Chat message translation and AI avatar/logo creation — Data shared: only when you request it; the text of the message you ask to translate, the photo you upload to create an AI avatar, and your logo preferences.
  • Payment processing for purchases on our websites — see Section 14.

We do not sell your personal data to any third party.

6. Advertising Measurement and Analytics

In the Basketball Mates mobile app, we work with Google Firebase / Google Analytics, Meta (Facebook SDK) and our mobile measurement partner Tenjin, Inc. to understand how you use the game and to measure the effectiveness of our advertising campaigns. These providers and the data shared with them are listed in Section 5.

6.1 Data Processed

  • In-app events (e.g. registration, tutorial completion, level, match, store view, purchase) and purchase information
  • Device and app information, IP address and the country derived from it
  • Advertising identifier (IDFA on iOS, Google Advertising ID on Android) — only under the conditions described in Section 6.2
  • Which ad network, campaign or ad you installed the app from (attribution record)

6.2 Advertising Identifiers and Consent

On iOS, your advertising identifier (IDFA) is used, and your data is matched with other companies' data, only if you allow tracking when asked by Apple's App Tracking Transparency prompt. If you do not allow it, your advertising identifier is not used; the effectiveness of ads is then measured only through aggregated methods that do not use an advertising identifier, such as Apple's anonymous, aggregated measurement (SKAdNetwork). On Android, the Google Advertising ID is used; you can reset or delete it in your device settings.

Users in the European Economic Area, the United Kingdom, Switzerland and Turkey are additionally asked for their explicit consent to analytics and advertising measurement when they first launch the game; until they answer, no data is sent to the providers for these purposes. The consent screen offers three choices: "Accept" (analytics and advertising measurement, including advertising identifiers), "Analytics only" (usage statistics only, nothing for advertising) and "Decline" (neither). On iOS, "Accept" also opens Apple's tracking prompt. Your choice does not affect how the game works.

Outside these regions, analytics and advertising measurement are on by default; the advertising identifier is used on iOS only if you have allowed tracking, and on Android subject to your device settings. You can change your choice at any time as described below.

6.3 Changing Your Choice or Withdrawing Consent

You can change your choice or withdraw your consent at any time, whatever your region, in the game under Settings → Ad Privacy Settings. On iOS, you can also turn off tracking permission in your device's Settings → Privacy & Security → Tracking. On Android, a change may in some cases take full effect the next time the app is launched. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

6.4 Retention

Measurement records on our game servers are retained for 30 days after they are delivered to the measurement services, and for at most 180 days if they cannot be delivered. Your attribution record is deleted when your account is deleted. Google Analytics event data is retained for 14 months. Retention periods in the providers' own systems are governed by their own policies.

6.5 Legal Basis and International Transfers

The legal basis for mobile app analytics and advertising measurement is your explicit consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)). In regions where consent is not requested, this processing is based on our legitimate interest; you can object to it or change your choice as described in Section 6.3. Data may be transferred to providers in the EU and the United States under safeguards such as the Standard Contractual Clauses described in Section 10.

7. Data Retention Periods

  • Account and game data: Retained as long as your account is active. How account deletion works is described in Section 7.1 below.
  • Payment, purchase and invoice records: Retained for as long as required by applicable tax and commercial laws, up to 10 years.
  • Security, anti-cheat and fraud-prevention records (including login attempts, security events and IP logs): Retained for 2 years.
  • Chat messages: Retained for 6 months after the last activity.
  • Password reset tokens: Automatically deleted upon expiry (1-72 hours).
  • Sign-in identifiers (your Apple, Google or Facebook user ID): Retained in connection with your account; when the account is deleted, they remain part of the closed account record for as long as the game service is operated (see Section 7.1). You can request their erasure under your rights in Section 8.
  • Advertising measurement and analytics data: Retained for the periods described in Section 6.4.

7.1 Account Deletion

You can delete your account at any time in the game (in Basketball Mates: Settings → Delete Account). When you delete your Basketball Mates account:

  • Your account is closed: you are signed out, and you can no longer sign in to it or use it.
  • You are removed from your team.
  • Your advertising measurement data (attribution record and measurement records) is erased.
  • If no other active game profile remains linked to your sign-in, the contact email address received from your login provider (Facebook, Google or Apple) is erased as well, and if you used Sign in with Apple, we ask Apple to revoke the Sign in with Apple authorization you gave the app.

The closed account record itself is not erased from our database. Matches, teams, leagues and the in-game economy are shared with other players, and their records refer to your account; to preserve the integrity of the game, this record and your gameplay records are kept.

After a Basketball Mates account is deleted, the following data is retained for these periods:

  • The closed account record — including your in-game nickname and avatar, your gameplay records (match history, teams, leagues, in-game economy), which other players' records refer to, and the sign-in identifier (Apple, Google or Facebook user ID) linked to it: for as long as the game service is operated.
  • Payment, purchase and invoice records: for as long as required by applicable tax and commercial laws, up to 10 years.
  • Security, anti-cheat and fraud-prevention records (including IP logs): 2 years.

You can delete your account using the account deletion option in the app's settings, or send a request to [email protected] as described on our Data Deletion Request page. Requests concerning data that is not erased in this way are handled under your rights in Section 8.

8. Your Rights

Under the GDPR and (for residents of Turkey) the KVKK, you have the following rights:

  • Right of access: To request a copy of your personal data.
  • Right to rectification: To request the correction of inaccurate or incomplete data.
  • Right to erasure: To request the deletion of your data ("right to be forgotten").
  • Right to restrict processing: To limit how your data is used.
  • Right to data portability: To receive your data in a structured, machine-readable format.
  • Right to object: To object to processing based on legitimate interest.
  • Right to withdraw consent: To withdraw your consent at any time if processing is based on consent.

To exercise any of these rights, contact us at [email protected]. We will respond to your request within 30 days.

9. Data Security

We implement appropriate technical and administrative measures to protect your data:

  • All data is transmitted over HTTPS (TLS encryption)
  • Passwords are hashed with bcrypt (cost factor 12)
  • Authentication tokens are stored in HttpOnly secure cookies
  • Rate limiting and brute-force attack protection
  • Parameterized SQL queries to prevent injection attacks
  • Regular security audits

10. International Data Transfer

Your data may be transferred to and processed in countries outside your country of residence (including countries within and outside the European Economic Area — EEA). When data is transferred outside the EEA, appropriate safeguards such as the Standard Contractual Clauses (SCCs) approved by the European Commission are provided. For transfers abroad, the necessary measures are taken under Article 9 of the KVKK.

11. Children's Privacy

Our service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you become aware that a child has provided us with personal data, please contact us; we will take the necessary steps to remove that data.

12. Changes to This Policy

This Privacy Policy may be updated from time to time. The "Last updated" date at the top of the page shows when the policy was most recently revised. We recommend that you review the page regularly. Your continued use of the service after changes means that you accept the updated policy.

13. Contact Us

For questions about this Privacy Policy or requests to exercise your data rights:

Email: [email protected] Website: www.ntroy.net

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

14. Purchases on Our Websites

This section applies only to purchases made on our websites (for example, the Basketball Mates web shop on basketballmates.net, when available). It does not apply to purchases inside our mobile apps; those are processed by Apple or Google as described in Section 2.3.

  • Payments on our websites are processed by Stripe, Inc.
  • We do not store your credit card number, CVV, or full card details.
  • The data we store: Stripe session IDs, transaction amounts, purchase history, and payment status.
  • Data shared with Stripe, Inc.: email, name, transaction amount.
  • Payment, purchase and invoice records are retained as described in Section 7.