Privacy Policy
Version 1.0.0 · Effective {{EFFECTIVE_DATE}}
This policy explains what personal data Play With Keyboard (playwithkeyboard.com, the "Service") collects, why, how long we keep it, who helps us process it, and the rights you have. It applies to visitors, account holders and anyone who contacts us. It is written to meet the EU and UK General Data Protection Regulation (GDPR / UK GDPR), the Turkish Personal Data Protection Law No. 6698 (KVKK), the Brazilian LGPD, the California CCPA/CPRA and comparable laws. Users in Türkiye should also read our KVKK Aydınlatma Metni.
1. Summary
- You can play without an account. We do not sell your data and we use no third-party advertising or tracking.
- With an account we store your username, email, password (hashed), recordings, duels, scores and settings — what is needed to run the features you use.
- We log your consent choices with IP address and timestamp as proof, as the law requires.
- Our main service provider is Cloudflare (hosting, database, security, email).
- You can download or delete everything at any time — in your settings, with the deletion form (username + email → 6-digit code → confirm), or by emailing info@playwithkeyboard.com.
2. Who is responsible
The controller (in Türkiye: veri sorumlusu) is {{COMPANY_NAME}}, {{ADDRESS}}, email info@playwithkeyboard.com.
- EU representative (GDPR Art. 27): {{EU_REPRESENTATIVE}}
- UK representative (UK GDPR Art. 27): {{UK_REPRESENTATIVE}}
- Data protection contact / LGPD encarregado: reachable at info@playwithkeyboard.com.
3. What we collect and why
| Data | When | Purpose | Legal basis (GDPR / KVKK / LGPD) |
|---|---|---|---|
| Technical data: IP address, browser and device type, language, pages requested, time, approximate country derived from IP | Every visit | Deliver the site, keep it secure, prevent abuse, choose your language | Legitimate interests in a secure, working service (GDPR 6(1)(f); KVKK 5(2)(f); LGPD 7(IX)) |
| Consent record: random consent ID, your choices, policy version, IP, user agent, timestamp, locale, account ID if signed in | When you use the cookie banner or change your choice | Prove and respect your choice | Legal obligation to demonstrate consent (GDPR 6(1)(c), 7(1); KVKK 5(2)(ç)); legitimate interests |
| Account data: username, email, password hash, locale, role, sign-up date, email-verification status, age confirmation, and (if you use Google sign-in) your Google account ID, name and email address | Sign-up / sign-in | Create and run your account, send codes and service emails | Performance of the contract (GDPR 6(1)(b); KVKK 5(2)(c); LGPD 7(V)) |
| Terms acceptance record: Terms and Privacy versions accepted, timestamp, IP | Sign-up and on updates | Prove the contract and its version | Contract; legal obligation; legitimate interests |
| Parental consent (if offered in your region): parent's email and confirmation | Sign-up of a child below the local consent age | Obtain and prove parental consent | Legal obligation (GDPR 8; COPPA) |
| Your content: recordings (note events, timing, instrument, tempo), duels and series, scores, quiz answers and timings, game history, leaderboard entries, notifications, display names | When you use those features | Provide recording, sharing, duels, competitions, rankings | Contract |
| Anti-cheat and security data: answer and note timings, rate-limit counters, Turnstile result, flags on implausible results | Duels, competitions, forms | Detect bots and cheating, keep rankings fair | Legitimate interests (fair play, security) |
| Song requests: song name, composer, country/language, note, and your account or email | When you send a request | Review and answer requests | Legitimate interests / your request (contract) |
| Reports, takedown notices and support emails: what you tell us, your contact details | When you contact us | Handle your request, moderation, legal compliance | Legal obligation (e.g. EU Digital Services Act, copyright law); legitimate interests |
| Deletion and data-rights requests: username, email, code (stored hashed), request status, timestamps | When you exercise a right | Verify and carry out the request; prove we did | Legal obligation |
| Device preferences (stored only in your browser): instrument key mode, metronome mute, the player name you type for duels | When you set them | Remember your settings | Strictly necessary for the function you request; no data is sent to us unless you share it |
| Analytics (only if you accept "Analytics"): aggregated page views and performance metrics via Cloudflare Web Analytics, without cookies or cross-site profiles | After consent | Understand which pages and features are used | Consent (GDPR 6(1)(a); KVKK 5(1) açık rıza; LGPD 7(I)) |
| Marketing emails (only if you tick the optional box) | After opt-in | News about songs and features | Consent; you can unsubscribe in every email |
We do not collect audio from your microphone, precise location, contacts, payment data or special categories of data (health, religion, etc.). Please do not send us such data.
We do not take decisions with legal or similarly significant effects based solely on automated processing. Our anti-cheat checks can automatically reject a score or hide it from a leaderboard; you can ask for a human review at info@playwithkeyboard.com.
4. What is public
Your username, avatar (if any), scores, ranks, badges and the recordings or duels you choose to share are visible to others: on leaderboards, duel pages and to anyone with a share link. Link previews (images) may be generated for social networks. Your email address is never shown publicly.
5. Cookies and similar technologies
We use only cookies and browser storage that are necessary, unless you agree to more. Nothing non-essential runs before you choose. Details and how to change your choice: Cookie Policy and the "Cookie settings" link in the footer.
6. Who receives your data
We never sell or rent personal data and do not "share" it for cross-context behavioural advertising.
| Recipient | Role | What for | Location |
|---|---|---|---|
| Cloudflare, Inc. (and affiliates) | Processor | Hosting (Workers), database (D1), file storage (R2), CDN, security and bot protection (Turnstile, rate limiting), email routing and sending, cookieless analytics, access control for admins | Global network; company in the USA |
| {{SMTP_PROVIDER}} (only if configured) | Processor | Sending verification and service emails | {{SMTP_PROVIDER_LOCATION}} |
| Google LLC (only if you use Google sign-in) | Independent controller for the sign-in | Authenticate you | USA |
| Authorities, courts, rightsholders | Independent recipients | Where we are legally required, or to establish, exercise or defend legal claims | — |
| A successor | Controller | If the Service is transferred; you will be informed | — |
Processors act only on our instructions under a data processing agreement.
7. International transfers
Cloudflare processes data on its worldwide network, and its parent company is in the USA. Transfers outside the EEA/UK/Switzerland rely on the EU–US Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified, and on the European Commission's Standard Contractual Clauses (with the UK addendum) included in the provider's data processing agreement. For Türkiye we rely on the standard contracts under KVKK Article 9, notified to the Personal Data Protection Authority; for Brazil, on the standard contractual clauses approved by the ANPD. You can request a copy of the safeguards at info@playwithkeyboard.com.
8. How long we keep data
| Data | Retention |
|---|---|
| Account data | As long as your account exists. Accounts inactive for 36 months are deleted after an email warning sent 30 days in advance. |
| Unverified sign-ups | Deleted after 7 days |
| Verification and deletion codes | Valid 15 minutes, single use, stored only as a hash |
| Sign-in sessions | Until you sign out, at most 30 days |
| Recordings, duels, game history, scores | Until you delete them or your account. On deletion, duel and leaderboard scores are kept only in anonymised form ("Deleted player") so other players' results stay correct. |
| Notifications | 90 days |
| Detailed anti-cheat timing data | 90 days, then only the final score is kept |
| Song requests | Until handled plus 12 months, then deleted or anonymised |
| Consent records (cookie banner, Terms acceptance, marketing opt-in, parental consent) | 3 years from the record, or for the life of the account plus 3 years for Terms acceptance — as proof. After account deletion they are kept only for this purpose and then purged. |
| Deletion and data-rights request records (no content, email stored hashed) | 3 years |
| Security and traffic logs (IP, time, action) | 12 months |
| Rate-limit counters | 24 hours |
| Reports, takedown notices, moderation decisions | 3 years after closure |
| Ban records (hashed email, reason) | 3 years after the ban |
| Support emails | 2 years after the last message |
| Database backups | Rolling, overwritten within 30 days |
We may keep data longer only if the law requires it or to establish, exercise or defend legal claims, and only for as long as needed.
9. Security
We use HTTPS everywhere, hashed passwords and codes, encrypted secrets, role-based admin access protected by additional access control, rate limits and bot protection. No system is perfectly secure; if a breach is likely to put you at risk, we will inform you and the authorities as the law requires.
10. Your rights
Depending on where you live, you have the right to:
- access your data and receive a copy;
- data portability — download your data as JSON in your settings or on request;
- rectification of inaccurate data (most fields can be changed in your settings);
- erasure ("right to be forgotten");
- restriction of processing and objection to processing based on legitimate interests;
- withdraw consent at any time (cookie settings in the footer; unsubscribe link in emails), without affecting earlier processing;
- not be subject to solely automated decisions (see section 3);
- lodge a complaint with a supervisory authority (see section 14).
California (CCPA/CPRA): you may know what we collect, delete, correct, and opt out of sale/sharing — we do neither sell nor share. You will not be discriminated against for using your rights. An authorised agent may act for you with written permission. Brazil (LGPD): additionally, confirmation of processing, anonymisation, blocking, information about sharing and about the consequences of refusing consent. Türkiye (KVKK Art. 11): see the KVKK Aydınlatma Metni.
How to delete everything
- Form: open "Delete my data", enter your username and email. If they match an account, we send a 6-digit code to that email (valid 15 minutes). Enter the code and confirm.
- Account settings: "Delete account" (you will be asked to confirm).
- Email: write to info@playwithkeyboard.com from the address linked to your account. If you write from another address, we send a code to the account email to verify that it is you.
We then delete your account, profile, email, password hash, sessions, Google link, recordings, song requests, notifications and settings, and anonymise your scores in duels and leaderboards. We keep only what section 8 says must be kept as legal proof (consent and request records), then purge it. Backups are overwritten within 30 days. We confirm by email.
How to exercise other rights
Email info@playwithkeyboard.com or use your settings. We answer within one month (KVKK: 30 days; LGPD: 15 days for a full access report; CCPA: 45 days), free of charge. We may ask you to verify your identity, usually by a code sent to your account email.
11. Children
Children can play without an account. Accounts require a minimum age of 13; below the age of digital consent in your country (13–16 in the EU, 13 in the UK and USA) an account needs verified parental consent where we offer it, otherwise sign-up is not possible. We collect only what is needed, show no advertising to children and do not build profiles. A parent who believes we hold a child's data without consent can contact info@playwithkeyboard.com and we will delete it.
12. Emails we send
Service emails (verification codes, deletion codes, security notices, important changes to terms) are part of the Service. Marketing emails are sent only with your opt-in and contain an unsubscribe link. For recipients in Türkiye, commercial electronic messages are sent only in line with Law No. 6563 and the İleti Yönetim Sistemi (İYS).
13. Changes
We will update this policy when our processing changes. The version and effective date appear at the top. We will inform account holders of material changes by email or on the Service in advance.
14. Complaints
Please contact us first at info@playwithkeyboard.com. You can also complain to your local data protection authority — for example your EU member-state authority, the UK Information Commissioner's Office (ico.org.uk), the Turkish Personal Data Protection Authority (kvkk.gov.tr), Brazil's ANPD (gov.br/anpd), or the California Privacy Protection Agency (cppa.ca.gov).
15. Contact
{{COMPANY_NAME}} · {{ADDRESS}} · info@playwithkeyboard.com