Informativa KVKK
Version 1.4.0 · Effective 2026-11-06
This is an English translation for convenience. The Turkish text is the binding version.
This notice is provided under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, to visitors, members and anyone who contacts Play With Keyboard (playwithkeyboard.com, the "Service"). More detail is in our Privacy Policy and Cookie Policy.
1. Data controller
{{COMPANY_NAME}} Address: {{ADDRESS}} Email: info@playwithkeyboard.com Registered electronic mail (KEP): {{KEP_ADDRESS}} Trade registry / tax no.: {{COMPANY_REGISTRATION}} VERBİS registration no.: {{VERBIS_NO}}
2. Data processed, purposes and legal grounds
| Category | Data | Purposes | Legal ground (KVKK Art. 5) |
|---|---|---|---|
| Identity | The name in your Google account (your full name or another name you use at Google) | Creating the account and showing it on your account page, addressing you in emails, verifying your identity for deletion and data-subject requests | Art. 5(2)(c) formation and performance of contract, 5(2)(ç) answering requests |
| Transaction security | IP address, browser and device data, access time, page requested, session data (random session token, the session's IP address and browser data, start and expiry time), the one-time security value used during Google sign-in, rate-limit counters per IP address, Turnstile result; for administrators only, a password hash | Providing the Service, information security, preventing abuse and bots, preventing forged sign-ins, obligations under Law No. 5651 | Art. 5(2)(ç) legal obligation, 5(2)(f) legitimate interest, 5(2)(c) performance of contract |
| Contact | Email address (received from Google with Google sign-in) and whether Google has verified it; for child accounts, the parent's/guardian's email | Sending service notices and deletion codes, answering requests, obtaining parental consent; for administrators only, sign-in and verification codes | Art. 5(2)(c), 5(2)(ç) |
| Customer transaction | Google account ID and the sign-in permissions granted (openid, email, profile), language, country derived from the IP address at sign-up, sign-up date, role, a username for administrators only, recorded performances (note events, timing, instrument, tempo), duels, scores, quiz answers and timings, game history, notifications, song requests, the result of the age check and the age limit applied (the date of birth is not stored) |
Creating and managing the account, recognising you when you sign in again; recording/sharing, duels, competitions and rankings; fair play (cheat detection); handling song requests | Art. 5(2)(c) formation and performance of contract, 5(2)(f) legitimate interest (fair play, security) |
| Legal transaction | Acceptance records of the Terms and Privacy Policy and your statement that you have read this Notice (version, hash of the text shown, result of the age check, timestamp, IP, browser, language), cookie consent records (consent ID, categories, policy version, IP, browser, timestamp, language), copyright/complaint notices, moderation decisions, deletion and data-subject request records | Proving the contract and consent, legal compliance, protecting rights in disputes, answering data-subject requests | Art. 5(2)(ç), 5(2)(e) establishment, exercise or protection of a right, 5(2)(f) |
| Marketing (only with your permission) | Email address, message permission and date | Commercial electronic messages about new songs and features | Art. 5(1) explicit consent and approval under Law No. 6563 |
| Analytics (only with your permission) | Cookieless, aggregated page-view and performance metrics (Cloudflare Web Analytics); with Google Analytics 4, loaded through Google Tag Manager: a random cookie ID, pages viewed, approximate location, device and browser data | Improving the Service | Art. 5(1) explicit consent |
| Embedded video (YouTube) (only if you press Play on a video in the blog) | IP address, browser and device information, the address of the page with the video, use of the player; cookies and similar identifiers Google may place on your device. This data goes from your browser directly to Google, not to us | Loading and playing the video you chose from YouTube (youtube-nocookie.com) | Art. 5(1) explicit consent: given by pressing Play after the notice under the video, for that video only |
Preferences stored only in your browser (keyboard mode, metronome sound, the player name you type for duels) are not sent to us; only when you share a link is the shared information added to the link.
Recordings saved on this device (My recordings, Studio): the takes and projects you save, their names, your folders, deleted items kept 30 days for Undo, the last unsaved take offered for 24 hours via "Restore last take" and the browser's answer to the persistent storage request are kept only in your browser (IndexedDB). They are not sent to us and we cannot see or recover them; they are therefore not among the personal data we process as data controller and are not affected when your account is deleted. Delete them in My recordings or by clearing this site's data in your browser. Replay links and backup files (.pwk.json) you share contain the notes; anyone with the link can play the take. Private windows and Safari on iPhone/iPad may erase this data.
Sign in with Google: accounts are created only with the "Continue with Google" button. When you press it, you go to Google's own sign-in page; there Google, as a separate data controller, is itself responsible for what happens with your Google account. We ask Google only for the basic sign-in permissions (openid, email, profile); Google sends us your name, your email address, whether it is verified, and your account ID. We do not store your profile picture, your Google password or Google's access tokens, and we cannot access your Gmail, contacts or files. On your first sign-in, your account is created when Google sends you back to our site; you are then asked your age and to accept the Terms of Use. If you are below the age limit, the account is deleted immediately; if this step is not completed, the account is deleted automatically after 7 days. Your name is not shown to other users. You can remove Play With Keyboard's connection to your Google account at myaccount.google.com/connections; this does not delete your account with us (for deletion, see section 8). Administrators can also sign in with an email address and password.
We do not process special categories of personal data (health, religion, biometrics, etc.); please do not send us such data. We do not collect microphone audio, precise location, contacts or payment data.
3. Method of collection
Personal data is collected electronically, partly or fully by automated means, through forms you fill in (sign-up, sign-in, song request, deletion form, complaints), features you use (recording, duels, competitions), your cookie-banner choice, emails you send us, and automatic records of our servers and security systems. Because accounts are created through Google sign-in, your name, email address, its verification status and your Google account ID are received from Google, by automated means, during sign-in. If you press Play on a video in the blog, your browser automatically sends the data listed above directly to YouTube (Google); as long as you don't press Play, no data goes to YouTube.
4. Transfers
| Recipient | Purpose | Legal ground |
|---|---|---|
| Cloudflare, Inc. and affiliates (processor; USA-based, global network) | Hosting, database (D1), file storage, content delivery, security and bot protection (Turnstile), email routing and sending, cookieless analytics | KVKK Arts. 8 and 9; for transfers abroad, a standard contract under Art. 9(4) (notified to the Authority) or an adequacy decision for the country |
| Google Ireland Limited / Google LLC (only if you allow analytics cookies; processor) | Website analytics with Google Analytics 4, loaded through Google Tag Manager | Art. 5(1) explicit consent; for transfers abroad, appropriate safeguards under Art. 9 (standard contract) |
| {{SMTP_PROVIDER}} (only if configured; processor) | Sending verification and service emails | Arts. 8, 9 (standard contract) |
| Google (Google Ireland Limited in the EEA and Switzerland, Google LLC elsewhere; only with Google sign-in; separate controller) | Running the sign-in on Google's pages and confirming your identity to us | We transfer no personal data to Google in this process: you connect to Google's sign-in page yourself with your browser, and Google, at your request, sends us the information above. We process it under Art. 5(2)(c) (see below) |
| Google Ireland Limited / Google LLC (YouTube; only if you press Play on a video in the blog; separate controller for its own processing) | Loading the video player and the video; also Google's own purposes described in its Privacy Policy | Art. 5(1) explicit consent; for the transfer abroad, explicit consent under Art. 9(6)(a) (see below) |
| Competent public authorities and courts | Responding to requests based on law | Art. 8(2)(a), 5(2)(ç) |
| Rightsholders (copyright notices, limited extent) | Handling the notice procedure | Art. 5(2)(e) |
Your personal data is not sold, rented or shared with third parties for advertising.
Transfers abroad: KVKK Art. 9 was amended by Law No. 7499 (in force since 1 June 2024) and is detailed in the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad (Official Gazette, 10 July 2024). Personal data may be transferred abroad (i) where there is an adequacy decision for the country, sector or international organisation; (ii) otherwise, with one of the appropriate safeguards listed in Art. 9(4) (e.g. the standard contract announced by the Board); (iii) failing both, only for occasional transfers (not regular or continuous) on one of the grounds in Art. 9(6).
- Cloudflare and Google Analytics: because the Service runs on Cloudflare's worldwide infrastructure, your data may be processed on servers outside Türkiye; if you allow analytics cookies, Google Analytics data is also processed in the USA. These transfers are made under KVKK Art. 9(4) by signing the standard contract announced by the Board with the processor and notifying it to the Authority within 5 business days of signature.
- YouTube videos: when you press Play on a video in the blog, your browser connects directly to Google's servers and the data listed above may be processed in the USA and other countries. This transfer is not part of a regular data flow; it happens only because you decide to start a video, and only for that video. As there is no standard contract with Google for this purpose, the transfer relies on your explicit consent, given after being informed of the possible risks, under Art. 9(6)(a). Possible risks: the destination country may not offer protection and independent oversight equivalent to Türkiye's; its public authorities may access the data; it may be harder for you to exercise your rights against Google and to seek legal remedies; we cannot determine in which country, for what purposes or for how long the data is processed. You do not have to consent: if you don't press Play, no data goes to YouTube and you can use the rest of the Service in the same way. You can withdraw your consent by not playing the video again and deleting YouTube and Google cookies in your browser; withdrawal does not affect transfers that have already taken place.
- Google sign-in: when you sign in with Google, you deal directly with Google on Google's pages; Google may process data such as your IP address, device data and sign-in time in the USA and other countries under its own privacy policy. This processing is Google's own responsibility as data controller. We transfer no personal data to Google, so we do not rely on an Art. 9 transfer safeguard or on explicit consent for this step. The name, email address and account ID we receive from Google are processed on Cloudflare's infrastructure like all other account data, under the standard-contract safeguard described above.
5. Retention periods
| Data | Period |
|---|---|
| Account data | While the account exists; accounts unused for 36 months are deleted after an email warning 30 days in advance |
| Unfinished sign-ups (email not verified, or the age question and Terms step not completed after Google sign-in) | 7 days; immediately if the user is found to be below the age limit |
| Verification and deletion codes | 15 minutes, single use, stored only as a hash |
| Sessions (session token, IP address, browser data) | Until sign-out or until the session expires 30 days after it was last renewed; renewed at most once a day while the site is used |
| Google sign-in security value | At most 10 minutes; deleted when used |
| Recordings, duels, scores, game history | Until you or your account are deleted; on deletion, duel and leaderboard scores are anonymised as "Deleted player" |
| Notifications | 90 days |
| Google Analytics data (only with consent) | At most 14 months at Google |
| YouTube data (only if you press Play) | Not received or kept by us; Google determines the period. You can delete YouTube and Google cookies in your browser at any time |
| Detailed cheat-detection timing data | 90 days |
| Song requests | 12 months after being handled |
| Consent and contract-acceptance records | 3 years from the record (for contract acceptance: account lifetime + 3 years) |
| Deletion and data-subject request records | 3 years |
| Security and traffic logs (IP, time, action) | 12 months (any minimum periods under Law No. 5651 are reserved) |
| Rate-limit counters | 24 hours |
| Complaints, copyright notices, moderation records | 3 years after closure |
| Ban records (email hash, reason) | 3 years |
| Support emails | 2 years after the last message |
| Backups | Overwritten within 30 days at the latest |
At the end of the period data is deleted, destroyed or anonymised. Longer periods required by law, or limitation periods in case of a dispute, are reserved.
6. Children
The Service can be used without an account at any age. The minimum age for an account is 13. Users below the age of digital consent in their country may only register with parental/guardian consent (where offered). With Google sign-in, the age question is asked right after Google sends you back to our site; by then your name and email address have already been received from Google. If you are found to be below the age limit, this data is deleted immediately; if you leave without answering, it is deleted after 7 days.
7. Your rights under KVKK Art. 11
By applying to the data controller you have the right to:
a) learn whether your personal data is processed; b) request information about it if so; c) learn the purpose of processing and whether data is used in line with that purpose; ç) know the third parties in Türkiye or abroad to whom data is transferred; d) request rectification if data is incomplete or inaccurate; e) request erasure or destruction under the conditions of KVKK Art. 7; f) request that actions under (d) and (e) be notified to third parties to whom data was transferred; g) object to a result against you arising from analysis exclusively by automated systems; ğ) claim compensation for damage caused by unlawful processing.
You can withdraw your explicit consent (cookie preferences, marketing messages) at any time via "Cookie settings" at the bottom of the site or the "unsubscribe" link in emails, and your consent for YouTube videos by not playing the video again and deleting YouTube and Google cookies in your browser.
8. How to apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, send your application in Turkish, stating your name (or username), signature (for written applications), Turkish ID number (for foreigners: nationality and passport/ID number), address or email for notification, and your request:
- by email to info@playwithkeyboard.com from the email address registered in our system,
- via the "Delete my data" form and the "Delete account" section of your account page (username, or for Google accounts the name shown on your account page, + email → 6-digit code sent to your email → confirm; if our email codes are not switched on yet, the form directs you to write to info@playwithkeyboard.com from your registered email address),
- to the KEP address {{KEP_ADDRESS}}, with a secure electronic or mobile signature,
- or in writing to {{ADDRESS}}.
We conclude your application free of charge within 30 days at the latest; if the action involves an additional cost, the fee in the Board's tariff may be charged. We may send a code to your registered email to verify your identity. If your application is rejected, you find the answer insufficient or we do not answer in time, you may complain to the Personal Data Protection Board (kvkk.gov.tr) within 30 days of learning the answer and in any case within 60 days of the application.
9. Explicit consent
For processing that requires explicit consent, your consent is obtained separately from this notice:
- for analytics and marketing cookies and commercial electronic messages, through the cookie banner and unticked, optional checkboxes in the sign-up form;
- for YouTube videos and the related transfer abroad, by pressing Play on a video after seeing the short notice under it; this consent covers that video only.
Refusing consent does not prevent you from using the Service.
No explicit consent is requested for the account or for Google sign-in; this processing is based on Art. 5(2)(c) (formation and performance of a contract). The "I have read and been informed" box shown at sign-up only confirms that you have read this Notice; it is not a declaration of explicit consent.
Version history: 1.4.0 (2026-11-06): accounts are created only through Google sign-in; data received from Google (identity, contact, customer transaction), session and sign-in security data, deletion of unfinished sign-ups after 7 days, transfer-abroad explanation for Google sign-in and the application route updated. 1.3.0 (2026-11-06): added YouTube videos in the blog (loaded only when you press Play) and the transfer-abroad rules of KVKK Art. 9 as amended in 2024. 1.2.0 (2026-10-27): added Google Analytics 4, loaded through Google Tag Manager. 1.1.0 (2026-10-26): added recordings saved on this device. 1.0.0: first version.