In short
- Suyga is free to play. We never ask for payment card, bank or government ID details.
- We collect what we need to run your account, keep the games fair and keep the service secure.
- Analytics are off unless you accept them, and you can change your mind at any time.
- We do not sell personal data and we do not use it for third-party advertising.
- You can ask us to give you a copy of your data, correct it or delete it.
Who we are
Suyga (“we”, “us”) runs the Suyga website and games at suyga.com. We decide why and how your personal data is used, so we are the data controller (veri sorumlusu under KVKK).
Operated by , .
For anything about your data, write to [email protected].
Data we collect
We collect data you give us, data created when you play, and technical data that your browser sends automatically.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Email address, username, sign-up date, email verification status. Your password is stored only as a salted scrypt hash, never in readable form. | You |
| Social sign-in | If you sign in with Google, Facebook or Apple, the provider tells us your account ID, your email address and whether it is verified. We never see your password with that provider. | The provider you choose |
| Security and device | IP address, browser and device type (user agent), a random device identifier stored in a cookie, sign-in attempts and times, active sessions, and two-factor authentication data if you turn it on. | Your browser, automatically |
| Chips and gameplay | Chip balance for each game, a ledger of chip movements (daily bonuses, bets, payouts, staff adjustments), game rounds, table and seat activity, and poker hand records. | Created when you play |
| Your choices and requests | When you accepted the Terms and this notice (with the version, time and IP address), your analytics choice, and any privacy request you make. | You |
| Enforcement records | Warnings, suspensions, fraud or fair-play flags and internal staff notes linked to your account. | Our systems and staff |
| Messages | Emails you send us, and service emails we send you such as verification messages. | You and us |
| Analytics (only if you accept) | Pseudonymous usage events collected by Firebase Analytics, linked to your internal numeric user ID but never to your email or username, plus device, browser and approximate location that Google derives from your IP address. | Your browser, with consent |
| Stored on your device | Your avatar picture and sound settings stay in your browser and are not sent to us. See the Cookie Policy. | You |
Other players can see your username and avatar and what you do at shared tables, for example your seat, bets and results in shared hand histories. They never see your email address.
Why we use your data and our legal bases
We only use personal data for the purposes below. For each one we rely on a legal basis under the GDPR (Article 6) and the matching condition in KVKK (Article 5).
| Purpose | GDPR basis | KVKK condition |
|---|---|---|
| Create and manage your account, verify your email, sign you in | Contract, Art. 6(1)(b) | Art. 5(2)(c): necessary to perform a contract |
| Run the games, keep chip balances and ledgers correct, show results | Contract, Art. 6(1)(b) | Art. 5(2)(c) |
| Protect accounts, prevent cheating, bots and multiple accounts, enforce the Terms, keep the service stable | Legitimate interests, Art. 6(1)(f) | Art. 5(2)(f): legitimate interests of the controller |
| Answer privacy requests, keep records we must keep, respond to lawful requests from authorities | Legal obligation, Art. 6(1)(c) | Art. 5(2)(ç): legal obligation |
| Establish, exercise or defend legal claims | Legitimate interests, Art. 6(1)(f) | Art. 5(2)(e): establishment, exercise or protection of a right |
| Optional analytics to understand how Suyga is used and improve it | Consent, Art. 6(1)(a) | Explicit consent, Art. 5(1) |
Where we rely on consent you can withdraw it at any time with the Cookie settings link in the footer. Withdrawing does not affect anything done before. We do not make joining Suyga depend on marketing or analytics consent.
We do not currently send marketing emails. If we ever offer them, they will be opt-in and separate from your account.
Analytics
If you accept analytics, we load Google’s Firebase Analytics to count visits and see which features are used. If you reject, or have not chosen, it is not loaded and no analytics cookies are set. Events use your internal numeric user ID, never your email address or username. Details of the cookies involved are in the Cookie Policy.
International transfers
Some of our providers, including Google, process data in countries other than yours, such as the United States. Where the law requires safeguards for such transfers, we rely on mechanisms such as an adequacy decision, standard contractual clauses or, under KVKK Article 9, the approved appropriate safeguards. You can ask us for details using the contact address below.
How long we keep data
| Data | How long |
|---|---|
| Account details | While your account exists. When you ask us to delete your account we anonymise it (see Your rights). |
| Sessions | Up to 14 days, or until you sign out. |
| IP address, user agent and device ID in sign-in records | Removed from the record after 180 days. The time and result of the sign-in attempt may be kept longer. |
| Chip ledger, game rounds and hand records | Kept to keep balances provable and to investigate unfair play. After deletion they stay but are no longer linked to your identity. |
| Consent and privacy request records | As long as needed to show that we respected your choices and requests. |
| Analytics data | For the period set in our analytics settings, which we keep as short as is practical. |
| Emails to us | As long as needed to deal with your request and for a reasonable period afterwards. |
We also keep data for longer where a law requires it or where it is needed to defend a legal claim.
Your rights
Under KVKK Article 11 and the GDPR you have the right to:
- find out whether we process your personal data and ask for information about it, including who receives it;
- get a copy of your data in a structured, commonly used format, and move it to another service;
- have inaccurate or incomplete data corrected;
- have your data deleted or anonymised when the reasons for processing no longer apply;
- object to processing based on our legitimate interests, and ask us to restrict processing in some cases;
- withdraw consent at any time where processing is based on consent;
- object to a result against you that comes only from automated analysis, and claim compensation for loss caused by unlawful processing (KVKK);
- complain to a supervisory authority: in Türkiye the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, kvkk.gov.tr), or in the EU the data protection authority of your country.
What deleting your account means
When we delete an account we anonymise it: the username and email address are replaced, and your password, linked sign-in providers, two-factor data, staff notes and IP and device details in sign-in records are deleted. The account is then closed for good. Chip ledgers and game records are kept without your identity so that balances and past games stay consistent. Deletion cannot be undone and your chips are lost with the account.
How to use your rights
Write to [email protected] from the email address on your account and tell us what you would like, for example a copy of your data or deletion of your account. If we cannot tell it is really you, we may ask for a little more information before acting.
- We reply within 30 days of receiving your request. Requests are normally free of charge.
- A data copy is a JSON file with your profile, chip balances, transactions, game rounds, sign-in records, linked providers, consent records and sanctions. It never contains your password hash or two-factor secrets.
- To stop analytics, use at any time. No request is needed.
- Under KVKK you may also apply to the controller in writing or by registered electronic mail as set out in the Communiqué on Procedures and Principles of Application to the Data Controller.
Children
Suyga is for adults only. You must be at least 18 years old to create an account. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to someone under 18, we close it and delete the data. If you believe a child is using Suyga, please tell us.
Security
Passwords are stored as salted hashes. Connections to Suyga are encrypted with HTTPS. You can protect your account further with two-factor authentication on the account security page. Staff access to personal data is limited by role and recorded in an audit log. No online service can promise perfect security, so please use a strong, unique password.
We use automated checks to flag suspicious activity, such as several accounts on one device. A flag is reviewed by our staff before an account is restricted.
Changes to this notice
We may update this notice when our services or the law change. The date at the top shows the latest version. If a change is important, we will tell you in the game or by email before it takes effect.
Contact
Questions about this notice or your data: [email protected].