Privacy notice

Last updated: 3 November 2026

This notice explains how Commit Kingdom (the mobile and web app, Commit Kingdom Desktop and the Commit Kingdom Tracker editor extensions) processes your personal data, under Turkey’s Personal Data Protection Law No. 6698 (KVKK). The waitlist notice is at the end of this page.

1. Controller. Poyraz Avsever (Commit Kingdom), Ankara, Türkiye. Email: destek@commitkingdom.com.

2. In short.

• Your source code, file names, file paths, branch names and real project names never leave your computer.
• From your coding we receive only time, language, line counts and how many of those lines an AI tool wrote.
• Raw coding records are deleted after 30 days; daily totals stay for your reports.
• We never sell your data or use it for ads, and there are no ads in the app.
• Other players see only your nickname, level and tower look, never your coding time.

3. What we collect.

• Account: email; nickname; language and time zone; sign-up and tutorial completion times. With Google or Apple sign-in: the account’s stable id and email (possibly Apple’s private relay address). We do not receive your name or photo.
• Sessions: an encrypted session key and device type (e.g. “ios 17”).
• Email sign-in codes: kept hashed for at most 24 hours.
• Coding activity (Commit Kingdom Tracker):
  • time, language, activity type and whether a file was written;
  • added and deleted line counts, and how many lines you versus an AI tool wrote;
  • editor type and file extension only;
  • a per-computer, one-way hash instead of the project name;
  • a random computer id.
• AI line counts: Tracker reads the local logs of AI coding tools on your computer. Those logs never leave it; only the counts do. The Tracker is open source.
• Connected computers: the name you give it (editable), connection and last-seen times, editor type.
• Game: your kingdom (tower, rooms, army, items, your king’s look, gold, gems, XP, chests, marches, raids), code goal and streak.
• Purchases: made in the App Store or Google Play; we never see card details. From RevenueCat we receive transaction id, product, store, dates and status.
• Product usage: screens opened, tutorial steps, game events, purchase steps, app version and platform. These are sent with your account id, without IP address or device details, and you can turn this off in Settings.
• Notifications: your device’s push token and preferences, if you enable notifications.
• Support messages: what you write to us.
• IP address: used only in memory for rate limiting; never stored.

4. Purposes and legal bases (KVKK art. 5/2).

• Performance of the contract (c): running your account and the game, verifying coding and turning it into rewards, reports, recording purchases, and service emails (sign-in code, Desktop download link).
• Legitimate interest (f): cheat and fake-activity detection, fairness, security and rate limiting, and pseudonymous usage statistics (you can opt out).
• Legal obligation (ç): keeping purchase records.
• Establishing or defending legal claims (e).

Nothing relies on your explicit consent. If we ever want to send marketing email, we will ask separately.

Automated checks. A coding day that matches set rules is placed under review. The rules are, for example:

• more than 12 hours in a day;
• more than 10 hours on seven days in a row;
• machine-regular intervals;
• a computer that belongs to another account.

Until review ends, that day’s energy cannot be used to raid other players. A person makes the final decision; if rejected, that day’s rewards are reversed. You can object (see 8).

5. Recipients.

• Service providers:
  • Hostinger: server and database, Germany (Frankfurt).
  • Resend: email, USA.
  • PostHog: pseudonymous analytics, USA.
  • RevenueCat: purchases, USA.
  • Google: sign-in, Google Play, Firebase notifications.
  • Apple: sign-in, App Store.
  • GitHub: Desktop update downloads.
  • Cloudflare: website and waitlist.
• Transfers abroad: fall under KVKK art. 9; signing the Board’s standard contracts and notifying the Authority is in progress.
• Authorities: competent authorities when legally required.
• Other players: see your nickname, level, tower look and shield. A player you raid sees your nickname. Coding time is never shown.
• What you share yourself: share cards and the GitHub README card show only what is on them. Share links expire in 7 days, and you can turn the README card off at any time.

6. Retention.

• Raw coding records: 30 days.
• Daily totals, game data and devices: while your account exists.
• Sign-in codes: 24 hours.
• Purchase records: as long as tax and commercial law requires.
• Backups: up to 30 days.

You can delete your account in the app or at commitkingdom.com/account-deletion:

• For 30 days you can restore it.
• After that, game, coding, device, support and notification data are deleted, and your account record is anonymised. Only the transaction data the law requires us to keep stays.
• Backups drop it within 30 days.

You can download a copy of your data in Settings.

7. Cookies and storage. The web app uses no cookies. It keeps your session and cache in the browser’s local storage. Google and Apple sign-in windows follow those companies’ rules. The website uses Cloudflare Turnstile on the waitlist form.

8. Your rights (KVKK art. 11). You can:

• learn whether your data is processed and request information;
• learn the purpose of processing and whether data is used accordingly;
• know the third parties your data is transferred to;
• request correction;
• request deletion, and that third parties are notified of it;
• object to an adverse result produced solely by automated analysis;
• claim compensation for unlawful processing.

Write from your registered email to destek@commitkingdom.com. We answer free of charge within 30 days. You may complain to the Personal Data Protection Board.

9. Age. Commit Kingdom is for people aged 16 and over. We delete accounts of younger users when we learn of them.

10. Security and changes. Connections use HTTPS. Session keys, device keys and sign-in codes are stored only as one-way hashes. We notify the Board and affected people of a breach as the law requires. We update the date when this notice changes, and announce major changes in the app.

11. Support and the contact form. When you write to us with the form on commitkingdom.com/support, we process your name, e-mail address, the topic you choose and your message to answer you and resolve your request (KVKK Art. 5/2-c and 5/2-f). We use them for support only, and our answer goes to the e-mail address you wrote. To prevent abuse, the number of messages from one address and one internet address in a short time is limited; the internet address is kept in memory for that limit only and is not stored with the message. Messages are kept on our own servers for at most 12 months after the request is closed, then deleted.

Waitlist privacy notice