Popilife — Privacy Policy

Effective date: 11 July 2026

This Privacy Policy explains how FociiGames Inc. (“FociiGames”, “we”, “us”, “our”) collects, uses, discloses and protects your personal data when you use Popilife, our isometric social multiplayer online game, on the web, Android and iOS. It is written to meet our obligations under the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK).

1. Who we are (Data Controller)

The data controller responsible for your personal data is:

FociiGames Inc.
Company website: fociigames.com
Privacy contact: [email protected]
General / support: [email protected]

2. What data we collect and why

We only collect what we need to run the game, keep it safe, and process your purchases. The table below sets out the categories of personal data we process, the purpose, and the legal basis for each.

Data	Why we process it	Legal basis (GDPR Art. 6 / KVKK Art. 5)
Account email address	To create and secure your account, verify your address, send password-reset and essential service emails.	Performance of a contract
Password (stored only as a bcrypt hash — never in plain text)	To authenticate you and protect your account.	Performance of a contract
Display name	To identify you to yourself and to other players in shared rooms and on leaderboards.	Performance of a contract
Gameplay save data (JSONB: inventory, virtual currencies, home/room layout, progress and settings)	To store your progress and sync it across your devices.	Performance of a contract
Chat messages and other in-game content you create	To deliver messages to other players in real time and to moderate for safety. Messages are sanitised to mask phone numbers, emails and links.	Performance of a contract; legitimate interest (safety & moderation)
IP address	To operate the multiplayer connection, apply rate limits, and keep security/audit logs to prevent fraud and abuse.	Legitimate interest (security & anti-fraud)
Purchase receipts (product bought and a store/processor receipt identifier)	To deliver purchased virtual currency (“Diamonds”), tie purchases to your account, and meet accounting/tax obligations. We never receive or store full payment-card numbers.	Performance of a contract; legal obligation (accounting)
Marketing preferences (only if you opt in)	To send optional news or offers about Popilife and other FociiGames titles.	Consent

Our lawful basis under the KVKK includes processing that is necessary for the performance of a contract to which you are a party, compliance with a legal obligation, and our legitimate interests, balanced against your rights. Where we rely on consent (e.g. marketing), your explicit consent (açık rıza) is the basis and you may withdraw it at any time.

3. Legal basis — summary

Performance of a contract — for creating and running your account, storing and syncing your game save, and delivering purchases.
Legitimate interest — for security, rate-limiting, anti-fraud, abuse prevention and moderation. We keep this proportionate and do not use it to profile you for advertising.
Legal obligation — for retaining purchase/accounting records where the law requires.
Consent — for optional marketing communications only. You can withdraw consent at any time without affecting your ability to play.

4. How long we keep it (retention)

Account and game-save data — kept for as long as your account exists. When you delete your account, this data is deleted (see Section 8).
Security and audit logs, including IP addresses — kept for 90 days, then deleted or anonymised, unless a specific incident requires us to retain a record longer to investigate abuse or comply with the law.
Purchase and accounting records — retained for the period required by applicable tax and accounting law after the transaction, even after account deletion.
Marketing preferences — kept until you withdraw consent or delete your account.

5. Who we share data with (processors & third parties)

We do not sell your personal data. We share it only with the service providers needed to run Popilife, each acting as our processor or as an independent controller for their part:

Self-hosted PostgreSQL database — runs on FociiGames’ own server and stores your account and save data.
Email (SMTP) provider — sends verification and password-reset emails.
DiceBear — generates avatar images in your browser/device (client-side). This is used to render avatars and does not receive your account data from our servers.
Payment processors — Stripe (web purchases), the Apple App Store and Google Play (mobile in-app purchases). They process your payment under their own privacy policies; we receive only a receipt identifier, not your card details.
Other players — in shared rooms, other players can see your display name, avatar, in-game presence/position and the chat messages you send.

We may also disclose data where required by law, to enforce our Terms, or to protect the rights, safety and property of our users or FociiGames.

6. International transfers

Our database is self-hosted on FociiGames’ own server. Some processors (for example Stripe, Apple, Google and the email provider) may process data outside your country, including outside the EU/EEA or Türkiye. Where personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs), adequacy decisions where available, and — for transfers from Türkiye — the conditions for cross-border transfer under Article 9 of the KVKK.

7. Your rights

Subject to the GDPR and the KVKK, you have the right to:

Access — obtain confirmation of, and a copy of, the personal data we hold about you.
Rectification — correct inaccurate or incomplete data.
Erasure — have your data deleted (“right to be forgotten”).
Portability — receive your data in a structured, commonly used, machine-readable format.
Restriction — ask us to limit processing in certain circumstances.
Objection — object to processing based on our legitimate interests.
Withdraw consent — withdraw any consent you gave (e.g. marketing) at any time, without affecting the lawfulness of prior processing.
Lodge a complaint — complain to a supervisory authority. In the EU/EEA this is your local Data Protection Authority; in Türkiye this is the Personal Data Protection Authority / Board (Kişisel Verileri Koruma Kurumu — KVKK Kurulu).

How to exercise your rights

You can:

Email us at [email protected]; and/or
Use the in-game Settings → Account → “Delete account” to erase your account and associated data yourself, and Settings → Legal & data → “Download my save” to export your data.

We will respond within the time limits set by law (generally within one month under the GDPR, and within 30 days under the KVKK). We may need to verify your identity before acting on a request.

8. Deleting your account

When you delete your account, your account record, display name, email, password hash and game-save data are removed from our active database. In-game content already shared with others (e.g. past chat messages) and records we must keep by law (e.g. purchase/accounting records) may be retained for the periods described in Section 4. Security logs age out on the 90-day cycle described above.

9. Children’s data & age policy

Popilife is a social game with open text chat and is not intended for young children. The game gates under-age users and requires an age confirmation on first launch. We do not knowingly collect personal data from children below the minimum age for consent in their country (for example, under 13, or the higher age set by local law in some EU/EEA countries, up to 16). If you are a parent or guardian and believe your child has provided us with personal data, please contact [email protected] and we will delete it.

10. Cookies & local storage

Popilife uses your browser/device local storage and, where applicable, cookies only for functional purposes — for example to keep you signed in (authentication token) and to remember your in-game settings and preferences. These are strictly necessary to provide the game you requested. We do not use advertising or third-party tracking cookies, and we do not build advertising profiles.

11. Security

Connections use HTTPS/WSS. Passwords are stored only as bcrypt hashes. We apply rate limiting, session controls and an audit log, and restrict access to our servers. No system can be guaranteed perfectly secure, but we work to protect your data appropriately.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and, for material changes, notify you in-game or by email. The “Effective date” at the top shows when the current version took effect.

13. Contact us

For any privacy question or to exercise your rights, contact [email protected]. For general help, contact [email protected].