Privacy Policy and Notice

13. Community Privacy Notice

This section explains, as required by Article 10 of Turkey's Personal Data Protection Law No. 6698 ("KVKK"), how your personal data is processed when you use the Althera Community (the forum and game reviews at altheragames.com/en/community). When you complete your community profile, you confirm that you have read this notice.

Data controller and hosting provider

The data controller is Althera Games, whose identity and contact details are given in Section 1: Dokuz Eylül University Tınaztepe Campus, Doğuş Cad. No:207/Z, DEPARK Tınaztepe Alfa Building, Buca, Izmir, Turkey; info@altheragames.com. Althera Games is also the hosting provider (yer sağlayıcı) of user content in the community under Law No. 5651, and can be reached at the same addresses in that capacity.

Personal data we process

Your data is collected electronically, by automated means, from the information you enter when you sign up and use the community, from the technical information your browser sends and, if you sign in with Steam or link your Steam account, from Valve:

• Account details: Your email address, your display name and the date you last changed it, the avatar you chose, your interface language, the date your account was created, your account status and your trust level.
• Confirmation records: The date and time at which you confirmed that you are at least 13 years old, accepted the community rules and confirmed that you have read this notice.
• Steam details (optional): You can also sign in to the community with Steam instead of an email address; your SteamID and, when available, your Steam profile name and avatar are then processed, and no email address is collected. If you sign in with Steam or link your Steam account: your SteamID, your Steam profile name and avatar when available, the date it was linked, and whether you own our games (game ownership).
• Content you write: Topic titles, messages, reviews (including whether you recommend the game), the images you upload, and edit dates. Metadata such as location is removed from images when they are uploaded.
• Interaction records: Your likes, your votes on whether reviews are helpful, and the reports you send (reason and note).
• Moderation records: Reports about your content and your account, and the moderation actions taken on them (for example approval, hiding, bans and the reason for a ban).
• Session data: Your sign-in link requests and your session records. Only a one-way hash of the session cookie is stored, never its value.
• Traffic record: As required by Law No. 5651, the IP address, country, browser information, time, account and action, for actions such as logging in, writing and editing content, uploading images, reporting and deleting an account.
• IP hash: A salted one-way hash of your IP address (not the address itself), recorded when your account is created, when you request a sign-in link and when you write a topic or a reply.
• Notification preference: Whether you want email notifications about replies in topics you take part in, and your notification records: for each topic, when a notification started waiting to be sent and when the last one was sent to you.
• Bot protection: The browser signals that Cloudflare Turnstile processes to verify that a submission comes from a human, when you request a sign-in link and on messages and reviews from accounts that are not yet trusted users.

Purposes and legal bases

• Creating your account and providing the community service (signing in by email or with Steam, profile, topics, replies and reviews, likes and votes, image uploads, the Steam link and the game ownership badge, downloading your data and deleting your account): KVKK Art. 5/2(c), processing is directly related to the establishment or performance of a contract.
• Moderation, security and preventing abuse (pre-approval of new accounts' first messages, the word filter, reviewing reports and automatically hiding content that receives a certain number of reports, bans, rate limits, bot protection, IP hashes and moderation records): KVKK Art. 5/2(f), processing is necessary for our legitimate interests, provided that it does not harm your fundamental rights and freedoms.
• Keeping traffic data under Law No. 5651 and providing it to the competent authorities: KVKK Art. 5/2(ç), processing is necessary for us to comply with a legal obligation.
• Keeping records of "Illegal content" reports and answering requests from the competent authorities: KVKK Art. 5/2(ç) and 5/2(e).
• Reply notifications: Letting you know by email when there are new replies in topics you take part in. These notifications are part of the community service (KVKK Art. 5/2(c)) and contain no commercial messages. They are on by default; you can turn them off at any time in your profile settings, with the link for turning them off in every notification email or, if your email app offers it, with its one-click unsubscribe option. If you signed in with Steam, there is no email address to send them to, so you get no reply notifications.

Transfers of personal data

• Cloudflare, Inc. (abroad): The community's hosting, database and file storage, email delivery (sign-in links and reply notifications) and bot protection run on the infrastructure of our data processor Cloudflare outside Turkey. Your community data is therefore transferred abroad from the moment you request a sign-in link (or, if you sign in with Steam, from the moment you sign in with Steam). This transfer relies on the standard contract we have signed with Cloudflare and notified to the Personal Data Protection Board, under KVKK Art. 9/4. When you request a sign-in link, your email address is used to send it; when you first sign in with the link, your account record (email address, interface language, IP hash), your session and, as required by Law No. 5651, a traffic record are created before you complete your profile. When you first sign in with Steam, your account record (SteamID, your Steam profile name and avatar when available, interface language, IP hash), your session and a traffic record are likewise created before you complete your profile; no email address is collected.
• Valve Corporation (Steam, abroad): Data is transferred to Valve only if you yourself start signing in with Steam or linking your Steam account. You sign in to Steam on Steam's own page; your Steam password is never passed to us. Your SteamID is sent to Valve's Steam services to verify the sign-in or the link and to get your Steam profile name and avatar, and, when you link your account, to check whether you own our games; your game ownership may also be checked when you write a review. This transfer is made occasionally, only as far as signing in with or linking your Steam account, which you start yourself, and the ownership check when you write a review require, under KVKK Art. 9/6(b). You can remove the Steam link at any time in your profile settings; your Steam details and game ownership records are then deleted. An account created with Steam can't be unlinked from Steam, but you can delete it. The ownership badge on reviews you have already written stays with them, because it shows the status when you wrote the review; it is updated if you save the review again.
• Public information: Your display name, avatar, join date, trusted-user badge, your published topics, replies and reviews, and the game ownership badge on your reviews can be seen by anyone on the community pages and may be indexed by search engines. Your email address is never shown on any public page.
• Competent authorities: Traffic records and any other data required are shared with third parties only upon an official request from legally authorised public bodies and courts, and only to the extent requested.

The site's fonts are not loaded from any outside service. Steam achievement icons and the images in Steam announcements are fetched in advance by our systems, and the avatars of members who chose their Steam avatar and the cover images of official updates are fetched from Steam by our server, not by your browser. All of these images are served from our own servers, so browsing the site does not connect your browser to Google or Valve. YouTube videos (the trailers and the videos in Steam announcements and community posts) and the map on our contact page load from youtube-nocookie.com and Google Maps only when you click play or load; at that point your browser connects to Google's servers, your IP address and browser information reach Google and are subject to Google's privacy policy. This transfer is based on the explicit consent you give by clicking the play or load button (KVKK Art. 9/6(a)). As there is no adequacy decision and none of the appropriate safeguards of KVKK Art. 9/4 for Google, your data may lack the KVKK's protection abroad and your rights against Google may be harder to exercise. You do not have to consent: the address is printed on the page, and you can watch the videos on YouTube instead. Clicking a Steam link is subject to Steam's privacy policy. We do not sell your data or share it with anyone for marketing.

Retention periods

• Your account details, your content and your other community data are kept until you delete your account, except as stated below.
• If you never complete your profile, your account is deleted entirely within two days at the latest after your session ends or you sign out, unless the account is banned, in which case it is kept while the ban lasts. Traffic records kept under Law No. 5651 are still kept for 400 days.
• Traffic records are kept for 400 days, within the limits set by Law No. 5651 (no less than one year and no more than two years), and are deleted automatically when that period ends.
• Sign-in links are valid for 15 minutes; their records are deleted within two days at the latest after they expire. Sessions end after 30 days and are deleted within one day at the latest; when you sign out, your session is deleted at once.
• When you delete a topic or a reply, its text is deleted from our database too. If no other messages remain in a topic you delete, the topic's title is removed from public pages but stays in our records; if the topic has other messages, it stays in place with its title so that it can still be read. Images you attached to the message are deleted within 31 days at the latest. However, if you delete a message that has an unresolved "Illegal content" report, it is removed from public pages, but its text and images are kept until the report is resolved; if the report is dismissed, the text is deleted and the images within 31 days at the latest. When you delete a review, its text is deleted too; the text of a review that has an unresolved "Illegal content" report is likewise kept until the report is resolved, and deleted if the report is dismissed. If the report is upheld, the text and images of the message or review you deleted are kept like content taken down by moderation, for the period given in the next item.
• Content hidden or taken down by moderation, and messages and reviews whose text is not deleted because of such a report, are not shown on public pages. This content, the reports people send (with their reason and note) and the moderation records are kept for the team's review and for official requests, and deleting your account does not delete them. The text and images of messages and reviews hidden or taken down by moderation, including every message in a topic that is hidden or taken down (but not topic titles), are deleted 400 days after the last moderation action. Content with an unresolved "Illegal content" report is kept until the report is resolved. Report records are deleted 400 days after the report is resolved; unresolved reports are kept until they are resolved. Moderation records are deleted after 400 days, except that the record of an edit our team made to a message is kept until the report is resolved while that message has an unresolved "Illegal content" report.
• The IP hashes kept with your messages and your account (a salted one-way hash, not the address itself) are deleted after 400 days, or at once if you delete your account.
• When you delete your account, your email address, display name, Steam details and game ownership records, sessions, likes and votes, notification records and the IP hash on your account record are deleted. The images you uploaded and the IP hashes in your messages are deleted too; only the images of a message with an unresolved "Illegal content" report are kept, unpublished, until the report is resolved. In your messages, the images are replaced by an "Image removed" note. The messages and reviews you wrote stay in place so that conversations still make sense, and their author is shown as "deleted user". If you wish, you can delete your messages and reviews one by one before deleting your account. All that remains of your account record is an ID number that keeps your remaining content together under "deleted user", the date the account was created and the confirmation dates. If you delete your account while a ban is in force, only a one-way hash of your email address (not the address itself) is kept until the ban ends, or indefinitely for a permanent ban, so that the same address cannot sign up again before then. If a SteamID is linked to your account, only a one-way hash of it (not the SteamID itself) is kept for the same period too, so that the same Steam account cannot sign up again or be linked to another community account before then. Even if you delete your account, traffic records are kept until their 400-day period ends.
• Deleted data may remain for up to 30 more days in database restore points kept only for disaster recovery.

Your rights (KVKK Article 11)

Under Article 11 of the KVKK, you can apply to the data controller to:

• Learn whether your personal data is processed
• Request information about it if it has been processed
• Learn the purpose of the processing and whether the data is used in line with that purpose
• Know the third parties in Turkey or abroad to whom your data has been transferred
• Request correction if your data has been processed incompletely or inaccurately
• Request deletion or destruction of your data under the conditions set out in Article 7 of the KVKK
• Request that any correction, deletion or destruction be notified to the third parties to whom your data has been transferred
• Object to a result against you arising from the analysis of your data exclusively by automated systems
• Claim compensation for damage you suffer because your data is processed unlawfully

You can send your application to info@altheragames.com from the email address registered to your community account; this lets us verify that it comes from the account holder. Accounts created with Steam have no registered email address. If you have such an account, you can send your application to info@altheragames.com from any email address, giving your community display name and your Steam profile link (in the form steamcommunity.com/profiles/…). To verify that the application comes from the account holder, we may ask you to temporarily add a one-time code we send you to your Steam profile name or summary, or to sign in with Steam and make a change we specify in your profile settings. We use that email address only to answer your application. You do not need an email address to download your data or delete your account: sign in with Steam and use the buttons in your profile settings. You can also apply by the other methods listed in the Communiqué on the Procedures and Principles of Application to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ), for example in writing to the address above. Include the information the Communiqué requires (your full name, identity and contact details, and the subject of your request), together with your display name in the community. We conclude your application free of charge as soon as possible, depending on the nature of the request, and within 30 days at the latest; if the action involves an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your application is rejected, you find our answer insufficient, or we do not answer in time, you may file a complaint with the Board under Article 14 of the KVKK.

You can download as a file, at any time, your account details (including your Steam details, the dates of your confirmations and your notification preference), your game ownership records, the topics, messages and reviews you write, the details of the images you upload, your likes and review votes, the reports you send and your notification records, with the "Download my data" button in your community profile settings, and delete your account on the same page. For data that is not in that file (for example traffic records and IP hashes), you can apply as described above.

Cookies and browser storage

The community uses only strictly necessary cookies: alth_sid, which keeps you signed in after you sign in, and __Host-alth_steam_state, which is used only while you sign in with Steam or link your Steam account. Drafts of topics, replies and reviews you have not sent yet are kept only in your browser (cm-draft:*). The details are in the table in Section 8.