1. Who we are
Pitchcraft is an online, turn-based football game for Android. It is made by Uğur Kontel, an independent developer in Türkiye who publishes as Fillbyte. Uğur Kontel is the data controller for Pitchcraft. Contact: support@fillbyte.com. This policy explains what the game stores about you, why, who processes it and for how long.
2. What we collect
Account
- A random player ID, the name you choose, a friend code and your language.
- Your age group (child, teen or adult) from the age screen. We never store your birth date.
- We do not ask for your email address, phone number or real name.
Sign-in
- Hashes of your session and recovery keys. The recovery key itself stays in your device's encrypted backup, so a reinstall restores your account.
Play
- Matches (opponent IDs, scores and moves), ratings, leagues and seasons, experience, missions, season pass, events, clubs, items, Coins and Gems balances with their history, fair-play penalties and the days you played.
Social
- Friends, friend requests, blocks and the reports you send (a reason and an optional note of up to 300 characters).
- In-match chat is limited to preset phrases and emotes, which are not stored.
Purchases
- Google Play's purchase token and order number for each Gem pack, to verify it once and handle refunds, and the time you confirmed that the content is delivered at once.
- Google processes your payment. We never see your card or bank details.
Notifications
- Your device's Firebase Cloud Messaging token, only if you allow notifications, to tell you about invites and friend requests.
Ads
- Ads are optional: you choose to watch one, for example to double the Coins of a match.
- Google AdMob shows the ad and collects data such as your device's advertising ID, IP address and ad interactions. See section 4.
Technical data
- Your IP address while you are connected, the app version and error reports. Game balance statistics (for example, how matches end), the steps of a first session and the number of times the app crashed or froze are stored without player IDs, device IDs or IP addresses, for up to three months.
3. Why we use it (legal bases)
- To run your account, your matches and the things you buy: performance of our contract with you.
- To keep matches fair, stop cheating and abuse, and keep the game secure and working: our legitimate interests.
- To send notifications: your consent, which you can withdraw in your phone's settings.
- To show personalised ads where the law requires consent: your consent. Other ads: our legitimate interest in funding the game.
- To keep the records that tax and consumer law require: legal obligation.
4. Ads and your age group
- Players in the child age group see no ads and cannot buy Gems; friends, clubs and chat are also off for them.
- Teens and players who have not answered the age screen get child-directed ads only: no personalisation and no remarketing, and Google does not receive the advertising ID for them.
- Adults in the European Economic Area, the United Kingdom and Switzerland are asked for consent through Google's consent message first; without consent, only non-personalised ads are shown.
- In other countries, Google may personalise the ads it shows to adults. You can reset or delete your advertising ID, or turn off ad personalisation, in your phone's Google settings.
- Google's use of data in ads is described at https://policies.google.com/technologies/partner-sites.
5. Who processes your data
We use these service providers. They process data only on our instructions or under their own terms for the service named:
- Cloudflare: hosts the game servers on its global network and processes your IP address to deliver traffic and limit abuse. Operational logs are kept for up to 7 days.
- Supabase: hosts the game database in Frankfurt, Germany, encrypted at rest and in transit.
- Google: Google Play (purchases and refunds), Firebase Cloud Messaging (notifications) and AdMob (ads).
- Adapty: revenue analytics. It receives only an opaque account ID and the details of purchases our server has already verified; no name, advertising ID or IP address.
- We do not sell your personal data and we do not share it with data brokers.
6. International transfers
Our service providers process data in the European Union, the United States and other countries. For transfers out of Türkiye we use the safeguards of Article 9 of the Personal Data Protection Law (KVKK), such as the standard contracts of the Personal Data Protection Board, and for transfers out of the European Economic Area or the United Kingdom we rely on adequacy decisions or the European Commission's Standard Contractual Clauses.
7. How long we keep it
- Your data is kept while you have an account.
- An account that is not used for 24 months is deleted.
- When an account is deleted, everything in section 2 goes with it. Match results remain only under a random ID that no longer links to anyone, so your opponents' histories stay intact.
- Google keeps its own order records for Play purchases under its terms.
8. Your rights
- Delete your account at any time in the game (Settings, then Delete account) or on the web at https://api.playpitchcraft.com/account-deletion.
- Under the GDPR, the UK GDPR and Türkiye's KVKK (Article 11) you may ask for access to your data, a copy, correction, deletion, restriction or objection, and you may withdraw a consent at any time.
- Write to support@fillbyte.com and include your friend code. We answer within 30 days.
- You may complain to your data protection authority: in Türkiye the Personal Data Protection Authority (KVKK, www.kvkk.gov.tr), in the EU the authority of your country, in the UK the Information Commissioner's Office.
9. Children
Pitchcraft asks every new player for their age group and limits the game for children as described in section 4. We do not knowingly collect more than this policy describes from a child. A parent who believes their child's account should be deleted can use the deletion page or write to us.
10. Security
Connections to our servers are encrypted (TLS). The database is encrypted at rest. Sign-in keys are stored only as hashes. No system is completely secure, so tell us at support@fillbyte.com if you find a problem.
11. Changes
When the game starts to process data in a new way, this policy changes in the same release and the date above changes.
12. Contact
Uğur Kontel (Fillbyte), Türkiye. Email: support@fillbyte.com. Website: https://fillbyte.com. Terms of service: https://playpitchcraft.com/terms.