Ellibir: Card Okey Privacy Policy

Data we collect on the website

• If you join the waitlist: your email address, language, the page version you signed up on, and which version of the consent text you agreed to and when.
• Anonymous visit statistics: a random session id, the page version shown (A/B test) and the experiment it belongs to, language, ad campaign parameters (utm_*) and an approximate country derived from your IP address.
• Visits made through our own test links (?v=qa or ?qa=1) are flagged as test traffic and excluded from the statistics.
• To prevent abuse, your IP address is kept only as a keyed HMAC hash (it cannot be reversed without our secret key) for at most 24 hours; raw IP addresses are not stored in our database. Our hosting provider may keep technical server logs.
• We use one first-party cookie (90 days) to remember which page version you saw, and session storage that is cleared when you close the tab.
• Meta Pixel and Conversions API: only if you click "Allow" in the cookie banner, the Meta Pixel loads and tells Meta which pages you viewed and whether you clicked the sign-up button or started the demo; when you join the waitlist, our server also sends Meta a sign-up ("Lead") event with the same event id, your IP address, your browser's user agent, the page address and Meta's own cookies (_fbp / _fbc) if present. We never send your email address to Meta, not even in hashed form. Before you choose, and if you decline, nothing is sent to Meta. You can withdraw your consent at any time in "Cookie settings"; it then stops immediately.

Data processed in the app

• An anonymous user id, device and app information, in-app usage events and crash reports.
• Subscription and purchase status (payments are processed by Apple or Google; we never see your card details).
• An advertising identifier to show ads; personalised ads are shown only if you consent.
• Online play (only when you play online): an anonymous online account id created on first use, the nickname you choose (checked against a list of offensive words), your match results and rating, and technical connection data needed to run the table. Preset chat phrases and emotes are relayed to the table but not stored.
• Player reports: when you report another player we store the reason you chose (fixed list, no free text), the match, the nickname shown, your account id and theirs; when you are reported, the same about you. Reports are reviewed and may lead to a nickname reset or a temporary online ban (the ban end date is stored).
• Account link (optional): if you protect your online account with Sign in with Apple or Google, we receive an identifier and the email address of that account from Apple / Google (Apple may give a relay address). We use them only to restore your account on a new device.

Purposes and legal bases

• Waitlist and launch notification: your consent, given by ticking the consent box (you can withdraw it at any time).
• Providing the Service, usage limits and subscriptions: performance of a contract.
• Security, abuse prevention and basic anonymous measurement: legitimate interests.
• Ad measurement with the Meta Pixel and the Conversions API sign-up event: only your consent given in the cookie banner.
• Online play, nickname, match results and the optional account link: performance of a contract (at your request).
• Player reports, nickname checks and online bans: legitimate interests (a safe game for all players) and the app stores' rules for user-generated content.

Waitlist emails and unsubscribing

After you sign up we send you a confirmation email (at most one per 24 hours); you receive launch news only after you confirm your address with its link. We use your email address only to send news about the launch of Ellibir: Card Okey. Every email contains an unsubscribe link. You can also unsubscribe on our unsubscribe page (https://ellibir.4ourstack.com/en/unsubscribe/) or by writing to support@4ourstack.com. Your address is deleted immediately when you unsubscribe.

For recipients in Turkey, launch news emails may count as commercial electronic messages under Law No. 6563; your approval is collected for this purpose and, where the law requires it, registered in the Message Management System (İYS). You can refuse further emails at any time via the link in every email (or through İYS where applicable).

Service providers on the website

• Vercel Inc.: website hosting and delivery
• Supabase Inc.: database for the waitlist and anonymous visit statistics
• Resend: sending the waitlist confirmation and launch emails
• Meta Platforms Ireland Ltd. / Meta Platforms, Inc. (USA): ad measurement via the Meta Pixel and the Conversions API (sign-up event), only with your consent

Service providers in the app

• Hetzner Online GmbH: game server for online tables (servers in the European Union)
• Supabase Inc.: online account, nickname, match results, ratings and player reports
• Apple Inc. / Google LLC: optional sign-in to protect and restore your online account (Sign in with Apple / Google)
• PostHog Inc.: product analytics, only if you opt in
• Functional Software Inc. (Sentry): crash and error reports
• Meta Platforms Ireland Ltd.: ad attribution, only with your consent (and your device's tracking permission)
• RevenueCat Inc.: subscription and purchase status
• Google LLC (AdMob): showing ads (personalised only with consent)

International transfers

Some of the service providers listed above may process data outside Turkey and the European Economic Area. Transfers rely on appropriate safeguards such as standard contractual clauses under the GDPR and Article 9 of Turkish Law No. 6698 (KVKK), or your explicit consent.

With your consent in the cookie banner, the Meta Pixel and Conversions API data described above are transferred to Meta Platforms Ireland Ltd. and processed by Meta Platforms, Inc. in the United States of America. The transfer is based on your explicit consent and the safeguards Meta provides (such as standard contractual clauses).

Retention

• Waitlist email addresses: deleted 12 months after the product launches, or 24 months after you signed up if the product never launches — and immediately when you unsubscribe. If you do not confirm your address with the link in our confirmation email, it is deleted 30 days after sign-up.
• Anonymous visit statistics: 24 months.
• Abuse-prevention IP hashes: 24 hours. They are keyed HMAC values that cannot be reversed without our secret key.
• Online account, nickname and rating: until you tap "Delete online account" in the game's Settings; an anonymous online account that is not linked to Apple / Google is also deleted automatically after 90 days without use. A linked account stays until you delete it.
• Online match results: 400 days after the match (your seat is anonymised earlier if you delete your account).
• Player reports: 180 days after they were handled, at most 365 days; reports about you are deleted with your account, reports you filed are anonymised.
• Online bans: 30 days after they end, or with your account.
• App data: the app does not create an account for you on our servers. Your settings and progress stay on your device until you delete them in the app or uninstall it.

Deleting your data

You can delete your online account and its data on our servers in the game (Settings → "Delete online account") and the game's data on your device by uninstalling it, leave the waitlist with the unsubscribe link, or ask us by email. Step-by-step instructions: https://ellibir.4ourstack.com/en/delete/

Your rights

You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability and to withdraw consent. Contact support@4ourstack.com. You may also lodge a complaint with your local data protection authority (in Turkey: the Personal Data Protection Authority, KVKK).

Age limit

The Service is intended for users aged 16 and over. We do not knowingly collect data from children under 16.

Changes and contact

We may update this policy; the current version is always on this page. Questions: support@4ourstack.com.