CraftMyFuture — Privacy Policy

TASLAK / DRAFT — avukat incelemesi gerekli / requires review by a lawyer before publication. Effective date: [DD Month YYYY] · Version: 0.1 (draft)

In short, for kids

Right now CraftMyFuture keeps your game (your nickname, your character, your coins, jobs and skills) only on your own computer. We do not see it.

There are no ads, we do not track you, and nothing in the game costs real money.

Later you may be able to play with friends. A parent must say "yes" first, using the parent's e-mail — never yours.

Pick a nickname, never your real name. Never share your address, school, phone number or photos in the game.

If someone is mean or makes you feel uncomfortable: Block, Mute, Report, and tell a grown-up you trust.

Your parent can ask us to show or delete your data at any time.

1. Who we are

CraftMyFuture ("the game", "we", "us") is made by Kadir Erhan, an individual developer based in Türkiye. He is the data controller (KVKK) / controller (GDPR) / operator (COPPA) for personal data processed through the game.

Contact: kadirerhan84@gmail.com — please write "CraftMyFuture – Privacy" in the subject line. Postal address for formal applications: [address to be added before launch].

CraftMyFuture is a life-simulation game for children aged 10+. This policy is written mainly for parents, because many players are under 13.

2. The game today: single-player, data stays on the device

The current version is single-player and works offline. It saves your child's progress only in a file on the device where the game is installed. That file contains:

the in-game name/nickname your child chose,
character appearance (body, hair, outfit, colours),
in-game wallet and bank balance, savings, items bought,
jobs done, skills, Interest Paths and goals,
the last position in the game world (in-game location only — not the real location of the device).

We do not receive this file. It is not sent to us or to anyone else. Deleting the game's save data or uninstalling the game removes it.

The current game has no analytics, no advertising, no tracking cookies and no real-money purchases. In-game coins are play money with no real value.

3. Planned online features (Phase 5) — not active yet

Optional online play with friends is planned. It will only be switched on after a parent gives verifiable consent; we will update this policy and ask for consent before anything goes live.

3.1 What we will collect

Data	Why	Where it comes from
Parent's e-mail address	Create and approve the account, verify consent, send one-time sign-in codes, notify the parent of safety actions	Parent
Parent's consent record (date, method, chosen settings, age range of the child)	Prove consent; respect the parent's choices	Parent
Unique nickname (no real names)	Let friends find each other	Child, checked by filters
Character look, progress, coins, items, skills (cloud save)	Keep progress across devices; run a fair, cheat-free economy	Game
Technical identifiers (player ID, device/session IDs, IP address as handled by the service providers)	Sign-in, security, connecting players	Device / services
Friend list, friend requests, blocks	Friends-only play	Child, parent
Messages (quick chat, filtered text) and, if enabled, voice	Communication between friends	Child
Reports, filter hits, moderation actions, and the messages/voice-transcript snippets attached to a report	Keep children safe	Players, automatic filters

We will not ask for real names, photos, phone numbers, home address, school or the device's precise location. We will not condition a child's participation on giving more information than is reasonably necessary for the activity.

3.2 Communication is off until the parent turns it on

Communication is friends-only (no strangers, no public lobbies). The parent switches levels on one by one: emotes → preset quick chat → filtered text → voice. Text is filtered by Vivox Safe Text (bad words and personal information such as numbers, addresses and links are blocked). Every player can block, mute and report anyone.

3.3 Moderation, including an AI assistant

Reports first go to an AI moderation agent that sorts them by type and seriousness. It may only take automatic, reversible, low-risk actions (hide a message, mute for a session, a short chat cooldown, a friendly warning). It never bans anyone. People decide bans and all serious cases (for example bullying, grooming signs, self-harm signs, threats or sexual content). Urgent cases are e-mailed to the human moderator immediately; both sides' chat is frozen while it is reviewed. The AI receives only what the case needs — never e-mail addresses. Parents are informed of actions taken on their child's account.

Where the law requires it (for example apparent child sexual abuse material), a human moderator will report to the competent authorities and may preserve the related data for that purpose.

3.4 Who processes data for us

Provider	Role	Location
Unity Technologies — Unity Gaming Services (Authentication, Friends, Lobby, Relay, Cloud Save, Cloud Code) and Vivox (voice, text, Safe Text)	Hosting, sign-in, friends, multiplayer connection, cloud save, chat	Servers outside Türkiye (for example the USA and the EU)
E-mail service	Send sign-in codes and parent notices	[to be named before launch]
AI provider	AI moderation triage	[to be named before launch]
Parental-consent verification provider	Verify the parent	[to be named before launch]

These providers act on our instructions under data-processing terms. Our Unity project is marked as directed to children (COPPA), and optional Unity "developer data" collection is not enabled. We do not sell personal data and do not share it for advertising. We may disclose data if the law or a competent authority requires it, or to protect a child's safety.

3.5 How long we keep data

Chat messages, report logs and moderation logs: 30 days, then deleted — unless a case is open or the law requires us to keep them longer (for example for a report to authorities).
Account data and cloud save: while the account exists; deleted within [30] days after the account is deleted.
Consent records: as long as needed to prove consent, then deleted [period to be confirmed by counsel].

3a. This website (craftmyfuture.com) and cookies

The website pages that describe the game (home page, privacy and terms pages) can use Google Analytics 4 (Google Ireland Ltd. / Google LLC) to count visits, only if you click "Accept" in the cookie banner. Until then no analytics cookies are set and no request goes to Google. You can change your choice at any time with "Cookie settings" in the footer.
What it measures: pages viewed, approximate country, device and browser type, how visitors found the site. IP addresses are not stored by Google Analytics 4; advertising features, Google signals and ad personalisation are off.
The browser game under /game/ uses no analytics, no cookies for tracking and no advertising. Game progress is stored only in your browser's local storage on your device.
Legal basis: your consent (KVKK Art. 5(1) explicit consent / GDPR Art. 6(1)(a); ePrivacy rules for cookies). Data may be processed by Google outside Türkiye (see section 6). Retention in Google Analytics: 2 months.

Explicit consent of the parent/guardian (KVKK Art. 5(1) and 6; GDPR Art. 6(1)(a) with Art. 8) — online account for a child, communication features, voice, AI moderation of the child's messages.
Performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)) — providing the game and the services the parent has turned on.
Legal obligation (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)) — legally required reports, responding to authorities.
Legitimate interest, balanced against the child's rights (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)) — security, preventing cheating and abuse, keeping chat safe.

Consent can be withdrawn at any time; this does not affect processing already done, but online features that depend on it will stop.

Türkiye (KVKK): for minors we rely on the consent of the parent or legal guardian.
EU / UK (GDPR): the age at which a child can consent alone varies by country between 13 and 16 (UK: 13). Below that age we require the consent of the holder of parental responsibility. To keep things simple and safe, every child account is created and approved with a parent's e-mail, whatever the age.
USA (COPPA): before collecting personal information from a child under 13 we give the parent notice and obtain verifiable parental consent. Parents can review their child's personal information, ask us to delete it, and refuse further collection or use at any time. We do not require a child to disclose more information than is reasonably necessary to take part.

If we learn that we collected a child's personal data without the required consent, we delete it promptly.

6. Cross-border transfer (KVKK Article 9)

Online features will store and process data on Unity's servers and those of the other providers listed above, outside Türkiye. Such transfers will be made only under KVKK Article 9: on the basis of an adequacy decision, or appropriate safeguards such as standard contracts (notified to the Personal Data Protection Authority as required), or — only where the law allows it for occasional transfers — explicit consent. For EU/UK users, transfers outside the EEA/UK rely on adequacy decisions or standard contractual clauses. [Exact transfer mechanism per provider to be confirmed by counsel.]

7. Your rights

Under KVKK (Article 11) you can:

learn whether personal data about you or your child is processed;
request information about it;
learn the purpose of processing and whether data is used in line with that purpose;
know the third parties in Türkiye or abroad to whom data is transferred;
ask for incomplete or incorrect data to be corrected;
ask for data to be erased or destroyed under KVKK Article 7;
ask that corrections/erasures are notified to third parties who received the data;
object to a result against you arising solely from automated analysis;
claim compensation for damage caused by unlawful processing.

How to apply (KVKK Art. 13 and the Communiqué on Application Procedures): write to kadirerhan84@gmail.com from the e-mail address registered with us (or by registered post / KEP / secure e-signature to [address]), with your name, the account nickname, and your request. We answer free of charge within 30 days (a fee may apply only where the law allows it). If you are not satisfied, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

access, rectification, erasure, restriction, data portability, objection, withdrawal of consent, and to complain to your local data protection supervisory authority (UK: ICO). [EU/UK representative under Art. 27, if required: to be appointed before launch.]

Under COPPA, parents can:

review their child's data, have it deleted, and refuse further collection — see Section 5.

Today (offline version)

Because we hold no data, you can exercise control directly: delete the save file or uninstall the game.

8. Parent page and deleting the account

Before online features launch, parents will have a parent page (web or a PIN-protected area in the game) to: give or withdraw consent, choose communication levels, see the friend list, export data and delete the account. Account deletion removes cloud data within [30] days, except data we must keep by law.

9. Security

We rely on our providers' security (encryption, access controls), keep the minimum data and limit access to the moderator. If a breach affects your data we will notify the authorities and you as the law requires (KVKK Art. 12; GDPR Art. 33–34).

10. Changes

We will update this policy before any new kind of data collection starts, and we will ask for parental consent again where required. The effective date at the top shows the latest version.

11. Contact

Kadir Erhan — CraftMyFuture · kadirerhan84@gmail.com · [postal address]