This Privacy Policy explains how your personal data is processed under Türkiye's Personal Data Protection Law No. 6698 (KVKK) when you play PirtDuck (Android, package name com.mrwhite.pirtduck) or browse www.pirtduckgame.com. Effective date: November 4, 2026.
In short: no accounts, no passwords, no ads, no real-money sales, and we never sell your data. We only process what it takes to run the game and answer the people who write to us. The Butcher may chase you down the hallway, but we are not chasing your data.
This is a privacy notice for you to read; you don't have to approve or accept it. The KABUL EDİYORUM (I agree) button in the game applies to the community rules and the Terms of Service, not to this notice.
The game is available in Turkish only, so in-game labels appear here in Turkish with an English translation in parentheses.
1. Data controller
The data controller is MrWhite, an individual developer based in Türkiye who develops PirtDuck alone (MrWhite is also the Google Play developer name; “we” in this policy). There is no company or team behind PirtDuck.
Privacy questions, KVKK requests and deletion requests: pirtduckgame@gmail.com
2. Data processed in the game
Nickname: you choose it in Ayarlar (Settings), up to 12 characters; if you don't, the game gives you a name made of “Ördek” (Duck) and a number. It is shown to the players in your room and sent to their devices during the match. Don't use your real name, school or phone number as your nickname.
Anonymous player ID: after you accept the first-launch rules and the game goes online, Unity Authentication creates a random ID for you; it never asks for a name, email, phone number or password. The ID and Unity's session token are stored on your phone, so you keep the same ID every time you open the game. You can see your ID under Ayarlar (Settings) → BİLGİ (Info).
The ID tells players apart in a room, keeps a player the host kicked out of that room and helps us review reports, so it is also sent to the other devices in the room, but it is not shown on screen. It doesn't directly reveal who you are, but it still counts as personal data.
Room and match data: room code, the players in the room, your HAZIR (Ready) status and hunter preference, your costume, profile icon and level, your role and the hunter you play in a match, your in-match actions and results. This data travels to the devices in your room through Unity Lobby and Unity Relay.
Connection data: when you connect to Unity's servers, your IP address and the approximate location Unity derives from it (country or region) are processed. Unity uses them to connect you to a suitable server region, run the service and produce service statistics, and it keeps diagnostic and performance records about how the service runs. We never collect precise (GPS) location.
Chat: messages you type (up to 40 characters) and quick phrases are relayed to the players in your room through the host's device and Unity Relay. We keep no chat history on any server: the history lives only in the memory of the phones in the room and is cleared when you leave the room. So that players can report someone, each player's last 5 messages stay in the memory of the other phones in the room until the game is closed.
Stays on your phone only: your XP, Feathers (Tüy) and Golden Eggs (Altın Yumurta), season and mission progress, unlocked hunters, costumes and icons, your settings, your mute list and the fact that you accepted the community rules and the Terms of Service. None of this is sent to us or included in Android backups.
Player reports: when you tap BİLDİR (Report) and choose a reason, that player is muted on your device and your email app opens with a ready-made report. Nothing is sent automatically; sending it is entirely up to you.
If you send the report, we receive your email address (and the sender name your email app adds), the reason you chose, the reported player's nickname and anonymous ID, the last 5 messages you saw from them with their times, the room code, game version, time of sending (UTC), your own anonymous ID and any notes you add. If someone reports you, we receive the same details about you.
What you send us: emails for support, bugs, privacy or deletion requests and the information in them.
What the game doesn't collect: real name (unless you type it as your nickname), phone number, address, precise location, contacts, photos, camera, microphone, advertising ID or payment details. The game asks you for no permissions; it only uses the internet connection and vibration.
3. Data processed on the website
www.pirtduckgame.com is a static site hosted on Cloudflare Pages. It uses no cookies, runs no advertising, analytics or tracking tools and has no forms.
Closed test sign-up: the “Join the closed test” button on the site only opens your email app; the site has no forms. If you write to us, we receive your email address (the one you use for Google Play on your phone), the sender name your email app adds and your message. We use them only to add you to the closed test tester list in Google Play Console and to reply to you; you can leave the list at any time.
To serve the pages and protect the site from attacks, Cloudflare processes your IP address, the date and time, the requested page and browser information with each request and keeps logs under its own rules. We don't use these logs to track visitors.
The pages load the Rubik font from Google Fonts. Your browser connects to Google's servers to do this, so your IP address and browser information are passed to Google. Google Fonts uses no cookies.
If you follow a social media link on the site, that platform's own rules apply.
4. Why and on what legal basis?
To set up and run online matches and pass your nickname, room data and messages to the players in your room: KVKK Art. 5(2)(c) (establishing and performing a contract, that is, providing the game to you).
To add you to the closed test tester list at your request and reply to you: KVKK Art. 5(2)(c) (establishing a contract, that is, acting on your request to join the test).
To keep chat safe, review reports, stop rule-breaking and cheating, fix connection problems, monitor how the service runs and serve the website securely: KVKK Art. 5(2)(f) (legitimate interests).
To answer KVKK requests and comply with lawful requests from authorities: KVKK Art. 5(2)(ç) (legal obligation). If we need to protect our rights in a dispute: KVKK Art. 5(2)(e).
We collect this data electronically and automatically while you use the game and the website, or when you email us. Nothing relies on your explicit consent. We don't profile you, make automated decisions about you or use your data for advertising.
5. Who we share data with
We don't sell your data or share it with anyone for advertising.
Players in your room: by the nature of the game, your nickname, costume, icon, level, chat messages and in-game actions are visible to the players in the same room, and your anonymous ID is sent to their devices.
Unity Technologies: the online part of the game runs on Unity Gaming Services (Authentication, Lobby, Relay). Unity processes this data on our behalf as our service provider. You can read how Unity handles data in Unity's Privacy Policy: https://unity.com/legal/privacy-policy
Cloudflare: hosts and serves the website. Privacy policy: https://www.cloudflare.com/privacypolicy/
Google: our mailbox is on Gmail, where reports, closed test sign-ups and the other emails you send us are kept. If you ask to join the closed test, we add your email address to the tester list in Google Play Console, and Google uses it to give you access to the test. The site's font comes from Google Fonts. If you later install the game from Google Play, Google Play also processes data under its own rules. Google's Privacy Policy: https://policies.google.com/privacy
Public authorities: only when the law requires it.
6. International transfers
Unity's, Cloudflare's and Google's servers may be located outside Türkiye (for example in the European Union and the United States). The data described above is therefore transferred abroad to run the game and the website.
Unity processes it under Unity's Data Processing Addendum (Unity DPA). Cloudflare and Google process it under their own privacy policies.
7. How long we keep data
Room and match data: removed from the devices when the room closes. Chat history is cleared when you leave the room, and the last messages kept for reports are cleared from memory when the game is closed.
Unity: Relay keeps your IP address and player ID for 30 days; Lobby keeps your player ID in its logs for up to 30 days. The Unity Authentication record of your anonymous player ID stays until you ask for it to be deleted or we delete it.
Emails: we delete report, support and deletion emails within 12 months at the latest after the matter is closed.
Closed test sign-ups: when the test ends, we remove you from the tester list and delete your sign-up email; in any case we do this within 12 months of your sign-up at the latest. You can also leave earlier if you like.
Data on your phone: stays there until you clear the app's data or uninstall the game.
Website: Cloudflare and Google keep their own logs for the periods set in their policies.
8. Deleting your data
On your phone: go to Android Settings → Apps → PirtDuck → Storage → Clear data, or uninstall the game. Your progress isn't backed up to the cloud, so it can't come back.
Your Unity record: first copy your player ID under Ayarlar (Settings) → BİLGİ (Info) with KİMLİĞİ KOPYALA (Copy ID), then email it to pirtduckgame@gmail.com with the subject “Data deletion”. Within 30 days at the latest we delete your Unity Authentication record, ask Unity to delete the related Relay and Lobby logs and delete the related emails.
Closed test list: you can ask at any time to be removed from the list and to have your email deleted by writing to pirtduckgame@gmail.com; no player ID is needed.
Step-by-step guide: https://www.pirtduckgame.com/en/legal/data-deletion
9. Security
The game's connections to Unity's services are encrypted: service calls use HTTPS and game traffic through Unity Relay is encrypted with DTLS. The app does not allow unencrypted web (HTTP) connections. Only the developer reads report and support emails.
No system is perfect, so don't share personal information in your nickname or in chat. More on the Security page.
10. Children
PirtDuck is made for players aged 13 and up: dark hallways, a cleaver-wielding Butcher and cartoon blood. It is not directed at children under 13, and we don't knowingly collect their data.
If you learn that a child under 13 is playing or has sent us data, email pirtduckgame@gmail.com and we will delete the related data.
11. Your rights
Under Article 11 of the KVKK you have the right to learn whether your data is processed; to request information if it is; to learn the purpose of the processing and whether the data is used accordingly; to know the third parties in Türkiye or abroad it is transferred to; to have it corrected if it is incomplete or wrong, and deleted or destroyed, and to have those third parties told; to object to a result against you that comes solely from automated analysis; and to claim compensation if you suffer damage from unlawful processing.
Send your request to pirtduckgame@gmail.com; if you include your player ID, we can find which record is yours. We reply free of charge within 30 days at the latest.
If your request is rejected, you find our reply insufficient or we don't reply in time, you can complain to Türkiye's Personal Data Protection Board within 30 days of learning our reply and in any case within 60 days of your request: https://www.kvkk.gov.tr
Any additional rights the laws of your country give you remain unaffected.
12. Changes
If we add new data processing to the game or change this policy, we publish the new version at the same address and update the date at the top of the page. We also announce important changes in the game's release notes.
The demo is currently distributed in Türkiye only. If we offer the game in other countries, we will update this policy for their rules beforehand.