Privacy Notice

Data controller: the operator of Sancak.lol. Website: sancak.lol · Privacy requests: destek@sancak.lol.

1. Data we process

• Account and profile: random player ID, display name, selected people, Google account identifier, Google-verified email and sign-in time. Google passwords and identity tokens are not stored.
• Game activity: voted city, vote day, people and clan contribution at vote time.
• Clan: name, membership, role, join time, description, logo and user-provided public or member-only links.
• Technical and safety: signed session ID, random browser or tab IDs, first and last activity, audit records and a daily one-way IP summary for abuse prevention. Raw IP addresses are not stored in the application database.
• Payment: Shopier order or product identifiers, amount, currency, status, city and clan. Sancak.lol does not receive card numbers, security codes or card passwords.
• Support: sender address, message, attachments, replies and ticket number.

2. Purposes

Data is used to operate seasonal people selection and the daily vote limit, count people and clan contributions, authenticate Google accounts, provide clan roles, publish chosen clan content, verify eligible banner payments, produce aggregated visitor and presence metrics, prevent abuse, secure the service, answer support and comply with law.

3. Public information

Display names, clan names, logos, short descriptions and public website or Instagram links may appear to visitors. Discord and WhatsApp links are limited to verified members of the same clan. Email addresses, raw security records and support correspondence are not public.

4. Providers and transfers

The platform uses Cloudflare Workers, D1 and R2 for application, database and logo storage; Google Identity Services for sign-in; Shopier for payment verification; and Cloudflare Email Routing and Gmail for support. Data is processed only as needed for the service, identity and payment verification, safety and legal duties. Personal data is not sold for advertising.

5. Retention

• Daily network safety and rate-limit records are removed or anonymized within three calendar days.
• Vote and related audit records may be retained for up to 400 days for season results, security and objections.
• Google challenges expire quickly and are cleared within one day. Account links and clan membership remain while the relationship is active.
• Inactive guest records with no clan membership or votes may be removed after 400 days.
• Support correspondence is retained only as needed to resolve the request and meet legal duties.

6. Your rights

You may request access, information, correction, deletion where applicable, restriction or objection and information about recipients. Send a clear request with the relevant account and reply address to destek@sancak.lol. Additional information may be requested to verify account ownership.