Privacy

Data controller and requests

The data controller is Bumba Teknoloji Limited Şirketi (Ataşehir / İstanbul). Puzz is a Bumba Games product; Bumba Games is the games arm of Bumba Group.

For any question about your personal data and for requests under Article 11 of the Turkish data protection law, KVKK (access, correction, deletion, objection), write to bilgi@bumbagroup.com. Requests are answered within 30 days at the latest.

What is stored in your browser

The site works with browser storage (localStorage), not cookies. The items below stay only in your browser, are not sent to our server and are needed for the site to work (the "Necessary" group in the cookie banner):

• bumba-cerez: your choice in the cookie banner.
• puzz-tema and puzz-dil: the theme and language you chose.
• puzz-oyun: your unfinished puzzles and the ones you finished in this browser.
• puzz-ayar: your game settings (sound, faint board and so on).
• puzz-sepet: your store cart.

You can delete these by clearing the site data in your browser. The only cookie is the session cookie of a signed-in member (see "Membership" below).

Statistics (Umami)

We count visits only if you press "Accept" in the cookie banner or turn statistics on in the preferences. If you do not allow it, or press "Reject", the counter is never loaded.

The counter is Umami, running on our own server; it uses no cookies and does not follow you on other sites. It processes: the address of the page you open (without the query part), the site you came from, browser, operating system, device type, language, and the country and city derived from your IP address. The IP address is not stored.

These actions are also counted, without personal information: signing up, signing in, joining the email list, a search being made (not the search term), language and theme changes, sharing (which platform) and a badge being earned for the first time (only the badge identifier).

You can change your choice at any time from the "Cookie preferences" link at the bottom of the page. Details are in the shared cookie policy.

Site search

The words you search for go to the server to find results. To see which words are searched often and which return nothing, only the day, language, search term and a count are kept; who searched is not kept. Searches that could contain an email address or a phone number are never written. These counters are deleted after 35 days.

Email list

The form at the bottom of the page belongs to Bumba's shared email list. Your email address goes straight to the shared service at bumbagroup.com; it is not written to the Puzz database. Before you join, the privacy notice is shown and your consent is taken; you leave via the link in every email. The list is separate from membership.

Membership

Membership is optional; people under 16 cannot become members. The processing of membership data is described in the shared Bumba membership privacy notice; here we only summarise what Puzz keeps and for how long.

• Account: email address, an irreversible hash of your password, Bumba member number, membership date, the time and text version of your consent at sign-up, language and time zone.
• Optional profile: first name, last name, nickname, photo, date of birth, gender, phone, country, city, occupation, "About me" text, social media links and your visibility choices. None of these is required.
• Sessions: browser and operating system name, the day it was opened and last used. No IP address is written to the session record. The session is recognised by a cookie (httpOnly) in your browser; it lasts 30 days.
• Attempt counters for the sign-in limit are kept briefly and deleted every day.
• Game: the puzzles you finish (which puzzle, difficulty, number of pieces, rotation mode, time, number of moves and hints, day) and your badges.

Emails (verification, password reset, account notices and, if you leave them on, celebration emails) are sent through Resend (USA); opens and clicks are not tracked. The database is backed up every night; backups are kept at Cloudflare R2 (USA).

Retention: an account whose email is not verified is deleted after 7 days; expired sessions, links and limit records are deleted every day; an unused account is not deleted. When you delete your account your data is deleted immediately and drops out of backups within 30 days at the latest.

Linked membership: your member number is the same in all Bumba products. No information goes to another Bumba product unless you turn it on; if you do, your email, password hash and profile are passed to that product.

You can get your data with "Download my data" on the account page and delete it with "Delete account".

Achievement badges

Badges are given only to signed-in members. If you are not a member, your game data does not leave your browser and no badges are calculated.

What is kept: in a separate table in your account, only the badge identifier and the day you earned it (no time). The condition of a badge (for example "finish 10 puzzles") is calculated automatically from the puzzles you have finished.

The only purpose is to show you your badges and progress. Your badges are not shown to other members, there is no leaderboard, and they are not written to browser storage. The legal basis is that this is part of the membership service (KVKK Article 5/2-c); no separate consent is asked.

Retention: for as long as your account is open. When you delete your account, your badges and finished puzzles are deleted at the same time and drop out of backups within 30 days at the latest.

If you allowed statistics, when you earn a badge for the first time only the badge identifier goes to Umami; not your name, counters, time or member identity.

Store

Sales are not open in the store yet; no order data is collected today. When sales open, an order will ask for your email, full name, delivery address and, optionally, a phone number; they will be used only to prepare and deliver the order and to meet legal record-keeping duties. Card details will not be kept on Puzz servers.

Order records are kept for the legal retention period; if you delete your account, the order record stays, detached from your account. Before sales open this section will be updated with the names of the payment institution and the courier.

Who else is it shared with?

Your data is not sold and not used for advertising. The site has no ads, social network scripts or tracking pixels; the share button is a plain link and no request goes to any social network until you click it.

The Bumba Games badge image at the bottom of the page is loaded from bumbagroup.com; your browser connects to that server (same data controller) to do so. Fonts are served from this site.

The site, the database and Umami run on Bumba's own server. Transfer abroad happens only through the two services named above: Resend (email, USA) and Cloudflare R2 (backup, USA).