Privacy Policy

Effective date: 28 June 2026

This Privacy Policy explains how Duelo ("Duelo", "we", "us") collects, uses, and protects your personal data when you use duelo.dev and related services (the "Service"). We handle your data in accordance with the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK).

1. Who we are (Data Controller)

The data controller is Abdullah Taş, an individual operating Duelo. For any privacy matter, or to exercise your rights, contact us at privacy@duelo.dev.

2. What data we collect

• Account data: your email address and display name. If you sign in with GitHub, we receive your GitHub username, email, and avatar from GitHub.
• Authentication data: a securely hashed password (for email sign-in) and session cookies that keep you logged in.
• Activity data: duels you take part in, moves and timing, ratings, battle logs you write, votes, and reputation.
• Technical data: IP address, browser/user-agent, and server logs, used to operate and secure the Service.
• Optional contribution data: only if you explicitly opt in (Settings → Data contribution), the content of your solving sessions is recorded for the Duelo research dataset. This is off by default. Secrets and personal data are automatically removed before storage, and only a pseudonym — never your name or email — is attached. See our Data & Ethics page for details.

We do not use advertising or third-party analytics/tracking cookies. The only cookies we set are strictly necessary for authentication.

3. Why we use your data and our legal bases

• To provide the Service — accounts, duels, ratings, leaderboards — as performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5).
• To keep the Service secure and prevent abuse, cheating, and fraud — legitimate interests (GDPR Art. 6(1)(f)).
• To publish leaderboards and the public profile you create through participation.
• To include your solving data in the research dataset — only with your explicit consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)), which you may withdraw at any time.

4. Who we share data with

We do not sell your personal data. We share it only with providers that help us run Duelo:

• GitHub — if you choose GitHub sign-in (authentication).
• Hosting and infrastructure providers — to operate servers and databases.
• Cloudflare — for DNS, security, and email routing.

These providers process data on our behalf under appropriate agreements. We may disclose data if required by law. The opt-in research dataset, if ever licensed to third parties, contains only pseudonymized, secret-scrubbed content and never your name, email, or account identifier.

5. International transfers

Our providers may process data outside your country, including outside Türkiye and the EEA. Where this happens, we rely on appropriate safeguards (such as standard contractual clauses) to protect your data.

6. How long we keep data

We keep your account and activity data for as long as your account exists. If you delete your account, we delete or irreversibly anonymize your personal data, except where limited records must be retained to comply with the law or resolve disputes. Server logs are kept for a limited period for security.

7. Your rights

Under the GDPR and KVKK you have the right to: access your data; correct it; delete it (the "right to be forgotten"); restrict or object to processing; receive a copy in a portable format; and withdraw consent at any time. Under KVKK Art. 11 you may also learn whether your data is processed and object to outcomes produced solely by automated analysis.

You can:

• Download your data at any time in Settings.
• Delete your account at any time in Settings, which triggers erasure.
• Or contact privacy@duelo.dev, and we will respond within 30 days.

You may also lodge a complaint with a supervisory authority — in Türkiye, the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu); in the EU, your local data protection authority.

8. Security

We protect your data with measures including encrypted transport (HTTPS), hashed passwords, scoped access controls, tamper-evident activity logs, and automatic removal of secrets from any recorded content. No system is perfectly secure, but we work continuously to protect your data.

9. Children

Duelo is not directed to children. You must be at least 16 years old, or the age of digital consent in your country, to use the Service.

10. Changes to this policy

We may update this policy. We will change the effective date above and, for significant changes, notify you in the Service. Continued use after an update means you accept the revised policy.

11. Contact

For any question or to exercise your rights: privacy@duelo.dev