Privacy

Who is responsible

Nivector is operated by Barış Furkan Koyuncu, a sole proprietorship registered in Türkiye (tax office: Mevlana V.D., Konya; tax no. 5811141301), at Aşkan Mah. Alakent Sk. Hanedan F Blok No:38/1, Meram / Konya.

Data controller enquiries and erasure requests: use the in-product report form, which produces a receipt you can quote later.

What an account stores

Your email address (twice: as you typed it, and lowercased for uniqueness), a scrypt hash of your password — never the password itself, your display name, the country you select, your referral code and the code that referred you.

Two anti-abuse signals from signup: a hash of your IP address and a short device string. The IP itself is not kept — only the hash, which cannot be reversed back into an address.

Gameplay: banked and played seconds, fragments collected, fish records, cosmetics owned and equipped, and quest progress.

Payments

Card payments are handled by iyzico. Card numbers never reach this service and are never stored here; we keep an order reference, the amount, the currency and the result.

Bank transfers store the reference you send with the transfer so it can be matched.

Crypto payments store the receiving address, the amount and the transaction hash. Blockchain transactions are public and permanent by design: we cannot delete them, and neither can anyone else.

Chat and voice

Text chat messages are stored so that reports can be acted on.

Voice is peer-to-peer (WebRTC). The audio travels between players directly and never passes through, or is recorded by, this service. Only the short connection-setup rows are stored, and they are deleted when the session ends.

Cookies and tracking

One cookie is set: a referral code, so that a friend who invited you is credited. Nothing else is written to a cookie.

There is no analytics platform, no advertising pixel and no third-party tracker in this service. Not Google Analytics, not Meta, not PostHog, not Plausible, not Vercel Analytics.

Your browser stores some settings locally (language, audio volume, key hints). That stays on your device.

Who else processes it

Vercel hosts the site. Neon hosts the database. Zoho sends the few transactional emails the service sends. iyzico processes card payments as its own controller.

To confirm a crypto payment, the service reads public blockchain data from mempool.space (Bitcoin), TronGrid (TRON), a public Solana RPC and dRPC/Etherscan (EVM chains). These services see the query, not your account.

How long it is kept

Account and payment records are kept while the account exists, and afterwards only as long as Turkish tax and commercial law requires for the payment records.

Connection-setup rows for voice are deleted at the end of the session. Presence rows expire within minutes.

Your rights

Under KVKK Art. 11 and GDPR Arts. 15-22 you can ask what is held about you, have it corrected, have it deleted, and object to processing. Use the report form; a written answer follows within 30 days.

Deleting your account removes the account row and everything keyed to it. On-chain payment transactions remain on their blockchain, because no one has the power to remove them.