Privacy Policy
Draft · 21 October 2026. Retention periods, service providers and international transfer arrangements must be confirmed before publication.
Controller and scope
Halil İbrahim Karademir (VDOX Lab) is the controller for Underworld and this website. Contact: info@gameofunderworld.com. The game is for adults aged 18 and over. We do not intend to knowingly collect children’s data. Please contact us about accounts that do not meet this requirement.
Data we process
Account data includes email, user ID, authentication and session information. Profile data includes username, character, language and age confirmation. Gameplay data includes progress, mission choices, vehicles, businesses, virtual balances and transaction history. Optional profile photos and photo reports/blocks may also be processed. Your password is protected by the authentication provider; never send it to support.
Usage, safety and region information
Country-level approximate location/country information is processed in connection with your account using device region, store country where available and an IP-derived country signal. It is used for eligibility, fraud prevention, security and compliance, not advertising tracking. We do not collect precise GPS location. Device region does not reliably identify your physical location.
App version, platform, session IDs and duration, screen/action events, tutorial progress, video loading and first-frame times, stalls and termination reasons are processed to understand and improve service performance. Age/policy confirmations and self-imposed casino limits support eligibility and safety. The scope and retention of provider IP and connection logs must be confirmed before release.
Photos, messages and support
Taking or choosing a profile photo is optional. Approved photos may be visible to other players. Contact details, messages and attachments you send to support are processed to respond to your request.
Family chat is part of the service. We process membership and roles; messages, mottos and announcements, their authors and timestamps; and blocking, reporting, appeal and moderation records. Content is shown to family members. Authorised moderators may access relevant content and a separate evidence copy captured when content is reported for safety review.
Purposes and legal bases
Proposed bases are performance of a contract for accounts and gameplay, legitimate interests balanced against your rights for safety, abuse prevention and proportionate service analysis, and legal obligations where specifically applicable. Separate consent is required where the law calls for it and may be withdrawn. An operating-system permission is not automatically legal consent for every processing purpose. The final bases for analytics and international transfers require legal review before publication.
Retention and account deletion
Deletion may remain pending until required photo cleanup, open gameplay rights and family obligations are resolved. After closure, direct account links are removed from certain transaction records. For eligible records, the one-calendar-year cleanup threshold starts at anonymisation, not the request date. This does not mean all records are fully anonymous or deleted on the same day. Required references, moderation evidence and provider/backup records have separate retention scopes.
Ordinary chat message bodies become eligible for cleanup 30 days after creation. The current family motto and announcement are not subject to the same message period. Report evidence is retained separately and scheduled for cleanup 90 days after the report or appeal decision is closed. Reopening an appeal changes that schedule. Account closure treats ordinary content separately from evidence needed for review.
The maximum retention for open reports, appeal text, provider logs, backups and support correspondence remains subject to legal and operational review. These are not covered by a blanket one-year deletion guarantee. You can request deletion or check a pending request.
Recipients and international transfers
We do not sell your data. Supabase provides authentication, database and photo storage. Expo/EAS supports app delivery and updates; Apple and Google distribute the app through their stores. The website host receives connection information, and account pages also load the Supabase JS library from jsDelivr. Support email is handled by the email provider to be selected. Information is disclosed to authorities only on a valid legal basis. Hosting regions, subprocessors and applicable GDPR/KVKK international transfer safeguards must be confirmed before publication.
Local storage and notifications
The mobile app stores authentication tokens, language/audio/graphics preferences, tutorial progress and retryable action information in local storage (AsyncStorage). Current notifications are scheduled on the device. This website adds no advertising or analytics cookies; account sessions stay in page memory. Closing the page clears that web session memory. Clearing mobile app data does not automatically delete the server account.
Your rights
Under KVKK, you may ask whether your data is processed, request information about purposes and recipients, seek correction or deletion/destruction where legally applicable and notification to recipients, object to adverse outcomes from exclusively automated analysis and seek compensation for unlawful processing. Where GDPR applies, rights of access, rectification, erasure, restriction, portability, objection, consent withdrawal and complaints to a supervisory authority apply subject to the relevant conditions.
Requests and changes
Send requests to info@gameofunderworld.com. Proportionate account-ownership checks may be needed. KVKK requests are addressed as soon as possible and within 30 days; GDPR requests normally within one month. Statutory extensions and exceptions may apply. Formal KVKK request channels and the controller’s service address must be completed before publication. Material changes will be announced here with an updated date.