Privacy notice
In short
- You do not need to give your name or email to play Gander.
- The levels you passed and your badges stay in your own browser; you can delete them whenever you like.
- We only count visits if you choose “Accept”.
- Anyone joining the mailing list types their address themselves; ask a grown-up before you do.
Data controller
The data controller is Bumba Teknoloji Limited Şirketi (Ataşehir / Istanbul, Türkiye). Contact and requests: bilgi@bumbagroup.com.
Kept in your browser (necessary)
The items below stay in this browser only (localStorage), are never sent to a server, and the site does not work without them. The legal basis is legitimate interest (Turkish data protection law KVKK, art. 5/2-f); no cookies are used.
- bumba-cerez: your cookie choice (policy version, statistics permission).
- gander-lang: the language you chose.
- gander-theme: the theme you chose (light or dark).
- gander-progress-v1: the levels you passed and their stars.
- gander-rozetler-v1: the badges you earned, the day you earned them, and counters.
Visit statistics (with your permission)
If you choose “Accept” in the cookie banner or switch statistics on in the preferences, visits are counted with Umami on our own server (istatistik.bumba.tr). It processes the page opened, browser, device type, language, and the country and city derived from your IP address. The IP address is not stored and no cookies are used. Visits are tied to a pseudonymous session.
Counted events: language change, theme change, search (only whether there was a result), joining the list, and the id of a badge earned for the first time. No name, email or other personal data is added to events. If you allowed statistics, the word you type into the site search is sent to our server to count in aggregate which words are searched; it is not linked to your account or session. The legal basis is your explicit consent, which you can withdraw at any time under “Cookie preferences”. Without permission the script is never loaded.
Accounts (optional)
If you create an account, our server keeps: your email address, your display name, an irreversible hash of your password, your language and theme preference, whether your email is verified, and your session records (when the session started and when it ends; no IP address or browser information is recorded). To limit sign-in and sign-up attempts, your IP address is kept for one day at most. When you sign in, a session cookie that scripts cannot read (gander.session_token) is set in your browser; it belongs to the necessary group. The purpose is to manage your account and session; the legal basis is the performance of a contract (KVKK art. 5/2-c).
Verification and password reset emails are sent through Resend (USA); your email address is transferred to that provider for this. The data is kept while your account is open; an account whose email is not verified within 7 days is deleted. When you delete your account on the Account page it is all deleted; a deleted account stays in backups for 30 days at most. Backups are stored abroad (USA, Cloudflare R2). You can download what your account holds as JSON from the Account page. Having an account does not put you on the mailing list. Your game progress and badges are not transferred to the account.
Mailing list
The form in the footer signs you up to the shared Bumba mailing list. Your address goes to the shared service at bumbagroup.com when you choose “I agree”; Gander does not store it. The confirmation email, unsubscribing and the consent record are handled by the shared service.
Achievement badges
Badges are worked out automatically from what you do in the game (landings, shifts, emergencies and so on); their purpose is to show you your badges and progress. The data kept: the badge id, the day you earned it (no time) and the counters a condition needs. It is first-party data, stays in this browser only, is never sent to a server and is not shown to anyone else. The legal basis is legitimate interest (KVKK art. 5/2-f).
It is kept until you delete it. To delete it, use “Delete badges” on the Badges screen or clear the site data in your browser. If you allowed statistics, the first time you earn a badge only its id is sent to Umami, with the same browser, device, country and city information as a page visit.
Requests to other addresses
The Bumba Games badge in the footer and the mailing list notice are loaded from bumbagroup.com (the same data controller). There is no other external resource (font server, video, map service, advertising); the game’s world data comes from this site.
Your rights
To use your rights under article 11 of KVKK (such as access, correction, deletion and objection), write to bilgi@bumbagroup.com. You can delete the data in your browser yourself; we hold no copy of it.