Last updated: 10 October 2026 · Türkçe
| Company | YCT Sağlık Hizmetleri Ltd. Şti., Türkiye |
| Registration (MERSİS) | 0946056894600001 |
| Tax ID (VKN) | 9460568946 |
| Address | Alacaatlı Mah. Park Cad. No: 15/15, Çankaya/Ankara, Türkiye |
| Phone | +90 546 233 77 87 |
| Contact | [email protected] |
No sign-up: no email, phone number, real name, date of birth or social login. On first launch an anonymous identifier is derived for your device; that is your account. A nickname is optional and visible to other players.
| Player ID | Anonymous identifier derived from the device. Tied to a device, not a person. |
| Nickname | Optional, chosen by you. |
| Device key | The raw device identifier is never stored on our servers. Only a truncated SHA-256 of it. On iPhone, a copy of the raw identifier is kept only in that device's keychain (it does not sync to iCloud or move to another device via backup) so that your account comes back if you delete and reinstall the app. It is replaced when you delete your account and erased when the phone is reset. |
| Recovery code digest | To restore your account on a new device. The code itself is not stored. |
| Rating and season stats | For ranking and matchmaking. |
Your IP address is not stored in clear; a salted SHA-256 hash is kept and deleted after 30 days. It is used to limit accounts opened from one connection and to detect collusive matches. The hash is pseudonymous data; data-protection duties still apply.
A closed list of events is kept (session_started, mode_selected, round_started, round_finished, match_finished, match_abandoned). Each event carries only a timestamp, player id, event name, game mode and at most two numbers — no free text, answers or nickname.
Usage statistics (only with your permission, from version 1.0.0 build 97). If you allow it (you are asked on first launch with two equal choices, “Don’t Allow” / “Allow”; nothing is pre-selected and nothing is sent until you choose; you can turn it off at any time in Settings › Share Usage Data), the app sends counts chosen from a fixed list — e.g. "a game finished, mode: duel" — to our own server in Istanbul. Your name, account, player id, device or advertising ID, location, content and IP address are not sent or stored. Counts are kept as daily totals, values matching fewer than five users are never published, and nothing is transferred abroad or shared. While it is off, nothing is sent.
On a crash the error type, message, first lines of the stack trace and the app version are sent. Quoted strings, email-like sequences, file paths and long alphanumeric strings are stripped before sending. Version 1.0.0 build 97 and later send reports to our own error server in Istanbul; reports contain no account data or IP address and are deleted after 60 days. Older versions send them to Sentry (see 6).
If you allow notifications, your device's push token is stored; if not, it is never requested. For friend requests, invites, match results and daily rewards the server sends only the event type and numeric fields; the app composes the sentence and no one's name is carried. Only the daily reminder is sent as text, chosen from a fixed pre-written pool with no names or personal numbers. Turn it off in Settings › Daily Reminder.
Without a photo your initials are shown. If you set one, the single image you pick is cropped to 512×512, stored on our server and visible to other players. We do not access your gallery; EXIF metadata is not kept. Remove it any time (Profile → Remove photo); deleting the account deletes it too. Report an inappropriate photo with the Report button on that player's profile: it is hidden on your screen immediately and images that break the rules are removed.
Ads are served through Google AdMob: an interstitial after matches and an optional rewarded ad. On iOS the advertising identifier (IDFA) is not collected and App Tracking Transparency is never requested; ads are non-personalised. On Android AdMob may process the device's advertising ID; without consent on Google's consent screen the request is non-personalised. AdMob may infer an approximate location from your IP address to select ads and to decide whether Google's consent screen is required. Pro or "Remove ads" removes interstitials; the rewarded ad plays only when you start it.
The question pool is compiled from publicly available career information about real athletes; it contains no special-category data and is not shared with third parties. Legal basis: legitimate interest (KVKK art. 5/2-(f), GDPR art. 6(1)(f)). Requests are resolved under the conditions and within the period in the Removal Policy.
Each round records the two teams asked, the outcome, score, time taken and the answer field (for a wrong answer, the text you typed). It exists for your match history and your friend's board; it is tied to your account, not shared, not used for advertising, and deleted with your account.
You can only message players who are your friends. The text of your message, the sender and recipient and the sent/read times are stored on our server; inappropriate words are masked with asterisks before storage. Messages are deleted automatically after 30 days; a message you report is kept until the review is closed (at most 1 year). The push notification for a new message does not contain its text. If the friendship ends or you block the player, the chat closes. When an account is deleted, messages in both directions are deleted. Messages are not shared with third parties or used for advertising. Legal basis: performance of the contract (KVKK art. 5/2-(c), GDPR art. 6(1)(b)).
None of the following is collected, stored, or shared:
Coin use on refund requests — sent to Apple only if you allow it. On iPhone, the store's “Share Coin Use with Apple on Refunds” switch is off by default and is not a condition of purchase. You are asked once, the first time you tap a coin pack (“Yes, Allow” / “No, Thanks”, equal choices); your answer does not affect the purchase. If you turn it on and later ask Apple to refund a coin pack, we answer Apple's request with how much of the pack you used (as a percentage) and that it was delivered; Apple considers this when deciding. No name, email or device information is sent. You can turn it off at any time; while it is off nothing is sent. Legal basis: explicit consent. Separately, the coins of a refunded pack are deducted from your balance, which may go negative.
| Running the game, matchmaking, keeping score | Performance of a contract |
| Detecting cheating and multiple accounts (IP digest) | Legitimate interest |
| Crash and error diagnosis | Legitimate interest |
| Product development (closed event list) | Legitimate interest |
| Usage statistics (aggregate counters; no personal data) | Permission (on first launch; can be withdrawn in Settings at any time) |
| Sending notifications | Consent (via the device permission) |
| Purchase verification | Performance of a contract |
| Building the question pool (see 3.8) | Legitimate interest (KVKK art. 5/2-(f), GDPR art. 6(1)(f)) |
Our servers are in Türkiye; hosting in-country does not remove data-protection obligations.
| IP digest | 30 days, then deleted automatically |
| Notification records | Newest 100 per player |
| Account, nickname, stats, game records | Until the account is deleted |
| Profile photo | Until you remove it, or the account is deleted |
| Reports | Until the review is closed, at most 1 year |
| Friend messages | 30 days; a reported message until the review is closed, at most 1 year |
| Event records | Aggregate product analysis only |
| Crash reports (our own server) | 60 days |
| Usage statistics | Daily totals only; raw counters are deleted at the end of each day, totals kept at most 24 months |
You have the right to access, rectify, erase and restrict processing of your personal data, to object to processing, and to data portability. Requests are sent to [email protected] and are resolved within 30 days at the latest.
Settings › Account › Delete my account — immediate and irreversible. On the server: nickname, profile picture, friends, invites, notifications, device record, push token, season stats, event and crash records. On this device: nickname, avatar, coin balance and history, achievements, cosmetics, statistics, records, daily streak and hidden-player list. Phone-level settings (language, sound, tutorial) stay. Matches you played remain in opponents' history as an anonymous record.
If you have already uninstalled the app: midpoint.lafish.com.tr/hesap-silme (with your recovery code) or email [email protected] with your nickname and discriminator (for example: Ali#4718). Resolved within 30 days.
Midpoint is not directed at children under 13 and does not knowingly collect data from them.
When this document changes, the date above is updated. Significant changes are announced in the app.