Privacy Policy

1. Data Controller

This Privacy Policy explains how personal data is processed in the WinwayStats mobile application, its web version and the winwaystats.com website (together the "Application"). Data controller:

Trade name: Winway Veri Analizi ve Yazılım Danışmanlık Hizmetleri Limited Şirketi

Address: Kınıklı Mah. 6021 Sok. No:59/7 Pamukkale / Denizli, Türkiye

Tax office and number: Pamukkale Tax Office, 8131516608

MERSİS number: 0813151660800001

Registered e-mail (KEP): winway@hs01.kep.tr

E-mail: info@winway.com.tr

2. Data Collected and Purposes

WinwayStats collects the following data for the purposes stated next to each item:

• First and last name: To identify the account holder and verify identity in support requests and for rewards that may be offered in the future.

• E-mail address: Account creation and sign-in, sending verification and password reset codes, mandatory service information.

• Username: Creating the name shown in the Application (profile, ranking).

• Password: Secure sign-in. Passwords are stored in irreversible form; no one, including WinwayStats staff, can see your password.

• Phone number: Account security and communication; in the future, phone sign-in and SMS verification.

• Date of birth: Checking the Application's 18+ age limit.

• Country and city (optional): Region-appropriate content and anonymous user statistics. Country also determines which support organisation is shown.

• Favourite team: Personalising the home page and notifications for your team.

• Favourite and pinned countries, leagues and matches: Highlighting favourite leagues and matches and pinned countries and leagues in the Bulletin and showing their results. Stored with the account; not shown to other users.

• Match poll votes ("Who Will Win?"): Showing the overall distribution of users' choices. Other users never see who voted for what, only overall percentages. Votes are deleted when the account is deleted.

• Followed users: Showing coupons of followed users on the Predictions page. Not shown to other users.

• Notification preferences and notification address (the phone's notification address, app language, match / user / Pisagol notifications turned on, points threshold preferences, a log of sent notifications): Sending the notifications the user has turned on to their phone. Notifications are off by default; no advertising or campaign notifications are sent. The user can turn notifications off at any time or revoke permission in the phone's settings. The phone's notification address is deleted on sign-out; the log of sent notifications is deleted after 7 days.

• Subscription information (package, start and end dates, whether the trial has been used; device information to prevent trial abuse): Providing Winway Plus packages, calculating the trial period, determining the loyalty badge based on the package duration purchased. Card details are not collected by WinwayStats; payment is taken through an app store or a licensed payment institution.

• Coupon and prediction history: Providing the service; keeping a prediction history that cannot be deleted; calculating performance indicators such as win rate, ROI and average odds; creating rankings; statistically analysing coupon data (odds, coins staked, potential winnings and result) to measure and improve the Application's effect. Analysis results are shared with third parties only in a form that cannot identify anyone (anonymous and aggregated).

• Virtual coin transactions: Allocating and tracking the monthly virtual budget, preventing cheating and manipulation. Coins have no real-money value.

• Behaviour summaries (calculated from coupon and coin history: share of balance used per coupon, time between coupons, winning/losing streaks and changes after them, day and hour distribution, change compared with the first 14 days): Letting users see their own decision behaviour. No additional data is collected; summaries are calculated from the user's own data, shown only to the user, and contain no diagnosis or label.

• Points history and ranking information: Determining monthly rankings and tracking points.

• Consent records (agreement acceptance and 18+ declaration, with date and time): Proof that consent was given.

• Technical data (IP address, device and session information, sign-in logs): Account and system security, cheat detection, record-keeping obligations under the law.

• App error logs (type of error and where it occurred in the code, app version, device model and operating system): Finding and fixing errors. Not linked to your account; contains no name, e-mail or coupon content.

• Usage statistics (screens opened and time spent on them, app opening and closing, device model, operating system, app version, language, approximate country and city derived from the IP address, account ID): Improving the app by seeing which parts are used and how. Name, e-mail, phone and coupon content are not sent; no screen recording is made.

• Bot verification (during sign-up, sign-in and password actions; IP address and browser / device signals): Preventing mass fake accounts and automated attacks. Verification is performed by Cloudflare; WinwayStats does not store this information.

• Language and appearance preference: Appearance is stored only on the device. Language is stored on the device and with the account; it is used to show the app, notifications and e-mails in the chosen language.

No special categories of personal data (health, biometric data, etc.), ID numbers, card details or addresses are collected.

When a new type of data collection is added to the Application, this text is updated and the current version is published in the Application.

3. Information Visible to Other Users

In line with the Application's transparency principle, your username, points and points progress, ranking, coupon and prediction history (including coins staked and potential winnings), performance statistics, and virtual coin balance and budget use (day-by-day balance, net coins against the monthly budget) can be seen by other users on your profile and in rankings.

Your loyalty badge (bronze, silver, gold, diamond), based on the package duration you purchased, is visible to other users on your profile and in rankings; the package type and payment information are not shown.

Your first and last name, e-mail, phone number, date of birth, city and behaviour summaries are not shown to other users.

4. Data Sharing

WinwayStats does not sell user data or share it for advertising. Data is shared only with the following recipients, limited to the stated purpose:

• Supabase Inc.: data hosting, database and sign-in service

• Resend (e-mail delivery service): sending verification, password reset and information e-mails

• PostHog Inc.: app error logs and usage statistics

• Cloudflare Inc.: bot verification during sign-up, sign-in and password actions (Turnstile)

• Expo (650 Industries Inc.) and Google LLC (Firebase Cloud Messaging), on iPhone Apple Inc. (Apple Push Notification service): delivering the notifications the user has turned on to their phone (notification address and notification text)

• App stores and the payment institution (once package sales start): verifying purchases

• Authorised public authorities and courts: where required by law and upon request

Apart from these, data may only be used for analysis in a form that cannot identify anyone (anonymous and aggregated).

5. Transfers Abroad

Your data is stored on servers in Frankfurt, Germany, through our infrastructure provider Supabase Inc. Error logs and usage statistics are kept on PostHog's servers in the European Union (Germany). E-mails are sent through Resend via servers in Ireland. Bot verification runs on Cloudflare's global network.

Notifications are delivered through Expo and Google (on iPhone, Apple) servers abroad, including in the United States; only the phone's notification address and the notification text are sent to these servers.

Your personal data is therefore transferred abroad. The transfer is carried out in accordance with Article 9 of Law No. 6698 (KVKK) through the standard contracts announced by the Turkish Personal Data Protection Board.

6. Cookies and Local Storage

No advertising or tracking cookies are used in the app or the web version.

In the web version, session information and preferences are kept in the browser's local storage; these are necessary for the Application to work.

App errors and how much each screen is used are measured with PostHog. Name, e-mail, phone and coupon content are not sent; no session recording (screen video) is made.

Cloudflare Turnstile bot verification is used during sign-up, sign-in and password actions.

7. Account Deletion

Users can delete their account in the Application (Settings) or on the Account Deletion page at winwaystats.com.

• After a deletion request the account enters a 30-day waiting period.

• Signing in again within 30 days cancels the deletion request.

• If there is no sign-in within 30 days, the account and the personal data linked to it are permanently deleted.

• Coupon and virtual coin records are made anonymous by removing their link to the account and are used only for statistical analysis.

• Records that must be kept by law (section 8) are deleted at the end of the statutory period.

8. Retention Period

Data is kept as long as the account is open. When the account is deleted, personal data is deleted or anonymised as described in section 7.

Consent records are kept for the relevant limitation periods to serve as proof in possible disputes; technical records are kept for the period required by the relevant legislation and deleted at the end of that period.

9. Age Limit

The Application is not suitable for persons under 18 and no service is provided to this age group. Accounts found to belong to someone under 18 are closed and their data deleted.

10. Security

Personal data is protected against unauthorised access by technical and administrative measures. Connections are encrypted, passwords are stored in irreversible form, session information on the phone is kept encrypted, and each user can access only their own personal data.

In the event of a data breach, the Personal Data Protection Board and affected users are informed within the period required by law.

11. Your Rights and Applications

Your rights under Article 11 of the KVKK and how to apply are explained in the KVKK Information Notice. For questions you can write to info@winway.com.tr.