Privacy Policy
Second Ball is a single-player football club management game. You can play it without an account, and your career lives on your phone. This policy explains, in plain words, the little data we do handle, why, who can see it, how long we keep it and how you can have it deleted.
The short version
- No account needed. Your career saves stay on your device. We can't see them.
- Cloud save is optional. If you turn it on, we store your email address and copies of your saves in the EU so you can restore them on another device. Only you can access them.
- Crash reports (technical details when the app crashes) are on by default. You can turn them off in Settings → Privacy.
- Usage analytics only if you say yes when the game first asks. It stays off until you answer, and you can change your mind at any time.
- No ads, no advertising identifiers, no tracking across other apps, and we never sell your data.
- You can delete your cloud account and all cloud saves in the app or by email.
1. Who we are
Second Ball is made by Ahmet Faruk Akgün, an individual developer trading as Afakgun Studio, based in Ankara, Türkiye ("we", "us"). We are the data controller for the personal data described here, under the EU General Data Protection Regulation (GDPR) and Türkiye's Personal Data Protection Law No. 6698 (KVKK).
- Email: [email protected]
- Postal address: Yeniçağ Mah., İkili Sk. No: 3 Daire: 1, 06170 Yenimahalle/Ankara, Türkiye
Turkish speakers can also read our KVKK Aydınlatma Metni.
2. Playing without an account
You don't need an account to play. Your careers, the game's automatic local backups of them, your settings and the record that you unlocked Full Career are stored only on your device, in the app's private storage. They are not sent to us unless you turn on cloud save (section 3.1). If you delete the app, this data is deleted with it.
3. What we collect and why
3.1 Cloud save (optional)
Cloud save keeps a copy of your careers online so you can restore them on a new phone. To use it you sign in with a 6-digit code we email to you, with Sign in with Apple or with Sign in with Google. If you never turn on cloud save, none of the data in this section exists.
| Data | Why |
|---|---|
| Your email address. With Sign in with Apple and "Hide My Email", this is a private relay address from Apple, not your real address. | To create your account, send you sign-in codes and recognise you when you sign in on another device. We don't send marketing email. |
| An internal user ID, and the account identifier Apple or Google gives us if you sign in with them. Google may also pass on the name and profile picture link on your Google account; our sign-in provider stores them with the account, but the game doesn't use or show them. | To link your cloud saves to your account and keep them separate from everyone else's. |
| Sign-in information: when the account was created and when you last signed in, and our provider's authentication logs, which include your IP address and the time of each sign-in. | To keep accounts secure, limit repeated sign-in attempts and investigate abuse. |
| Your uploaded save files: a compressed copy of a career, which contains the game's fictional world, the manager profile you created (the name and in-game face you chose) and your career progress. | To restore your career on this or another device. |
| A short summary of each save (club name and in-game date), the name of your device's operating system (for example iOS), upload times, file size and a checksum. | To show you which backup is which before you restore, and to check that a file arrived undamaged. |
You can keep up to 5 save slots in the cloud, and up to 2 versions of each slot; a new backup replaces the oldest version. The manager name is whatever you typed; it doesn't have to be your real name.
If you sign in with Apple or Google, they confirm who you are and tell us your email address. Their own privacy policies apply to the sign-in itself. Sign-in code emails are sent from [email protected] by our email delivery provider, Resend.
3.2 Crash reports
When the game crashes or hits a serious error, it sends a crash report through Firebase Crashlytics (Google). A report contains:
- the technical stack trace (which part of the code failed);
- device model, operating system version and app version;
- a Crashlytics installation identifier, a random ID for this installation of the app;
- the time of the crash.
Why: to find and fix bugs. Crash reports don't contain your email, your saves or your cloud account ID. They are on by default, and you can turn them off at any time in Settings → Privacy → Send crash reports. Development builds never send them.
3.3 Usage analytics (only with your consent)
The first time you open the game, it asks whether you want to share usage data. Nothing is collected until you answer, and nothing at all if you say no. If you agree, the game uses Google Analytics for Firebase to record:
- how the app is used: sessions, which screens are opened and how long they are used;
- when the Full Career offer is shown, and when Full Career is bought or restored;
- when a cloud backup or restore is made;
- a Firebase app instance ID, a random ID for this installation of the app;
- basic information that Google Analytics collects automatically, such as device model, operating system and app version, language, and country or region (Google derives this from your IP address but does not store the IP address in Analytics).
Why: to see which parts of the game are confusing or slow and make it better. Analytics doesn't contain your name, email address or saves, and it isn't linked to your cloud account. We don't collect advertising identifiers (Apple's IDFA or Google's advertising ID), we've turned off collection of the iOS identifier for vendors (IDFV), ad personalisation is disabled and nothing is used for advertising or for tracking you across other companies' apps or websites. You can change your answer at any time in Settings → Privacy → Share usage data.
We never learn who you are from analytics, but because each installation has a random ID, data protection law treats this data as pseudonymous rather than anonymous, so this policy treats it as personal data.
3.4 Purchases
Full Career is a one-time purchase made through the App Store (and, once the Android version is out, Google Play). Apple or Google process the payment; we never receive your card or bank details or your store account details. The app stores a record of the unlock on your device and can ask the store to restore it ("Restore purchases"). The stores give us sales reports that don't identify you.
3.5 Support emails
If you email us, we keep the conversation so we can help you and handle any follow-up.
4. What we don't collect
- Advertising identifiers. Second Ball has no ads and no advertising SDKs, and doesn't track you across other companies' apps or websites.
- Your location.
- Your contacts or address book.
- Camera or microphone input.
- Your payment card or bank details (Apple and Google handle payments).
We do not sell personal data, rent it or share it with advertisers or data brokers.
5. Who can see your data
- Only you can access your cloud saves. Our database uses row-level security, so an account can read and change only its own files. There are no shared or public saves.
- We can access the systems that store the data, only to run, secure and support the game and to handle your requests.
- Our service providers (section 6), only to the extent needed to provide their service to us.
- Authorities, only if we are legally required to, and we will push back on requests that are not lawful.
If Second Ball is ever transferred to another owner, this policy will continue to apply to your data and we will tell you in advance.
6. Service providers
We use the following companies to run Second Ball. They process data on our behalf and under contracts that require them to protect it.
| Provider | What for | Data | Location |
|---|---|---|---|
| Supabase Inc. | Cloud save: accounts, sign-in and file storage | Everything in section 3.1 except the sign-in emails themselves | EU (Frankfurt, Germany) |
| Resend | Sending sign-in code emails | Email address, the code, delivery status | USA |
| Google LLC (Firebase Crashlytics) | Crash reports | Section 3.2 | USA and other countries |
| Google LLC (Google Analytics for Firebase) | Usage analytics, only with your consent | Section 3.3 | USA and other countries |
| Apple Inc. (Sign in with Apple), Google LLC (Sign in with Google) | Signing in to cloud save, if you choose these options | Email address (or Apple relay address), account identifier | USA and other countries |
| Apple App Store, Google Play | App distribution and payments | Handled under Apple's and Google's own privacy policies | Global |
7. International transfers
Cloud saves are stored in the European Union (Frankfurt). We work from Türkiye, and some providers (Google, Apple, Resend) process data in the United States or other countries. Where data leaves the EU or Türkiye, we rely on the safeguards the law requires: the EU Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework for transfers from the EU, and the standard contracts set by Türkiye's Personal Data Protection Authority for transfers from Türkiye (KVKK article 9). You can ask us for more information about these safeguards.
8. How long we keep data
| Data | Kept for |
|---|---|
| Saves, local backups and settings on your device | Until you delete them or the app. We never delete or lock them, including when the free season ends |
| Cloud save files and their summaries | Until you delete them or your account. A new backup replaces the oldest of the 2 versions in that slot |
| Cloud account (email, user ID, sign-in provider details) | Until you delete your account |
| Authentication logs (including IP address) | A short time (typically days), as set by Supabase |
| Sign-in code emails | Codes expire quickly. Resend keeps delivery logs for a limited time under its own rules |
| Crash reports | About 90 days, then deleted automatically by Crashlytics |
| Analytics data (only if you agreed) | Event-level data 2 months (our Google Analytics retention setting); aggregated reports that don't identify anyone may be kept longer |
| Support emails | Up to 2 years after the conversation ends |
Deleted data may remain in encrypted backups for a limited time until they are overwritten.
9. Legal bases (GDPR and KVKK)
- Providing the service you asked for (GDPR art. 6(1)(b); KVKK art. 5(2)(c)): your cloud account, sign-in emails and cloud saves.
- Our legitimate interests (GDPR art. 6(1)(f); KVKK art. 5(2)(f)): crash reports to keep the game stable, authentication logs and other measures to keep accounts secure and prevent abuse, and handling support requests. You can object, and you can switch crash reports off in the app.
- Your consent (GDPR art. 6(1)(a); KVKK art. 5(1)): usage analytics. You can withdraw consent at any time in Settings → Privacy; this doesn't affect processing that happened before.
- Legal obligations (GDPR art. 6(1)(c); KVKK art. 5(2)(ç)): for example answering lawful requests from authorities.
- Establishing, exercising or defending legal claims (KVKK art. 5(2)(e)).
We do not process special categories of personal data (such as health data), and we do not use your data for advertising or profiling.
10. Your choices
- Cloud save: optional. You can sign out, delete a cloud copy ("Delete cloud copy") or delete your whole account at any time.
- Crash reports: Settings → Privacy → Send crash reports.
- Analytics: Settings → Privacy → Share usage data.
- Sign in with Apple: you can choose "Hide My Email" so we only receive a relay address.
11. Deleting your account and data
In the app, go to Settings → Cloud save → Delete account. Or email [email protected] from your account's email address with the subject "Delete my Second Ball account". More details are on our account deletion page.
- We delete your cloud account and all your cloud save files within 30 days.
- Saves on your device are not affected. To remove them too, delete the app.
- Crash reports and analytics are not linked to your account or email, so we usually can't find them for a specific person. They are deleted automatically after the periods in section 8. Turning them off in Settings → Privacy stops any new data.
- If you used Sign in with Apple or Google, you can also remove Second Ball from the apps connected to your Apple or Google account.
- Full Career stays with your App Store or Google Play account. Deleting your cloud account doesn't remove it, and you can restore it at any time.
12. Your rights
Depending on where you live, you have the right to:
- find out whether we process your data and get a copy of it;
- have incorrect data corrected;
- have your data deleted;
- restrict or object to certain processing (including processing based on legitimate interests);
- withdraw consent at any time, where we rely on it;
- receive data you gave us in a machine-readable format (data portability);
- know which third parties your data was transferred to, in Türkiye or abroad;
- object to a result that is to your detriment and arises solely from automated analysis;
- claim compensation if you suffer damage from unlawful processing;
- complain to a data protection authority: in Türkiye, the Personal Data Protection Authority (KVKK, kvkk.gov.tr); in the EU/EEA, the authority in your country.
To use any of these rights, email [email protected]. We will answer free of charge within 30 days. Requests under KVKK can also be sent in writing to our postal address; see the KVKK Aydınlatma Metni (in Turkish).
13. Security
- All data travels encrypted (HTTPS/TLS).
- Cloud saves are protected by row-level security: each account can only reach its own files.
- Sign-in codes are single-use and expire quickly, and repeated attempts are limited.
- Every cloud save has a checksum, so a damaged file is never restored over your career.
- Access to production systems is limited to the developer and protected with strong authentication.
No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as the law requires.
14. Children
Second Ball is not directed at children under 13. Cloud save sign-in is intended for people aged 13 or over, or 16 or over where local law requires that age to agree to data processing; analytics consent follows the same ages. We do not knowingly collect data from children below these ages. If you think a child has given us data, contact us and we will delete it.
15. Additional regional information
United States (including California): we do not sell or "share" personal information for cross-context behavioural advertising, and we don't use sensitive personal information to infer characteristics about you. You can ask to know, correct or delete your data as described above, and we will not treat you differently for doing so.
16. Changes to this policy
If we change this policy, we will update the date at the top. If the change is significant, for example a new type of data or a new purpose, we will tell you in the game before it takes effect and, where we rely on your consent, ask you again.
17. Contact us
Questions, requests or complaints: [email protected]
Afakgun Studio, Ahmet Faruk Akgün, Yeniçağ Mah., İkili Sk. No: 3 Daire: 1, 06170 Yenimahalle/Ankara, Türkiye