Privacy Policy

Last updated: 25 July 2026

This policy explains what data JournaPlay collects, why, who we share it with, and what control you have over it. We have tried to write it in plain language rather than legal boilerplate.

1. Who we are

JournaPlay is operated by JournaPlay, based in Sarıyer, İstanbul, Türkiye. For the purposes of the Turkish Personal Data Protection Law (KVKK) we are the data controller (veri sorumlusu), and for the EU General Data Protection Regulation (GDPR) we are the controller of the data described below.

2. What we collect

Data	When	Why
Email address	When you create an account	To identify your account, verify it, send password resets and service notices
Password	When you create an account	Stored only as a salted scrypt hash. We never store, log or have access to your actual password.
Organisation name	At sign-up	To group team members and games under one account
Article text you submit	Each time you generate games	To produce the games. See section 3 — this is the most important part of this policy.
Games you create	When you save a game	To store, edit and serve them inside your embeds
Images you upload	Only if you add a puzzle cover image	Stored as part of the game data
Session cookie	When you sign in	To keep you signed in. See section 5.
Subscription status	If you buy a paid plan	To apply your plan limits. We do not receive or store card details.

We do not collect: your name, phone number, postal address, date of birth, or any special category data. We do not buy data about you from anyone, and we do not sell or rent your data to anyone.

3. Your article content and AI processing

When you paste an article and ask JournaPlay to generate games, the text of that article is sent to OpenAI, which runs the model that produces the game content. This is how the product works — without it, no games can be generated.

What this means in practice:

• Your article text leaves our servers and is processed by OpenAI.
• We use OpenAI's commercial API. Under OpenAI's API terms, data submitted through the API is not used to train their models by default, and is retained by them only for a limited period for abuse monitoring.
• We store a one-way fingerprint (hash) of each article you submit. We use it to recognise when you regenerate the same article so it does not count against your quota twice. The fingerprint cannot be reversed back into the article.
• The full article text is stored in your game record only to the extent needed to render and edit the games you saved.

If you are working with material that must not leave your organisation before publication, do not paste it into JournaPlay until it is published, or contact us to discuss options.

4. Why we process it

Under GDPR Article 6 and the corresponding provisions of KVKK, our legal bases are:

• Performance of a contract — creating your account, generating and hosting your games, applying your plan limits, taking payment.
• Legitimate interests — keeping the service secure, preventing abuse of the free plan, understanding aggregate usage so we can improve the product.
• Legal obligation — keeping invoicing records where tax law requires it.

We do not rely on consent for any of the above, and we do not send marketing email unless you ask us to.

5. Cookies and analytics

Cookies

We use exactly one cookie: a session cookie that keeps you signed in. It is HttpOnly (not readable by JavaScript), SameSite=Lax, sent only over HTTPS, and expires after 30 days or when you sign out. It is strictly necessary for the service to function, so it does not require consent.

We use no advertising cookies, no third-party trackers, and no cross-site tracking of any kind. Your theme preference (light or dark) is stored in your browser's local storage and never leaves your device.

Analytics

We run our own analytics rather than a third-party service. It records only aggregate daily counts, never a profile of an individual:

• how many times each page was viewed;
• which website referred the visit — domain only, for example instagram.com, never the full URL;
• a campaign label if you arrived through a link we tagged (for example ?utm_source=instagram);
• a coarse device category — mobile, tablet or desktop;
• the two-letter language of your browser, for example tr or ar, so we know which languages to support;
• counts of a small fixed list of on-page actions, such as a click on the sign-up button or scrolling to the pricing section.

Each of these is stored only as a daily counter — for example "42 visits from mobile today". They are not attached to you, to each other, or to any identifier, so they cannot be combined into a profile.

To count unique visitors for a single day, we compute a one-way hash of your IP address and browser user agent combined with a salt that changes every day. We store only that hash. Your IP address and user agent are never written to our database. Because the salt rotates daily, the same visitor cannot be linked across different days. These hashes are deleted after 60 days.

We honour the browser Do Not Track signal: if it is enabled, we record nothing at all.

6. Who we share data with

We use a small number of processors, each for a single clearly defined purpose:

Provider	Purpose	What they receive
OpenAI	Game generation	The article text you submit
Resend	Sending email	Your email address and the message content
Railway	Hosting and database	All service data, as our infrastructure provider
Polar	Payments (paid plans only)	Your billing details, handled entirely on their systems

Beyond these, we disclose data only where we are legally required to — for example in response to a valid order from a competent authority.

7. Where your data is stored

Our application and database are hosted on Railway. Email is delivered through Resend's European (Ireland) region. Game generation is performed by OpenAI, which processes data in the United States.

Where data is transferred outside Türkiye or the European Economic Area, that transfer is made under the relevant provider's Standard Contractual Clauses and data processing agreement.

8. How long we keep it

• Account data — until you delete your account.
• Games and article content — until you delete them, or until you delete your account.
• Sessions — 30 days, or until you sign out.
• Visitor hashes — 60 days, then automatically deleted.
• Aggregate page counts — kept indefinitely. They contain no personal data.
• Backups — we take an automatic database backup roughly twice a day and keep the most recent ones on a rolling basis. Deleted data may persist in a backup for a short period before it is rotated out.
• Invoicing records — for as long as tax law requires.

9. Your rights

Under KVKK Article 11 and GDPR Articles 15–22 you have the right to:

• learn whether we process your data, and request a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• object to processing based on legitimate interests;
• receive your data in a portable format;
• lodge a complaint with a supervisory authority — in Türkiye the Personal Data Protection Authority (KVKK Kurumu), or in the EU your national data protection authority.

To exercise any of these, email us at 02fatihaslan@gmail.com. We respond within 30 days.

10. Deleting your account

You can delete your account yourself from the studio at any time; you will be asked to confirm with your password. Deletion is immediate and permanent.

When you delete your account we remove your user record, all sessions, and any pending verification or password-reset tokens. If you are the only remaining member of your organisation, we also delete the organisation, every game it owns, its generation history and its subscription record. Games deleted this way stop working in any page they were embedded in.

Copies may remain in encrypted backups for a short period until those backups rotate out.

11. Security

• All traffic is served over HTTPS.
• Passwords are stored as salted scrypt hashes and are never recoverable.
• Session cookies are HttpOnly, SameSite=Lax and Secure.
• API keys are shown once at creation and stored hashed afterwards.
• Account deletion requires password confirmation, so a stolen device cannot be used to destroy an account.

No system is perfectly secure. If you believe you have found a vulnerability, please tell us at 02fatihaslan@gmail.com before disclosing it publicly.

12. Children

JournaPlay is a tool for publishers and is not directed at children. You must be at least 18 years old to create an account. We do not knowingly collect data from children. Readers who play an embedded game are not asked for any personal data at all — the player records only an anonymous play count.

13. Changes

If we change this policy in a way that materially affects you, we will email account holders before the change takes effect. The date at the top always reflects the current version.

14. Contact

Questions, requests, or complaints: 02fatihaslan@gmail.com
JournaPlay, Sarıyer, İstanbul, Türkiye