01Who we are
Numhead is run by the person or company below, who is the “controller” of the information described on this page.
{{SORUMLU_AD}}Address: {{ADRES}}Email: {{ILETISIM_EPOSTA}}EU representative (Article 27 GDPR): {{AB_TEMSILCISI}}For any privacy question, just email us at the address above.
02What we process, where, and for how long
There are no accounts. We don’t ask for your name, email, phone number or age. This is everything that gets processed while you play.
| Information | Where it’s kept | Why | How long |
|---|---|---|---|
| Player ID (a randomly generated code) | In your browser. In the server’s memory while you’re connected. | So bans can follow you; statistics | In your browser until you delete it. On the server while you’re connected, and in ban and report records for as long as section 5 says. |
| Nickname | In your browser. In the server’s memory and on other players’ screens while you’re connected. | To show you in the game | In your browser until you delete it. On the server while you’re connected, and in ban and report records for as long as section 5 says. |
| Settings, key bindings, sound, mouse speed, graphics, personal best | In your browser. If you create a room, the match settings you pick go to the server with the room. | So the game remembers you | In your browser until you delete it. On the server until the room closes. |
| IP address | Only in the server’s memory. Never written to disk. | Room bans, rate limits, stopping attacks, working out your country | While you’re connected. Rate-limit entries for a few minutes; room bans until the room closes. |
| Country | Only as an aggregate counter | Picking ads for your country; country statistics | Counters aren’t linked to anyone |
| Match data (position, view direction, numbers you type, bombs) | Passed on to the players in the room, not stored | Running the match | For the match |
| Chat messages | Passed on to the players in the room, not stored | Chat | Not stored |
| Reports | On the server | Reviewing the report | Up to 90 days after a decision; for as long as the ban lasts if it led to one |
| Server-wide ban records | On the server | Enforcing the rules | For as long as the ban lasts; deleted within 30 days after a temporary ban ends |
| Statistics | On the server: daily totals, plus monthly hashes for counting unique players | Improving the game; giving sponsors aggregate figures | Monthly hashes deleted within 7 days after the month ends. Daily totals aren’t linked to anyone. |
| Ad impression counters | On the server, as totals | Sponsor reports | Counters aren’t linked to anyone |
| Error logs (error text, game version, browser type) | On the server | Fixing bugs | 30 days |
| Emails you send us | Our inbox | Replying to you | Up to 2 years after the matter is closed |
| Advertisers’ contact details | Admin panel | Contracts, invoices, staying in touch | For the business relationship, plus as long as tax and commercial law requires |
| Admin session cookie | Only in the admin’s browser | Signing in to the admin panel | Deleted when the session ends |
| This site’s theme choice (“site-tema”) | In your browser, if you pick one | Remembering light or dark view | Until you delete it |
Server records are backed up daily. Backups are deleted after 30 days.
03What’s kept in your browser
The game keeps a few things in your browser’s local storage. They stay on your device and we can’t see them. When you play online, your player ID and nickname go to the game server, and so do your match settings if you create a room. Your key bindings, mouse speed and personal best never leave your browser.
- Player ID: a random 24-character code your browser creates the first time you open the game. It isn’t tied to your name, your device or who you are. It lets bans follow you and is used for statistics.
- Nickname: the name you pick in the game.
- Settings: match settings, key bindings, sound, mouse speed and graphics quality (including whether it was picked automatically).
- Personal best: your best result in matches against bots.
- Theme: your light or dark choice on this site, if you make one.
You can delete all of this at any time, with the button below or by clearing this site’s data in your browser settings. After that the game won’t recognize you: you’ll get a new player ID and lose your settings and personal best.
Numhead data in this browser
There’s no Numhead data saved in this browser.
Only share your player ID when you write to us. This box works when the page is opened from the same address as the game.
04What reaches the game server
When you play online, your browser connects to our game server. As with any website, that connection carries your IP address and your browser’s type and version. Here’s what the server does with them:
- IP address: used to stop too many connections or rooms coming from one place, keep a player who was banned from a room out of that room, catch fake ad impressions, and work out which country you’re in. Your IP address only ever sits in the server’s memory. It’s never written to disk, a database or log files, and it’s gone when you disconnect, with two exceptions: it stays in memory for a few minutes for the room-creation limit, and if you’re banned from a room, it stays on that room’s ban list until the room closes.
- Country: worked out from your IP address. If the site runs behind Cloudflare we use the country Cloudflare passes on; if not, an offline country list on our own server. Your IP address isn’t sent anywhere else for this. The country is only used to pick ads and for counters like “how many people played from each country today”. It isn’t stored against you.
- Match data: during a match, your position, where you’re looking, the numbers you type and the bombs you throw are passed on to the other players in the room. The match is run in the browser of the player who created the room, so this data reaches their browser too. None of it is stored.
- What other players see: your nickname, team, role in the room (owner or admin) and chat messages. If you create a room, your nickname also shows in the room list. Your IP address and player ID are never sent to other players.
- Rooms: the room name, password (if there is one), settings and player list stay in the server’s memory and are deleted when the room closes. The room list (except hidden rooms) is public.
05Chat, reports and bans
- Chat: messages only go to the screens of the people in the room. They aren’t stored on the server. During a match, numbers with two or more digits are masked in public chat (that’s a game rule).
- Reports: if you report a player or a message, we keep the reported message as it was, both players’ nicknames and player IDs, the room, and the date and time. We review reports ourselves. A report is kept for up to 90 days after a decision, or for as long as a ban lasts if it led to one.
- Muting: a player you mute is only muted on your screen.
- Room bans: a room’s owner or admins can ban a player from their room. That record (nickname, player ID, IP address, date) only lives in the server’s memory and is deleted when the room closes.
- Server-wide bans: we can ban players who break the rules badly from the whole server. The record holds the player ID, the nickname at the time, the reason, and start and end dates. No IP address is stored. Records of temporary bans are deleted within 30 days after the ban ends; permanent bans are kept until lifted.
The rules themselves are in the Terms of use.
06Statistics
We keep statistics to understand how the game is played and to give sponsors aggregate figures. We do it without knowing who anyone is:
- The game sends events like a match starting or ending, its length, mode and map, in batches and not very often.
- To count “how many different people played this month”, we don’t use your player ID itself but a hash of it, made with a secret key that changes every month. During the month the hash can still be matched to your player ID, so we treat it as personal data and protect it the same way. When the month ends, the key is deleted and that month’s hashes go within 7 days. After that, a hash can’t be traced back to a person or matched across months.
- From your browser’s details we only count the device type (computer or phone) and the browser’s name. From invite or campaign tags in the address we only count where you came from (invite link, direct, search, social media).
- Loading times, frame rates and game errors are counted, so we can fix the game on slower devices too.
- Apart from the monthly hashes, the server only keeps daily totals, like “how many matches were played today, and how many on phones”. These counters aren’t linked to anyone.
07Ads and sponsors
The game is free. We cover the costs with sponsor images inside the game: wall billboards, the big screen in the middle of the map, and a few in-between screens.
- We don’t use ad networks. Images come from our own server, and billboards can’t be clicked.
- Ads are chosen only by your country. There’s no profile of you, no guessing your interests and no personalized ads.
- For sponsor reports we count how many times each billboard was actually on screen. The game sends these counts in batches, and the server applies per-connection limits to stop fake counts. Those checks happen in memory.
- Sponsors only get aggregate figures: impressions, player-minutes, countries and an estimated number of unique players. No sponsor ever gets personal data.
09Service providers and international transfers
The game and this site load their fonts, code and images from our own server. We don’t use outside services like Google Fonts, ad networks or social media plugins.
- Hosting: the game and site run on servers operated by {{BARINDIRMA_SAGLAYICI}} in {{BARINDIRMA_ULKESI}}. Like any web host, they may keep short-lived access logs for security (IP address, date, page requested). These are deleted after {{ERISIM_KAYDI_SURESI}}.
- Cloudflare (if we use it): a network in front of the site that speeds up traffic and filters attacks. Your connection passes through Cloudflare, which passes your IP address on to us along with the country it’s coming from. We use the IP address only in memory, as described above.
- Sharing: if you share your end-of-match card through WhatsApp or another app, what you share falls under that app’s rules.
- Authorities: where the law requires it and we receive a valid request, we share the information we have with the relevant public authorities.
We’re based in Turkey. If you play from the EU, EEA or UK, your data is handled by us in Turkey and on servers in {{BARINDIRMA_ULKESI}}. Where data moves between countries, we use the safeguards the GDPR requires, such as the European Commission’s Standard Contractual Clauses.
10Children
Numhead is for players aged 13 and over. If you’re under 13, please don’t play.
If you’re under 18, read this page with a parent or guardian and play with their permission. In some countries, including several in the EU, the age at which you can use online services without a parent’s consent is higher, up to 16. If that applies to you, ask a parent or guardian first.
We never ask your age or for any ID. Don’t use your real name, your school or your phone number as a nickname, and don’t share personal details in chat.
If we find out we hold a record about a child under 13 (in a report, for example), we’ll delete it. Parents and guardians can write to us at {{ILETISIM_EPOSTA}}.
11Security
- The connection between the game and our server is encrypted (HTTPS and WSS).
- We collect little and store even less. Data we don’t keep can’t leak.
- Only we can sign in to the admin panel. The password isn’t written in the code; only a salted hash is stored. Sign-in attempts are limited, and two-step sign-in is available.
Still, no system on the internet is perfect. If there’s ever a data breach, we’ll notify the authorities and the people affected as the law requires.
12Our legal bases
Under the GDPR (and Turkey’s data protection law, the KVKK), we rely on these legal bases:
| What we do | Legal basis |
|---|---|
| Running the game and rooms: the connection, player ID, nickname, match data, passing chat on | Performing our agreement with you, the Terms of use (Art. 6(1)(b) GDPR) |
| Bans, rate limits, stopping cheating and abuse, reports | Our legitimate interest in keeping the game fair and safe (Art. 6(1)(f)) |
| Working out your country, picking ads by country, sponsor reports | Our legitimate interest in funding a free game (Art. 6(1)(f)) |
| Statistics and error logs | Our legitimate interest in improving the game (Art. 6(1)(f)) |
| Answering requests and emails | Legal obligation (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f)) |
| Contracts and invoices with advertisers | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Requests from authorities | Legal obligation (Art. 6(1)(c)) |
Nothing here relies on your consent. You don’t have to give us any personal data, but without a connection to the game server you can only play against bots, not online.
13Your rights
You can ask us to:
- tell you whether we hold information about you, and give you a copy (access),
- correct it if it’s wrong or incomplete,
- delete it,
- restrict how we use it,
- give it to you in a portable format, where that applies,
- stop using it where we rely on legitimate interests (you can object at any time).
Email us at {{ILETISIM_EPOSTA}} or write to {{ADRES}}. Because we don’t know who you are in the game, we can only find your records through your player ID, so please include it. You can see it in the box in section 3.
We’ll reply within one month, free of charge. If a request is complex, we may need up to two more months and will tell you why.
If you write before the month is over, we can use your player ID to find and delete that month’s statistics hash. Daily totals and older hashes whose key is gone can’t be linked to you, so we can’t find them for you. The hashes are deleted every month anyway.
You also have the right to complain to the data protection authority where you live or work. In Turkey, that’s the Personal Data Protection Authority (kvkk.gov.tr). Turkish law gives you similar rights; see the Turkish version.
14Changes to this policy
We’ll update this page when we add features or when the law changes, and the date at the top will change with it. If it’s a big change, we’ll also let you know in the game.