Privacy, in plain words.

1. Who is responsible?

The controller is PaperPixel Games Oyun ve Yazılım Limited Şirketi, operating under the PaperPixel Games brand in Türkiye. You can contact us at [email protected] or at the business correspondence address below.

It covers paperpixelgames.com, the PaperPixel Post Office mailing service, and newsletter and creator communications. It does not describe data processing inside individual games. Steam and other linked services have their own privacy notices.

2. What information is involved?

Newsletter information includes your email address, chosen language, game interests, subscription status, and records of confirmation or withdrawal. Creator communications may also include your name, email address, language, the source and date of permission, and the game keys assigned to you. Creator records can be supplied directly or imported from our existing permission-based mailing records.

Mail records include the recipient, personalised content, send and delivery status, bounces, spam complaints and opt-outs. Campaign emails may include open and click tracking through Amazon SES: a small remote image records an image load, and tracked links record a visit before redirecting to the destination. The Post Office records the related campaign, recipient, event time, link destination and link placement to understand campaign engagement. These signals can also be produced by privacy tools or automated security scanners and do not prove that a person read the message. Subscription-confirmation messages are not tracked.

When you visit or contact us, hosting and communications providers process the technical information needed to handle the request, such as IP address, request information and message content. The mailing application also temporarily uses request information to limit abusive or repeated requests.

AWS processes technical information for tracking events, which may include IP addresses and user-agent information. The Post Office engagement table does not retain IP addresses or user-agent strings. Links for unsubscribing and the privacy notice are excluded from campaign click tracking. Engagement records in the Post Office are removed after 90 days.

3. Why we use it

We use your newsletter subscription consent to send the game news you request. Language and game preferences select relevant content. Registration is optional and email confirmation is a separate step. Reading this notice is separate from choosing to receive marketing.

We use delivery, bounce, complaint and opt-out records to deliver messages, troubleshoot failures and prevent further unwanted mail. Creator details and key assignments allow us to send agreed creator communications and avoid assigning a key to multiple recipients. We also handle requests about your information and protect the service against misuse.

Subject to the applicable law and its conditions, proportionate security, delivery troubleshooting and opt-out management rely on our legitimate interests in operating the service safely, without overriding your rights. Legally required records and responses to requests rely on the relevant legal obligation. Creator outreach must have an applicable permission or other lawful basis; finding an address publicly does not itself establish permission.

4. Who receives information?

The service uses Cloudflare for website delivery and protection, OVHcloud for the Post Office server, and Amazon Web Services SES, SNS and SQS for mail delivery and event handling. The configured AWS mail region is Stockholm, Sweden. The recipient’s mail provider also receives the message. Mailbox hosting is provided through Google for the current business email setup.

Authorised studio operators use the mailing system and local working copies of campaign and creator records. Access should be limited to people who need it for these tasks. Service providers process the information necessary to provide their services. We do not use the newsletter list to sell contact lists or provide advertisers with a mailing audience.

5. International processing

Our service uses providers and infrastructure outside Türkiye. AWS mail and event infrastructure is configured in Stockholm, Sweden. Cloudflare, OVHcloud and Google may process service data in countries where they operate; a selected server region does not necessarily cover all support or service operations.

You may contact [email protected] for information about the recipients, processing locations and transfer safeguards applicable to your information. Newsletter consent is not a blanket consent for unrelated international transfers.

6. Retention and deletion

We keep active newsletter and authorised creator records for the duration of that relationship. On withdrawal, we stop marketing. We retain the limited opt-out and permission records needed to honour your choice, demonstrate how the relationship began and avoid re-importing you. Game-key assignments are retained while needed to prevent reassigning a key. We review these needs when the relationship ends or you request deletion.

Our operational cleanup removes unconfirmed, unused registrations after 30 days, provided there is no fresh confirmation request or linked delivery/key record. Confirmation links expire in 48 hours. Email previews are removed after 30 days and processed event records after 90 days. Personalised bodies and key snapshots in completed deliveries are cleared after 365 days; unresolved outcomes are kept until investigated. Minimal delivery identifiers remain to prevent duplicate sends.

Managed server backups are rotated after 30 days. Data removed from the running database may remain in a backup until rotation; a restore must reapply deletion and opt-out decisions before sending resumes. Unprocessed SQS events have a maximum 14-day retention. Other provider records follow their applicable service terms. We assess deletion requests separately, including any applicable legal retention requirements.

7. Cookies & browser storage

The website’s World Passport feature stores the game stamps you collect in your browser’s session storage under paperpixel-world-passport-v1. The inspected feature does not send that stamp list to the mailing service. Browser session storage normally lasts for the tab’s session, subject to your browser’s restore behaviour, and can be cleared through browser controls.

The Post Office admin panel uses an eight-hour authentication cookie for authorised administrators. The website serves its fonts and game videos locally. The website source does not embed Google Analytics or advertising pixels. Hosting and security providers may process request information to deliver and protect the site.

8. Your choices & rights

You can unsubscribe using the link in a marketing email. Player newsletter recipients can also change their language and game interests through their preference link. Saving preferences does not reactivate an unsubscribed address. You can contact us at [email protected] about access, correction, deletion or your choices.

Under applicable law, your rights may include learning whether your data is processed, receiving information about the processing and recipients, correcting inaccurate information, requesting deletion where the conditions are met, asking for relevant corrections or deletion to be communicated to recipients, objecting to adverse results from exclusively automated analysis, and seeking compensation for unlawful processing. Where GDPR applies, additional rights can include restriction, portability, objection and a complaint to the competent supervisory authority. Withdrawal of consent does not retrospectively invalidate processing that was lawful before withdrawal.

Send requests to [email protected], explaining the right you wish to exercise and the relevant email address. We may request proportionate information to verify identity. Requests are assessed and answered within the periods and conditions of the applicable law.

9. Changes and contact

We update this notice when our purposes or tools materially change. Where a change requires fresh permission, updating this page alone is not sufficient. The date shown above identifies this version.

Privacy contact: [email protected]. Our business correspondence address is shown below.