Sign up

Privacy Policy

Last updated: 5 November 2026

This is our privacy notice under Article 10 of Turkey's Personal Data Protection Law No. 6698 (KVKK). It explains what data is processed when you use 2oyun.com, why, on what legal basis, who receives it and how you can exercise your rights. If you visit from the European Economic Area, the matching GDPR provisions are given in each section.

Every cookie we use, with its purpose and lifetime, is listed in our Cookie Policy.

Who is responsible

2oyun.com is run by GEO Yazılım, the sole proprietorship of Ömer Furkan Oruçoğlu, who is the data controller.

  • Legal name: Ömer Furkan Oruçoğlu (GEO Yazılım), sole proprietorship
  • Tax office / no: M. Karagüzel V.D. / 6480433594
  • Address: Karapürçek Mah. Şehit Bülent Yalçınkaya Cad. Huzur Apt. No: 21, Altındağ/Ankara, Türkiye
  • Email: hi@2oyun.com (also info@geoyazilim.com)
  • Web: geoyazilim.com

We don't offer phone support. Privacy questions and requests go by email or through the channels described under "How to make a request" below.

The short version

  • You don't need an account to play. Without one, what reaches our server is the connection data every website receives, and we count visits without identifying anyone.
  • Statistics and personalised advertising cookies only run if you allow them. You can change your mind any time with the Cookie settings link at the bottom of every page.
  • We don't sell your data and we don't send marketing emails.
  • Most games load from distribution networks' servers. The ads and cookies inside those games are the network's responsibility.

What we process and why

Each section lists the data, the purpose, the legal basis and how long we keep it.

1. When you connect: server logs

  • Data: your IP address, time of the request, the address you opened, the referring page, browser and device details (user agent) and the server's response code.
  • Purpose: keeping the site running, blocking attacks and abuse, finding bugs, and meeting our obligations under Turkish Law No. 5651 on internet publications.
  • Legal basis: legal obligation (KVKK Art. 5(2)(ç)) and legitimate interest (KVKK Art. 5(2)(f)); GDPR Art. 6(1)(c) and (f).
  • Retention: web server access logs for up to 2 years, application error logs for 14 days.

2. Our own visit count (no cookies)

To see which pages and games people enjoy, we run a simple count on our own server. It writes no cookie or local-storage entry, does not store your IP address and builds no profile of anyone.

  • How it works: so the same visitor isn't counted twice in one day, an irreversible hash is made from your IP address, browser details and a random key for that day. The key is never written to the database; it sits in the server cache for at most two days and is then deleted, so visits on different days cannot be linked.
  • What is recorded: the page opened (without the query string), the domain of the site you came from, device type, browser family, language and country. The country comes from the country code Cloudflare adds to each request.
  • Legal basis: legitimate interest (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
  • Retention: detailed records are deleted within 48 hours; only daily totals remain.

If your browser sends a "Do Not Track" or "Global Privacy Control" signal, you are not counted at all.

3. Google Analytics (only with your consent)

  • Data: the random ID in the Google Analytics cookie, the pages you view and what you do on them, device and browser details, and an approximate location derived from your IP address. Google Analytics does not store the IP address itself.
  • Purpose: aggregate reports on how the site is used. Google signals and ad personalisation signals are switched off.
  • Legal basis: your consent (KVKK Art. 5(1); GDPR Art. 6(1)(a)). The tag does not load until you allow "Statistics". Google Tag Manager is tied to the same consent.
  • Retention: cookies up to 2 years; event data in Google Analytics up to 14 months, per our account setting.

4. Advertising

2oyun is free and ads pay for it. Ad slots may show ads from Google AdSense or Google Ad Manager.

  • If you don't consent: Google neither writes nor reads advertising cookies and shows non-personalised ads. For an ad to load at all, your IP address, browser details and the page address still reach Google, which uses them for frequency capping, filtering invalid traffic and aggregate measurement.
  • If you consent: Google and its partners may use advertising cookies and choose ads based on your visits to this and other sites.
  • Legal basis: your consent for advertising cookies and personalisation (KVKK Art. 5(1); GDPR Art. 6(1)(a)); our legitimate interest for serving non-personalised ads (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
  • Retention: cookie lifetimes are set by Google and listed in our Cookie Policy.

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the internet. You can opt out of personalised advertising in Google Ads Settings, and from other vendors at aboutads.info or youronlinechoices.eu. Google explains how it uses this information here.

5. Our own promotions

Ad slots sometimes show 2oyun's own promotions or artwork from advertisers we deal with directly. We only keep totals of how often these are seen and clicked; no cookies are used. Your IP address is processed briefly so the same view isn't counted twice and to prevent abuse; it is not written to the database. Legal basis: legitimate interest (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).

6. Accounts

  • Data: your username, email address, an irreversible hash of your password (bcrypt) and your display name; if you add them, your bio, profile picture and cover image. As you use the account: favourites, play history (which games, how often, when last played), friends and friend requests, blocked users, notifications and your last-seen time.
  • Purpose: creating and running your account, syncing your lists across devices, friend features, password-reset emails when you ask for one, and protecting accounts from abuse.
  • Legal basis: performance of the membership agreement (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)); legitimate interest for security measures (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
  • Retention: until you delete the account. Deletion removes the data from the live database at once; because database backups rotate, it drops out of backups within two months at the latest.

Profiles are public by default. If you make yours private, only friends see your favourites, play history and friends list; your name and profile picture always stay visible. Profile pages are not indexed by search engines. To rate-limit login, registration and password-reset attempts we keep only a short-lived irreversible hash of your IP address.

You can delete your account any time under My account → Delete account. Your comments stay in place so conversations still make sense, but they show "Guest" instead of your name. Write to us if you want them removed too.

7. Comments, ratings and reports

  • Data: the text of your comment; your username if you are a member or the nickname you typed as a guest; your ratings and likes; an irreversible SHA-256 hash made from your IP address and a secret key of ours. When you report a comment, the reason and the same kind of IP hash are stored.
  • Guest votes: when you rate a game or like a comment as a guest, an encrypted cookie (2o_v) holding a random ID is set in your browser. The database stores only a hash of that ID, never the ID itself.
  • Purpose: publishing comments and ratings; stopping repeat voting, spam and abuse; handling reports and notices of unlawful content.
  • Legal basis: legitimate interest (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)); legal obligation for notices under Law No. 5651 (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)).
  • Retention: as long as the comment or rating is online; reports are deleted together with the comment. The 2o_v cookie lasts 2 years.

Comments are public, so please don't include phone numbers, email addresses, home addresses or social media handles. Comments containing such details are held for review automatically. Members can edit or delete a comment within 10 minutes of posting; after that, email us to have a comment or rating removed.

8. When you email us

  • Data: your email address, your name if you give it, your message and any attachments.
  • Purpose: answering you and fixing the problem; keeping a record of privacy requests and copyright or content notices.
  • Legal basis: legitimate interest (KVKK Art. 5(2)(f)); for requests and notices, legal obligation (KVKK Art. 5(2)(ç)) and the establishment, exercise or defence of legal claims (KVKK Art. 5(2)(e)); GDPR Art. 6(1)(c) and (f).
  • Retention: general correspondence for 1 year after the request is closed; privacy requests and copyright or legal notices for 2 years.

9. Data that stays in your browser

Your favourites, recently played games, recent searches, display preferences and cookie choice are kept in your browser's local storage. Without an account they stay on your device; apart from a random key used for guest likes, none of it is sent to our server. When you log in, your favourites and play history sync with your account. The full list is in the Cookie Policy.

How we collect data

  • Automatically: from what your browser sends when a page opens, from server logs, cookies and scripts on the site.
  • From forms you fill in: registration, login, profile, comment, rating and report forms.
  • By email: messages and requests you send us.

Who receives data

We rely on a few service providers to run the site. They receive data only for that job and only as much as it needs.

  • Hetzner Online GmbH (Germany): hosts our server. The site, database, logs, email and the game files on play.2oyun.com all live on our server in Hetzner's data centre in Finland.
  • Cloudflare, Inc. (USA): sits in front of the site as content delivery network, DNS and security layer. Every request you make passes through Cloudflare's global network with your IP address and request details. Cloudflare uses them to filter attacks, tell people from bots and serve pages quickly.
  • Google Ireland Limited and Google LLC: Google Analytics and Google Tag Manager (only with consent), Google AdSense and Google Ad Manager. We also use Google Search Console, which gives us aggregate search reports; we don't send it any visitor data.
  • Game distribution networks: if a copyright notice concerns a game from a network, we forward it to that network so it can act on it.
  • Authorities: courts, prosecutors and other public bodies with legal authority, when they make a proper request.

The games themselves: most of the catalogue opens in a frame from GameMonetize's servers (gamemonetize.com, gamemonetize.co); other networks such as GameDistribution may be added later. We don't send these networks any visitor data. When you start a game, your browser connects directly to the network's server; the network receives your IP address, may show its own ads in the game and may set its own cookies. That processing is the network's responsibility: GameMonetize privacy policy. From the games we host ourselves on play.2oyun.com, we remove tracking code and external requests.

International transfers

Some of our providers are outside Turkey, so some of your data is transferred abroad:

  • Finland and Germany (Hetzner): our server and all data on it.
  • USA and other countries in Cloudflare's network (Cloudflare): IP address and connection details of your requests.
  • Ireland and USA (Google): data in ad requests; if you consent, data collected through statistics and advertising cookies.

Transfers needed to run the site (Hetzner, Cloudflare and ad requests to Google) are made within the appropriate safeguards provided for in Article 9 of the KVKK.

When you allow statistics and advertising cookies, the transfer to Google relies on your explicit consent under KVKK Art. 9(6)(a). Before you consent, you should know that data protection rules in the USA differ from those in Turkey and that US authorities can, under certain conditions, access data held by these companies. You can withdraw consent any time in Cookie settings; this does not affect processing that happened before.

Under the GDPR: our server is already inside the EU. Google LLC and Cloudflare, Inc. participate in the EU-US Data Privacy Framework.

How we protect data

  • 2oyun.com and play.2oyun.com only work over HTTPS.
  • Passwords are stored as bcrypt hashes; we can't see yours either.
  • Comments, ratings, reports and visit counts never write your plain IP address to the database.
  • Games we host run on a separate domain (play.2oyun.com), so their code cannot reach the session cookies of 2oyun.com.
  • Only authorised accounts can enter the admin panel. Database backups are kept in a directory only the administrator can access; daily backups are kept for 14 days, weekly backups for 8 weeks.

Your rights

Under Article 11 of the KVKK you can ask us:

  • whether your personal data is processed,
  • for information about it if it is,
  • why it is processed and whether it is used for that purpose,
  • which third parties in Turkey or abroad receive it,
  • to correct it if it is incomplete or wrong,
  • to delete or destroy it when the conditions in Article 7 of the KVKK are met,
  • to tell third parties who received it about any correction, deletion or destruction,
  • to object to a result against you that comes solely from automated analysis of your data,
  • to compensate you for damage caused by unlawful processing.

If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, data portability and objection. Where processing relies on consent you can withdraw it at any time, and you can complain to the data protection authority in the country where you live.

Some things you can do yourself without a request: change cookie consent in Cookie settings, correct your profile on the My account page, or close your account under Delete account.

How to make a request

Under the Turkish Communiqué on the Procedures and Principles of Applications to the Data Controller, you can apply in one of these ways:

  • In writing: a letter with your handwritten signature, delivered to our address above in person, by post or through a notary.
  • With an electronic signature: signed with a secure electronic signature or mobile signature, or sent from your registered electronic mail (KEP) address, to hi@2oyun.com.
  • From an email address we already have: the address registered to your 2oyun account, or one you have previously corresponded with us from, sent to hi@2oyun.com with "Privacy request" in the subject line.

Your request should include:

  • your first and last name and, for written requests, your signature,
  • your Turkish ID number if you are a Turkish citizen; otherwise your nationality and passport number, or ID number if you have one,
  • your residential or business address for official correspondence,
  • your email address, phone or fax number, if any,
  • what you are asking for, with any supporting information or documents.

If the request concerns an account, include the username. We may ask for more information to make sure the request really comes from you.

We answer free of charge within 30 days at the latest, depending on the nature of the request. If answering involves an extra cost, we may charge the fee set in the tariff of the Turkish Personal Data Protection Board.

If your request is refused, you find our answer insufficient, or we don't answer within 30 days, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning our answer and in any case within 60 days of your request (KVKK Art. 14). The Board's website: kvkk.gov.tr.

Children

2oyun is a games site for a general audience; it is not specifically directed at children under 13. You must be at least 13 to create an account, comment or set up a profile. If you are between 13 and 18, you need a parent's or guardian's permission to do so.

We don't knowingly collect personal data from children under 13. If you learn that such a child has created an account or sent us personal information, write to hi@2oyun.com and we will delete the account and related data. We recommend that young children use the site under an adult's supervision.

About this notice

We update this notice when something on the site changes, for example when we start working with a new provider. The current version is always on this page and the date at the top shows the last change. After a significant change we may ask for your cookie consent again.

Last updated: 5 November 2026.