Privacy policy

Last updated: 9 November 2026

This page explains what data is processed when you use konfeti.site and its games ("Konfeti"), why, and what your rights are. Konfeti is the data controller. Contact: destek@konfeti.site.

What we keep

• Account: your email address, player name, chosen icon and language. Your password is never stored in readable form, only a one-way hash.
• Sign in with Google: if you choose it, we receive only your email address, name and Google account ID. We never access your contacts, files or any other Google data.
• Security: with two-step verification on, the authenticator key is stored encrypted and backup codes only as hashes. For signed-in devices we keep the device type and browser name (for example "iPhone · Safari") and when the session started and was last used.
• Game data: your saves, playtime, furthest level and when you last played. If you choose to bring progress from the games' old firatkocabay.workers.dev addresses, those saves are added to your account.
• Security and operations log: sign-ins, sign-outs, sign-ups and failed sign-in attempts, password and security setting changes, which game you opened when and how long you stayed, and technical errors in the games. Each entry has the time, IP address, the approximate location Cloudflare derives from the IP (country, region, city) and device/browser details. Only the site administrator can see this log. Your password, verification and recovery codes and session keys are never written to it.
• Popularity counter: for the "most played" order on the home page your IP address is not stored in this counter. A short hash mixed with a secret that changes every day is kept and deleted after 30 days.
• Payments: during the launch offer every game is free. When sales open, payment happens on iyzico's secure page; the name, phone and address you give for the invoice go to iyzico. Card details never reach Konfeti.

Cookies and browser storage

• __Host-kf: the session cookie. With "Remember me" it lasts 30 days, otherwise until the browser closes.
• __Host-kfg, __Host-kfm, __Host-kfl: security cookies used for at most 10 minutes during Google sign-in and two-step verification.
• kf_game: remembers which game is open for 1 day, so game files reach the right game.
• Browser storage (localStorage): game saves, language choice and whether old progress was already brought over on this device.

We use no advertising or third-party tracking cookies. Page views and visits are counted with cookieless Cloudflare Web Analytics. That count does not identify you and is not used for advertising. Fonts are served from our own site. The measurement script is loaded from static.cloudflareinsights.com.

Why we process it

To create your account, run the games and carry your progress across devices (performance of a contract), to protect your account from abuse, detect attacks and keep the service running, including the security and operations log (legitimate interest), and to meet legal obligations. We do not sell your data or use it for advertising.

Who we share it with

• Cloudflare: the site and games run on Cloudflare, where the data is stored. Cloudflare's servers are worldwide, so your data may be processed outside your country.
• Google: only if you sign in with Google, to confirm who you are.
• iyzico: only once sales open and you make a payment.
• Authorities, where the law requires it.

How long we keep it

Account data is kept until you delete your account. Deleting it removes the account, saves, playtime and sessions right away. Completed payment records are kept for the legal retention period, unlinked from your account. Popularity counter hashes are deleted after 30 days, the security and operations log after 90 days, automatically.

Your rights

You can ask what data we hold, get a copy, correct it, delete it or object to its use. Most of this you can do yourself: on My account use "Download my data", edit your profile or delete your account. For anything else write to destek@konfeti.site; we answer within 30 days.

Children

Konfeti offers games for all ages. Children under 13 should create an account together with a parent or guardian.

Changes

If this policy changes, the new version is published on this page with a new date.