LSMPrivacy Policy
This policy explains which personal data is processed when you use the LSM – Live Soccer Manager (“LSM”, “we”) mobile game, why it is processed, how long it is kept and what your rights are. It is based on the Turkish Personal Data Protection Law No. 6698 (KVKK), the EU General Data Protection Regulation (GDPR) and the US Children’s Online Privacy Protection Act (COPPA).
1. Controller and contact
The data controller is the developer of LSM. For any privacy question or request: info@lsm.semadan.net.
2. Data we collect
Nickname and avatar colour; country, language and game region preference; the age band you declare (we do not store your date of birth).
Device identifier and session data: on first launch the server generates a random device secret; it is kept in your device’s secure storage (iOS Keychain / Android Keystore) and the server stores only a one-way hash of it.
If you link Apple or Google: the user identifier provided by that service. We do not store your email address; at most a salted one-way hash may be kept.
Game data: club, squad, tactics, matches, progress, tasks, LSM Gold and wallet transactions.
Chat messages, message reports, friendships and blocks.
Purchase records: store receipt, product, amount, currency and date. Your card or payment details never reach us; payments are handled by Apple/Google.
Advertising identifier: only if you allow it, to verify rewarded ads.
Push notification token: only if you allow notifications.
Technical logs: your IP address is used briefly for security and rate limiting and is stored in our database only as a salted hash.
3. Purposes and legal bases
Providing the game and protecting your account and progress: performance of a contract (KVKK Art. 5/2-c, GDPR Art. 6(1)(b)).
Security, preventing cheating, fake accounts and abuse, chat moderation: legitimate interests (KVKK Art. 5/2-f, GDPR Art. 6(1)(f)).
Accounting for purchases and refunds: legal obligation (KVKK Art. 5/2-ç, GDPR Art. 6(1)(c)).
Advertising identifier and push notifications: consent (KVKK Art. 5/1, GDPR Art. 6(1)(a)). You can withdraw consent at any time in your device settings.
4. Retention
Account and game data: until you delete your account.
Chat messages: 60 days. Notifications: 30–90 days. IP hashes: 30 days. Rate-limit counters: 2 days. Revoked session records: 90 days. Server logs: up to 30 days.
Purchase and LSM Gold transaction records: for the statutory period required for tax and refunds (up to 10 years), pseudonymised, without your name or contact details.
5. Sharing and international transfers
Your data is processed on the infrastructure of Cloudflare (processor), which hosts the game; servers may be located outside your country, including the EU and the US. Transfers rely on the safeguards of KVKK Art. 9 and GDPR Chapter V (standard contractual clauses).
Apple and Google: for sign-in, purchases and notifications. Ad networks: only with your consent and only for rewarded ads.
We do not sell your personal data. It may be shared with authorities where required by law.
6. Your rights
Under KVKK Art. 11 and GDPR Arts. 15–22 you have the right to access, rectify, erase and port your data, to object to processing, to withdraw consent and to lodge a complaint with a supervisory authority (the Turkish Personal Data Protection Authority or your local EU authority).
In the app: Settings → Account → “Download my data” (machine-readable JSON) and “Delete my account”. For other requests write to info@lsm.semadan.net; we reply within 30 days.
7. Account deletion
When you delete your account: your club returns to a bot, your profile is anonymised; your chat messages, friendships, notifications, progress and LSM Gold are deleted; linked Apple/Google accounts are unlinked and all device sessions are revoked.
Purchase records are kept pseudonymised only for the statutory retention period. Deletion cannot be undone.
8. Children’s privacy
We ask for your age band on first launch. For players under 13 (16 in some countries) the game runs in a restricted mode: chat and purchases are disabled, no personalised ads are shown, and only the data needed to run the game (nickname, country, game data, device session) is processed.
We do not knowingly collect any further personal data from children under 13. Parents or guardians can request access to or deletion of their child’s data by writing to info@lsm.semadan.net or by using “Delete my account” in the app.
For players under 18, purchases are disabled without parental consent and a monthly spending limit applies.
9. Security
Connections are encrypted with TLS; device secrets are stored only as hashes; session tokens are valid for 15 minutes; account deletion and data export require an authenticated session.
10. Changes
We may update this policy. We will announce significant changes in the app. The effective date is shown at the top of this page.