Privacy Policy and KVKK Notice

Version 2026-11-03 · Under Turkish Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR)

• We never see your password; you sign in on Steam's own page.
• We don't collect credit card or payment details.
• From Steam we only receive your public profile and game information.
• Photos you upload to your profile are checked automatically for safety before they are published, by an AI model running on our own server and, when needed, additionally by Google's Gemini; only the photo is processed and your identity is not sent. Data goes to Google only when Gemini is used (section 7). Photo sharing in community posts is currently turned off.
• We don't sell your data, use it for ads, or use tracking or analytics cookies.
• You can delete your account whenever you want.

1Data controller

Your personal data is processed by the owner of the convengg.com domain and the CONVEN platform, acting as data controller. Requests and questions: team.convengg@gmail.com

2What data we process

a) Public data from Steam (via the Steam Web API):

• SteamID64, Steam username, profile picture and profile link, the date your Steam account was created,
• your game library and playtimes (only if "Game details" is public on Steam) and the game you are currently playing.

Your Steam password, email address, phone number, payment details, Steam wallet and friends list are not shared by Steam, and we don't receive them.

b) Information you enter: nickname, "about me" text, up to 6 profile photos, favorite games, play style tags, your username on other communication platforms, Steam trade link and 24-hour status note.

c) Activity on the platform: likes and matches, follows, posts and comments, private messages (encrypted), view-once photos (encrypted and temporary), reports and blocks, messages you share in a report, notifications, your public key for message encryption and your optional key backup.

d) Technical and legal records:

• terms acceptance: the version you accepted, date and time, IP address and browser information (as legal evidence),
• session and language cookies, and theme and sound preferences stored in your browser,
• short-lived server logs for security (such as blocking excessive requests and attack attempts),
• content moderation records: the time and type of an attempted post, comment, profile text, nickname, status note or photo that was blocked for breaking the community rules, and a short excerpt of the blocked text (no excerpt is kept for attempts containing a phone number or IBAN).

3Why we process it

• To create your account and let you sign in with Steam,
• to suggest matches based on your game library and calculate compatibility scores,
• to provide messaging, the community feed and profile features,
• to investigate rule violations, reports and fraud, and keep the platform secure,
• to automatically block inappropriate content (profanity, hate speech, sexual content, threats, scam links) before it is published,
• to check uploaded photos with AI before publication for nudity and sexual content, real violence and gore, and self-harm imagery,
• to document terms acceptance and legal requests, and to meet legal obligations.

4Legal bases

• Necessary to enter into and perform a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)): account, matching, messaging and profile.
• Legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)): security, abuse prevention and moderation (including the automated checking of uploaded photos).
• Establishing, exercising or defending a right (KVKK Art. 5/2-e): terms acceptance records.
• Legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)): requests from competent authorities.

Please don't put sensitive personal data such as health, religion or political views in your profile or "about me" section. If you share such information, you are making it public by your own choice.

5Who we share it with

Your data is never sold or shared for advertising.

6International transfers

Because the platform's server is located in Germany and some service providers are abroad, your personal data is transferred outside Türkiye. These transfers are made in accordance with Article 9 of the KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad:

• Hosting (Vultr, Germany) and traffic routing (Cloudflare, USA and other countries) are continuous transfers. The signing of the standard contracts announced by the Board under Article 9 of KVKK for these transfers, and their notification to the Personal Data Protection Authority, have not yet been completed; this text will be updated when they are.
• The transfer to the USA so that you can sign in with Steam is an occasional transfer that is necessary to perform our contract with you.
• Transfers to the services your browser loads fonts and images from are technically necessary for you to view the page.
• The transfer to Google (US and other countries) for photo checking takes place only when you choose to upload a photo and the additional Gemini check is in use. Under the paid Gemini API terms Google processes this content as a data processor on CONVEN's instructions; Google LLC is certified under the EU-US Data Privacy Framework (DPF). Details are in section 7.
• For users in the EU, data is hosted within the EU (Germany); transfers outside the EU are made with the safeguards required by the GDPR.

7Automated safety check of photos

The photos you upload to your profile may be checked automatically by AI before they are published. The model on our server tells apart only nudity and sexual content; when Gemini is used it also tells apart real violence and gore, and self-harm imagery, before publication. No face recognition is performed and no identity or biometric data is extracted; your photos are not used to build profiles, for advertising or for any other purpose. Photo sharing in community posts is turned off; photos in earlier posts are no longer shown and are deleted from disk when you delete the post or your account.

How it works: photos are first checked by an AI model that runs on our own server and sends nothing out. When needed we may also use Google's Gemini API as an additional check for the same purpose; data goes to Google only while this additional check is on, and within the limits described below.

• What is sent (when Google Gemini is used): only the photo itself, rewritten on our server with its metadata (location, device, date taken) removed, together with a fixed checking instruction, sent to Google's Gemini API. Your name, username, SteamID and other profile details are not sent.
• What is not sent: end-to-end encrypted photos in private messages (including view-once photos) are not checked and are not sent to Google. A photo that is already on our server is not sent again. Your profile photo from Steam is not sent either.
• The decision: the model on our server and, when it is used, Google's safety filter and Gemini assess the photo. A photo found inappropriate is not published and you are told the reason. This decision is made only by automated systems; if you think it was wrong, write to team.convengg@gmail.com and a person will review it again. If the check cannot be carried out, your photo upload is temporarily rejected.
• Not mandatory: uploading photos is not mandatory. If you upload no photos, no image is sent to Google and you can use all other features of CONVEN.
• Google's role: under the paid Gemini API terms, Google processes this content on CONVEN's instructions and only for the check, as a data processor, and does not use it to improve its products; it only logs prompts and responses for a limited time to detect violations of its terms.
• Our record: if a photo is rejected, only its category and the first 12 characters of its content digest are kept for 30 days; the photo itself is not kept.

Why do we use Gemini? We check photos on our own server first, so that photos are sent to a third party as little as possible, and use Gemini only when an additional check is needed. Many photos can be uploaded to profiles; it would be impossible for a small team to look at each one, and it would also be more intrusive for you. Automated checking blocks inappropriate images before they are published without a person having to review every photo. Nudity and sexual content, real violence and gore, and self-harm imagery seriously harm users and the platform in a gaming community; blocking such content before publication is a legitimate and necessary measure for the safety of the community, public morals and public order. Obscenity and the sexual abuse of children are crimes under the Turkish Penal Code; as a hosting provider under Law No. 5651 we remove unlawful content once we are made aware of it, and this check helps keep it from being published at all. We chose Gemini because it can judge different kinds of images, such as game screenshots, drawings and real photos, in context; because we can instruct it to keep in-game violence apart from real violence (so legitimate game images are not blocked needlessly); and because it can assess many photos within seconds at a cost a small platform can afford. Google's built-in child-safety protections, which cannot be switched off, add a further safeguard.

8How long we keep it

9Plain facts about private messages

Message content is end-to-end encrypted for new messages and one-time photos: encryption happens on your device, and only you and the person you chat with can open the content. Only the encrypted form is stored on the server and CONVEN cannot read it. The server still sees who wrote to whom, when and how large a message is, as well as reactions and read status. Your encryption key stays on your device; if you create a recovery code, a backup of your key encrypted with that code is stored on the server, and nobody without the code can open it. If you lose the recovery code and the key on your device, the encrypted history cannot be recovered by anyone, including CONVEN. Older messages sent before encryption are not encrypted and are stored on the server in readable form. Messages are not read for advertising, profiling or AI training. When you report a user you can share the latest messages you choose from the chat with moderators; moderators only see the part of an encrypted chat that you knowingly share. For reported older (unencrypted) chats, the conversation between the reporter and the reported person may be reviewed by an administrator. Every review is logged with its date and administrator.

10Security

Connections are encrypted with HTTPS, no passwords or payment details are stored, only authorized admins can access the database and backups, and server security updates are applied regularly. No system is completely secure; in the event of a data breach, the Board and affected users will be notified within the legal deadlines.

11Cookies

Only cookies that are strictly necessary for the service are used. No advertising, tracking or analytics cookies.

12Age limit

CONVEN is not for anyone under 18. Accounts and data found to belong to someone under 18 are deleted.

13Your rights

Under Article 11 of the KVKK, you have the right to learn whether your data is processed, to request information, to learn the purpose of processing and who it is transferred to, to request correction or deletion, to object to an adverse result produced by automated analysis, and to claim compensation for damages. Users in the EU also have the rights to data portability, restriction of processing and objection under the GDPR.

• You can delete your account and data yourself with the "Delete My Account" option in Settings.
• For other requests, write to our contact address. Requests are answered free of charge within 30 days at the latest.
• If you are not satisfied with the answer, you can complain to the Turkish Personal Data Protection Authority or, if you are in the EU, to your country's data protection authority.

14Changes

This policy may be updated. After significant changes you will be asked to accept the new version at your next sign-in.

15Contact

Contact the data controller: team.convengg@gmail.com