Privacy notice

Version: 2026-11-07

In short

This notice covers the central account, the purchases, the Steam link and the HLauncher app. Your data is kept only so the account, the membership and the downloads can work; there are no advertisements, and what you do is not tracked and sold to anyone. What happens inside a game is in that game's own notice; Cogito's is at https://cogito.hakantopcu.dev/legal/privacy.en.html.

This text is the information notice required by Türkiye's Law No. 6698 on the Protection of Personal Data, Article 10. There is a separate section below for people who live in the European Union.

Who answers for your data

The seller's details will appear here once the sole proprietorship is founded. Sales start on that date. The data controller is Hakan Topçu. To get in touch: https://hakantopcu.dev/#contact.

What is kept about your account

• Your username. You sign in with it, and the games show you by it.
• Your email address. It is stored encrypted; beside it there is only a keyed digest so it can be looked up. Whether you confirmed the address is kept too.
• Not your password itself, but a digest of it that cannot be turned back.
• The moment you created the account.
• Your open sessions. A session opened on the site lasts 30 days, a session in HLauncher 60 days; both are kept only as a digest.
• The confirmation and password reset links mailed to you, only as digests. A confirmation link lasts 3 days, a password reset link 2 hours.

What is kept about your purchases

• For each payment: the membership or the product, the amount, the currency, the status, the time and the payment numbers iyzico gave; and its refund, if it was refunded.
• Your membership: until when it runs, whether it is for good, whether the renewal is on.
• Your billing details: your first name, your last name, your address, your city, your country and, if you gave it, your Turkish identity number. They are stored encrypted so the monthly renewal does not ask for them again.
• If you chose to keep your card at iyzico: the key iyzico gave that card, the card's last four digits and its brand. Your card number never reaches the central service; you write it into iyzico's payment form.
• Your orders, if you bought an Evolia cosmetic.

Your Steam link

If you link your Steam account, your Steam account number, the moment of the link, the Cogito right that came from Steam and the moment that right was last checked are kept. Only a digest of the Steam ticket used for the link is stored, so the same ticket cannot be used twice. Steam is asked about your right again every 2 days.

Fault and crash reports

A bug report, a suggestion or a crash report you send from a game or from HLauncher is kept tied to your account: the text written, the version of the program that sent it and at most 3 attachments, screenshots or text. Before it is stored, email addresses, phone numbers, network addresses, IBANs and the name of the user folder on your computer are taken out of it; names and places written inside a screenshot are removed. Reports are deleted after 30 days.

If HLauncher hits a fault while you are signed in, it sends a short crash report by itself: the cleaned fault text and HLauncher's version. Before the text leaves your computer, your Windows user name, the path of your user folder, email addresses, your username, your display name and session keys are taken out of it. This setting comes on; you can turn it off in the Settings.

Your network address

The network address (IP) you connect from is held in the central server's memory for a short time to limit sign-in, registration and password reset attempts, and is not written to disk. When you buy, your network address goes to iyzico; it is not stored with your billing details. The sites' web server writes the network address and the time of incoming requests to its access log; these records are deleted by the server's regular log cleanup.

Why it is processed, and on what legal ground

• Your account, membership, purchases, downloads and Steam link are processed to make and carry out the contract with you, KVKK 5/2-c.
• Payment records and billing details are also kept for the duties of tax and consumer law, KVKK 5/2-ç.
• Attempt limits, noticing abuse and fault reports keep the service safe and working; this is a legitimate interest, KVKK 5/2-f.

The data is collected electronically, from what you write when you create an account, buy, link your Steam account or send a report, and from what HLauncher sends.

Who it is shared with

• iyzico, the payment institution in Türkiye: when you buy, your first name, your last name, your email address, your billing address, your Turkish identity number if you gave it, and your network address. You write your card details straight into iyzico's form; if you choose to keep your card for the monthly renewal, iyzico keeps it.
• Resend, the email delivery service in the USA: your email address and your username, when a message is sent to you. Confirmation and password reset links and the notices about your account come this way.
• Valve, Steam, USA: only if you linked your Steam account, your Steam account number and the ticket Steam gave, to ask whether you own Cogito.
• The games: at sign-in, Cogito and Evolia receive in a short-lived signed document your account number, your username, whether your email is confirmed and until when your membership runs. Your email address does not go to the games.
• Evolia's server: when you buy an Evolia cosmetic or it is refunded, your account number, the product and the order number, so the cosmetic is given to your account.

Resend and Steam are abroad; they receive only the data these tasks need. Beyond these your data is shared with no one.

What is kept on your computer

In the %LOCALAPPDATA%\HLauncher folder, HLauncher keeps your settings, the records of the games you installed, a copy of the game list and the keys it uses to check signatures. Your session is kept in Windows Credential Manager, for this computer and this Windows user only.

The uninstall entries of HLauncher and of each installed game, and the entry that opens hlauncher:// links, are written to your user registry; shortcuts are put in the Start menu and on the desktop. HLauncher writes its own log file only if you turn it on in the Settings.

When you remove HLauncher, these and your session are deleted. When you remove a game, you are asked separately whether to delete the game's own data too.

How long it is kept

• Your account, your purchase records, your billing details and your Steam link: until your account is deleted.
• A session on the site: 30 days.
• A session in HLauncher: 60 days.
• A confirmation link: 3 days. A password reset link: 2 hours.
• Fault and crash reports: 30 days.
• Daily backups on the central server: 14 days.

If you delete your account

Send the request on https://hakantopcu.dev/#contact and write your account's email address. When your account is deleted, your sessions, your email address, your billing details, the iyzico key of a kept card, your payment records, your Steam link, your reports, your game rights and the copies of your Cogito worlds at the central service are deleted. Deleted data drops out of the central backups within 14 days. What iyzico and Steam keep themselves follows their own rules.

Your rights

Law No. 6698, Article 11, gives you the right to learn whether your data is processed, to ask about it if it is, to learn why it is processed and whether it is used for that, to know who it was shared with, to ask for it to be corrected if it is incomplete or wrong, to ask for it to be deleted when the conditions are met, and to ask that those it was shared with are told. You can object to a result against you that comes only from automated processing, and ask for damages if unlawful processing harmed you.

Write your request on https://hakantopcu.dev/#contact; it is answered within 30 days at the latest. If the answer does not satisfy you, you can complain to the Personal Data Protection Board. You can change your password on the account page and close your open sessions there.

If you live in the European Union

If you live in the European Union or the European Economic Area, your data is also covered by the General Data Protection Regulation, the GDPR. The legal ground for the account, membership, purchases, downloads and the Steam link is the contract, 6/1-b. For payment records it is a legal duty, 6/1-c. For attempt limits, noticing abuse and reports it is a legitimate interest, 6/1-f.

You have the right to access, correct and delete your data, to restrict its processing, to object, and to receive the data you gave under the contract in a portable form. You can complain to the data protection authority of the country you live in. Your data leaves the European Union, to iyzico in Türkiye and to Resend and Steam in the USA; this transfer is made only to carry out the contract with you.

Age

The central account is for people over 18. An account found to belong to someone younger is deleted.

If this text changes

If the notice changes, the version date above changes. The current text is always at https://hlauncher.hakantopcu.dev/legal/privacy.en.html.