Evolia

Privacy notice

Version: 2026-11-07 · Terms of use

In short

Evolia has no ads. Your data is not sold and not used for advertising. Evolia keeps only what the game needs to run: your profile, cards, decks, matches, messages and friends. Your email address, password and membership are not Evolia’s to keep; they belong to your shared account on HLauncher.

Who is responsible for your data

The data controller is Hakan Topçu, who develops and runs Evolia. Evolia is offered by Hakan Topçu in person, not by a company. When a company is founded, the controller details in this section will be updated.

Contact: the contact section of hakantopcu.dev.

Your account lives on HLauncher

You sign in to Evolia with the one account you share with Cogito and HLauncher. The register form inside the game opens that account too. Your username, email address, password, sessions, device number, membership and payments are kept in that shared account. How they are handled, who they are shared with and when they are deleted is set out in the HLauncher privacy notice; this notice does not repeat it.

When you sign in, the Evolia server receives only three things from HLauncher: your account’s permanent number (central ID), your username and when your membership ends. Your email address and password never reach the Evolia server.

Older accounts opened with Evolia’s own form before the shared account existed keep an email address and a one-way digest of the password on the Evolia server.

What the Evolia server keeps

Your profile

Your username and central ID.
The avatar, card back and frame you picked; with a membership, the VIP badge and when the membership ends.
Your level and experience points, in-game credit balance, Elo rating, and number of matches, wins and losses.
When your account was opened, when you last signed in and when you were last online.

Your collection and decks

The cards, packs, avatars and card backs you own, and whether a look came from in-game credits or from a membership.
The decks you build.
Rewards you received and the credits and experience you earned in solo matches that day.

Your matches

For each match: the players, the winner, the mode, whether it was ranked, and when it started and ended.

Your messages and friends

Your chats with other players: who is in them, the text of each message, its sender and when it was sent.
Your friends list, the friend requests you sent and received, and the players you blocked.

Player market

The offers you list: seller, card, quantity, price in credits and when it was listed.

Activity log

Your account being opened, your username changing, credit and item movements (with the balance before and after), market trades and rewards. The log exists to find cheating and bugs, and to give back credits or cards that went missing.
When you order an Evolia cosmetic or a membership, HLauncher sends the Evolia server your account number (your central ID), the product and the order number. They are kept as a permanent ownership record: so the item you bought stays on your account and the same order is never applied twice. Your payment details do not reach Evolia; the purchase runs on HLauncher under the HLauncher sales agreement.

What other players see

A signed-in player who opens your profile, in the game or by sending a request to the game server, and the ranking show only this: your username, avatar, card back, frame, VIP badge, level, Elo rating, and your match, win and loss counts.

Your collection, decks, credit balance, friends list, the players you blocked, when your membership ends, your email address and your central ID are not shown to other players. Only you, the game server and Evolia’s administrator see them.

Players who added you to their friends list, and players you sent a friend request to, see your avatar, frame, VIP badge and when you were last online in their friends list. The game server’s online counter, which needs no sign-in, only tells how many players are online, not who they are.

Your opponents see your username and the cards you play in the match. A match record holds both players’ usernames, Elo ratings and the reward each got from that match; a player who knows the match number can read it. The player you chat with privately sees your messages, and every signed-in player sees what you write in the global chat, with your username. Every signed-in player sees your market offers, with your username as the seller. If a message is reported for breaking the rules, Evolia’s administrator may review that chat. Your email address, central ID and IP address are never shown to any player.

Your IP address and server logs

The game server keeps your IP address in memory for a short time to rate-limit requests; it does not write it to the database.
The web server writes each request to an access log: IP address, time, the address requested and the line the app or browser identifies itself with. These logs are deleted after 14 days.
The game server’s run logs (errors, connections, match events) go to the server’s system journal. The journal is not deleted after a set time; when its allotted space fills up, the oldest entries go first.
IP addresses that send requests resembling an attack on the server may be reported to CrowdSec’s shared blocklist for security.

What stays on your computer

The game keeps, in its own settings folder, your settings, your session’s sign-in keys, a copy of the game content and the log files of recent runs. When the game crashes or meets an error, these logs are not sent anywhere; they reach us only if you share them while reporting a problem. Signing out deletes the session keys; uninstalling the game and deleting its folder removes the rest.

Problem reports

When you report a problem from inside the game (“Report a problem” in the menu or the match menu, or F8), your text is sent together with, unless you leave them out, a screenshot of that moment, the last 400 lines of the game log, the match record when you are in a match, and system details (game version, operating system, graphics card, resolution, interface scale, language). The match record holds your own deck, the moves both sides played openly and the board at that moment; the cards in your rival’s hand and deck are never written. You can remove each attachment before sending. User folder names, sign-in tokens and password lines are taken out of the log before it is sent, and the centre removes personal details such as e-mail, phone, network address and IBAN from the text and the attachments before storing them. Reports are kept in the HLauncher centre for 30 days; only Evolia’s developer sees them, to fix the problem.

This website

evolia.hakantopcu.dev uses Cloudflare Web Analytics to count visits. It sets no cookies and does not follow you across sites; Cloudflare counts aggregate details such as the page address, the page you came from, the browser type and the country. The site keeps the language you picked in your browser’s local storage. The site has no forms, accounts or ads.

HLauncher (the Cogito central service): verifies your sign-in and tells Evolia about membership rights. It is run by the same person.
Server hosting: the Evolia server runs in Turkey, in the data centre of HZD Teknoloji ve İnovasyon San. ve Tic. Ltd. Şti. The company provides the server hardware and does not handle your data.
Cloudflare (USA): only the visit counting for this website, with the aggregate details above.
CrowdSec (France): only the IP addresses of requests that resemble an attack.

If Evolia is later released on Steam, the data shared with Steam will be added to this notice at that time. Apart from these, your data is shared with no one; if the law requires it, only the competent authorities receive only what they ask for.

How long it is kept

Your profile, collection, decks, matches, messages and friends: as long as your account stays in Evolia.
Market offers: until they sell or you take them down.
Order records (account number, product and order number): 3 years (1095 days). The item you own stays in your collection as long as your account stays in Evolia.
Activity log: no set deletion period. When you have your Evolia data deleted, the details that identify you are removed from these lines.
Web server access logs: 14 days.
The server’s system journal: until its allotted space fills up.
Database backups taken before maintenance stay on the same server. Evolia data is not backed up off the server.
Your shared account and the data tied to it: the periods in the HLauncher privacy notice.

Having your Evolia data deleted

There is no button in the game yet that deletes your Evolia data. Send your request through the contact section, writing from the email address tied to your account. The request is carried out within 30 days: your profile, collection, decks, market offers, friends list, block list and the messages you sent are deleted; in match records and the activity log your username is replaced with a label that does not identify you. Copies in maintenance backups go when those backups are deleted.

Deleting your shared account on HLauncher does not delete your Evolia data by itself, and having your Evolia data deleted does not close your shared account. If you want both gone, delete your shared account the way the HLauncher privacy notice describes, and write separately for your Evolia data.

KVKK information notice

Under article 10 of Turkey’s Personal Data Protection Law No. 6698 (KVKK):

Data controller

Hakan Topçu. Contact: the contact section of hakantopcu.dev.

Data processed and purposes

Identity and account data (username, central ID): to recognise your account and verify your sign-in.
Game data (collection, decks, matches, ranking, credits, market offers): to run the game, matchmaking and ranking.
Communication content (messages, friends and block lists): to let players write to each other and to review complaints.
Transaction security data (activity log, IP address, server logs): to prevent cheating and abuse, find bugs and protect the server from attacks.

How it is collected and legal grounds

Data is collected electronically and automatically from the game client, the game server, HLauncher and this website. The legal grounds are in article 5(2) of the Law: it is necessary to form and perform a contract to provide the game (point c), legal obligations (point ç), establishing, exercising or protecting a right (point e), and the legitimate interest in keeping the game secure, provided it does not harm your fundamental rights and freedoms (point f). No processing relies on explicit consent.

Transfers

Within Turkey, data is transferred to HLauncher and to the server host, only for the purposes above. Abroad, Cloudflare (USA) receives only the visit counting for this website and CrowdSec (France) only the IP addresses of requests that resemble an attack. Data may be transferred to competent public authorities where the law requires it.

Your rights

Under article 11 of the Law you may ask to learn whether your data is processed and, if so, request information about it; learn the purpose of processing and whether it is used for that purpose; know the parties in Turkey or abroad it is transferred to; have incomplete or wrong data corrected, have it erased or destroyed under the conditions of article 7, and have those parties told; object to a result against you that comes only from analysis by automated systems; and claim compensation if unlawful processing caused you damage.

How to apply

Send your application in writing, or from the email address tied to your account, to the address in the contact section. Include your name, username and request. Applications are answered free of charge within 30 days. If you find the answer insufficient or get none in time, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

If you play from the European Union or the European Economic Area, the General Data Protection Regulation (GDPR) applies as well.

Controller: Hakan Topçu, Turkey. Evolia has no representative in the EU.
Legal basis: contract, to provide the game (Article 6(1)(b)); legitimate interests, to prevent cheating, abuse and attacks and to find bugs (Article 6(1)(f)); legal obligations (Article 6(1)(c)).
Your rights: access your data, have it corrected or erased or its processing restricted, receive it in a portable format, object to processing based on legitimate interests, and complain to the data protection authority of the country you live in. Requests go through the route in the deletion section and are answered within one month.
Retention: the periods in How long it is kept.
Transfers: the Evolia server is in Turkey. There is no European Commission adequacy decision for Turkey; your data is processed in Turkey because that is necessary to provide the game you asked for (Article 49(1)(b)).

Age

You need a central account to play Evolia. The minimum age for a central account is 18 (HLauncher terms of use). People under 18 cannot open a central account and cannot play Evolia. Evolia data found to belong to someone under 18 is deleted.

If this notice changes

When the notice changes, the version date at the top changes. An update that changes how your data is handled is announced in the game or on this website. The current text is always at this address.