Cookie Policy

In plain language (this box is a summary only and is not legally binding). We use a few essential cookies to keep you signed in, remember your language and remember your guest progress. Analytics is first-party only. Advertising cookies from our ad partners are used only if you agree where the law requires it; if you say no, you still get the games, with non-personalised ads. Games run on a separate domain and may save your progress in your browser's storage there. You can change your choices at any time using the "Privacy choices" link at the bottom of every page.

1. About this policy

1.1 This Cookie Policy explains how [BENERITS LEGAL ENTITY NAME] ("Benerits", "we", "us") and third parties use cookies and similar technologies on the Benerits game portal at [PORTAL DOMAIN], on the separate domain from which Games are served at [GAMES DOMAIN], and in any native application wrapper we make available (together, the "Service").

1.2 This Cookie Policy should be read together with our Privacy Policy, which explains how we process personal data collected through cookies and similar technologies, the legal bases we rely on and your rights. Capitalised terms not defined here have the meaning given in the Privacy Policy or the Player Terms of Service.

1.3 This Cookie Policy is designed to comply with Article 5(3) of Directive 2002/58/EC (the ePrivacy Directive) as implemented in EU Member States, the UK Privacy and Electronic Communications Regulations 2003, the KVKK and the Personal Data Protection Authority's Guidelines on Cookie Practices, and the CCPA.

2. Definitions

2.1 In this Cookie Policy:

• "Cookie" means a small text file placed on your device by a website you visit, which the website (first-party cookie) or another domain (third-party cookie) can read on later requests.
• "Similar technologies" means other technologies that store or access information on your device, including browser local storage (localStorage), session storage, IndexedDB, the Cache API, pixels, web beacons, software development kits (SDKs) in native applications, and mobile advertising identifiers.
• "Session cookie" means a cookie deleted when you close your browser; "persistent cookie" means a cookie that remains until it expires or you delete it.
• "Game Domain" means [GAMES DOMAIN], the separate domain from which Games are served inside a sandboxed frame.
• "Privacy choices" means the link in the footer of every page of the Service that opens our consent management platform ("CMP").

3. How we use cookies and similar technologies

3.1 We group cookies and similar technologies into the following categories.

3.2 Strictly necessary. These are essential to provide the Service you have requested, such as keeping you signed in, remembering your language, remembering your progress as a Guest, storing your consent choices and protecting the Service against fraud and abuse. They do not require your consent under Article 5(3) of the ePrivacy Directive, PECR or the Authority's Cookie Guidelines, and they cannot be switched off in our CMP. If you block them in your browser, parts of the Service will not work.

3.3 Functional. These remember choices you make to improve your experience (for example, sound and interface preferences, or recording the creator referral link through which you arrived). Where they are not strictly necessary for a service you have explicitly requested, we use them only with your consent where the law requires it.

3.4 Analytics. These help us understand how the Service is used so we can improve it. We use first-party analytics only: analytics data is collected by Benerits on our own infrastructure and is not shared with third-party analytics providers or used for advertising. Where the law requires it, analytics cookies and similar technologies are used only with your consent. Certain limited, first-party audience measurement that is strictly necessary for the operation of the Service may be exempt from consent in some jurisdictions; we rely on such exemptions only where, and to the extent, the applicable law and guidance permit.

3.5 Advertising. Our Advertising Partners (currently AppLovin and Google, and any other vendor listed in our CMP) use cookies, SDKs and similar technologies to deliver advertising, limit how often you see the same advertisement, measure advertising performance, detect invalid traffic and fraud and, where you consent, personalise advertising based on your interests. In the EEA, the UK, Switzerland and Türkiye, and wherever else the law requires it, advertising cookies and similar technologies are used only with your consent, which we collect through our CMP (implementing the IAB Europe Transparency & Consent Framework in the EEA and UK). If you do not consent, we request only non-personalised or limited advertising that does not use cookies or identifiers to store or access information on your device for advertising purposes. We never enable personalised advertising for Players we know or have reason to believe are under 16. Games themselves are not permitted to set advertising or tracking technologies.

3.6 Game Domain storage. Games run in a sandboxed frame on the Game Domain, which is separate from the portal domain. Games cannot read or write the portal's cookies, including your session cookie. A Game may use localStorage, IndexedDB, the Cache API or similar browser storage on the Game Domain to store data needed to run the Game, such as save games, levels reached, settings and cached game assets. This storage is strictly necessary to provide the Game you have chosen to play. Most modern browsers partition this storage so that it is only available when the Game Domain is embedded in the portal. Publishers are contractually prohibited from using Game Domain storage for advertising, tracking, profiling or analytics, and we check Games for compliance during review. Game Domain storage is separate from Cloud Saves, which are stored on our servers through the SDK (see the Privacy Policy).

4. Cookies and similar technologies we use

4.1 The table below lists the cookies and similar technologies used on the Service. Third-party names and durations are controlled by the third party and may change; the up-to-date list of advertising vendors, their purposes and their maximum storage durations is always available in our CMP.

Name	Category	Purpose	Duration	Party
lonca_session	Strictly necessary	Keeps you signed in to your Account; contains a random session token (the server stores only a hash of it). Set as HttpOnly and, in production, Secure	30 days, or until you sign out	First-party (Benerits)
lonca_anon	Strictly necessary	Anonymous ID: a random identifier that lets the Service remember a browser without an Account, so that it can keep Guest Cloud Saves, recently played Games, likes and favourites, transfer them to your Account when you sign in, count plays for the portal's rankings and revenue attribution, and detect abuse and invalid traffic. Not used for advertising or cross-site tracking. Set as HttpOnly	400 days from when it is first set	First-party (Benerits)
lonca_locale	Strictly necessary	Remembers the language you have chosen for the Service	1 year	First-party (Benerits)
[CMP COOKIE NAME(S), e.g. euconsent-v2]	Strictly necessary	Stores your consent choices and the TCF consent string so that we and our vendors can respect them	13 months at most (we ask again at least every 13 months)	First-party (Benerits / [CMP PROVIDER])
[REFERRAL COOKIE NAME]	Functional	Records the creator referral code in the link through which you arrived, so that the creator can be credited under our creator programme; creators receive only aggregated statistics	30 days	First-party (Benerits)
Local storage keys prefixed [LOCAL STORAGE PREFIX]	Functional	Remember interface preferences such as sound volume, dismissed notices and layout; stored only in your browser	Until you clear them	First-party (Benerits)
[FIRST-PARTY ANALYTICS COOKIE NAME, if used]	Analytics	First-party measurement of visits and feature usage, aggregated for service improvement	13 months at most	First-party (Benerits)
__gads, __gpi	Advertising	Google: ad delivery, frequency capping, measurement and, with consent, personalisation	Up to 13 months	Third-party (Google)
__eoi	Advertising (security)	Google: ad fraud prevention and security	Up to 6 months	Third-party (Google)
IDE, test_cookie (domain doubleclick.net)	Advertising	Google: ad delivery, measurement and, with consent, personalisation; test_cookie checks whether the browser accepts cookies	IDE: up to 13 months; test_cookie: 15 minutes	Third-party (Google)
AppLovin cookies and SDK identifiers	Advertising	AppLovin (including MAX mediation): ad delivery, mediation, measurement, fraud prevention and, with consent, personalisation	As disclosed by AppLovin in our CMP	Third-party (AppLovin)
Game Domain localStorage / IndexedDB / Cache API	Strictly necessary	Storage used by each Game on the Game Domain for saves, settings and cached assets (section 3.6)	Until cleared by you or the Game	Game Domain (operated by Benerits; content written by the Game)
Mobile advertising identifiers (IDFA / GAID) and SDK storage	Advertising	In native application wrappers only: as for advertising cookies, subject to operating-system permissions such as App Tracking Transparency	Until reset by you in device settings	Third-party (Advertising Partners)

5. How to manage cookies and similar technologies

5.1 Our CMP. You can give, refuse or withdraw consent, and object to processing based on legitimate interests, at any time and for each purpose and vendor, by clicking "Privacy choices" in the footer of any page. Withdrawing consent is as easy as giving it. Your choices are stored for up to 13 months, after which we will ask you again.

5.2 Browser settings. Most browsers let you view, block and delete cookies and site data. Blocking all cookies will prevent you from signing in. Deleting the lonca_anon cookie, or site data for the Game Domain, will permanently delete your Guest progress and Game-local saves, as we cannot restore them. Useful help pages are provided by the makers of each browser (for example, Chrome, Firefox, Safari and Edge).

5.3 Global Privacy Control. We treat a Global Privacy Control signal as an opt-out of the sale or sharing of personal information and of targeted advertising where US state law applies, as described in section 16 of the Privacy Policy.

5.4 Industry opt-out tools. You can also opt out of interest-based advertising from participating companies at www.youronlinechoices.eu (EU), www.youronlinechoices.com/uk (UK), optout.networkadvertising.org and optout.aboutads.info (US), and manage Google's ad personalisation at https://adssettings.google.com.

5.5 Mobile devices. In native application wrappers, you can limit or reset your advertising identifier and deny tracking permission in your device settings (on iOS, Settings > Privacy & Security > Tracking; on Android, Settings > Google > Ads or Privacy > Ads).

6. Changes to this Cookie Policy

6.1 We will update this Cookie Policy when we change the cookies or similar technologies we use, and we will ask for your consent again where a change requires it. The version number and effective date at the top show when it was last updated.

7. Contact

7.1 If you have questions about this Cookie Policy, contact us at [DPO / KVKK CONTACT: [email protected]] or [BENERITS LEGAL ENTITY NAME], [REGISTERED ADDRESS].

8. Language

8.1 This Cookie Policy is available in English and Turkish, and the two versions are intended to be substantively identical. In case of conflict: for Turkish consumers, the Turkish version prevails; for Publishers and Creators, the English version prevails; in all other cases, the English version prevails, except where applicable law requires otherwise.