Privacy Policy

Controller and scope

OSM Next Level is operated in Türkiye by OMER AYKUT, an individual operator. This policy explains personal data processed for the website, free accounts, Premium access, communications and user-submitted content.

OSM Next Level is not designed specifically for children.

Categories of data we process

Depending on the feature you use, the following data may be processed:

• Account and authentication: email address, Firebase user ID, session and provider information, and account creation/sign-in metadata.
• Profile: manager nickname, country preference, favourite formation and other profile fields the user chooses to save.
• Tactics and community data: saved tactics, comments, ratings, match/tactic inputs and submitted match reports. Visibility follows the real product behaviour; approved comments may be public.
• Premium and abuse prevention: Premium code, random device identifier, usage/expiry state and technical records used to prevent unauthorised code sharing.
• Payment and delivery: purchase events, supporter email/name and delivered Premium-code records received through Buy Me a Coffee. OSM Next Level does not receive card or bank details.
• Communications and email: support messages plus addresses and technical delivery records needed for transactional Welcome, Premium-code delivery and Password Reset emails.
• Security and operations: timestamps, limited rate-limit/event records, error and security logs, and a random presence session identifier.
• Analytics: only after valid analytics consent, Google Analytics measurement such as page/feature usage, approximate location, device and browser information.

Purposes and legal grounds

Data is processed to provide the account and requested service, manage sessions and Premium access, send support and transactional emails, display/moderate user content, maintain security, prevent fraud, support payment/accounting processes, comply with legal obligations, and establish, exercise or defend legal claims.

Consent is requested where applicable law requires it. Google Analytics does not load before the user permits it. Other processing may rely, as applicable, on performing a contract, legal obligations, establishing a right, or legitimate interests appropriate to the activity.

Service providers and international processing

Firebase Authentication supports accounts and sessions; Cloud Firestore stores application data; Firebase Functions performs server operations; Vercel hosts and distributes the site; Resend sends transactional email; Buy Me a Coffee handles payment and membership processes; and Google Analytics provides consented measurement.

Firebase documentation states that Firebase Authentication operates from US data centres. The actual location of this project’s Cloud Firestore database has not yet been verified, so no Firestore region is claimed. Providers may process data outside Türkiye under their own infrastructure, agreements and legal obligations.

Retention

Personal data is retained only for as long as reasonably necessary to operate the account and service, provide support, maintain security and prevent fraud, process payments/accounting where applicable, comply with legal obligations, and establish, exercise or defend legal claims.

When the relevant purpose ends, data is deleted or anonymised unless continued retention is required or permitted by applicable law. Exact periods may vary by data type, service/provider, security needs, payment/accounting requirements and legal obligations. Third-party providers may retain data under their own retention and legal duties.

Rights and account deletion

Requests for information, access, correction, deletion, objection and other applicable rights under Turkish data-protection law may be sent to admin@osmnextlevel.com / omer@osmnextlevel.com. No invented response or deletion period is promised; statutory time limits remain preserved.

The normal verification method is a request from the email registered to the account. Loss of access to that address does not automatically defeat the request; only reasonable minimum additional information needed to verify ownership may be requested. Government ID or excessive sensitive information is not requested by default, and account information is not disclosed to an unverified requester.

A deletion request may not immediately remove limited records that must be retained for legal, security, fraud-prevention, payment/accounting or dispute purposes. Deleting an OSM Next Level account does not automatically delete records independently held by providers such as Buy Me a Coffee; users may contact those providers separately.

Minors

Minors are encouraged to use the service under the supervision of a parent or legal guardian. Their purchase of Premium or another paid service should be subject to parental or guardian permission where applicable law requires it. The site does not claim a fixed minimum age or a technical age-verification system.

Contact

Both official channels are regularly monitored for privacy and data-subject requests:

• Email: admin@osmnextlevel.com
• Email: omer@osmnextlevel.com