PuzzleLab

Draft — under legal review.

Privacy Policy

Effective date: [DATE]

Article 1 – Who we are

This policy explains how personal data of people who use the PuzzleLab mobile app ("the App") is processed. It is given under Article 10 of Turkish Personal Data Protection Law No. 6698 ("KVKK") and, for users in the European Union and the United Kingdom, Article 13 of the General Data Protection Regulation ("GDPR").

Controller: [COMPANY NAME] Address: [ADDRESS] Email: [EMAIL]

Article 2 – Data we process

The App needs no sign-up. We do not collect your name, email address, phone number or precise location. We process:

  1. Player data: the nickname you choose, a player ID created by the App, the friend leagues you join and their codes.
  2. Game data: your scores, progress, unfinished games, language and settings.
  3. Purchase data: the status of subscriptions and purchases made through the Apple App Store. Payment and card details are handled by Apple and never reach us.
  4. Advertising and device data: advertising ID (IDFA, only if you allow it), device model, operating system version, language, and approximate country or city derived from your IP address.
  5. Technical data: error and crash logs, app version.
  6. Contact data: if you email us, your email address and message.

Article 3 – Why we process it

  1. To provide the daily games and let you resume where you left off;
  2. To run daily leaderboards, the "Günün Beşlisi" ranking and friend leagues;
  3. To unlock subscription features and the ad-free experience;
  4. To show ads in the App;
  5. To detect cheating or impossible scores and keep play fair;
  6. To fix errors, keep the App secure and improve it;
  7. To answer your requests and meet our legal obligations.

Article 4 – Legal bases and how we collect it

Data is collected automatically and electronically while you use the App, on these legal bases:

  1. Contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)): providing the games, leaderboards, leagues and subscriptions.
  2. Legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)): keeping purchase records and answering authorities.
  3. Legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)): security, preventing cheating, fixing errors and showing non-personalised ads.
  4. Consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)): personalised ads and use of your advertising ID for them. You can withdraw consent at any time in Settings.

Article 5 – Who receives your data

We share data only for the purposes above, and only as far as needed, with:

  1. Google (Firebase): app infrastructure, database and crash reporting. Data is stored on servers in the European Union.
  2. Google (AdMob): advertising.
  3. Apple Inc.: verifying purchases and sending notifications.
  4. Public authorities: where the law requires it.

Because these providers' servers are outside Turkey, transfers are made under Article 9 of KVKK using [standard contracts published by the Turkish Data Protection Board / safeguard confirmed by the lawyer], which are notified to the Board within five business days of signing. Transfers outside the EU/UK are protected by standard contractual clauses or an adequacy decision.

Your nickname and scores are visible to other players on leaderboards and in leagues you join. We recommend not using your real name as a nickname.

Article 6 – How long we keep it

  1. Player and game data: until you use "Delete my data" in the App, or after 12 months without using the App, when it is deleted.
  2. Purchase records: 10 years, as required by tax and commercial law.
  3. Error and crash logs: 90 days.
  4. Emails: 2 years.

When a period ends, data is deleted, destroyed or anonymised.

Article 7 – Children

The App is not directed at children and is not designed for anyone under 13. [Lawyer: confirm age limit, App Store age rating and AdMob child-directed settings.] If you believe we hold a child's data, tell us at [EMAIL] and we will delete it.

Article 8 – Security

Data is sent over encrypted connections. Database access is restricted so each player can reach only their own data. Scores are checked on our servers. If a data breach occurs, we notify the Turkish Data Protection Board within 72 hours and inform affected users.

Article 9 – Your rights

Under Article 11 of KVKK you may: learn whether your data is processed; request information about it; learn the purpose and whether it is used accordingly; know who it was transferred to in Turkey or abroad; ask for correction; ask for deletion or destruction; ask that corrections or deletions be passed on to recipients; object to a result against you produced solely by automated analysis; and claim compensation for damage from unlawful processing. Under the GDPR you may also ask for restriction of processing and data portability, and complain to your local data protection authority.

Article 10 – How to make a request

To delete your data straight away, use Settings > "Delete my data" in the App. For other requests, fill in the Data Subject Request Form at the end of this document and send it to [EMAIL]. We answer within 30 days, free of charge.

Article 11 – Changes

We may update this policy. Important changes are announced in the App; the current version is always in the App and at [WEBSITE]. If the Turkish and English versions differ, the Turkish version prevails.