Privacy Policy

This page explains which data is processed when you use Toguz Kumalak. The app uses no ads, advertising ID, tracking or third-party analytics.

1. Data we collect

• Account: a server-generated player ID, your player name (initially a generated name such as Misafir#1234 / Oyuncu#1234), chosen avatar and optional country. For guest accounts, a random installation ID generated by the app (not an advertising ID).
• Sign in with Apple / Google (optional): sign-in is handled by Google Firebase Authentication (Sign in with Apple is offered on iOS only). Our server stores ONLY the provider's account number (the Apple/Google sub). With Apple you can hide your e-mail; no name or e-mail is requested. Your real name and e-mail address are not stored on our server and are never shown to other players. For data processed by Firebase see Firebase privacy.
• Game data: match results, move records, rating (ELO), statistics, tournament participation and rankings.
• Social: friends, requests, blocked players, private messages, in-match chat and reactions, invites, notification inbox, reports and feedback.
• Preferences: notification and privacy preferences, game settings.
• Notification token: if you allow notifications, your device's push token (used only to deliver notifications). Notifications reach your device through Apple's (APNs) and Google's (Firebase Cloud Messaging) push services; only this token and the notification text are passed to them. It is not used for advertising or analytics.
• Technical logs: IP address and request time for security and abuse prevention (short-lived logs).

2. How we use data

Only to run the game: online matchmaking, friends and messaging, tournaments, leaderboards, keeping your account across devices, and fighting cheating, abuse and inappropriate content. Data is never sold or shared for advertising or profiling.

3. What other players see

Your player name, avatar, country, rating, statistics, online status and tournament results may be visible to other players. You can limit who may send you friend requests, messages and invites in Settings › Privacy.

4. Storage and retention

Data is stored on our own servers (Hetzner Online GmbH, European Union) and encrypted in transit with TLS. When you delete your account it is closed immediately; personal data is permanently erased after 30 days and drops out of daily backups at most 14 days later.

5. Your rights

Under GDPR and similar laws you may access, correct, delete and object to processing of your data. You can change your name and profile in the app and delete your account from the app.

6. Children

The app is not directed at children under 13 and we do not knowingly collect data from them.

7. Changes and contact

If this policy changes, the date on this page is updated. Questions and requests: fcanbarbaros@gmail.com