Bulmaca Kafası
Privacy Policy
Who we are
Bulmaca Kafası is a word-game platform with solo play, friend lobbies and ranked matches. We are the data controller for the data described here. Contact: info@bulmacakafasi.com.tr.
What we collect
| Data | Why |
|---|---|
| Username, optional e-mail address, password (stored only as a one-way hash) | Your account and sign-in. An e-mail address is optional; it is used to send sign-in codes and to recover the account. |
| Game progress, stars, coins, gems, XP, league rating, match results, purchases and items, friends list | To run the game, keep your progress on every device and rank players fairly. |
| Device type (web, Android or iOS), language, last-seen time | Show a small platform badge, send your content in the right language, and decide whether to send a push notification. |
| Push notification token (only if you allow notifications) | Lobby invites and friend requests when the app is closed. |
| Purchase receipts and transaction identifiers | Verify purchases with Apple or Google and prevent double delivery or refunds abuse. |
| IP address and browser or device identifier in server logs, security and anti-cheat logs | Security, abuse and cheating detection. Not used for advertising. |
| Bug reports you send us | Fix the problem you reported. |
You can play without an account. Guest progress stays on your device until you create or sign in to an account.
Advertising
The free game shows rewarded and interstitial ads through Google AdMob. AdMob may use an advertising identifier (and, on iOS, only if you allow it in the tracking prompt) to show and measure ads. Google's own policy applies to that data: policies.google.com/privacy. We receive a signed confirmation that a rewarded ad was watched, not your advertising identifier. You can reset or limit the advertising identifier in your device settings.
Services that receive data
- Google AdMob: advertising (see above).
- Google Analytics: anonymous usage statistics on the web version only, and only if you accept the cookie banner (declining loads nothing). The mobile apps do not use it.
- Google Play Billing and Apple In-App Purchase: payments are handled by the store; we never see your card details.
- Firebase Cloud Messaging (Google) and Apple Push Notification service: delivery of push notifications.
- Hosting: our servers run on a rented virtual server (Hostinger). Fonts on the web version are served by bunny.net.
We do not sell your personal data.
How long we keep it
Account data is kept until you delete your account. Deleting it removes your profile, progress, purchases records, friends, tokens and logs linked to you immediately (see Delete account). Anything left in a server backup is overwritten within 30 days. Sign-in codes expire after a few minutes.
Your rights
You can see and change your username and language in the app, and delete your account there. You can also ask us by e-mail for a copy of your data, a correction, or deletion. Under KVKK (Turkey) and, where it applies, the GDPR, you may also object to processing or complain to your data-protection authority. We answer within 30 days.
Children
The game is not directed at children under 13 and we do not knowingly collect their data. If you believe a child has created an account, write to us and we will delete it.
Security
Connections use HTTPS. Passwords are hashed. Access to the server is restricted. No system is perfectly secure, so please choose a strong password and keep your device up to date.
Changes
If this policy changes in a way that matters, we update the date above and tell you in the app.