Privacy Policy
This policy explains which personal data is processed when you play the Tiny Realm Heroes mobile game (the “Game”), why, who receives it, how long it is kept and what your rights are. It is the information notice under Turkish Law No. 6698 on the Protection of Personal Data (KVKK, art. 10) and, for players in the European Economic Area, the privacy notice under the GDPR. The Turkish version prevails in case of conflict.
1. Controller
Controller: {{VERI_SORUMLUSU}}
Postal address: {{VERI_SORUMLUSU_ADRESI}}
Contact and requests (e-mail): {{ILETISIM_EPOSTA}}
2. Age limit
The Game is for players aged 16 and over. If you are under 16, do not use the Game. The Game does not verify age; because the validity of explicit consent given by 16–17-year-olds is unclear, only players who tick “I am 18 or older” can allow personalised ads; everyone else sees ads without personalisation. If we learn that an account belongs to someone under 16, we delete it and its data; you can tell us at {{ILETISIM_EPOSTA}}.
3. Data, purposes, legal bases, retention
There is no sign-up form: on first launch a guest account tied to your device is created. We do not ask for your name, phone number or address. Legal bases are the conditions of KVKK art. 5(2) (for the EEA, GDPR art. 6(1)): establishment or performance of a contract (art. 5(2)(c); providing the game), compliance with a legal obligation (art. 5(2)(ç)), establishment, exercise or protection of a right (art. 5(2)(e)) and legitimate interests (art. 5(2)(f)). Only personalised advertising relies on your explicit consent (art. 5(1); for the EEA, GDPR art. 6(1)(a)): the Game asks before the first real ad and accepts it only if you confirm you are 18 or older; without consent ads are shown non-personalised, and you can change your choice at any time under Account › Settings › “Personalised ads”.
How data is collected: electronically, through the Game app and the game server. The “How collected” column shows the way for each category: automatically (the app and server record it while you play), entered by you (nickname, picture, messages, forms) or from a third party (Google / Apple sign-in, store verification).
| Category | Examples | How collected | Purpose | Legal basis | Retention |
|---|---|---|---|---|---|
| Account and identifiers | Device ID (on Android derived from the system device identifier, otherwise random), player ID, account number, game server; if you link Google or Apple, your Firebase user ID and sign-in provider | Automatically (the app creates it on first launch); if you link Google / Apple, from Firebase Authentication (third party) | Creating the account, sign-in and account recovery, linking characters on several servers to one account | Contract (art. 5(2)(c)) | Until the account is deleted |
| E-mail address (only if you link Google / Apple) | E-mail of your Google or Apple account (for Apple possibly a private relay address), name | From a third party: Firebase Authentication provides it at Google / Apple sign-in | Showing the linked account on your device | Contract (art. 5(2)(c)) | Not stored on the game server; kept on your device and in the Google Firebase Authentication record (deleted with the account, see 8) |
| Profile | Nickname, profile picture you pick from your gallery (resized to a 256×256 JPEG; re-encoding removes photo metadata such as location), chosen frame and title | Entered by you (nickname, picture you pick, frame, title) | Representing you in the game, rankings and chat | Contract (art. 5(2)(c)) | Until the account is deleted (only the latest picture is kept) |
| Game data | Cloud save (progress), log of resource changes, power, wave, trophies, arena and event points, VIP level, clan membership and contributions, pending rewards, mailbox, chest opening records, idle timer | Automatically (the app and server while you play) | Providing the game, keeping progress across devices, preventing cheating | Contract (art. 5(2)(c)); legitimate interests (art. 5(2)(f), anti-cheat) | Until the account is deleted; mailbox messages 30 days (max. 100; older ones are deleted every hour) |
| Chat and social | Your messages in global, server and clan chat, private messages, recent conversation list, friend and block lists | Entered by you (your messages, friends and blocks you add) | Communication between players | Contract (art. 5(2)(c)) | Each channel keeps its last 200 messages; in quiet channels (private, clan) messages may stay longer. On account deletion your messages and the private conversations you were in are deleted |
| Chat translation (only if enabled on the server) | Message text to translate and the target language. Nickname and player ID are not sent, but personal data written inside a message would be | Automatically. Automatic translation is on by default in the reader’s game; while it is on, other players’ messages in another language are sent routinely by the server to be translated. The reader can turn it off in the Chat settings; the writer of a message has no choice about it | Translating messages into the reader’s language | Legitimate interests (art. 5(2)(f)) | Only an in-memory cache on the game server; for OpenAI’s own retention see 5 |
| Notifications | Push (FCM) device token, platform; title and text of a scheduled notification | Automatically (on every start the app gets a token from Firebase Cloud Messaging and sends it to the server; the token is kept even if you turn notification permission off, only no notification is shown) | Sending game notifications such as “your farm is ready” | Contract (art. 5(2)(c)). You can turn notifications off in your phone settings at any time | Token: until the account is deleted or the token expires; scheduled notification: deleted when sent, or one day after its time if it could not be sent (at most 15 days) |
| Purchases | Order / transaction number, product and price tier, store, price, time, whether it was a test purchase, refund status (refund time, the refund reason and source reported by the store), purchase counters and VIP points. So that a purchase cannot be used on another account, a pseudonymous identifier of your account is passed to Google Play with it. Your card and payment details never reach us; Google Play or the App Store processes payments | Automatically; from the store’s (Google Play / App Store) verification answer and refund notices | Verifying purchases with the store and delivering them, refunds and accounting, preventing payment and refund abuse (a purchase refunded by the store is marked in the record and taken off your spending total and VIP points) | Contract (art. 5(2)(c)); legal obligation (art. 5(2)(ç)); legitimate interests in preventing fraud (art. 5(2)(f)) | Linked to you while the account exists. When the account is deleted the player ID is removed and the record is kept as accounting and refund evidence for 10 years from the end of the calendar year of the purchase, then deleted. The period follows the book-keeping retention duties of the Turkish Commercial Code art. 82 (the period starts at the end of the calendar year in which the record was made) and the Tax Procedure Law art. 253. As the order number can be matched with store records, these records are pseudonymised, not anonymous |
| Advertising (rewarded ads) | Ads for the “watch an ad” rewards are served by Unity LevelPlay (Unity Technologies) and the ad networks working through it (ironSource Ads, Unity Ads and their bidding partners). The ad SDK is started only once you use the ad feature (your first “watch an ad” tap, after your ad choice is asked), and never when VIP or the Ad-free Pass means you need no ads. Once started, it collects from your device: the advertising ID (Android Advertising ID), device and app information (model, operating system, language, network type, app version), IP address and ad interactions (impressions, clicks, views, rewards). Your player ID is passed to the ad provider, and after the ad the provider sends our server a signed “reward earned” callback. On our server we keep that callback (event ID, player ID, reward, placement / network, time) and the daily use count of the rewards. Your ad choice (personalised yes / no, the 18-or-older confirmation, the version of the choice text, time) is also recorded on our server as proof of consent | Automatically (the ad SDK and the ad provider's server); the consent choice is yours | Showing rewarded ads and granting the reward, frequency capping, preventing fake views and fraud, ad measurement; personalising ads to your interests only with your consent | Personalised ads: explicit consent (art. 5(1)). Non-personalised ads, rewards and caps: contract (art. 5(2)(c)); fraud prevention and measurement: legitimate interest (art. 5(2)(f)) | Reward callbacks 7 days on our server, daily counters until the account is deleted. For Unity's and the ad networks' own retention see 5. You can reset or delete the advertising ID at any time in your phone's settings (Google › Ads); VIP or the Ad-free Pass unlock the rewards without ads |
| Analytics | Not collected. Google Firebase Analytics, which comes into the app as a software component, is permanently switched off and does not read the advertising ID. (Only the ad SDK uses the advertising ID, see “Advertising”.) | — | — | — | — |
| Crash reports | Firebase Crashlytics: device model, operating system, app version, stack trace | Automatically (when the app crashes) | Finding and fixing bugs | Legitimate interests (art. 5(2)(f)) | About 90 days at Google |
| Acceptance of the Terms of Service | The terms version you accepted, time, player and account ID | Entered by you (“I accept” before your first chat message or first photo upload) | Proving that you accepted the rules; keeping chat and photo uploads closed for those who have not | Performance of a contract (art. 5(2)(c)); protection of a right (art. 5(2)(e)) | Until the account is deleted |
| Reports and moderation | Reporting and reported player, channel, copy of the message, reason, time; actions taken (mute, suspension, message or photo removal: the admin who took it, time, duration, reason) | Entered by you (the report) and automatically (a copy of the reported message) | Reviewing content that breaks the rules, protecting players | Legitimate interests (art. 5(2)(f)); establishment, exercise or protection of a right (art. 5(2)(e)) | At most 2 years, then deleted. When the reported account is deleted, reports are deleted at once (except under a legal hold) and moderation records stay for the 2 years without the IDs; the reporter’s ID is removed when the reporter’s account is deleted |
| Test logs (test accounts only) | For accounts our team marks as test accounts: in-game event log, device model, app version | Automatically (test accounts only; the server does not store a log sent for any other account) | Debugging | Legitimate interests (art. 5(2)(f)) | 30 days (the oldest day is deleted daily); at once when the account is deleted |
| Web deletion request | Player ID, nickname, contact e-mail, your note | Entered by you (web form) | Verifying the request and replying | Legal obligation (art. 5(2)(ç); answering your request) | 30 days after the decision; undecided requests at most 90 days |
| Technical connection data | IP address (in memory only, to limit abuse; not written to the database); server logs contain player IDs, nickname changes, report texts, purchase keys, request URLs | Automatically (the server, while connected) | Running the service, security, debugging | Legitimate interests (art. 5(2)(f)) | In-memory data at most one day; server logs at most 30 days |
4. What other players see
Your nickname, profile picture, frame and title, power, wave and trophy counts, clan and chat messages are visible to other players. Rankings and profile pictures are served from addresses that can be read without signing in. Do not put personal details such as your real name in your nickname or messages.
5. Recipients
- Google LLC / Google Ireland: Firebase Authentication (Google sign-in), Firebase Cloud Messaging (notifications), Firebase Crashlytics, Google Play Billing (purchase verification).
- Apple Inc. (iOS): Sign in with Apple, App Store purchase verification.
- Functional Software, Inc. (Sentry) (only if error monitoring is enabled on the server): the game server’s error reports; the error trace, the request address (without query string and cookies) and warning-level server log lines. These may include a player ID. Kept according to the Sentry setting (90 days by default).
- OpenAI (only if chat translation is enabled on the server): the message text to translate. OpenAI may keep API data for a limited time (typically 30 days) for abuse monitoring.
- Unity Technologies (Unity LevelPlay ad mediation) and the ad networks working through it: ironSource Ads and Unity Ads (both owned by Unity Technologies); if another ad network is enabled in the dashboard it will be added to this list. Data shared: the advertising ID, device and app information, IP address, ad interactions and player ID listed under “Advertising”. These companies also process the data under their own policies: Unity Game Player and App User Privacy Policy.
- Hosting provider Hetzner Online GmbH: game server, database and backups (server location: {{SUNUCU_KONUMU}}).
- Other players: the public information in section 4.
- Authorities: only where legally required and to the extent required.
We do not sell your personal data.
6. International transfers
The recipients below process data outside Turkey. The KVKK art. 9 basis of each transfer is given next to it:
- Hetzner Online GmbH (game server, database, backups): {{SUNUCU_KONUMU}}. Basis: {{AKTARIM_DAYANAGI}}
- Google (Firebase Authentication, Firebase Cloud Messaging, Firebase Crashlytics, Google Play Billing): mainly the United States and other countries. Basis: {{AKTARIM_DAYANAGI}}
- Apple (iOS only: Sign in with Apple, App Store): mainly the United States. Basis: {{AKTARIM_DAYANAGI}}
- OpenAI (only if chat translation is enabled on the server): United States. Basis: {{AKTARIM_DAYANAGI}}
- Sentry (only if error monitoring is enabled on the server): United States or the chosen data region. Basis: {{AKTARIM_DAYANAGI}}
- Unity Technologies and the ad networks (ironSource Ads, Unity Ads): United States, Israel and other countries where these companies operate. Basis: {{AKTARIM_DAYANAGI}}
Where a transfer relies on a standard contract, the contract is notified to the Turkish Personal Data Protection Authority as the law requires. For players in the European Economic Area the transfer rules of GDPR chapter V also apply. For information on the transfer safeguards, write to {{ILETISIM_EPOSTA}}.
7. Retention, backups and logs
- Account data is kept until you delete your account. There is currently no automatic deletion of inactive accounts.
- The database is backed up daily and each backup is deleted after 14 days. Data of a deleted account stays in backups for at most 14 more days and is used only if a backup has to be restored.
- Mailbox messages are kept for 30 days and reports for at most 2 years. Purchase records of deleted accounts are kept without the player ID for 10 years from the end of the calendar year of the purchase. Scheduled notifications are deleted at the latest one day after their time, test logs after 30 days, ad reward callbacks after 7 days. For a deleted character only one-way hashes of the player ID and of the IDs of the devices that played it, the deletion time and its reason are kept for 400 days; only those devices are told about the deletion, so an old save left on one of them is not uploaded into a new account.
- Moderation records (which admin took which action, when and why) are kept for at most 2 years. When you delete your account these records are kept without your player ID, nickname and account ID, and deleted at the end of the 2 years.
- Legal hold: for an account sanctioned for a serious violation such as threats, sexual content, child safety, harassment or extortion, or subject to an official process, reports about the account and moderation records (with the identifiers) are kept for at most 2 years even if the account is deleted, to establish, exercise or defend legal claims and to answer requests from the authorities (KVKK art. 5/2-e and ç); then they are deleted. Other data is deleted as usual.
- Server logs are kept for at most 30 days: every day, log files older than 30 days are deleted.
- Expired data in the database is deleted by a job that runs every hour.
8. Deleting your account
In the game: Account window › Hesabı Sil (Delete account) at the bottom. You are asked to type SİL to confirm.
Without the game: account deletion request page (with your player ID or, if you do not know it, your server name, plus nickname and e-mail). Player IDs and nicknames are public, so we verify that the request comes from the account owner; once approved, the account gets an in-game mail and a notification.
- Deletion covers the whole account: characters on every server, save, clan membership, messages, friend lists, push token, profile picture, ad reward callbacks. For data held by the ad provider the routes in Unity's policy apply (you can also reset the advertising ID on your phone).
- There is a 7-day grace period. During it your account is immediately hidden from rankings, arena, chat, profile lookups, friend and clan lists. If you asked in the game, your open sessions are ended too (a web request leaves them open). If you sign in again you can cancel the deletion.
- After 7 days the data is permanently deleted. Clan leadership passes to the next member; a clan with no members left is disbanded. Your name in clan dungeon history and system messages becomes “Silinmiş oyuncu” (deleted player).
- Purchase records are kept without your player ID as accounting and refund evidence for 10 years from the end of the calendar year of the purchase (see 3). Purchases are not refunded.
- If you delete in the game, the save and session on that device are deleted at once.
- If you linked Google or Apple, your sign-in record in Firebase is deleted too; after a technical error the deletion is retried every hour. Your Google or Apple account itself is not affected.
- Backups and logs follow the periods in section 7.
9. Your rights
Under KVKK art. 11 you may ask the controller to: learn whether your personal data is processed; request information about it; learn the purpose of processing and whether it is used accordingly; know the third parties it is transferred to in Turkey or abroad; have incomplete or inaccurate data corrected; have it deleted or destroyed under KVKK art. 7; have these corrections or deletions notified to recipients; object to a result against you arising solely from automated analysis; and claim compensation for damage caused by unlawful processing.
If you are in the European Economic Area you also have the GDPR rights of access, rectification, erasure, restriction, data portability, objection and withdrawal of consent. You can withdraw your consent to personalised ads at any time in the Game under Account › Settings; withdrawal does not affect the lawfulness of earlier processing.
Under art. 5 of the Communiqué on the Procedures and Principles of Applications to the Data Controller you can apply in any of these ways: in writing (a signed letter) to {{VERI_SORUMLUSU_ADRESI}}; by registered electronic mail (KEP) to {{KEP_ADRESI}}; or signed with a secure electronic or mobile signature, or by e-mail, to {{ILETISIM_EPOSTA}}. Include your name, your signature for a written request, your player ID (shown in the Account window next to the copy button) and your request. If your account is not linked to an e-mail address (guest account), we may ask for further details to confirm that the account is yours. Requests are answered within 30 days and, as a rule, free of charge. You may complain to the Turkish Personal Data Protection Board or, in the EEA, to your local data protection authority.
10. Security
The connection between the Game and the server is encrypted with HTTPS. Sessions use signed tokens that expire. Only authorised team members can access the administration tools.
11. Changes
When we change this policy we update the date at the top.