Privacy Policy

This policy explains what personal data the mobile game Pourcery collects, why we collect it, who we share it with, how long we keep it and what you can do about it. It applies to the Pourcery apps for iOS and Android and to the servers that support them.

1. Who is responsible for your data

The data controller is:

For data-protection questions, write to the address above with "Privacy — Pourcery" in the subject line. We answer within 30 days, and within the shorter periods required by Turkish Law No. 6698 (KVKK) or the EU General Data Protection Regulation (GDPR) where those apply to you.

2. Playing without an account

Pourcery does not require registration. The first time the app runs, it generates a random identifier on the device, stores it in the device keychain, and uses it to create an anonymous profile on our servers. That profile holds your level, coins, boosters, lives and streak, and a generated display name such as "Player4821". It is not linked to your real identity, your phone number, your contacts or your email address unless you later choose to sign in.

3. Data we collect

3.1 Account data

If you use Sign in with Apple and choose to hide your email address, we only ever see Apple's private relay address.

3.2 Gameplay data

Levels completed and failed, moves played in a level, time spent in a level, boosters used, coins earned and spent, lives, daily rewards, quests, streaks, live-event scores and leaderboard points. We use this to run the game, to keep leaderboards fair, to balance difficulty and to detect cheating (for example a level "completed" with an impossible sequence of moves).

3.3 Device and technical data

Device model, operating system version, app version and build, language and region, screen size, a generated installation identifier, session start and end times, network availability, and error and crash reports including stack traces. Crash reports are sent to Sentry and are configured not to include personally identifying payloads.

3.4 Purchase data

When you buy something, Apple or Google processes the payment. We never receive your card number, bank details or billing address. We receive from RevenueCat and from the app stores: the product purchased, the transaction and receipt identifiers, the purchase, renewal, cancellation and refund events, whether a subscription is in a trial period, the store country and the price tier. We use this to deliver what you bought, to keep your VIP status accurate, to reverse items after a refund and to keep accounting records.

3.5 Advertising data

Pourcery shows rewarded videos that you choose to watch, and interstitial ads between levels. Ads are delivered by Google AdMob and AppLovin MAX. Those providers may process your advertising identifier (IDFA on iOS or Advertising ID on Android), a device identifier, IP address, coarse location derived from the IP address, device and network characteristics, and data about which ads you were shown and which you interacted with. They use this to select and measure ads and to detect fraud. Our servers additionally receive a signed confirmation that a rewarded ad was genuinely watched, so we can grant the reward.

On iOS 14.5 and later we ask for permission through the App Tracking Transparency prompt before any tracking identifier is used for advertising. Where the GDPR applies, we ask for advertising consent through Google's User Messaging Platform. If you decline either one, the game works exactly the same and you still receive rewards; you simply see non-personalised ads.

The app also embeds the Meta (Facebook) SDK for install attribution and app-event measurement. Apple's SKAdNetwork is used for privacy-preserving install attribution.

3.6 Analytics

The app records product-analytics events such as "level started", "level completed", "shop opened", "booster used", "ad watched" and "purchase completed", together with the technical data in section 3.3. These events are sent to our own servers and are also forwarded to GameAnalytics from our servers. We use them to understand which levels are too hard, where players stop playing and whether a change improved the game.

3.7 Notifications

If you allow notifications, the app schedules reminders on your device — for example when your lives are full or when a daily gift is waiting. These are local notifications. We do not operate a push server and do not collect a push token.

3.8 Support correspondence

If you email us, we keep your message, your email address and our reply so we can help you and keep a record of the request.

4. What we do not collect

• No GPS or precise location.
• No access to your camera, microphone, photos, contacts, calendar, health data or files. The app never asks for these permissions.
• No chat, messaging, voice or uploaded content. The only text you can publish is your display name.
• No payment card data.
• No biometric data.

5. Legal bases for processing

Where the GDPR applies, we rely on these legal bases:

Where Turkish Law No. 6698 applies, the equivalent grounds are the necessity of processing for the performance of a contract (Art. 5/2-c), our legitimate interests (Art. 5/2-f), compliance with a legal obligation (Art. 5/2-a) and, for advertising identifiers, your explicit consent (Art. 5/1).

6. Who we share data with

We do not sell personal data and we do not share it for other companies' independent marketing. We share only what each of the following needs to do its job:

Each provider's own privacy policy explains how it handles data: Apple, Google, RevenueCat, AppLovin, Meta, Sentry, GameAnalytics and Expo all publish one.

7. Where your data is stored and transferred

Our game servers and databases are hosted in Türkiye. Several of the providers listed above are established outside Türkiye and the European Economic Area, mainly in the United States, so using the app involves international transfers. For those transfers we rely on the providers' standard contractual clauses and equivalent safeguards, and on your explicit consent where Turkish law requires it. Leaderboards are global, so your display name and score are visible to players in other countries.

8. How long we keep data

9. Deleting your account

You can delete your account from inside the app at any time, whether or not you ever signed in: Settings › Account › Delete account, then confirm. This immediately and permanently:

• closes the account and ends every active session on every device;
• erases the email address, password, and any Apple or Google identifier linked to it;
• removes your entries from all leaderboards;
• deletes files stored for your account on our storage;
• resets the app on your device to a fresh guest state, wiping local progress.

Your level, coins, boosters and purchases cannot be recovered afterwards. Records we must keep by law, such as invoices for purchases, are retained for the periods in section 8 and are not used for any other purpose. If you prefer, you can ask us to delete your account by writing to developer@grouptaiga.com; we may ask you for information that lets us identify the account.

10. Your rights

Depending on where you live, you have the right to: know what we hold about you and get a copy of it; correct it; delete it; restrict or object to processing, including profiling for advertising; withdraw a consent you gave; receive your data in a portable format; and complain to a supervisory authority. In Türkiye that authority is the Personal Data Protection Authority (KVKK Kurumu); in the EEA it is your national data-protection authority. Under Turkish Law No. 6698 you may also ask whether your data has been processed, learn the purpose, learn who it has been transferred to, and request that any damage caused by unlawful processing be compensated.

To exercise a right, email developer@grouptaiga.com. We do not charge for this, and we will not treat you differently for asking. Some rights can be exercised faster in the app itself: you can change your display name and delete your account from the Account screen, and you can change your advertising choices in your device settings.

11. Your advertising choices

• iOS: Settings › Privacy & Security › Tracking, and Settings › Pourcery.
• Android: Settings › Google › Ads, where you can delete or reset your advertising ID and opt out of personalised ads.
• In the app: where the GDPR applies, the consent dialog can be reopened from the game's settings.
• VIP: a VIP subscription removes interstitial ads. Rewarded ads remain available because you choose when to watch one.

12. Children

Pourcery is a general-audience puzzle game. It is not directed at children under 13, and we do not knowingly collect personal data from them. We do not use personalised advertising for users we know to be children, and where a store's families programme applies we follow its rules. If you believe a child has given us personal data, write to us and we will delete the account and its data.

13. Security

Traffic between the app and our servers uses TLS. Passwords are stored only as salted hashes and are never logged. Sessions use short-lived tokens with rotating refresh tokens that can be revoked. The device secret is stored in the platform keychain. Access to production systems is restricted and logged, and we take regular backups. No system is perfectly secure, so we cannot promise absolute security; if a breach affects your data and the law requires it, we will notify you and the relevant authority.

14. Changes to this policy

If we change this policy we will update the date at the top and publish the new version at this address. If a change materially affects you — for example a new category of data or a new purpose — we will tell you in the app before it takes effect and, where the law requires it, ask for your consent.

15. Contact

Taiga Teknoloji Anonim Şirketi
Çifte Havuzlar Mah., Eski Londra Asfaltı Cad., Kuluçka Mrk. A1 Blok No: 151/1C, İç Kapı No: B35, Esenler / İstanbul, Türkiye
developer@grouptaiga.com