This policy explains how personal data is handled in the Tiki XOX mobile game and the Tiki Games website. The data controller is Tiki Games — Hasan Hüseyin Şengün. Contact: destek@tikigames.app. Store operators process their own transactions under their respective policies.
1. Data we process
- Player and device association: A secret-key HMAC of a random installation UUID, a player UUID, nickname, iOS/Android platform, app version, and language preference. We do not store the raw installation identifier in the database. Hashing does not by itself make account-linked data anonymous.
- Game data: Moves, match outcomes and duration, trophies, XP, diamond balances, achievements, cosmetic ownership, daily puzzle progress, and activity days. These support gameplay, reward validation, and seasons.
- Security and correspondence: Infrastructure may process connection IP addresses and technical request information. Fraud flags and administrative audit records support security. The deletion form collects your email and explanation solely to process the request and verify ownership; these fields are encrypted in the database.
We do not request location, contacts, camera, or microphone access. The website does not place advertising or analytics cookies. Necessary session and form security cookies may be used. Do not send payment card details to this server.
2. Purposes and legal bases
Account access, content synchronization, cosmetic ownership, and reward accounting are processed to deliver the service. Security, fraud prevention, and service reliability may rely on legitimate interests after considering your rights. Legal duties and the establishment, exercise, or defense of legal claims may provide additional applicable grounds. Information supplied with a request is processed to handle that request.
Optional personalized advertising or nonessential analytics will not begin without valid consent where required by applicable law. Withdrawing consent does not affect the lawfulness of earlier processing. Essential service processing is distinguished from optional processing requiring consent.
3. AdMob, Firebase, and stores
Google AdMob ad serving and the Firebase Analytics SDK are not enabled as part of this backend release. If enabled in the mobile app, the SDKs, data categories, purposes, and consent controls will be described here before release. AdMob may process advertising identifiers such as the Android advertising ID or permitted IDFA, device and connection data, and ad interactions. Firebase Analytics may process app instance identifiers and usage events. iOS tracking permission and regional consent requirements apply separately.
The current limited ad reward endpoint does not independently prove an ad was watched. Actual AdMob server-side verification and Apple/Google purchase receipt verification are not enabled in this version. When store payments are enabled, Apple or Google processes the relevant payment data under its terms; this backend does not collect card details.
4. Sharing and international transfers
We do not sell data. Hosting, network security, and bot prevention providers may process limited data needed to deliver their services. When Cloudflare Turnstile is enabled on the form, browser and connection signals and a verification token are sent to Cloudflare; our server includes the connecting IP in its verification request. Lawful authority requests and disclosures necessary to protect rights are assessed separately.
Cloudflare, future Google integrations, or store services may involve processing abroad. Transfers must use the applicable KVKK/GDPR mechanisms and contractual safeguards. Service locations and contractual settings are verified during release preparation; this policy alone does not authorize a transfer.
5. Retention and deletion
- Account and personal game profile: Retained to provide the service while the account remains in use. Verified in-app deletion immediately removes the device association, nickname, profile preferences, and access tokens and deletes personal daily activity records. Web/email requests are processed after ownership verification, with a response within 30 days.
- Request information: Retained during review. Completing deletion in the panel clears the contact and explanation fields. Contact content of requests closed in other ways is retained for no more than 30 days after closure.
- Security and administrative audit: Up to 365 days. Specific records subject to a concrete dispute or legal duty may be retained with restricted access for the required period.
- Backups: When rolling backups are enabled, older copies leave the cycle within 30 days. They are not returned to ordinary use; deletion actions must be reapplied after a necessary restore.
- Nonidentifying summaries: Aggregate game statistics that cannot identify you may be retained for service analysis. Records retaining a personal link are not kept indefinitely merely by calling them statistics.
6. Your rights
Under KVKK and GDPR where applicable, you may request information and access, correction, deletion where conditions are met, restriction, objection, portability, and withdrawal of consent. You may challenge adverse effects of automated processing. Contact the email above or use the account deletion page. We may request proportionate ownership verification but will not ask for a password or API token.
KVKK requests receive a response within 30 days. GDPR requests generally receive a response within one month; if a lawful extension is needed, we explain the reason and timeframe. You may complain to the Turkish Personal Data Protection Authority or a competent European supervisory authority where applicable. Statutory complaint and objection time limits apply.
7. Children and security
The game is designed for ages 13 and above and is not directed to children under 13. This does not override higher local digital consent ages or parental permission requirements. Contact us if you believe a child's data was processed without required permission so we can investigate and remove it as appropriate.
Controls include access permissions, administrative multifactor authentication, token revocation, and encrypted request fields. Production communications must use HTTPS. No system guarantees absolute security; applicable breach notification duties will be followed.
8. Changes
We update this policy and its date when processing practices change. Material changes are communicated through appropriate channels, and renewed consent is requested when required. Support and account deletion links appear below.