Privacy Policy
Effective date: 18 October 2026
This policy explains what personal data the Bulmaca Çengel mobile application (“the App”) processes and why. Data controller: Atavussoft, contact: info@bulmacacengel.com.
1. Data we collect
| Data | When | Purpose |
|---|---|---|
| Name, email address, user ID | When you sign in with Google, Apple or email | To create your account and keep you signed in |
| Puzzle scores, total score, display name | When you finish a puzzle while signed in | To save your scores and show you on the leaderboard |
| Crash logs, device model, OS version | When the App crashes | To find and fix bugs (Firebase Crashlytics) |
| Advertising ID, IP-based approximate location, device information, ad interactions | When ads are shown in the free version | To serve and measure ads (Google AdMob) |
| Purchase status | When you buy a Premium subscription | To unlock Premium features |
When you play as a guest, no account data is collected; your progress stays on your device. We never receive your payment details (card etc.); payments are processed by Google Play or the App Store.
2. Service providers
- Google Firebase (Authentication, Cloud Firestore, Crashlytics) — privacy
- Google AdMob and Google’s advertising partners — how Google uses data
- Google Play and Apple App Store — in-app purchases
Your data may be processed on these providers’ servers outside Türkiye. We do not sell your data.
3. Advertising and consent
In the European Economic Area and the United Kingdom, your consent for personalised advertising is requested through Google’s consent form; you can change your choice in the App under Profile > Privacy options. On iOS, cross-app tracking only happens if you allow it. If you decline, non-personalised ads are shown. No ads are shown to Premium subscribers.
4. Retention
Account and score data are kept while your account remains open. When you delete your account, your Firestore scores and leaderboard entry are removed immediately and your sign-in record is deleted by Firebase. Crash logs are kept for at most 90 days.
5. Your rights
You have the right to access, rectify, erase and object to the processing of your data (Turkish KVKK Art. 11; GDPR). You can delete your account in the App under Profile > Delete account or by following the steps on the account deletion page. For other requests, email info@bulmacacengel.com; we respond within 30 days.
6. Children
The App is not directed at children under 13, and we do not knowingly collect personal data from children under 13.
7. News ticker
Headlines in the App are read from a third-party RSS feed; no personal data is sent with that request.
8. GDPR rights (EU / UK)
If you are in the European Union or the United Kingdom, you have the following rights under Regulation (EU) 2016/679 (“GDPR”). The controller is Atavussoft; requests can be sent to info@bulmacacengel.com and are answered within 30 days.
- Access (Art. 15): obtain a copy of the personal data we process and information about the purposes.
- Rectification (Art. 16): have inaccurate or incomplete data corrected.
- Erasure (Art. 17): delete your account in the App under Profile > Delete account or via the account deletion page. Scores, leaderboard entry and account data are removed.
- Restriction (Art. 18) and objection (Art. 21): object to personalised advertising and to processing based on legitimate interests.
- Data portability (Art. 20): request a machine-readable copy of the data you provided.
- Withdraw consent (Art. 7(3)): withdraw advertising consent at any time via Profile > Privacy options or Google’s consent form. Withdrawal does not affect the lawfulness of prior processing.
- Complaint (Art. 77): lodge a complaint with a competent data protection supervisory authority.
Legal bases (Art. 6): performance of a contract (6(1)(b)) for account and score data; legitimate interests (6(1)(f)) for debugging and service security; consent (6(1)(a)) for personalised advertising; legal obligations (6(1)(c)).
International transfers: data may be processed on servers in the United States and other countries through Google (Firebase, AdMob), Apple and Google Play. Transfers rely on the EU Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework (DPF).
Retention: account and score data while the account is open; crash logs at most 90 days; advertising identifiers for the relevant ad session. No automated decision-making or profiling is used.
Children: we do not knowingly process data of children under 13. If we learn that such data was processed, we delete it.
See our Cookie Policy for cookies and similar technologies.
9. Changes
When we update this policy we change the effective date and announce material changes in the App.