Privacy Policy
In short: Curio Bazaar is an offline, single-player game. There is no account, no login and no server-side save; your progress stays only on your device. Personal data is processed by Google AdMob (optional rewarded ads), by Adapty, Apple and Google (the one-time purchase), and by our own server on curiobazaar.net when you download content packs (planned).
1. Data controller
This policy is written for the Turkish Personal Data Protection Law No. 6698 (KVKK) and, for users in the European Economic Area (EEA) and the United Kingdom, the General Data Protection Regulation (GDPR).
- Controller: [DOLDUR: developer name / legal entity]
- Address: [DOLDUR: address]
- Email: [DOLDUR: contact email]
- VERBİS registration: [DOLDUR: VERBİS obligation / registry no.]
- EU representative (GDPR Art. 27): [DOLDUR: EU representative needed? / contact]
2. Data that stays on your device
Your game progress (gold, inventory, map progress, settings, etc.) is stored in local storage on your device (MMKV). It is not sent to us or to any server, and we cannot access it. If you delete the app, this data is deleted too and cannot be recovered.
3. Data categories, purposes and legal bases
| Data | Processed by | Purpose | Legal basis |
|---|---|---|---|
| Device identifiers and advertising ID (IDFA / Android Advertising ID), IP address, ad interaction data (impressions, clicks, reward completion), general device information | Google AdMob | Show the rewarded ad you start, verify the reward, ad measurement, fraud prevention; personalised ads if you consent | Personalised ads and iOS tracking: consent (KVKK Art. 5(1); GDPR Art. 6(1)(a)). Non-personalised ads and fraud prevention: legitimate interest (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)) |
| Your privacy/consent choices (UMP consent status, ATT response) | Google UMP (on device), Apple iOS | Store and respect your choice | Legal obligation (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)) |
| Purchase receipt and transaction data (product, date, transaction ID), anonymous in-app user ID [DOLDUR: additional fields collected by the Adapty SDK — verify in Adapty docs] | Apple App Store / Google Play, Adapty | Process, validate and restore the “No-ads pack” purchase | Performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)); legal obligation for tax and accounting records |
| IP address and request time (server access logs); also requested file and client information — for planned content packs | Developer (own static HTTPS server on curiobazaar.net) [DOLDUR: hosting provider and location] | Deliver content packs (new countries; data and images only), security and abuse prevention | Performance of a contract and legitimate interest (KVKK Art. 5(2)(c), (f); GDPR Art. 6(1)(b), (f)); obligations under Turkish Law No. 5651 [DOLDUR: does Law 5651 apply?] |
Analytics: the game contains no separate analytics SDK beyond what AdMob and Adapty include. [DOLDUR: will analytics be added?]
We do not collect your name, email, phone number, precise location (GPS), contacts or photos. We do not carry out automated decision-making or profiling; profiling by AdMob for personalised ads happens only with your consent and under Google's policies.
4. Ads and consent
- The game has rewarded ads only, and they open only when you tap a button. There are no forced (interstitial) ads.
- EEA and UK: on first launch, Google's User Messaging Platform (UMP) consent form is shown. If you refuse personalised ads, you can still watch non-personalised ads.
- iOS: Apple's App Tracking Transparency (ATT) prompt asks for permission to use your advertising identifier (IDFA). Refusing does not limit the game.
5. Third parties and their policies
These companies process data under their own policies, as independent controllers or on our behalf:
- Google AdMob and UMP — Google Privacy Policy, How Google uses information from sites or apps that use its services, Google advertising technologies
- Apple (App Store, ATT) — Apple Privacy Policy, About app tracking permission
- Google Play — Google Privacy Policy
- Adapty — Adapty Privacy Policy
International transfers
Google, Apple and Adapty servers may be located outside Türkiye and the EEA (e.g. in the USA). These transfers are made under KVKK Art. 9 and GDPR Art. 44 et seq. Transfer mechanism: [DOLDUR: transfer mechanism — KVKK standard contract / explicit consent; GDPR SCCs / EU-US Data Privacy Framework]
6. Retention
- Game progress: only on your device, until you delete the app.
- AdMob data: according to Google's retention policies.
- Purchase records: according to Apple/Google and Adapty policies; accounting records for the period required by law. [DOLDUR: Adapty retention period]
- Server access logs (content packs, curiobazaar.net): IP address and request time are kept for [DOLDUR: days] days, then deleted or anonymised.
7. Withdrawing consent and changing your choices
- Ad consent (UMP): in the game, open Settings → Privacy choices to reopen the consent form and change your choice at any time.
- iOS tracking: on your iPhone, go to Settings → Privacy & Security → Tracking and turn the permission off for Curio Bazaar.
- Android advertising ID: in device settings, go to Google → Ads to reset or delete your advertising ID.
- You can also simply not watch ads; ads are never required.
Withdrawing consent does not affect the lawfulness of processing before the withdrawal.
8. Your rights
Under KVKK Art. 11
- Learn whether your personal data is processed,
- Request information about it if so,
- Learn the purpose of processing and whether data is used for that purpose,
- Know the third parties in Türkiye or abroad to whom data is transferred,
- Request correction of incomplete or inaccurate data,
- Request deletion or destruction under the conditions of KVKK Art. 7,
- Request that corrections and deletions be notified to third parties who received the data,
- Object to an outcome against you that results solely from automated analysis,
- Claim compensation for damage caused by unlawful processing.
Send requests to [DOLDUR: contact email] or in writing to [DOLDUR: address]. Requests are answered free of charge within 30 days. If you are not satisfied, you can complain to the Turkish Personal Data Protection Board (KVKK Kurulu).
Under GDPR (EEA and UK)
You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), and to withdraw consent at any time (Art. 7(3)). You can lodge a complaint with the data protection authority in your country (Art. 77).
Important: because there are no accounts, we hold no record that identifies you. Your game data exists only on your device; deleting the app deletes it. For ad and purchase data you can also contact Google, Apple or Adapty directly; if you contact us, we will help direct your request.
9. Children
Curio Bazaar is not directed at children under 13. We do not knowingly collect personal data from children under 13. Age rating: [DOLDUR: age rating]. If you believe a child under 13 has shared data, contact us.
10. Security
Content packs are downloaded over HTTPS only, from our server on curiobazaar.net. Security of third-party SDKs is the responsibility of the respective companies.
11. Changes
We may update this policy. The current version is always published on this page with its effective date. We will also announce significant changes in the app.
12. Contact
[DOLDUR: developer name] · [DOLDUR: contact email] · [DOLDUR: address]