This Privacy Policy explains how personal data is processed when you use the PackPlay iOS and Android apps, the packplay.app website and the related account, game, subscription and support services (together, the "Services"). It covers guest users too. Users in Türkiye should also read the KVKK Aydınlatma Metni (KVKK information notice, in Turkish).
This Policy is a notice, not a request for blanket consent. Using PackPlay or accepting the Terms of Service does not, by itself, give consent to optional advertising or to any other processing that needs separate consent; those choices are made separately where the law requires them.
1. Who is responsible
PackPlay is operated by Alihan Kuru, an individual publisher based in Istanbul, Türkiye, who is responsible for the processing described in this Policy, including as data controller where that role applies. For privacy questions and requests, write to [email protected]. A postal address for written requests has not been published yet; until it is, please use e-mail.
2. What we process and where it comes from
Accounts and sign-in
- Guest accounts: the app creates a random guest id on your device; we create an internal account id and keep your display name and app language.
- Sign in with Apple or Google: we receive the provider's account identifier, the e-mail address the provider shares with us (for Google, only a verified address; Apple may give a private relay address instead of your own), and your name if the provider supplies it. For Sign in with Apple we also keep an encrypted Apple token, used only to revoke the link with Apple when your account is deleted. We never receive your Apple or Google password.
- Linking: you can link a guest account to Apple or Google in the app; the same account, with its progress, coins and Premium, then opens with that service. Choosing "Sign in" instead of linking opens or creates a separate account and does not move guest progress.
- Profile: username, display name, chosen preset avatar and equipped cosmetics. Your display name may first be filled from the name Apple or Google provides and may contain your real name; you can change it, and later sign-ins do not overwrite a name you set. There is no photo upload and no profile bio.
- Terms acceptance: the version of the Terms of Service you accepted and when.
- Account deletion: when you ask to delete your account, the date of the request and a fingerprint (hash) of the deletion receipt shown to you, so the deletion status page can answer without knowing who you are. We do not keep the receipt itself.
- Sessions: the information needed to issue and revoke sign-in sessions on the app and the website.
Games and social features
- Gameplay: rooms you create or join, room codes, teams, your moves and results in a game, scores, leaderboard positions, experience and level, achievements, daily rewards, challenges and weekly and monthly leaderboard prizes, your in-game coin balance and its history, cosmetic inventory, shop activity and in-game pranks.
- Social: friend requests and friendships, room invitations, in-app notifications and their settings, players you block, and when you were last active in the app (used to show friends whether you are online — see section 4).
- PackPlay has no user-to-user text or voice chat.
Purchases and subscriptions
Apple and Google take the payment; we never receive your card or payment details. The app sends the store's purchase information to RevenueCat, which checks it with the store; RevenueCat identifies you by your PackPlay account id. Our servers then receive from RevenueCat, and keep, the subscription events for your account: event type, product and entitlement, start, renewal, expiry, cancellation and refund events, and their dates. We keep a fingerprint of each event message, not the message itself. Your Premium status is stored with your account.
Support and safety reports
- In-app support: the request type, category, subject, your message and any steps or expected behaviour you describe, the severity you choose, and the app version and platform.
- E-mail: when you write to [email protected], your e-mail address, the message and its metadata.
- Reports: who reported whom, the reason, any details you add and, where relevant, the room. We record each report's status (open, in review, resolved or dismissed), a short note on the outcome and who reviewed it. When we act on an account (for example a suspension or resetting a name), we keep a record of the action and its reason.
Please do not send passwords, payment card details or sensitive information you do not need to share.
Device, connection and logs
- App identifier: the app generates a random identifier for your installation and sends it, with the app version, platform and language, on each request. It stays on the device after you sign out. It is not stored in our database.
- IP address: Cloudflare and our servers process your IP address to deliver traffic and protect the Services. The API uses it in memory to limit excessive requests and works with a keyed hash of it in its request context. The website's web server log records the client IP address with each request.
- Server logs: technical events and errors. Account identifiers in these logs are shortened (masked).
An IP address can indicate a general location. We do not request GPS or precise-location permission. Advertising providers may derive an approximate location from an IP address (see section 5).
Camera and other permissions
The app asks for camera access only to scan room QR codes. The camera image is processed on your device; it is not recorded or uploaded, and only the decoded room code is used to join the room. You can revoke the permission in your device settings and always join with a room code instead. PackPlay does not ask for access to your contacts, microphone, photo library or location.
3. Why we use it and on what legal basis
Where the GDPR or the UK GDPR applies, each purpose relies on the basis shown:
| Purpose | Legal basis |
|---|---|
| Creating and signing in to accounts, guest access, linking, sessions; running rooms and games; saving progress, scores, coins and items; friends, invitations, notifications and online status | Performance of our contract with you (the Terms) |
| Recognising Premium, restoring purchases and handling subscription events | Performance of a contract |
| Answering support and privacy requests and sending necessary service or security messages | Performance of a contract; for privacy requests, the legal obligation to answer them |
| Security: limiting excessive requests, protecting accounts, preventing cheating, fraud and abuse, refusing reserved or clearly abusive usernames, display names and team names, reviewing reports and acting on accounts, keeping server logs | Our legitimate interest in keeping the Services and their players safe, balanced against your rights, including the interests of younger users |
| Recording which version of the Terms you accepted | Performance of a contract and our legitimate interest in being able to show what was agreed |
| Keeping records the law requires and answering lawful requests from authorities | Legal obligation |
| Establishing, exercising or defending legal claims | Our legitimate interest in protecting our rights |
| Internal operating figures, such as how many players were active | Our legitimate interest in running the Services; only totals are shown |
| Advertising in the apps, where the law requires consent for it or for storing or reading information on your device | Consent (section 5). Playing does not depend on giving it. |
Where processing relies on consent, you can withdraw it at any time; this does not affect processing before the withdrawal. A device permission is not automatically the same as every consent the law may require. Processing under Turkish law is addressed in the KVKK notice; a GDPR basis is not automatically a condition under Turkish law.
We send support replies and necessary service messages, not marketing e-mails. We do not use separate analytics or crash-reporting services such as Google Analytics, Firebase Analytics, Crashlytics or Sentry. That does not mean that our own logs, or the advertising and subscription providers' software, collect no diagnostic or measurement information. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. What other players can see
- Profile: any player who is not blocked can find you by username and open your profile, which shows your display name, username, avatar, equipped cosmetics, level, whether you have Premium, your game totals (games played, wins, correct answers), achievements and best leaderboard finishes.
- Leaderboards: your display name, avatar and avatar frame, and results such as score, wins and games played.
- Rooms: players in the same room see your display name, avatar, cosmetics, team, whether you are ready and whether you are connected, as the game needs.
- Online status: only your accepted friends can see whether you are online, and their friends list is ordered by recent activity. You can turn this off under Settings › Privacy & Safety › Show online status; you then always appear offline to friends and are not ordered by activity. This does not change what players in the same room see.
- Friends list: only you can see your full list of friends.
- Your e-mail address is not shown to other players.
You can change your display name but you cannot hide it, so choose names you are comfortable sharing. Blocking a player hides your profiles from each other and keeps you out of each other's search results, but does not remove results already shown on a shared leaderboard or in a past game. Public games may include computer-controlled players run by PackPlay (see the Terms). Contact us if you are worried about information others can see.
5. Advertising in the apps
Ads are shown only in the iOS and Android apps, using Google AdMob. The website shows no ads. Our server decides whether an ad may be shown for a game and placement. When it confirms that your account has Premium, the app does not request the ads shown during and between games. An optional reward video that you choose to watch, for example for an extra hint, is not part of the Premium benefit; where the app offers one, it can be offered to Premium players too, and watching it is never required. Within a game, the app does not start Google's advertising software at all until the server has confirmed that an ad applies to you.
Before the first ad request in each app session, the app runs Google's consent tool (the User Messaging Platform). Where that tool reports that consent is required, for example under EEA, UK or Swiss rules, it shows Google's consent message, and ads are requested only if the tool then allows it. Unless the tool records that you have given consent, the app asks Google only for non-personalised ads; showing a consent message, or a region where no message is required, is not treated as consent. All ad requests are limited to content Google rates as suitable for teenagers and older. Where it applies to you, Settings › Privacy & Safety › Ad privacy choices lets you review or change your choice; to know whether to offer it, that screen checks your consent status with Google's consent tool when you open it.
When ads are requested, Google's Mobile Ads SDK can process your IP address, device and app information, an advertising identifier where one is available, and ad views and taps, to deliver and measure ads and to prevent fraud. Whether ads are personalised depends on your consent and on the law. Non-personalised ads still involve processing of this kind and, where the law requires it, consent for storing or reading information on your device. Installing the SDK does not by itself mean that personalised advertising or cross-app tracking is permitted.
- iOS: PackPlay does not track you across other companies' apps and websites without your permission under Apple's App Tracking Transparency. If the app asks for that permission, it uses Apple's system prompt; you can change your answer in Settings › Privacy & Security › Tracking. Without permission, iOS does not make the advertising identifier available.
- Android: you can reset or delete the advertising ID in your device settings.
Device controls do not stop every kind of ad-related processing. You can also send a request to [email protected]. Google's privacy information: policies.google.com/privacy and how Google uses information from apps that use its services.
6. Who receives information
Each provider receives only what its function needs, not everything listed in this Policy.
- Hetzner Online GmbH: hosts PackPlay's application servers, database and backups in Germany.
- Cloudflare, Inc.: DNS, delivery and protection for the website and the app's connection to our servers; processes IP addresses and request information. On the website it also adds a small script that hides e-mail addresses from spam bots.
- Apple: Sign in with Apple (including token revocation when an account is deleted) and App Store purchases.
- Google: Sign in with Google, Google Play purchases, AdMob and its consent tool (section 5).
- RevenueCat, Inc. (USA): checking store purchases and subscription status, identified by your PackPlay account id. When your account is erased, we ask RevenueCat to delete its customer record.
- Google Workspace: the support mailbox — e-mail addresses, message content and metadata.
- Authorities and advisers: where the law requires it, or where needed to establish, exercise or defend legal claims, limited to that purpose.
- A future owner: if PackPlay is transferred, the relevant data may pass to the new operator, subject to applicable law and any required notice.
Depending on the processing, these providers act as our processors or as independent controllers under their own terms and privacy information.
We do not sell user databases. Some advertising disclosures may still count as a "sale", "sharing" or targeted advertising under certain laws, depending on how ads are configured; not being paid in cash does not mean such rules cannot apply. Where they apply, you can use the opt-out and objection rights they give you.
7. Where information is processed
PackPlay's servers, database and backups are hosted by Hetzner in Germany. PackPlay is operated from Türkiye, so administrative and support access from Türkiye also involves cross-border processing. Google, Apple, RevenueCat and Cloudflare may process information in other countries, including the United States, under their own arrangements; hosting in Germany does not mean that their processing stays in Germany.
Each transfer has to meet the law that applies to it. Depending on that law, this may be an adequacy decision, contractual safeguards with any additional measures required, or a narrow statutory exception. EU, UK, Swiss and Turkish transfer rules are assessed separately; meeting one does not automatically meet another. This Policy does not itself put any safeguard in place and is not consent to unrestricted transfers. To learn which destinations and safeguards apply to your data, or to ask for a copy of a safeguard where the law gives you that right, contact [email protected].
8. How long we keep it
We keep account and game data while your account exists and the related features need it. A record is not kept merely because it might be useful.
Account deletion
- At once: when you ask to delete your account (in the app or on the account deletion page), the account is deactivated: it is hidden from other players and signed out on every device.
- Within 30 days: you can ask [email protected] to restore it. We will ask for proportionate proof that the account is yours.
- After 30 days: the account is erased. Your Apple and Google links, e-mail address and guest id are removed; your display name, username, avatar and cosmetics are removed; your friendships, blocks, invitations, notifications and their settings, coins and their history, inventory and shop purchases, progress, achievements, reward and challenge claims, pranks and in-app support requests are deleted; the text of reports you made is removed; the stored Apple token is revoked with Apple and deleted; and we ask RevenueCat to delete its customer record. Erasure is done by an automatic job; an attempt that fails is retried automatically. The requests to Apple and RevenueCat are sent after the erasure and retried until they succeed; they are not recorded as done until the provider has accepted them.
When you ask for deletion, the app or website shows a one-time deletion receipt. You can enter it on the deletion status page to see whether the erasure is complete; it is not linked to your name or e-mail, and we do not contact you about it.
Some records stay after erasure, linked only to a random internal id with no name, e-mail or sign-in method: past game results, leaderboards and room seats, shown as "Deleted player" (they are part of other players' games); reports other players made about you (safety); the reports you made, without their text; store purchase, entitlement and subscription-event records; records of actions taken on the account; the fingerprint of your deletion receipt; and a basic account record (for example when it was created, its language and the Terms version accepted). These records can no longer be used to sign in, but they are pseudonymised, not anonymous: they are still personal data and we treat them as such.
Other records
- Support e-mails in the support mailbox are not deleted automatically when an account is deleted.
- Reports, support requests, records of account actions and store records: kept while needed for the matter, follow-up, safety, legal obligations or legal claims. We have not yet set fixed periods for these.
- Server logs: application logs are rotated by size (older entries are overwritten as new ones arrive), not after a fixed number of days. A fixed period for web server logs has not been set yet.
- Backups: database backups are taken, for example before each production database update. A retention period for backups has not been set yet, so a deleted account's data can remain in older backups until those are deleted. Backups are not used to bring back a deleted account. The 30-day recovery period is not a promise that every backup is erased within 30 days.
Deleting your account does not cancel an App Store or Google Play subscription; cancel it in the store.
9. Your rights
Depending on the law that applies to you, you may have the right to be informed, to access your data and get a copy, to correct it, to have it erased, to restrict or object to processing, to data portability, to withdraw consent and to complain to a data protection authority. Where applicable, you may also opt out of a "sale", "sharing" or targeted advertising, appeal our decision on a request, or act through an authorised representative.
Under Article 11 of Türkiye's Law No. 6698 you can, among other things, learn whether your data is processed and request information about it, learn the purpose and the recipients, ask for correction or erasure where the conditions are met and for those actions to be notified to recipients, object to an adverse result produced solely by automated analysis, and claim compensation for unlawful processing. See the KVKK Aydınlatma Metni for how to apply.
In the app you can edit your profile, turn off your online status, review ad choices where they apply and delete your account; you can also delete it on this website. For anything else, write to [email protected] with the subject "PackPlay Privacy Request", saying what you are asking for and how we can find your account. We may ask for proportionate proof of identity or authority; do not send identity documents unless we ask for them. We answer within the time the law sets, and other application methods the law provides remain available.
Requests are normally free. Any refusal, limitation, extension or permitted fee will follow the law and be explained where required. Using a privacy right will not lead to unlawful discrimination. Some information is needed for sign-in, purchases and online play; without it the related feature may not work, but your other rights remain.
10. Younger users
PackPlay is intended for users aged 13 or older, or older where local law sets a higher minimum age. Users below that age must not use the Services, and users below the age of majority need the permission and supervision described in the Terms.
We do not ask for your date of birth and do not verify age, and we do not claim that any user's age has been verified. A minimum age does not replace any age assurance, parental authorisation or advertising safeguard the law requires for a particular user or feature, and a parent's permission under the Terms is not automatically valid consent for all processing. If you believe a child who is not allowed to use PackPlay has given us personal data, contact [email protected]; we will look into it and restrict or delete the account where required, keeping only what the law allows or requires. See also our Child Safety Policy.
11. Website, cookies and storage on your device
The website shows no ads and uses no visitor analytics. PackPlay's own cookies are only those needed for sign-in, protection against forged requests and completing a sign-in safely. Apple's sign-in code loads only on the sign-in page, and Google's only after you choose to continue with Google there; Google's code then sets a cookie of its own (g_state); Cloudflare, which delivers the site, may process requests and add its security features. Details: Cookie Policy.
The app stores on your device what it needs to work, such as your sign-in session, settings, its installation identifier and downloaded game content. Storage used by the advertising SDK is assessed separately under section 5; it is not "strictly necessary" just because the website's cookies are.
12. Security
Connections to the Services are encrypted (HTTPS/TLS). Access to systems is restricted, the stored Apple token is encrypted, and sessions can be revoked: deleting or suspending an account signs it out everywhere at once. No system is completely secure. Protect your Apple and Google accounts, and tell us at [email protected] if you suspect unauthorised access or find a vulnerability.
13. Changes and contact
We may update this Policy when the Services, the processing or the law change. The date at the top shows the latest version, and we give additional notice of material changes where required. An update does not by itself obtain consent for a new purpose that needs consent.
Controller and service provider: Alihan Kuru, Istanbul, Türkiye · E-mail: [email protected] · Website: packplay.app