This policy explains which personal data is processed in connection with the NumberChallenge mobile game (the "App"), for which purposes and on which legal bases, and sets out the rights of data subjects. It is provided in fulfilment of the information obligations under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, for users in the European Economic Area, Article 13 of the General Data Protection Regulation ("GDPR").
Controller within the meaning of the KVKK and the GDPR: İsmail KARHAN (independent developer, Türkiye).
Contact: ikarhan@gmail.com
By default the App operates anonymously, without account registration. Name, phone number, location, contacts and photos are never requested or processed. An e-mail address is processed only if you use the optional account features (Google sign-in or e-mail/password registration). The complete list of processed data is set out below; items marked "optional" are processed only if you use the corresponding feature.
| Data category | Scope | Location |
|---|---|---|
| Account identifier | A random identifier (UUID) generated on first launch. It is not a device identifier and does not in itself contain information capable of identifying you. It can be viewed and copied under Settings → Account ID. | Server |
| Display name and username | The display name is assigned automatically ("Oyuncu-1234") and editable (max. 20 characters). You may also choose a unique username ("@username"). Both are visible to other players in matches, room lists, leaderboards and season records; weekly and season boards are retained historically. You are advised not to use your real name or any expression capable of identifying you. The display name must be 3–20 characters; the server refuses names containing invisible characters, names impersonating staff or brands, and abusive names. | Server |
| Gameplay data | Match records, guesses and clues, rating (ELO), league, win/loss statistics, match history, last-seen timestamp, daily play streak and hint tokens, unlocked achievements, end-of-season rating/league/rank records. For the daily streak, the device's time zone (a city-level name such as "Europe/Istanbul") is stored; it serves to anchor your day boundary to local midnight and does not constitute location data. Season records and leaderboard rows are visible to other players. | Server |
| Usage events | Limited to five event types: app open, tutorial completed, bot match started, bot match finished, error report. The server does not accept events outside these five types. | Server |
| Error reports | For caught errors: error type, message (max. 1024 characters), truncated technical trace (max. 5120 characters), app version and platform name. No third-party crash or analytics SDK is used. | Server |
| Purchase record | For the "Remove Ads" purchase: the purchase token generated by Google Play and its verification result. Payment instrument details (card etc.) remain exclusively with Google Play and are not transferred to the controller. | Server |
| Server access logs | Requests to the server leave the IP address and request time in short-lived access and security logs. These records are kept solely to operate the service and prevent abuse; they are not used for profiling or advertising. | Server |
| Notification registration (optional) | If notifications are permitted: the registration token generated by Google Firebase Cloud Messaging, the app language and the time zone. The token is not a device identifier and is used solely to deliver notifications. If permission is not granted, none of this data is processed and the App functions unchanged. | Server + Google (delivery only) |
| Account sign-in (optional) | If game progress is tied to an account: with Google sign-in, the e-mail address and Google user ID of that account; with e-mail/password registration, the e-mail address and an irreversible digest of the password (the password is never stored in plain text and cannot be read by the controller). On a password-reset request, a 6-digit verification code is sent to your e-mail address. Unless these features are used, the account remains fully anonymous; the App never requires sign-in. | Server |
| Player reports (optional) | When you report a player: the account identifiers of the reporter and the reported player, the reason you chose (inappropriate name / cheating / other), a copy of the reported player's display name at the time of the report, and a timestamp. There is no free-text field — no text you write is processed. The records are visible only to the controller, for moderation; they are never passed to the reported player and the reporter's identity is never disclosed. | Server |
| On-device settings | Theme, language, notepad preference, sound/music/haptics preferences, tutorial and notification preference flags. Stored only on the device; not transmitted to the server. | Device |
Personal data is collected by automated means, electronically through the App, in the course of its use. Neither the App nor this web page uses cookies. The processing purposes and the legal bases relied upon are as follows:
| Purpose | Data concerned | Legal basis (KVKK art. 5 / GDPR art. 6) |
|---|---|---|
| Providing the game service: matchmaking, running matches, leaderboards, seasons, achievements, granting the purchased entitlement | Account identifier, display name, gameplay data, purchase record | Performance of a contract (KVKK art. 5/2-c; GDPR art. 6(1)(b)) |
| Security and stability of the service: debugging, prevention of abuse and cheating | Usage events, error reports, access logs (IP) | Legitimate interest (KVKK art. 5/2-f; GDPR art. 6(1)(f)) |
| Personalized advertising (Google AdMob) | Device/advertising identifiers processed by Google | Explicit consent (KVKK art. 5/1; GDPR art. 6(1)(a)); managed via the consent screen and revocable at any time |
| Sending notifications: opponent joined your room, streak reminder, season closing and result | Notification registration (token, language, time zone) | Explicit consent (KVKK art. 5/1; GDPR art. 6(1)(a)); given via the system notification permission, revocable at any time in device settings |
| Creating/linking an account (Google or e-mail/password) and carrying progress across devices; password reset | Account sign-in data (e-mail, Google user ID or password digest) | Performance of a contract at the data subject's request (KVKK art. 5/2-c; GDPR art. 6(1)(b)) |
| Enforcing the community rules: assessing reports of inappropriate display names and cheating, resetting a name or closing an account where warranted | Player reports, display name and username | Legitimate interest (KVKK art. 5/2-f; GDPR art. 6(1)(f)) — keeping the game environment safe and complying with the store's user-content rules |
| Data | Period |
|---|---|
| Usage events and error reports | At most 180 days; deleted automatically on the server thereafter |
| Account, display name/username, gameplay and purchase records (incl. account sign-in data) | Until a deletion request (see §9) |
| Notification registration | Deleted automatically after 180 days of device inactivity; delivered-notification records are deleted within 30 days. Revoking the notification permission stops new deliveries |
| Player reports | Deleted automatically on the server 180 days after the report is resolved; retained for that window so repeat abuse stays visible. Reports not yet assessed are never deleted |
| Access/security logs (IP) | Short-lived; rotated in the routine operating cycle |
| On-device settings | Until the App is uninstalled; uninstalling removes them from the device |
The App shows interstitial ads between matches and a rewarded "watch an ad for a hint" ad that plays only when initiated by the user, both via Google AdMob. There are no banner ads on the game board and no ads during a match.
AdMob may process data such as device identifiers for ad serving under Google's own policies. In the European Economic Area and the United Kingdom, Google's consent screen (UMP) is shown before the first ad; where consent is not given, the ads SDK is not initialized and no ads are shown. Further information: Google Privacy Policy · How Google uses data.
The "Remove Ads" purchase removes interstitial ads. Payment is processed exclusively by Google Play.
All server-side data is kept on a server operated by the controller and hosted in Türkiye, and travels only over TLS-encrypted connections. Personal data is not sold and is not shared with third parties except in the cases listed below. Transfers abroad take place only within the scope of the following services, to the global infrastructure of Google LLC (KVKK art. 9):
These transfers occur only insofar as the corresponding feature is used, and within the framework of the data-protection commitments to which Google is subject. Where a feature is not used, no transfer takes place.
The App does not employ decision-making based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. Rating (ELO) and league calculation is a game mechanic serving only in-game matchmaking and ranking. Ad personalization is carried out only within the consent framework described in §5 and by Google.
Under KVKK art. 11 you have the right to learn whether your personal data is processed; to request information about such processing; to learn its purpose and whether the data is used in line with that purpose; to know the third parties to whom it is transferred, in Türkiye or abroad; to request rectification of incomplete or inaccurate data; to request erasure or destruction; to request that these actions be notified to the third parties to whom the data has been transferred; to object to a result arising to your detriment from analysis carried out exclusively by automated systems; and to claim compensation for damage arising from unlawful processing. Users covered by the GDPR additionally have the rights of access, rectification, erasure, restriction of processing, objection and data portability; where processing is based on consent, consent may be withdrawn at any time.
Applications may be submitted to ikarhan@gmail.com together with the account identifier copied from Settings → Account ID in the App. Applications are concluded within the period prescribed by the KVKK and in any event within 30 days. You may also lodge a complaint with the Turkish Personal Data Protection Board; EEA users may contact the supervisory authority in their own country.
Uninstalling the App removes only the local data on the device; the account record on the server remains. There are two ways to delete your account:
Step-by-step instructions and the full list of what is deleted and what remains: nc.ikarhan.com/account-deletion/.
Deleted: your sign-in data (e-mail, password, Google link, sessions), your display name and username, your rating, league and statistics, achievements, daily streak and hint tokens, notification registration, purchase records, error and usage events, your secret numbers from matches, rooms you created, and your season results.
Retained in anonymised form: the records of matches you played (date, mode, moves, outcome) are not deleted, because they are also your opponents' game history and their statistics cover those matches. Your name in those records is replaced with "Silinmiş oyuncu" (deleted player); the record can no longer be linked to you and contains no data identifying you. Copies in routine server backups expire on their own as the backup cycle rotates (35 days at the latest).
If you purchased the ad-free version, deleting your account does not refund it (refunds are handled by Google Play); because your purchase record is deleted too, you can restore the purchase on a new profile using the same Google Play account.
All traffic is TLS-encrypted. Game rules and data access are enforced server-side: no player can read another player's secret number or any data that is not their own. Server access is limited to the controller, and regular backups are maintained.
The App is not directed at children under 13, and no data is knowingly collected from persons under 13. Should such processing come to attention, the data concerned is deleted without delay; notifications to that effect may be made through the channel in §8.
Changes to this policy are published on this page with an updated effective date; significant changes are additionally announced within the App.
The contractual terms for using the App are in a separate document: the Terms of Service.