Paint Twist Privacy Policy and Information Notice
Effective date: [EFFECTIVE DATE]
This notice explains how we process your personal data when you play the Paint Twist game (the "Game"). It is also our information notice under Article 10 of the Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"). Additional information for the European Economic Area and the United Kingdom (GDPR), the United States and children is set out in separate sections below.
1. Data controller
Elif Şen · Zekeriyaköy Mah. Yediveren Sok. İsmail Zengin Apt. No: 30 Daire: 13, Sarıyer, Istanbul, Türkiye · Privacy and data requests: privacy@nunogames.com
2. In short
- The Game does not use accounts; we do not ask for your name, phone number or location.
- We keep game statistics on our own server in Türkiye, and we do not sell them.
- Personalized ads are only shown if you give your permission. You can change your permission in Settings > Terms & Privacy > Ad preferences.
- Players under 13 play in Kids mode: there are no personalized ads and no personalized offers.
- You can always write to us about your data; we reply within 30 days.
3. What data we process
| Data | Example | Source |
|---|---|---|
| Player identifier | The random Player ID the Game creates when it is first opened | The Game |
| Device information | Language, screen size, game version and region (from your phone's region setting: Türkiye / EU / other). We do not collect your device model or iOS version; advertising partners may (section 5). | Your device |
| Connection information | IP address: our server keeps it only in memory, briefly, to prevent abuse (rate limiting); it is never written to disk or to the database and is not used to determine your country. | The connection |
| Game data | Levels you played, number of moves, times, boosters you used, rewards, league points, session lengths, your test group | The Game |
| Age group | Age group calculated from your birth month and year (under 13 / 13 and over). Your date of birth itself stays only on your device. | You |
| Purchase information | Product, price, date, Apple transaction number. We do not see your card details. | Apple |
| Ad information | Which ad was shown, whether it was watched, the reward earned; if you gave permission, your advertising identifier (IDFA) | The Game and advertising partners |
| Error logs | Technical information when the Game crashes or reports an error | The Game and Apple |
| Notification permission | If you allowed notifications, reminders (e.g. "your lives are full") are scheduled on your phone itself. We do not collect a notification token; our server does not send you notifications. | Your device |
| Parent's email | Only the email of the parent who sets up Parental Control (for PIN verification and reset) | The parent |
| Support correspondence | Your email address and message when you write to us | You |
4. Why we process data and on what legal basis
| Purpose | Legal basis (KVKK / GDPR) |
|---|---|
| Running the Game, giving you your progress and what you bought, running the league and events | Formation and performance of a contract (KVKK Art. 5/2-c · GDPR Art. 6/1-b) |
| Improving the Game: adjusting level difficulty, finding bugs, game statistics and A/B tests | Legitimate interest (KVKK Art. 5/2-f · GDPR Art. 6/1-f) |
| Selecting in-game offers based on your play style | Legitimate interest (KVKK Art. 5/2-f · GDPR Art. 6/1-f). You always have the right to object (section 9). [LAWYER: whether explicit consent is required for Türkiye] |
| Showing personalized ads and measuring ads | Explicit consent (KVKK Art. 5/1 · GDPR Art. 6/1-a) and, on iPhone, Apple's tracking permission |
| Showing non-personalized ads | Legitimate interest (KVKK Art. 5/2-f · GDPR Art. 6/1-f); in the EEA and the UK, consent as required by local rules |
| Protecting children (Kids mode, Parental Control) | Legal obligation and legitimate interest (KVKK Art. 5/2-ç, f · GDPR Art. 6/1-c, f) |
| Preventing cheating and misuse, security | Legitimate interest (KVKK Art. 5/2-f · GDPR Art. 6/1-f) |
| Keeping purchase records, legal obligations | Legal obligation (KVKK Art. 5/2-ç · GDPR Art. 6/1-c) |
| Answering support requests | Performance of a contract and legitimate interest |
Automated decisions and adapting to how you play. The Game adjusts some things automatically based on how you play:
- If you lose several times in a row, it offers help such as a hint or an extra move, and chooses when help messages appear and how they are worded.
- Outside Kids mode, it chooses in-game offers based on your play style.
- If you gave permission, advertising partners choose ads based on your interests.
The Game never secretly changes the board or the move limit, and never makes the game harder for a particular player. These adjustments do not produce legal or similarly significant effects for you. You can still object to them (section 9).
5. Who we share data with
We do not sell your data. We share it only with the following partners, and only as much as necessary:
- Hosting: Our game server is located in Türkiye (Istanbul) and is hosted by DT Cloud.
- Apple: for purchases, iCloud saves and crash reports.
- Advertising partners: AppLovin (MAX), Google (AdMob), Meta (Audience Network), Unity (Unity Ads) and the ad networks they mediate. These companies process device information, IP address and, if you gave permission, your advertising identifier under their own privacy policies, in order to show ads, measure them and prevent fraud. In Kids mode, AppLovin is never started; only Google shows ads, with child-appropriate settings.
- Email service: Google (Google Workspace). We use it to send Parental Control codes and to handle support emails. Google processes this data only on our behalf and on our instructions; it does not use it for its own purposes.
- Competent authorities: when there is a legal obligation.
List of advertising partners and links to their privacy policies: [LINK].
Our contracts with service providers require them to process data only on our behalf and to protect it.
Other services: Ads or links in the Game may take you to other apps and websites (for example the App Store). Those services are subject to their own terms and privacy policies; we are not responsible for their practices.
6. Transfers abroad
Our own server is in Türkiye. Some of our partners process data on servers abroad:
- Google (email service): The parent's email address, the code email sent to it and support emails are processed in Google's data centers (including the EU and the US). This transfer is based on a standard contract with Google under KVKK Art. 9. The contract is notified to the Turkish Personal Data Protection Authority within 5 business days of signature. For players in the EEA and the UK, Google's EU Standard Contractual Clauses apply. List of Google's subprocessors: workspace.google.com/terms/subprocessors.html
- Apple and advertising partners: They may process data on their servers in the United States and other countries. These transfers are made under KVKK Art. 9 on the basis of [LAWYER: standard contract / explicit consent] and, for the EEA and the UK, on the basis of the EU Standard Contractual Clauses or adequacy decisions.
7. How long we keep data
| Data | Period |
|---|---|
| Game data linked to a Player ID | At most 13 months; then deleted or anonymized so that it cannot be linked to anyone |
| Anonymous statistics | Indefinitely (cannot be linked to anyone) |
| Purchase records | For the statutory retention periods ([LAWYER: e.g. 10 years]) |
| Parent's email | Until Parental Control is turned off |
| Support correspondence | 2 years after the request is closed |
| Error logs | 90 days |
8. Personalized ads and your permissions
- Türkiye: The "personalized ads" checkbox on first launch is empty by default; you only give explicit consent if you tick it yourself.
- EEA, UK and Switzerland: On first launch, Google's consent window appears; you choose your preferences there.
- iPhone: If you answer "Ask App Not to Track" to Apple's tracking question, your advertising identifier is not shared.
- You can withdraw your permission at any time in Settings > Terms & Privacy > Ad preferences. Withdrawing does not affect processing carried out before that. Even if you turn off personalized ads, you will still see ads; they just won't be chosen based on your interests.
9. Your rights and how to use them
Under KVKK Art. 11, you have the right to:
- learn whether your data is processed and for what purpose;
- know the persons to whom your data is transferred;
- request that incomplete or incorrect data be corrected, or that your data be deleted or destroyed, and request that this be notified to the persons to whom it was transferred;
- object to a result against you that arises solely from the analysis of your data by automated systems;
- request compensation if you suffer damage because of unlawful processing.
If you are covered by the GDPR, in addition:
- you have the right to receive a copy of your data in a portable format;
- you can request that processing be restricted;
- you can always object to processing based on legitimate interest, in particular to personalized offers;
- you can lodge a complaint with the data protection authority of the country where you are.
How to apply: Write to privacy@nunogames.com and include your Player ID from Settings > Terms & Privacy. Because the Game has no accounts, we find you by this number. You can write in Turkish or English; we reply free of charge within 30 days at the latest. We may ask for additional information to verify your identity. You can also submit KVKK requests in writing or by registered electronic mail (KEP) in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ). Your right to complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) in Türkiye remains unaffected.
Deleting your data: Because the Game has no accounts, you request deletion by writing to privacy@nunogames.com with your Player ID.
- The game data linked to your Player ID on our server, and the parent's email if any, are deleted or anonymized so they cannot be linked to anyone, within the time we take to answer your request.
- Purchase records are kept until the legal retention period ends (section 7).
- Progress on your device is deleted when you delete the Game. You can delete the iCloud backup in your iPhone's iCloud settings.
- Deleted progress and purchased virtual items cannot be restored.
10. Children
- The Game is open to all ages. On first launch, the birth month and year are asked; age information shared by Apple is also used.
-
For players under 13, Kids mode turns on automatically and cannot be turned off by the player. In Kids mode:
- there are no personalized ads and no personalized offers;
- Apple's tracking question is not asked, and the advertising identifier is not collected;
- only ads suitable for children are shown;
- game statistics are processed only to run and improve the Game.
- Parents can lock purchases with a PIN using Parental Control. We use the email address given for this only to send the PIN code and to reset the PIN; we never send ads or promotional emails to it.
- If you believe a child's information has been processed in breach of this policy, write to us and we will take the necessary action.
11. Players in the United States
- We do not sell your personal information for money.
- If you gave permission, the processing carried out by our advertising partners for personalized ads may count as "sharing" under California law. To stop this, you can turn off personalized ads in Settings > Terms & Privacy > Ad preferences. We also honor the Global Privacy Control signal from your browser or device.
- We process the data of children under 13 in accordance with COPPA, only to support the operation of the Game (section 10).
- [LAWYER: California thresholds and state-specific addenda]
12. Security
We take technical and organizational measures to protect your data, such as encrypted connections, access restrictions and regular backups. No system is completely secure. If a data breach occurs, we will notify the Turkish Board within the period it requires (72 hours) and the people affected without delay; for players in the EEA and the UK we also follow the rules that apply there.
13. Changes
We may update this notice. If there is an important change, we will let you know in the Game. The current version is always available in Settings > Terms & Privacy.
14. Contact
Elif Şen · Zekeriyaköy Mah. Yediveren Sok. İsmail Zengin Apt. No: 30 Daire: 13, Sarıyer, Istanbul, Türkiye · privacy@nunogames.com