Privacy Policy
Last updated: November 7, 2026
This policy explains how personal data is processed when you use the Word Mix-Up mobile game (also published as “Kelime Karmaşası”, the “App”). It meets the transparency requirements of the EU General Data Protection Regulation (GDPR, Art. 13/14) and the Turkish Personal Data Protection Law No. 6698 (KVKK). The Turkish version is available here.
1. Controller
Yasin Dalkılıç
Contact: yefem.dalkilic@gmail.com
2. Data we process
| Data | Details | Purpose |
|---|---|---|
| Nickname and avatar | The display name you choose and a drawn animal avatar (no real name needed). | Showing you in matches and leaderboards |
| Profile photo (optional) | Only if you upload one: the photo you choose. It is stored with our processor Cloudinary and is downsized on your device before upload. Your photo is shown to your opponent and on leaderboards. It is deleted if you switch back to an animal avatar or delete your account. | Personalising your profile (your consent) |
| Personal details (optional / age) | Your date of birth (required to verify your age), first and last name and gender (both optional; “prefer not to say” is available). When you sign in with Apple/Google we take the name the provider supplies; date of birth and gender are never taken from the provider. These details are visible only to you and are never shown to other players or shared with third parties. You can change or delete them under Settings → My personal info. | Enforcing the age limit and protecting children; a personalised experience (name) |
| Notification token | If you allow notifications: the code Apple (APNs) or, on Android, Google (Firebase Cloud Messaging) assigns to your device, plus your language and time zone. | Invites, match reminders, friend and daily-puzzle notifications (switchable per category in Settings) |
| Device identifier | A random code generated by the app; it is not an advertising ID. | Recognizing your guest account |
| Apple / Google account identifier | Only if you sign in with them: the unique code the provider issues. We never see your password. | Restoring your account on a new device |
| Game data | Scores, match results, win streak, friend list, game language, hint and gem balances and their history. | Running the game, rankings, matchmaking |
| Voice and spoken words | Voice mode only: speech recognition to understand your answer (by Apple on iPhone or Google on Android, on your device or on the provider's servers). The recognised text (the words you say) appears live as text on your opponent's screen; for each round the text of the words or phrases you say (text only) and the exact moment you said your correct answer (in milliseconds into the round) are kept for 30 days for fair results and appeals; correct answers are shown to both players after the round. If you delete your account these records are deleted too. We do not store audio recordings and your voice is never sent to your opponent. | Voice game mode, fair results, appeal review |
| Purchase information | The transaction ID and product from Apple or Google Play. To verify purchases, the transaction is shared with our processor RevenueCat together with your account ID. We never see your card or payment details. | Crediting purchased gems, fraud prevention |
| Technical and security logs | IP address, device/OS version, error logs, request times. | Security, preventing cheating and abuse, debugging |
| Usage statistics | Anonymous usage events such as which screens are opened, use of features like matches and the shop, app version and language. Text you enter (nickname, answers, suggestions) and your voice are not part of this data. Before sign-in it is tied to a random device-specific ID, afterwards to your account. Kept for 90 days. You can turn it off in Settings → Usage statistics. | Improving the product and analysing errors/performance (legitimate interest) |
| Reports and blocks | If you report a player: the reason and your note. | Community safety and moderation |
| Advertising data | Rewarded ads are served by Google AdMob. We only request non-personalized ads and do not use your advertising ID for personalization. | Letting you earn free hints |
We do not collect location, contacts, photos or health data and we use no third-party analytics or tracking SDKs.
3. Purposes and legal bases (GDPR Art. 6)
- Providing the game, creating accounts, matchmaking and rankings — performance of a contract (Art. 6(1)(b)).
- Security, preventing cheating/abuse and fraud, fixing bugs, reviewing reports — legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)).
- Keeping purchase records — legal obligation and contract.
- Microphone and speech recognition in voice mode — consent (Art. 6(1)(a)) through the system permission; you can withdraw it any time in Settings, after which you can still play in typing mode.
4. Recipients and processors
We do not sell your data. We share it only as needed with these providers: Railway (hosting, USA); Apple Inc. (App Store payments, Sign in with Apple, speech recognition, Game Center); Google LLC (Google sign-in, Google Play payments, Android notifications via Firebase Cloud Messaging, speech recognition on Android, AdMob rewarded ads); public authorities where legally required.
5. Transfers to third countries
Some providers are located in the USA. Transfers rely on an adequacy decision (e.g. EU–US Data Privacy Framework certification) or the EU Standard Contractual Clauses with additional safeguards (GDPR Art. 44 ff.). You can request a copy of the applicable safeguards at yefem.dalkilic@gmail.com.
6. Retention
- Account and game data: as long as your account exists. When you delete your account, personal data is deleted or anonymized (match statistics remain without identity).
- Technical/security logs: up to 12 months.
- Reports: up to 24 months for moderation and legal deadlines.
- Purchase records: for the statutory retention periods.
7. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (16), erasure (17), restriction (18), data portability (20), objection (21) and to withdraw consent at any time (7(3)). Under KVKK Art. 11 you have equivalent rights. In the app: Settings → Download my data (access/portability), Settings → Delete my account (erasure). For other requests email yefem.dalkilic@gmail.com; we answer within 30 days, free of charge. You may also lodge a complaint with your local data protection supervisory authority (in the EU, the authority of your country) or the Turkish Personal Data Protection Authority.
8. Children
The App is not directed at children. Users in the EU must be at least 16 years old (or the age of digital consent in their country); younger users need their parent's or guardian's consent. We do not knowingly collect data from children under 13. If you believe we have, write to us and we will delete it immediately.
9. Security
Data is encrypted in transit with TLS, session tokens expire, and access is restricted. No system is entirely risk-free; in case of a breach we meet our notification duties under applicable law.
10. Changes and cookies
We may update this policy; important changes are announced in the app. This website uses no cookies and does not identify or track you. It only uses Cloudflare Web Analytics for aggregate, anonymous page statistics (for example how many times a page is viewed): no cookies are set, no IP address or personal data is stored, and individuals are not tracked across sites.