Privacy Policy

Personal Data Collected

The following information is collected when an account is created:

• The account holder’s first and last name
• The account holder’s email address
• Password (the password never reaches the App; see “Passwords” below)
• Account type (parent or teacher)
• The date and time parental consent was given

When the App is first used, the child chooses a nickname. The nickname does not need to be the child’s real name; on teacher accounts this field contains the class name.

The following information is recorded while the App is used:

• Experience points (XP), gold and level earned
• Lessons and games completed
• Daily login streak
• Number of games played
• The date and time the App was last used (so that account activity can be monitored from the administration panel)
• Character appearance and unlocked outfits
• Selected board colour, piece set and pet

Character and appearance preferences are stored with the account so that the same appearance is shown when the App is accessed from different devices.

For sending notifications:

• Device notification token. This record identifies the device to which notifications are delivered, not the user; it is deleted when the user signs out or the account is deleted, and it is not used for advertising or tracking.

If a support request is submitted:

• The title and description of the request
• The selected topic (question, bug or suggestion) and priority
• The account holder’s email address and name (in order to reply to the request)
• Device type (web or Android) and App version (in order to investigate the reported issue)

Submitting a support request is optional; this information is not collected unless a request is submitted.

Sound, music, vibration and large-text preferences are stored only on the device and are not sent to the server.

Data Not Collected

The following data is not collected through the App:

• Location data
• Camera or microphone recordings
• Contacts, phone number and postal address
• The child’s surname, date of birth and school
• Advertising identifier (AAID / IDFA)

The App does not display advertisements. No third-party advertising networks or behavioural analytics tools are used.

Purpose of Processing the Name

The account holder’s first and last name are processed solely for identity verification. Requests such as deletion of data or provision of a copy require verification that the request belongs to the account holder; relying on the email address alone could allow third parties with access to that address to make requests on the account holder’s behalf.

This information is not used for advertising, profiling or marketing.

Phone Number

A phone number is not requested, as the App offers no SMS verification, telephone support or two-step verification. Under data protection law, personal data must be relevant, limited and proportionate to the purpose for which it is processed; collecting data that will not be used would be contrary to this principle.

Should a feature requiring a phone number be added in the future, this text will be updated and users will be asked for separate consent.

Note on Email Addresses

Although the child’s surname is not collected, an email address is itself personal data and often contains a first and last name. An address such as “ahmet.yilmaz@ornek.com” may contain the account holder’s surname and therefore, most likely, the child’s surname as well.

This information is not shared with third parties and is not used for advertising or profiling.

Passwords

Passwords never reach the App. Authentication is handled by the Google Firebase Authentication service; the password is sent directly to Google’s servers and stored there in salted form.

As a result, no one, including the App’s developers, can view passwords. A forgotten password can be reset by email.

Where Data Is Stored

Account and progress information is stored with the Google Cloud Firestore service on servers in the European region (europe-west).

Progress information is also kept in the device’s own storage, so that the App continues to work when the internet connection is lost and data is synchronised once the connection is restored.

Sharing of Data

Personal data is not sold, rented or shared with third parties for marketing purposes.

The Google Firebase infrastructure (Authentication, Firestore and Cloud Messaging for notifications) is used to process data. Subscriptions are purchased through Google Play and the App Store; the RevenueCat service (RevenueCat, Inc.) is used to verify and track subscriptions. Only the account’s user ID, device information and the store’s purchase record are shared with RevenueCat; no name, email address or payment card details are shared. Google and RevenueCat act as data processors for these services.

If a legal obligation arises, such as a court order, only the information requested is disclosed to the relevant authorities.

Retention Period

Personal data is retained for as long as the account remains open. The account can be deleted from within the App via Settings → Danger Zone → Delete Account; password verification is required.

After a deletion request, the account is closed immediately, while the data is retained for 30 days; during this period the deletion can be cancelled by signing in to the account. When this period expires, the account, progress records, device record and submitted support requests are permanently deleted.

There are two exceptions to this rule:

• If a payment was made, the record of the sale (amount, date and plan) is retained as required by tax law; since its retention is a legal obligation, a deletion request does not cover this record. Purchases are made through Google Play and the App Store; the invoice is issued by the store and no customer information is created on our side.
• The App’s error logs are retained in de-identified form; they contain only which error occurred in which version and on which screen.

Support requests are retained until the account is deleted, in order to monitor whether the same issue recurs.

Preferences stored on the device are deleted when the App is uninstalled and are not included in the phone’s cloud backup; when moving to a new device, progress is retrieved from the server upon signing in, not from a backup. If the App is used through a web browser, preferences remain in that browser; on shared computers, signing out is sufficient.

Your Rights

Under applicable data protection law you have the right to:

• Learn whether your personal data is processed and which data is processed
• Request a copy of the data processed
• Request the correction of incomplete or inaccurate data
• Request the deletion of your personal data
• Object to the processing of your data

Requests may be sent to destek@satranchayalim.com. Requests are answered within 30 days at the latest.

Children’s Personal Data

Although the App is intended for children aged 6–7, the account always belongs to, and is created by, an adult. No contact information is collected directly from the child.

The only information that could identify the child is the nickname the child chooses in the App. The nickname is used only for greetings and the profile within the App.

Further information is available in the “For Parents” section of the App.

Security Measures

Access to the database is restricted by security rules enforced on the server. Each user can read and modify only their own records and cannot access other users’ data.

Users cannot change their own role or subscription status; these fields can be changed only by an administrator.

Changes

If this Privacy Policy is changed, the date of the last update will be revised; significant changes will also be announced within the App.