KilkuleThis policy explains how your personal data is processed when you use the Kilkule mobile game (iPhone) and this website (the “Service”).
Controller: Mehmet Mutlu (an individual developer living in Türkiye; “Kilkule”, “we”). Contact: destek@mm-apps.com. If the Turkish and English texts differ, the Turkish text prevails for players in Türkiye.
Summary
- We don't ask for your name, email or location. You don't need to give a name, email, phone number, address, ID number or date of birth to play. We don't access your location, contacts, photos, camera or microphone. We don't ask for or use Apple's advertising identifier (IDFA).
- Players are stored under random IDs. On first launch an anonymous player account with a random ID is created for you. It contains no name, but legally it still counts as personal data (pseudonymous data). This policy covers it.
- We only process what the game needs: your progress, battle results and move records, your in-game wallet, your league and daily rift standings; and, if you choose to watch a rewarded video, the check of that reward.
- Results are verified on the server. A battle's move record is replayed on our server with the same game rules, so boards and rewards stay fair for everyone.
- We keep data briefly (Retention). We don't write IP addresses to server access logs or game data.
- We don't sell your data or use it for ad targeting, and we use no third-party analytics or crash-reporting tools.
- You can delete your account from inside the app at any time.
1. Data we process
| Category | Examples | When |
|---|---|---|
| Account | A random player ID and session key. No name, email or phone number is asked for. | On first launch |
| Profile | The nickname the game gives you (you don't choose it), and the league card and emblem shown on the boards. | When you appear on a board |
| Battle results | The level you played, whether you won, your stars, the battle's move record (which defense you built on which slot and when, which card you picked, when you used the skill), the game version; your Time Rift results and score; your Endless run (sectors, depth, rescues). | At the end of every battle |
| Progress and wallet | Your Gold, Crystal, Age Shard, XP and Endless Dust balances and their movements (why they were earned or spent); your Workshop and Root Tree nodes; the daily gift; your Age Path progress; the cosmetics you bought in the Showcase and wear. | As you play |
| Boards | Your Weekly League group, points and tier; your Depth League depth; your place on the daily Time Rift board; your number on the Gate Openers' Wall. | As you play |
| Rewarded video | When you choose to watch a rewarded video: a single-use random ticket we create to check the reward, and the record of the reward (for which level result, when). For the ad data Google processes, see Ads. | When you choose to watch |
| Security and anti-cheat | Records of a result or spend the server rejected, and cheat flags; app and battle version. Your IP address is used momentarily during a connection to limit excessive requests; it is not written to server access logs or game data. Only the sign-in service's session record keeps the IP address the session was opened from and app information (user agent); it is deleted with the session when you delete your account. | On every connection |
| Support emails | If you email us: your email address and message, used only to answer and to keep a record of the outcome. | When you write to us |
A copy of your settings (sound, haptics, battery saver) and progress stays on your device so you can play offline. The “Playtest report” in Settings exists only in test builds and is shared only if you choose to share it.
2. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the game, saving your progress and wallet | Account, battle results, progress and wallet | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c) |
| Weekly League, Depth League, Time Rift and the Gate Openers' Wall | Profile, battle results, boards | Performance of a contract |
| Verifying results and rewards, preventing cheating and abuse | Battle results and move records, wallet movements, security records | Legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5/2-f): keeping boards and rewards fair for everyone |
| Showing a rewarded video when you ask, and checking the reward | Rewarded video records; Google's ad data | Performance of a contract (the reward you asked for) and legitimate interests (an ad-supported free game). In the EEA, UK and Switzerland, personalized ads are shown only if you agree in Google's consent form. |
| Answering support and rights requests, keeping a record of deletions | Support emails, account | Legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5/2-ç); legitimate interests |
We don't use your data for profiling-based automated decisions or marketing. Anti-cheat checks may void a result or spend that breaks the rules; if you want to dispute that, write to us.
3. What other players see
On the boards, other players see the nickname the game gave you, your league card and your emblem. Also:
- Your Weekly League group: your points, place and tier this week.
- Depth League: your Endless depth and place this week.
- The daily Time Rift board: your score and place (the top 20 are visible to everyone).
- The Gate Openers' Wall: which number you were to open the Mythic Gate.
4. Service providers and international transfers
We share your data only with the providers needed to run the Service, and only as far as their service requires:
- Güzel Hosting (GNET İnternet Telekomünikasyon A.Ş., Türkiye): the virtual server that holds our server and backups. The database, authentication and server functions run there on software we operate (open-source Supabase). Backups are encrypted and kept for 30 days in Güzel Hosting's backup space in Türkiye.
- Google LLC / Google Ireland Ltd.: AdMob rewarded video and consent management (User Messaging Platform); Google processes data as an independent controller under its own policy. Privacy
- Apple Inc.: the App Store and app distribution (including TestFlight); an independent controller. Privacy
- GitHub Inc. (USA): hosting of this website; GitHub processes access logs that include IP addresses under its own policy. The site uses no cookies.
- Email: our support address is hosted on Güzel Hosting's business email service; emails you send us are stored in Türkiye. Our replies are relayed through Güzel Hosting's mail relay MailChannels Corporation (Canada; servers in North America); the reply and your address pass through its servers without being stored there.
International transfers: Our server is in Türkiye. When you choose to watch a rewarded video, ad data goes to Google; when you use the App Store, the related data goes to Apple, as part of your choice to use those services and your own relationship with those companies. Our replies pass through MailChannels' servers (Canada) in transit. Data may also be shared with competent public authorities where the law requires it.
Players in the EEA, UK and Switzerland: the controller and our server are in Türkiye; your data is processed and stored in Türkiye. There is no EU adequacy decision for Türkiye. The retention periods, security measures and rights in this policy apply to you as well.
5. Ads
Kilkule shows an ad only when you ask for one: when you tap “Double the reward” at the end of a level to double your Gold and XP (up to 5 a day). No ads interrupt the game, and ads are limited to content suitable for a general audience.
- Ads are served by Google AdMob. To show and measure ads and to prevent fraud, Google processes device and app information, your IP address (including inferring an approximate location) and ad interactions. We don't collect your location.
- The app doesn't ask for iOS's “Allow Apps to Request to Track” permission, so Apple's advertising identifier (IDFA) is not used.
- To check the reward, we attach a single-use random ticket to the ad; your player ID is not sent to Google.
- In the EEA, UK and Switzerland, Google's consent form is shown before an ad loads; personalized ads are shown only with your consent. You can change your choice in Settings → Ad privacy options.
- How Google uses data: policies.google.com/technologies/partner-sites.
6. Retention and deletion
- We keep game data for as long as your account exists.
- A verified battle's move record is deleted 90 days after verification (the result itself stays with your account). Pending results that could not be verified are deleted after 30 days.
- Time Rift results, Endless run records and rewarded video records are kept for at most 90 days.
- Our server's technical logs (request time, error details) are kept for at most 7 days and deleted automatically.
- When you delete your account (Settings → Account → Delete account), your account and all game data linked to it are deleted immediately and leave encrypted backups within 30 days. Exception: for anti-cheat checks, wallet movements and cheat flags are kept for up to 12 months with the link to your player ID removed, then deleted. We record the deletion itself only with a date and a random request number (without your ID) for 24 months. Details: Delete your account.
- Support emails are kept for as long as needed as proof once the request is settled, then deleted.
- Deleting the app from your device only deletes the data on the device; to delete your account on the server, use “Delete account” in the app first.
7. Security
We take reasonable technical and organizational measures to protect data: data is encrypted in transit with TLS; backups are encrypted; in the database each player can reach only their own data (row-level security); sensitive operations such as balances, rewards and rankings happen only on the server; only the developer administers the server. Data on your device is protected by your device's own security.
No system is completely secure. If we learn of a data breach, we act to limit its impact and make the notifications the law requires (to the authority and, where needed, to you).
8. Children
Kilkule is a game players of any age can play, with no blood and no horror. It isn't designed specifically for children and isn't in the App Store's Kids category. We don't ask for a name, email or date of birth; ads are shown only on request and with content suitable for a general audience. If we learn that a child under 13 (or a higher age where that applies in your country) has given us personal data, we delete it. Parents and guardians can write to destek@mm-apps.com.
9. Your rights
Under the GDPR and related local laws (in the EEA, UK and Switzerland) and KVKK Art. 11, you have the right to know whether your data is processed, to access and receive a copy, to rectification, erasure, restriction and objection, to data portability and to withdraw consent.
How to apply: You can delete your account straight away in the app. For anything else, write to destek@mm-apps.com. Since we keep no name or email, we may ask you for extra information to confirm the request comes from you. We answer within 30 days, free of charge. You keep the right to complain to the Turkish Personal Data Protection Authority or to the data protection authority in your country.
10. Changes
We may update this policy. When in-app purchases, Sign in with Apple or new online features arrive, we'll describe here which data is processed for what, and announce important changes in the app as well. The current version is always on this page. This policy doesn't limit your statutory rights.