King (Rifki) — Privacy Policy

Summary

Data We Process

We do not collect real name, email, phone, precise location, contacts, photos, microphone, or camera data.

Third-Party Services

Unity LevelPlay (advertising)

On iOS, banner and interstitial ads are shown to support free access; the Android app currently shows no ads. Ads are delivered through the Unity LevelPlay (ironSource) mediation SDK, which may pass the ad request to ironSource Ads, Unity Ads, and other mediated demand partners. Before any ad is requested the app shows its own consent prompt once, and your answer is forwarded to the SDK and every mediated network; on iOS we then present the App Tracking Transparency prompt. Declining either limits ads to non-personalised and disables the advertising identifier for ad purposes. You can change your answer at any time with Settings → Reset Consent. No ads are served while the "Remove Ads" purchase is active. Ad impressions report only the ad format, network name, and estimated revenue to our analytics — never who saw the ad. Unity privacy policy · Unity Ads & LevelPlay privacy policy.

Firebase Analytics

We use Firebase Analytics to understand which screens are used, which contracts are most popular, and session duration to inform product decisions. Firebase assigns a pseudonymous App Instance ID; we do not send real names, emails, or identifiers you have provided to us. Firebase automatically collects some standard events (e.g., first_open, app_update, session_start, screen_view) together with device model, OS version, app version, and approximate (country-level) location. Event data and user-level data are currently retained for 2 months, the minimum supported by Firebase Analytics (the maximum supported is 14 months). This conservative retention setting is applied in line with the data-minimisation principle of GDPR Art. 5(1)(e). Aggregated standard reports (e.g., daily-active-user counts) are retained independently by Google and are not user-identifiable. Users may opt out by declining the in-app consent prompt (Settings → Reset Consent reopens it) or by declining ATT and resetting the advertising identifier. Firebase privacy and security.

Firebase Crashlytics

Crashlytics is enabled in release builds only and disabled in debug builds. When the app crashes or hits an uncaught exception, Crashlytics sends a stack trace together with device model, OS version, app version, locale, the Firebase Installation ID, and the time of the crash. We use this strictly to find and fix bugs. Player nicknames, IAP receipts, statistics, and game state are not sent to Crashlytics. Google retains Crashlytics data for up to 90 days. Firebase Performance Monitoring is not used.

In-App Purchases (IAP)

Payments are processed by Apple App Store or Google Play. We never see your card number or payment details. The app receives only a verification token that unlocks purchased content (e.g., the king_remove_ads ad-free unlock). The verification token is forwarded once to https://king.albooren.com/api/receipts/verify for server-side validation; it is not persisted in a database after validation completes.

Self-Hosted Online Game Server (king.albooren.com)

Room creation and online multiplayer connect to a Dart WebSocket server we operate. Endpoints used:

• POST https://king.albooren.com/api/rooms — create a new online room and receive a room code
• GET https://king.albooren.com/api/rooms/{code} — query whether a room is still live
• POST https://king.albooren.com/api/receipts/verify — server-side IAP receipt validation
• wss://king.albooren.com/ws/{code} — real-time game traffic (player nicknames, hands, scores, cards played, contract selections, rejoin tokens)

The server keeps room codes, player nicknames, game state, and rejoin tokens in memory only; no persistent database is used. When a room ends or expires, the data is discarded. All traffic uses TLS (HTTPS / WSS).

International Transfers

Firebase Analytics and Crashlytics data may reach Google data centres, and ad requests may reach Unity / ironSource and mediated ad networks, globally, including the United States, under the EU–US Data Privacy Framework and Standard Contractual Clauses (GDPR Art. 46). Online multiplayer traffic (player nicknames, game state, rejoin tokens, IP address) and IAP receipt validation are transmitted to our self-operated server in Turkey. See the common policy — International Data Transfers section.

Analytics Deletion Request

To delete the Firebase Analytics data associated with your App Instance ID, email privacy@albooren.com with the subject "Firebase Analytics Deletion - King". Requests are submitted via the Firebase User Deletion API and processed within 30 days. The App Instance ID is not shown in the app; uninstalling King resets it, and data tied to the old ID expires under the 2-month retention above.

Children's Privacy

King is a card game suitable for teens and adults, not directed to children under 13 (COPPA) or 16 (GDPR Art. 8). We do not knowingly collect data from users below these thresholds. Contact privacy@albooren.com to report inadvertent child data collection.

Your Rights & Deletion

Online game data is deleted when the room ends. Uninstalling removes device-local statistics, settings, save state, and the stored player nickname. To reset the advertising identifier on iOS: Settings → Privacy & Security → Tracking. On Android: Settings → Google → Ads. For full GDPR / KVKK rights, including access, rectification, portability, and complaint to a supervisory authority, see the common policy.

Direct requests: privacy@albooren.com