Privacy Policy · Prizma Bahçesi

1. In short

You can play as a guest or sign in: with Sign in with Apple on iOS, and with a Google or Facebook account on Android. We never receive your profile photo or social profile content. The name your sign-in provider shares is used only to create your first nickname if you do not have one yet: your first name and the initial of your last name are taken; the name itself is not stored separately and your full name is not shown (see sections 4 and 6).
Your e-mail address: if you sign in with a Google account (Android) or use Sign in with Apple (iOS), the e-mail address in the provider's sign-in token and whether it is verified are stored on the server. If you chose Apple's "Hide My Email", this is the private relay address Apple created for you (…@privaterelay.appleid.com); your real address never reaches us. It is used only for account recovery and support; it is never written to logs, never shared with third parties, never used for advertising, and it is deleted together with your account. Players who play as a guest have no e-mail address on the server at all.
Nickname and leaderboard: every player on the leaderboard appears under a nickname. If you sign in with Google, Facebook or Apple and have no nickname yet, your first nickname is created from the name your provider shares, using your first name and the initial of your last name (e.g. “Ayşe Gül Yılmaz” → “Ayse Gul Y”); you can change your nickname in the app at any time. Other players see your nickname, rank, highest unlocked level and star count on the in-app leaderboard. Players without a nickname (e.g. a guest who has not chosen one) do not appear on it. An inappropriate nickname can be reported by other players and can be reset by the moderation team. Your nickname is deleted together with your account.
On the server your account is a random player ID plus a keyed hash (HMAC-SHA-256) of your sign-in provider's user ID; raw tokens are not stored.
Progress, balances and purchase entitlements live on the server and are verified there. Payments go through Apple (App Store) on iOS and Google Play on Android; card details never reach us.
No location, contacts, advertising ID, device ID, camera or microphone data is collected. The iOS version has no ads; on Android, data processed by the ad network is described in section 10.
You can delete your account and data permanently: on iOS from the in-game ACCOUNT screen, on Android by sending a request to destek@prizmabahcesi.com. The steps are on Delete account.
This website sets no cookies and loads no analytics or third-party code.

2. Controller and contact

Data controller: Zegroni
Publisher: Zegroni (Zegroni)
Address: Oltu / Erzurum, Türkiye
Privacy requests: destek@prizmabahcesi.com
Support: destek@prizmabahcesi.com

3. Scope

This policy covers:

the Prizma Bahçesi app for iOS on the App Store and for Android on Google Play (application ID com.zegroni.prizmabahcesi),
the https://prizmabahcesi.com information website,
the https://api.prizmabahcesi.com game server (API).

Processing that Apple, Google and Meta perform inside their own services (App Store, Google Play, sign-in services) is governed by their own policies (see section 8).

4. Data we process

The table describes the records our server actually keeps. "Digest" means a SHA-256 or keyed HMAC output that cannot be turned back into the original value.

Category	Data	Purpose	Retention
Account identity	Your sign-in provider's (Apple on iOS; Google or Facebook on Android) one-time signed identity token is verified on the server. What this link stores is a keyed digest of the provider's user ID and the random player ID that maps to it; the raw token is not stored. If you play as a guest there is only the random player ID and no provider link.	Recognising your account across devices	Until the account is deleted
E-mail address	If you sign in with a Google account or with Sign in with Apple, the e-mail address in the sign-in token and whether it is verified are stored against your player record. If you chose Apple's "Hide My Email", what is stored is Apple's private relay address for you. With Facebook sign-in this field stays empty until Meta's App Review is complete. Guest players never have one. Profile photo is not stored; how the name your provider shares is used is described in the nickname row below.	Account recovery and support: finding your account when you lose progress or a purchase, telling the right player apart on a support request	Until the account is deleted
Session	Digests of access and refresh tokens, issue and expiry times	Session security, sign-out and revocation	Access token 15 minutes; refresh token at most 7 days
Progress and economy	Current and highest unlocked level, stars, coin and crystal balance, booster counts, entitlement status fields, record revision, update time	Providing the game and protecting your progress	Until the account is deleted
Nickname	The nickname shown on the leaderboard (3–16 characters; Latin letters, digits, underscore and space only), its source (chosen by you or created at social sign-in), its status (active or reset by moderation), how many times it was changed, and timestamps. If you sign in with Google, Facebook or Apple and have no nickname yet, only your first name and the initial of your last name are taken from the name your provider shares (with Google and Facebook, the name in the sign-in token; with Apple, the name the app receives from Sign in with Apple on your first sign-in only), their accents are removed and they are reduced to Latin letters (e.g. “Ayse Gul Y”; if that exceeds 16 characters, the first word of your first name is used), and if the result meets these rules, the blocklist and the impersonation check it is saved as your first nickname; otherwise nothing is saved. Your full name is never used as a nickname; the name is not stored separately, never written to logs and never overwrites an existing nickname. If you never choose a nickname and no suitable name comes from your provider, this record is never created. If you report another player's nickname as inappropriate, the IDs of the reporting and the reported player, a fixed reason code and the time are stored; a report carries no free text.	Showing you on the leaderboard; weeding out inappropriate nicknames; finding the right account on a support request	Until the account is deleted
Level runs	Run ID, level, board seed, the move sequence (sent so the server can replay the result) and a result summary. Score and rewards are never taken from the client; the server computes them.	Verifying results, preventing cheating	Unfinished run 2 hours; the result summary of a completed run until the account is deleted
Purchases	On Google Play: digests of the transaction ID and receipt. On the App Store: Apple's signed transaction record (JWS) is verified on the server against Apple's root certificate; what is stored are digests of the transaction ID and of the record, plus a digest of the transaction details Apple signed (transaction ID, original transaction ID, product, quantity, type, purchase and signing date); the raw transaction ID and record are not stored. For both stores the product, environment (test or live), status (pending, verified, refunded…) and timestamps are kept. On iOS a purchase is started with an account-binding code derived one-way from your player ID (`appAccountToken`); Apple signs this code into the transaction record and the server delivers the purchase only to the account whose code matches. The code is not stored; it is recomputed at each verification. Refunds and revocations arrive through the store's server notifications (Google Play real-time developer notifications, App Store Server Notifications); the notification record carries only a transaction digest and no player ID. Payment card details stay with Google Play or Apple and never reach us.	Delivering what you bought to the right account; reconciling refunds	For the life of the account; after deletion only an opaque evidence copy (see section 11)
Security signals	Signal type (e.g. integrity failure, replay), severity, app version, time. Free text, IP addresses and device IDs are not accepted.	Preventing cheating and abuse	30 days
Game event counters	Low-detail event types from an allow-list (e.g. level completed). Only daily totals persist.	Monitoring game balance and health	Individual event record 7 days; daily totals contain no personal data
Rate limiting	A short-lived, endpoint-bound digest of the player ID and client IP address; the raw IP is not stored	Protecting the server from excessive requests	Short-lived window
Server access logs	IP address, time, requested URL, response code and browser/client string (website and API)	Security and debugging	at most 35 days (weekly rotation, 4 copies)
Support correspondence	Your e-mail address and what you write to us, if you contact us	Answering your request	2 years

The entitlement status fields in the record (premium and the no-ads entitlement) are still carried, but no product fills them any more: the Premium subscription was withdrawn and "Remove Ads" is not sold. They remain only so that older records stay readable; on an account created today they stay empty.

The e-mail address is used only for the purpose above: it is never written to logs, never shared with third parties, never used for advertising or personalisation, and we send you no marketing messages. When your account is deleted it is removed in the same operation as your player record (see section 11).

Nickname and leaderboard: if you have a nickname (chosen by you or created at social sign-in), other players see only your nickname, rank, highest unlocked level and star count on the in-app leaderboard; your player ID, e-mail address and sign-in provider are not shown. The leaderboard is visible only inside the app and is not published on this website. You can change your nickname in the app at any time. Names containing severe slurs or impersonating the moderation or support team are rejected by the server from the start. Players can report a nickname they find inappropriate; the reporter's identity is not shown to the reported player. A nickname found to be inappropriate can be reset by the moderation team: it disappears from the leaderboard and you are asked to choose a new one; the removed name stays on your account record, shown to no one, so that the same name cannot simply be put back. Your nickname and your nickname report records are deleted in the same operation as your player record when your account is deleted.

The token obtained from your sign-in provider when an account deletion is verified (see Delete account) is likewise used only at verification time; again only a digest is stored. When an account created with Sign in with Apple is deleted on iOS, the one-time authorisation code Apple issues during re-authentication is used only to revoke the authorisation at Apple; neither that code nor any token obtained from Apple is stored or written to logs.

5. Data kept on your device

The app keeps a progress cache, settings (sound, language, colour-blind mode) and the link to your server player ID in the app's private storage on the device. So that you do not have to sign in every time you open the app, the session's refresh token and the fields that belong to it (server address, session type, provider name, player ID, expiry time) are also kept in a private app file; that file is deleted when you sign out or your account is deleted. The access token is held in memory only while the app runs; neither it nor the sign-in provider's identity credential is ever written to a file, analytics or logs.

The progress and session files are excluded from backups: on Android from cloud backup and device-to-device transfer, on iOS from iCloud and computer backups. Uninstalling removes local data; it does not delete the server account (see Delete account). If you play as a guest, uninstalling also removes the guest session, and that guest account can no longer be reached.

This website consists of information pages only: there is no browser version of the game, and it uses no cookies or local storage.

6. Data we do not collect

Your profile photo or social profile content. The sign-in sheet may also offer to share your name: on iOS the Sign in with Apple sheet, at the app's request, also asks to share your full name. Only your first name and the initial of your last name are taken from a shared name, to create your first nickname as described in section 4; the full name is not stored. Nicknames are described in section 4,
Phone number, contacts, calendar,
Location,
Advertising ID (except by the ad network on Android, see section 10; never on iOS), device ID or IMEI,
Camera, microphone, photos or files,
Cookies, fingerprinting or analytics on the website.

The e-mail address is not on this list. If you sign in with Google or Apple, your e-mail address is taken and stored; section 4 explains the detail and the purpose. Players who play as a guest have no e-mail address.

7. Purposes and legal basis

Performance of a contract: recognising your account, protecting your progress, delivering purchased entitlements, showing you on the leaderboard if you have a nickname (Turkish KVKK art. 5/2-c; GDPR art. 6/1-b).
Legitimate interest: preventing cheating and abuse, weeding out inappropriate nicknames, protecting the server, debugging, keeping access logs (KVKK art. 5/2-f; GDPR art. 6/1-f). Data collected for these purposes is minimised and unsuitable for profiling.
Legal obligation: keeping financial records, answering lawful requests from authorities (KVKK art. 5/2-ç; GDPR art. 6/1-c).
Consent: on Android, personalised ads are shown only with the consent you give inside the app, which you can withdraw at any time (KVKK art. 5/1; GDPR art. 6/1-a).

Target countries: all countries and regions except mainland China (including Hong Kong, Macao and Taiwan). The law of your country (KVKK no. 6698 in Türkiye, the GDPR in the EU/EEA) may grant additional rights; they are unaffected.

8. Sharing and recipients

Your data is never sold or shared for marketing. Only the following recipients are involved:

Your sign-in provider — on iOS Apple Inc. (Apple privacy policy); on Android Google LLC (Google privacy policy) or Meta Platforms (Meta privacy policy). Google and Apple tokens are verified on our server with the provider's public keys; a Facebook access token is sent from our server to Meta for verification. When an account created with Sign in with Apple is deleted, the one-time authorisation code Apple issued is sent from our server to Apple to revoke the authorisation at Apple. Only the provider you use is involved.
Google Play (Google LLC) — payment and purchase verification on Android. Google does not give us card details; we do not give Google your game progress.
App Store (Apple Inc.) — payment, purchase records and refund notifications on iOS. Apple's signed transaction record is verified on our server; when a purchase starts, Apple receives an account-binding code derived one-way from your player ID (appAccountToken). Apple does not give us card details; we do not give Apple your game progress.
Hosting provider — Hostixo Internet Bilisim Yazilim Hizmetleri Tic. ve San. Ltd. Sti.; operates our servers and accesses data only at the infrastructure level.
Ad network — Google AdMob; Android version only, see section 10.
Other players — only if you have a nickname, and only on the in-app leaderboard: your nickname, rank, highest unlocked level and star count (see section 4).
Authorities — only where legally required and limited to the scope of the request.

9. Server location and international transfers

Our servers are located in Bursa, Türkiye. Sign-in and payment providers (Apple, Google, Meta) process data in their own locations under their own policies. Transfers out of Türkiye follow KVKK art. 9; transfers out of the EU/EEA follow Chapter V of the GDPR.

10. Advertising

The Android version shows ads through Google AdMob. To serve ads, cap their frequency and prevent fraud, the ad network may process data such as your device's advertising ID under its own privacy policy: https://policies.google.com/technologies/ads.

Consent for personalised ads is requested inside the Android app; you can change your choice in the app settings and in your device's ad settings. This build has no between-level (interstitial) ads: an ad is shown only in a rewarded ad you start yourself, so no ad-removing entitlement is sold.

The iOS version has no ads: there is no ad SDK, no access to the advertising identifier (IDFA), no App Tracking Transparency prompt and no ad measurement.

This website carries no ads, ad cookies or measurement code.

11. Retention and deletion

Retention periods are listed per category in section 4. When your account is deleted, your profile, sign-in provider link and any e-mail address taken from the provider, any nickname and nickname report records, sessions, progress, balances, entitlement records, level runs and security signals are removed in a single operation. Only the following remain, for a limited time:

Opaque purchase evidence — store (App Store or Google Play) transaction and receipt digests, product, status and dates; no balance, progress or profile. Kept for financial record-keeping and refund reconciliation: 7 years (2555 days).
Re-registration suppression record — a keyed digest of the deleted account's sign-in identity, so the account cannot silently come back under the same identity. 30 days.
Deletion receipt — an identity-free result record that lets the completed deletion be confirmed afterwards: 30 days.
Pseudonymous deletion journal — a sequenced, identity-free record of the deletion: 90 days.
Server access logs and support correspondence — for their own periods (section 4).

None of these records contains your e-mail address; the e-mail address goes with the player record during deletion. The only exception is the support correspondence itself, if you wrote to us, and that is limited to its own period.

For accounts that used Sign in with Apple, a record of the revocation at Apple also remains: one-way digests derived from the deletion request ID and the player ID, plus the revocation time. It contains neither your Apple ID nor your e-mail address, and it is kept without deletion so that a repeated deletion request never contacts Apple a second time.

Only an explicit, time-limited legal retention obligation can postpone deletion, through a technical hold of at most 31 days; you will be informed if that happens. An ordinary account restriction does not block deletion.

12. Children

Prizma Bahçesi is not designed for people under 13 and does not knowingly collect data from them. If you believe a child has created an account, write to destek@prizmabahcesi.com; the account and its data will be deleted.

13. Security

All traffic between the app, the website and the server is encrypted with HTTPS.
Tokens and provider identities are stored only as digests; server secrets never reach the client.
Score, rewards, balances and purchase entitlements come from server verification, not from the client.
Server access is limited to authorised people and logged.

No system is completely secure. If you find a vulnerability, write to destek@prizmabahcesi.com before disclosing it publicly.

14. Your rights

Under KVKK art. 11 and, where applicable, the GDPR you have the right to learn whether your data is processed and to access it, to rectification, erasure, restriction of processing, objection, data portability, and to lodge a complaint with the competent data protection authority.

Requests go to destek@prizmabahcesi.com and are answered within the statutory period (at most 30 days). For any request about your account we verify you through the account's sign-in provider. If you signed in with Google or Apple we do hold your e-mail address on the server, but writing from an e-mail address is not verification on its own: a sender address can be spoofed, and guest players have no e-mail address on their record at all. We never ask for passwords, payment card details or identity documents.

No separate KVKK/GDPR application is needed to delete your account and data: on iOS you can delete it from the in-game ACCOUNT screen, on Android you send the request to destek@prizmabahcesi.com. The steps are on Delete account.

15. Changes

When this policy changes, the effective date is updated; significant changes are announced in the app or on this website. The current text is always at https://prizmabahcesi.com/privacy (Turkish reference version: https://prizmabahcesi.com/gizlilik).

Governing law: Türkiye Cumhuriyeti hukuku.