Privacy Policy
Last updated: November 4, 2026. This policy covers the Castle of Numbers iOS app and this website.
In short
- There are no accounts. We do not ask for your name, email, phone number, location, contacts, camera or microphone.
- The only ads are optional rewarded ads (Google AdMob), and they are non-personalized for everyone. We do not track you across apps and websites, we do not show Apple's "Allow tracking" prompt and we do not use the advertising ID (IDFA).
- To improve the game, the app can send usage measurements without your name or any user ID (Google Firebase). You can switch it off at any time in Settings › Privacy › Analytics; in the EU, EEA, UK and Switzerland it is off by default.
- Your game progress stays on your device.
- This website uses no cookies and loads no third-party scripts, fonts or analytics.
1. Controller and contact
The controller is the independent developer of Castle of Numbers: Osman ASCI (bireysel geliştirici) · iletişim: [email protected]. For any privacy question: [email protected].
2. Data that stays on your device in the app
- Your game progress, settings, daily results and the player name you choose (the name is never part of analytics events and is not sent to the developer; it appears only inside a challenge link if you create and share one, see section 7).
- The state of the Analytics switch, the last copy of the remote configuration and a queue of analytics events that have not been sent yet.
- A random install ID generated at install. It stays on the device and is only used to assign in-game experiment groups. It is never part of any analytics event and is not sent to Google.
- The Castle of the Day reminder (it does not turn on by itself; you can turn it on in Settings, or by agreeing on the card the app shows after you finish Castle of the Day): the reminder is scheduled on your device as a local notification and shown by iOS. iOS asks for the notification permission when you agree. No data is sent to any server for it and no remote (push) notifications are used. You can turn off the notification permission at any time in iOS Settings.
- A small marker that the starter pack has been delivered, stored in the iOS Keychain. If iCloud Keychain is on, Apple may sync this marker between your devices; we cannot access it.
This is not sent to the developer. Deleting the app removes it from your device (the Keychain marker depends on how Apple handles the Keychain). "Reset progress" in Settings deletes your local progress, generates a new random local ID and empties the unsent analytics queue; it does not change your Analytics switch.
3. Usage measurement (analytics)
While Analytics is on, the app sends usage events with Google's Firebase Analytics (without the advertising ID). The only purpose is improving the game: seeing difficulty balance, bugs and where players get stuck. No user ID, name, email or advertising ID is attached to events. We do not call this "fully anonymous": Firebase keeps a persistent app instance ID for the installation, and events arrive with it.
| Data | What it contains |
|---|---|
| Game events | Session start and end, tutorial steps, battle start and result, which modes are used, setting changes, hint use, daily puzzle and quest events, ad events (offer, start, completion, failure). |
| Store events | Store screen views, purchase attempts and outcomes: product ID, price and currency. Your payment details never reach us; Apple handles the payment. |
| Event and user properties | App version, build number, session number, days since install, install week, the race you chose, how far you have got, whether you own the Commander's Seal, experiment group. |
| What Firebase itself collects | Persistent app instance ID, approximate location derived from the IP address (country or region level), device model and iOS version, language and time zone. |
What we do not send: name, email, user ID, free text, device name, advertising ID (IDFA), vendor ID (IDFV), precise location, contacts, photos. Ad personalization signals and advertising ID collection are switched off.
Consistency with the App Store "Privacy Details": Because these data types arrive with persistent device and app identifiers, the app's App Store privacy label cautiously marks them as "linked to you". This does not mean the data is linked to your name or email.
Retention: Analytics data is kept in Firebase for 14 months and is then deleted automatically.
Your choice: The Settings › Privacy › Analytics switch is off by default in the EU, the EEA, the UK and Switzerland, and wherever your region cannot be determined, and on by default elsewhere. The region comes from your device's region setting. Once you change the switch, your choice is kept and the region is no longer consulted. When you turn it off, the event queue is emptied, user properties are deleted, Firebase stops collecting, and Firebase's local analytics data and app instance ID on the device are reset.
4. Ads (Google AdMob) and consent
The app has rewarded ads only: you watch one if you want to, in return for a hint, star protection or a reward multiplier. This version shows no ads between levels; if they are added, this policy will be updated before that version is released. Ads are served by Google AdMob.
- Non-personalized ads, for everyone. Every ad request is made as non-personalized; we do not ask your age and we show personalized ads to nobody. Ad content is capped at "PG" (parental guidance).
- No tracking. We do not show Apple's App Tracking Transparency (ATT) prompt, and the advertising ID (IDFA) is not used.
- What AdMob collects (according to Google's disclosure): approximate location from the IP address, device or app/developer-level limited identifiers, ads seen and ad performance, other product interactions, and crash logs that are not linked to you. Google processes this under its own policy: Google Privacy Policy and How Google uses information from sites or apps that use its services.
- When it starts. Google's ads and consent software run when a rewarded ad is offered, that is, on the first ad. At app launch there may also be a limited technical contact, such as checking the consent status (a network request to Google); it shows no ad.
- Consent form (EU, EEA, UK, Switzerland). In these regions Google's consent form (UMP) is shown, when required, on the first rewarded ad request. If you need to change your choice later, a "Ad privacy options" row appears in Settings › Privacy.
5. Remote configuration
The app connects to Google's Firebase Remote Config to fetch game settings (balance values, experiments, the switch that turns ads off). This is an app function that works independently of the Analytics switch. For Remote Config, Firebase creates a random Firebase Installations ID for your installation; it is sent to Google even while Analytics is off. The request sends Google your device's country code, language, time zone, iOS version and app identifiers; Google states it does not link this request data to a user or device identifier.
6. Purchases
Purchases go through Apple's App Store (StoreKit). Your card or payment details never reach us. If Analytics is on, we see a purchase only as an event (product ID, price, currency). To restore purchases on another device, use "Restore Purchases" on the store screen.
7. Sharing
Sharing is always your decision; the app sends nothing on its own and what you share is not uploaded to a server of ours. When you open the iOS share sheet, we do not see which app you send it to.
- Result text: when you share your result, the app prepares a short text and adds this website's address.
- Share card: a PNG image is generated on your device and handed to the share sheet only if you share it. The card does not contain your player name.
- Challenge link: besides the game data, the link carries the player name (nickname, up to 16 characters) you chose in the game; it carries no email or account information. This feature is available once it is switched on; you share the link yourself. The link is not uploaded to a server of ours, but the people who receive it and the messaging service you send it through can see the name (see section 10).
8. Third parties
- Google (Firebase Analytics and Remote Config): for the measurement and configuration described above, as a processor on our behalf.
- Google (AdMob and the UMP consent form): for rewarded ads and regional consent. Google may process data in countries other than Turkey, on its own infrastructure.
- Apple (App Store, StoreKit): for distributing the app and for purchases. Apple's own privacy policy applies.
- Apple (Game Center): an optional Game Center integration has been prepared; it is off in this version, and while it is off the app never connects to Game Center. Once the feature is switched on (in an update) and you are already signed in to Game Center on your device, your scores and achievements are sent to Apple's Game Center service; Apple associates them with your Game Center account and processes them under its own privacy policy. Your player name is not sent to Game Center. The game does not send your Game Center identity or this data to a server of its own (we have no server for this purpose); it does not reach us. If Analytics is on, only a "signed in to Game Center" event (with a short label that carries no identity) is measured. The app never forces you to sign in to Game Center; the game works the same without it.
We do not sell your data and do not share it with data brokers. Google AdMob is the only ad network; if another advertising service is added, this policy will be updated before that version is released.
9. Children
The app is not directed to children and does not ask your age. It creates no accounts and asks for no personal information such as name, email or location. Ads are non-personalized for everyone and their content is capped at "PG". If you are a parent or guardian and have a concern, write to us.
10. This website
- No cookies, no tracking. No third-party script, font, map, video or analytics tool is loaded; fonts and scripts come from our own server. The Google links on this page open only when you click them.
- The daily puzzle runs in your browser. Your results, streak and language preference stay in your browser's local storage (localStorage) and are never sent to a server. You can remove them by clearing your browser data.
- The service that hosts the site (Cloudflare) may, like any web server, keep technical request logs (IP address, time, requested address) for a short time. We run no analytics tool of our own on this site.
- Challenge links (/d/…): the fallback page that opens when the app is not installed does not read or store the data in the link. Besides the game data, the link carries the player name (nickname) you chose in the game; it carries no email or account information. You share the link yourself. The address may appear in the server logs mentioned above and in the messages you share.
11. Legal basis and transfers abroad
- Running the app (remote configuration, purchases): legal basis to be confirmed with legal advice.
- Analytics: on by default in Turkey and in regions outside the EU, EEA, UK and Switzerland; legal basis to be confirmed with legal advice. For this reason this policy also serves as the notice required by KVKK article 10: data processed (sections 3 and 4), purpose (improving the game, showing ads, running the app), collection method (automatic, by the app), transfers (this section) and your rights (section 12). In the EU, EEA, UK and Switzerland Analytics only runs if you turn it on.
- Ads: rewarded ads are optional; in the EU, EEA, UK and Switzerland your consent is collected with Google's consent form.
- Transfers abroad: Google may process Firebase and AdMob data outside Turkey, on its own servers. For Turkey this transfer falls under KVKK article 9: to be confirmed with legal advice. For transfers from the EU, EEA, UK and Switzerland, Google applies the safeguards named in its data processing terms (for example the EU Standard Contractual Clauses, SCC).
12. Your rights
Under applicable data protection law (for example KVKK article 11 in Turkey, or the GDPR in Europe) you may have the right to access, correct or delete your data, to object to processing, to withdraw consent and to complain to an authority. The easiest way to withdraw consent is to turn off Settings › Privacy › Analytics; for your ad consent you can use "Ad privacy options". Because we do not link analytics data to your name or email, finding the records of one particular device may not always be possible; we will still consider your request and explain if we cannot fulfil it. For requests: [email protected].
13. Changes
If the app's data practices change, this policy is updated before the change takes effect and the date above changes.