This policy is specific to Chopzy. It explains the data this game processes, the third-party services it uses and the choices it gives you. The common framework for all our games and this website is in our Privacy Policy and KVKK Information Notice; this page supplements them.
Data controller
The data controller for Chopzy (within the meaning of the Turkish Personal Data Protection Law No. 6698 "KVKK" and the EU General Data Protection Regulation "GDPR") is:
- Company: Machware Teknoloji A.Ş.
- Address: Maslak Mah. Maslak 42 B Blok İç Kapı 542, Sarıyer/İstanbul
- MERSIS number: [TO BE COMPLETED]
- Registered e-mail (KEP): [TO BE COMPLETED]
- Email: support@machware.com.tr
- EU representative (GDPR art. 27): [TO BE COMPLETED]
In short
- You do not need to sign in or create an account to play. To save your progress, the game creates an anonymous player profile on our game server, tied to your installation. We do not ask for your name, email, phone number or other identity details.
- If you want, you can link your progress with Google Play Games (Android) or Sign in with Apple (iOS). This is optional; the game is fully playable without it.
- Data is linked to technical identifiers of your device and of the game installation.
- Analytics is off by default; the game asks for your permission when it first starts, and you can change your choice at any time in the game's Settings screen.
- Personalised ads are off by default and shown only if you consent. On iOS the game does not track you.
- Crash reports are on by default so that we can fix crashes; you can switch them off in Settings.
- We do not sell your data.
Data processed in this game
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Device information (model, operating system, language, app version) | Running the game on your device, compatibility | KVKK art. 5(2)(c) · GDPR art. 6(1)(b) | Retention of the related service (below) |
| Support code (Shown in Settings › Account); linked to your anonymous profile on the game server | Finding and deleting your data, matching support requests | KVKK art. 5(2)(c) · GDPR art. 6(1)(b) | While the profile exists; erasure is completed within 30 days after you delete the profile (copies in encrypted backups are overwritten about 35 days later). Missions are kept 30 days, event progress 90 days after its last change, inbox messages 90 days after they expire, days-played records 400 days |
| Anonymous player profile: a random installation ID generated on the device, an internal player number, an automatically assigned nickname, language, country (from the device's region setting, not from GPS or the IP address), platform and app version | Providing the game and its online features, keeping your progress safe, country-appropriate content and events | KVKK art. 5(2)(c) · GDPR art. 6(1)(b) | While the profile exists; erasure is completed within 30 days after you delete the profile (copies in encrypted backups are overwritten about 35 days later). Missions are kept 30 days, event progress 90 days after its last change, inbox messages 90 days after they expire, days-played records 400 days |
| Game data (depending on the game's features: scores and run results, virtual currency and item balances and their history, missions, rewards, inbox, event progress, leaderboard entries) | Letting you continue where you left off, leaderboards and rewards | KVKK art. 5(2)(c) · GDPR art. 6(1)(b) | While the profile exists; erasure is completed within 30 days after you delete the profile (copies in encrypted backups are overwritten about 35 days later). Missions are kept 30 days, event progress 90 days after its last change, inbox messages 90 days after they expire, days-played records 400 days |
| Detailed run records for score verification | Preventing cheating, keeping leaderboards fair | Legitimate interest (preventing cheating and fraud, service security): KVKK art. 5(2)(f) · GDPR art. 6(1)(f) | 30 days |
| Server access logs (shortened IP address, time, requested address, result) and server error reports | Keeping the server secure and working | Legitimate interest (preventing cheating and fraud, service security): KVKK art. 5(2)(f) · GDPR art. 6(1)(f) | Access logs 14 days, error reports 90 days |
| Security records of actions in the service (linked only to the internal player number) | Preventing and investigating abuse, service security | Legitimate interest (preventing cheating and fraud, service security): KVKK art. 5(2)(f) · GDPR art. 6(1)(f) | 2 years (also after the profile is deleted); staff notes are removed when the profile is deleted |
| Optional linked account: the player/user ID given by Google Play Games (Android) or Sign in with Apple (iOS) (no name or email) | Restoring your progress on another device if you choose to link | KVKK art. 5(2)(c) · GDPR art. 6(1)(b) | Until the link or the profile is deleted. If the profile is banned for cheating, an irreversible hash of the ID is kept for the ban, at most 2 years |
| Usage and analytics data (App Instance ID, events, sessions) | Improving the game with aggregate statistics | Explicit consent: KVKK art. 5(1) · GDPR art. 6(1)(a) | User-level data for up to 14 months |
| Crash logs (on by default; can be switched off in Settings) | Finding and fixing bugs, keeping the game stable | Legitimate interest (keeping the game stable and secure, fixing bugs): KVKK art. 5(2)(f) · GDPR art. 6(1)(f) | 90 days |
| Advertising ID (Android only: GAID; the IDFA is not used on iOS) and ad interactions | Showing ads, frequency capping, fraud prevention. Non-personalised ads whenever consent is not obtained; personalised ads only if you consent (through the Google consent screen in the EU/EEA, the UK and Switzerland). Always non-personalised, whatever your consent: on iOS (iPhone and iPad) and in Türkiye | Personalised ads: explicit consent (KVKK art. 5(1) · GDPR art. 6(1)(a)). Non-personalised ads: legitimate interest (ad revenue that lets us offer the game for free, preventing ad fraud), KVKK art. 5(2)(f) · GDPR art. 6(1)(f); in the EU/EEA, UK and Switzerland, storing and accessing information on your device follows your choice in the consent screen | Per Google AdMob policies; Machware does not store your advertising ID on its own servers |
| Rewarded ad records (placement, time, AdMob verification transaction ID) | Granting the reward only once, and only when the ad was really watched | KVKK art. 5(2)(c) · GDPR art. 6(1)(b) | While the profile exists; erasure is completed within 30 days after you delete the profile (copies in encrypted backups are overwritten about 35 days later). Missions are kept 30 days, event progress 90 days after its last change, inbox messages 90 days after they expire, days-played records 400 days |
| Purchase records (product, date, order number, the store's purchase token). Card and payment details stay with Apple/Google | Verifying, delivering and restoring purchased content, accounting and tax obligations | KVKK art. 5(2)(c) and 5(2)(ç) · GDPR art. 6(1)(b) and 6(1)(c) | As required by law, at most 10 years (linked only to an internal number); the store's purchase token is erased 90 days after confirmation or when the profile is deleted |
| Local reminder notifications and the notification setting (no push token) | Showing reminders on your device if you allowed them | KVKK art. 5(2)(c) · GDPR art. 6(1)(b) | On the device only; never sent to us |
This game does not collect your name, email, phone number, precise (GPS) location, contacts, photos, microphone or camera data. If you write to us through the support or data-deletion form, only the details you give in that form (e.g. your email address) are processed.
Do you have to provide the data?
- Data needed to run the game: device information and installation identifiers (including the Support code) and the anonymous profile on the game server are needed to run the game and to serve ads. Without them the game cannot be provided.
- Optional data: your permission for analytics and personalised ads is entirely optional. Refusing it does not limit any feature of the game.
- Progress linking: optional; if you do not link, the only difference is that you cannot move your progress to another device.
- Form data: the fields requested in the support or data-deletion form are needed to handle your request; without them we cannot process it.
Your player identifier
The game shows a copyable Support code (Shown in Settings › Account). This code is tied to your anonymous profile on the game server and contains neither your name nor your email address. Because there are no accounts, it is the way we can find and delete your server-side data and confirm that the data is yours. We ask you to include it in support and deletion requests; do not share it with anyone else.
Game server and saved progress
Chopzy uses Machware's game server to keep your progress and provide its online features. There is no sign-in: when the game first starts, an anonymous player profile tied to your installation is created on the server automatically.
What is stored on the server
- Installation ID: a random value generated on your device when the game first starts. It is not your phone's hardware ID or advertising ID.
- Anonymous player profile: an internal player number, an automatically assigned nickname (visible to other players if the game has leaderboards), language, country (taken from your device's region setting, not from GPS or your IP address), platform and app version.
- Game data: depending on the game's features, scores and run results, virtual currency and item balances and their history, missions, rewards, inbox messages, event progress and leaderboard entries.
- Purchase records: product, the store's purchase token, order number, status and dates.
- Rewarded ad records: which rewarded ad was watched and when, and the transaction ID that Google AdMob sends to confirm the reward.
- Linked account ID (optional): if you link your progress, only the player or user ID given by Google Play Games (Android) or Sign in with Apple (iOS).
- Server access logs: a shortened IP address (the last part is removed, so it points to a network, not to your device), the time, the address requested and the result. Your IP address is not stored in the game database.
Purpose and legal basis
- Providing the game and your progress, keeping your progress safe, delivering purchases and granting rewards: performance of a contract (KVKK art. 5(2)(c) · GDPR art. 6(1)(b)).
- Preventing cheating and fraud, verifying scores and keeping the server secure: legitimate interest (KVKK art. 5(2)(f) · GDPR art. 6(1)(f)).
- Keeping purchase and accounting records: legal obligation (KVKK art. 5(2)(ç) · GDPR art. 6(1)(c)).
Retention
- Profile and game data: while the profile exists.
- Detailed run records for score verification: 30 days.
- Unused profiles: anonymous profiles that were never linked, with no purchases and not opened for 365 days are deleted automatically.
- Missions: 30 days. Event progress: 90 days after its last change. Inbox messages: 90 days after they expire. Days-played records: 400 days.
- Server access logs: 14 days. Server error reports: 90 days.
- Security records of actions in the service (linked only to the internal player number; notes our staff wrote about you are removed when your profile is deleted): 2 years.
- After you delete your profile: you are removed from leaderboards immediately, and erasure of the rest of your personal data is completed within 30 days. Copies in encrypted backups are overwritten about 35 days after that. Security records and purchase records are kept until the end of the periods above.
- Purchase records and virtual currency history (linked only to an internal number; no name or contact details): as long as tax and accounting law requires, at most 10 years. The store's purchase token is erased 90 days after the purchase is confirmed or when your profile is deleted.
Server location
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Railway (Railway Corporation) · Privacy policy | Hosting the game server, its database and server logs for games that use online features | United States (US East, Virginia) | KVKK art. 9: the Board's standard contract (notified to the Board within 5 business days of signing). GDPR: the European Commission's Standard Contractual Clauses |
This provider acts as a processor on Machware's behalf.
Deleting your server data
- In the game: use the delete option in the game's Settings screen to delete your profile and the data linked to it.
- On the web: if you cannot open the game, send a request on the data deletion page with your Support code.
- Deletion is final and cannot be undone. Your purchases stay tied to your store account and can be restored on a new profile where the store allows it.
Optional progress linking
Where available, you can link your progress with Google Play Games (Android) or Sign in with Apple (iOS). Linking is entirely optional; the game is fully playable without it.
- What is shared: only the player or user ID given by Google Play Games (Android) or Sign in with Apple (iOS) is stored on our server. Your name and email address are not requested and do not reach us.
- Purpose: restoring your progress on another device (performance of a contract, KVKK art. 5(2)(c) · GDPR art. 6(1)(b)).
- Unlinking and deletion: deleting your profile in the game or on the data deletion page also deletes the link. You can also ask us to remove the link through the support page with your Support code, and you can remove the game's access in your Google account or Apple ID settings.
- Fair play: if a profile is banned for cheating or abuse, a keyed, irreversible hash of the linked account ID is kept for the duration of the ban, at most 2 years, so the ban cannot be avoided with a new profile (legitimate interest).
Firebase services used
Chopzy uses the Google Firebase services below. Firebase is provided by Google LLC / Google Ireland Limited, which acts as a processor on Machware's behalf for these services.
| Service | Purpose | Data processed |
|---|---|---|
| Google Analytics for Firebase | Measuring, in aggregate, how the game is used (sessions, screens, progress events) to improve it. Runs only while the in-game analytics permission is on. | App Instance ID, usage events, session length, device model, operating system and language, approximate location (country/city) derived from the IP address. |
| Firebase Crashlytics | Detecting and fixing crashes and serious errors. | Crash log (stack trace), device state at the time of the crash (model, OS, memory, orientation), the Crashlytics installation UUID and the Firebase Installation ID. |
Firebase privacy and security: https://firebase.google.com/support/privacy
If you allowed analytics, Firebase data may be linked to your anonymous player number.
Consent prompt and settings
- Analytics: off by default in every region. When the game first starts it asks for your permission; until you give it, no analytics data is collected. Switch it on or off in the game's Settings screen.
- Personalised ads: off by default and shown only with your consent; until consent is obtained, only non-personalised ads are requested. In the EU/EEA, the UK and Switzerland consent is collected through the Google consent screen described below; you can change your choice in Settings › Privacy Choices.
- Crash reports: on by default so that the game stays stable (legitimate interest). Switch them off with the toggle in the game's Settings screen; while off, no crash reports are collected on your device, and your choice is kept.
- Withdrawing a permission does not affect the lawfulness of processing before the withdrawal.
Ads and Google AdMob
To offer the game for free, it shows ads served by Google AdMob. To serve and measure ads, cap how often you see the same ad and prevent fraud, AdMob may process your advertising ID on Android (the Google advertising ID "GAID"), your IP address, device information and your interactions with ads.
Ad formats
- Interstitial: a full-screen ad shown at a natural break in the game, which you can close.
- Rewarded ad: an ad you watch only if you choose to, in return for an in-game reward. Watching is entirely optional.
The game has no banner ads.
Interstitials appear only on the game-over screen: never in your first session or your first 5 runs, and at least 90 seconds apart. You watch rewarded ads only if you choose to. The Remove Ads purchase turns interstitials off; rewarded ads stay available as an option.
So that a reward is granted only once, and only when the ad was really watched, your anonymous player number is passed to AdMob and AdMob confirms the reward to our server (server-side verification).
Personalised and non-personalised ads
- Personalised ads are shown only if you consent. Until you consent, and whenever consent is not obtained, the game requests non-personalised ads from AdMob, which are based on context.
- Ads are always non-personalised, whatever your consent choice, on iOS (iPhone and iPad) and in Türkiye.
- How Google uses this data is explained in the Google Privacy Policy and in How Google uses information from sites or apps that use its services.
- On Android you can reset or delete your advertising ID in your device settings (Settings › Privacy › Ads).
Consent screen in the EU, EEA, UK and Switzerland
In these regions, when the game first starts, it shows a Google-certified consent management platform (Google User Messaging Platform, "UMP") that implements the IAB Europe Transparency and Consent Framework (TCF). There you set your choices for advertising and measurement purposes. You can change or withdraw your choice at any time in the game's Settings › Privacy Choices. If you do not consent, only ads that meet Google's limited-ads rules are shown.
No tracking on iOS
On iOS, Chopzy does not track you across other companies' apps and websites, does not show Apple's tracking permission prompt and does not access your device's advertising identifier (IDFA). On iOS, ads are always non-personalised.
In-app purchases
The game offers optional in-app purchases. Payments are handled entirely by the Apple App Store or Google Play billing system; we never see or store your card number, billing address or other payment details. We only receive from the store the transaction details needed to deliver and restore what you bought (product, date, transaction number, whether the transaction is valid). Purchases are verified with the store on our game server before they are delivered. Payment data is governed by the Apple Privacy Policy and the Google Privacy Policy. Refund rules are explained in the Terms of Use.
Unity
Chopzy is built with the Unity game engine.
To improve the engine, Unity may send anonymous technical device statistics (e.g. device model, operating system, processor, graphics and memory information) to Unity Technologies.
The Unity purchasing library (Unity IAP) used for in-app purchases sends technical information (e.g. device model, operating system and app version, an installation identifier) to Unity Technologies to run and monitor the purchase service; your payment details are not sent.
This data is governed by Unity's privacy policy.
Device permissions
The game does not ask for camera, microphone, contacts or precise location. The game schedules reminders (e.g. "your daily reward is ready") as local notifications on your device and may ask for notification permission for them. No push token is collected and no data is sent to us for notifications. You can turn reminders off in the game's Settings screen or in your device settings.
International transfers
Data of the Google services used in this game (Firebase and AdMob) is processed on Google servers outside Türkiye (mainly in the US and the EU). For transfers out of Türkiye we follow KVKK art. 9 (an adequacy decision or, failing that, appropriate safeguards such as a standard contract); for EU/EEA users we rely on the GDPR transfer mechanisms (Standard Contractual Clauses and, for Google, also the EU-US Data Privacy Framework).
Game server data is processed outside Türkiye (Railway, United States (US East, Virginia)). For transfers out of Türkiye we rely on the Board's standard contract under KVKK art. 9 (notified to the Board within 5 business days of signing), and for EU/EEA users on the European Commission's Standard Contractual Clauses under the GDPR.
Details, including transfers related to the support and deletion forms, are in our Privacy Policy.
Deleting your data
- Data on your device: removing the game from your device deletes the game data stored on it.
- In the game: the delete option in the game's Settings screen starts the deletion of your server profile and the data linked to it.
- Data on our servers: to delete your anonymous profile and game data on the game server, analytics data and crash logs, send a data deletion request. You only need your Support code; we confirm the request with a reference number. We complete your request within 30 days at the latest: we start the deletion and tell you. Google then fully removes the data of the deleted identifiers from its live and backup systems within the following 180 days.
- Records we must keep by law (e.g. purchase and accounting records) are kept until that period ends and then deleted.
Your rights
You can exercise your rights under KVKK art. 11 and GDPR arts. 15–22 (information, access, rectification, erasure, restriction, objection, portability and withdrawing consent) through the Data Subject Request page. Your rights and how to complain (to the Turkish Personal Data Protection Board, or to the supervisory authority of your EU/EEA country) are detailed in our Privacy Policy and KVKK Information Notice.
Children
Chopzy is designed for users aged 13 and over and is not directed at children under 13. We do not knowingly collect data from children under 13. In some EU countries the age of digital consent is as high as 16; if you are under that age, ask a parent or guardian before giving consent. If you believe your child is using the game, write to support@machware.com.tr and we will delete the related data.
Changes and contact
We update this policy when the game or the law changes; the current version and date are shown at the top of this page. For questions, write to support@machware.com.tr or use the support page. Our corporate privacy policy: machware.com.tr/privacy.