Privacy Policy — GuessChallenge

Last updated: 28 September 2026

This policy is published in Turkish and English. If the two texts differ, the Turkish text prevails.

Who we are

GuessChallenge is developed by Bayram Furkan Kurucan, an individual developer who publishes games under the name Feastek. Feastek is not a company but the name the developer uses; under KVKK (the Turkish Personal Data Protection Law) and the GDPR, the data controller is the developer.

Contact and data deletion requests: [email protected]

In short

You can play the game with an automatically created guest account. Signing in with Google is optional; when you sign in, we keep persistent account data so that you can open the same account on another device, choose a username and use the friends features.

The only ad in the game is a Google AdMob interstitial shown when a match ends, and it gives no reward. Ads are requested as non-personalized; the app does not ask for cross-app tracking permission and does not sell data. We do not use first-party behavioral analytics. Room chat is normally temporary: it is deleted when the room closes. A message is kept as evidence only if you report it.

Data we process

All players

A question report is not stored together with your account, display name or username and contains no free text; only the day of the report is recorded, not the time.

The account ID is a randomly generated pseudonymous identifier. The app's account matching does not rely on the Android advertising ID, Apple's IDFA or a device fingerprint. The Android version removes the advertising ID permission; the iOS version does not ask for ATT tracking permission. The AdMob SDK may still process the app- or device-scoped identifiers described below. Removing the app deletes the ID and session data on the device; it does not find and delete the pseudonymous record on the server automatically. You can delete your data on the server immediately from inside the app or use the request process below (see "Your rights and deletion requests").

End-of-match ad

When a match ends, an interstitial ad is shown as the leaderboard opens. The ad has no reward and does not turn into any in-game value. To serve ads, measure views and clicks, run diagnostics and prevent fraud, the Google Mobile Ads SDK may send Google your IP address (from which an approximate location can be derived), product interactions such as app launches, taps and video views, performance and diagnostic information, and app- or device-scoped identifiers. According to Google's disclosures for Android and iOS, advertising history, crash logs and performance data may also be processed.

Ads are requested with the npa (non-personalized) option. In regions where it is required, the Google User Messaging Platform consent form is shown; you can reopen your choices from the Ad privacy link on the settings screen. Because the ad has no reward, no ad verification callback is sent to our server and no ad transaction record is kept.

If you sign in with Google

Your password never reaches us. We verify the identity token issued by Google on our server and then store the following data:

Your real name and profile photo on Google are not brought into the game. Sign in with Apple is not active in the app.

Friends, blocks and reports

• Friend connections, incoming and outgoing requests and the accounts you block are stored to run the social features. When you remove a friend connection or a block, the related record is deleted.
• The last 60 messages of room chat are kept only in the room's memory and are deleted when the room closes. There is no persistent record of ordinary chat.
• If you report a message, the message text, the identifiers of the reporting and reported accounts, the display name, the room code and the time are recorded. This record is kept for 1 year to review abuse and is then deleted automatically; if the reporting or reported account is deleted, the record is deleted at that moment.
• You no longer see new messages from a player you block, and you receive no friend requests or room invites from them. The other player is not told that they have been blocked.

Connection information

To connect to the game server, your IP address technically reaches the server. We do not store the IP address as a persistent profile or as a first-party analytics record. AdMob's processing of the IP address is described separately in the end-of-match ad section above.

If you email us

When you write to our support address, we process your email address, the name shown in your email, your message and anything you include in order to answer you and to verify deletion or access requests. Incoming mail is forwarded to our support mailbox in Gmail through Cloudflare Email Routing; our replies are sent on behalf of our support address through Resend. Correspondence is kept for 1 year from the last message and then deleted.

Stored on your device

• Random account ID;
• a signed session token, if you signed in with Google;
• the fact that the sign-in screen has been passed once;
• the language choice and the sound effects, room music and vibration settings;
• the active room code and player ID (so that you can return to the room if the connection drops).

This information is kept in the app's local storage and is deleted from the device when you remove the app. The active room code and player ID are deleted automatically when the app is closed. Your choice in the ad consent form is stored on the device by Google's consent tool (User Messaging Platform) itself.

What we do not collect

• Location, contacts, photos, files, camera or microphone;
• ATT permission for cross-app tracking or the Android advertising ID permission;
• crash reports or behavioral analytics in our own systems (the AdMob SDK's own diagnostics are described above).

Where data is kept

The persistent records above are kept in a PostgreSQL database on a server that we rent and operate ourselves in Denizli, Türkiye. The database is reachable only from the app's private network and does not publish any port outside the server.

Transfers abroad

Backups of the database are stored in Cloudflare R2 object storage, which means the data is transferred abroad. The backup bucket was created with Cloudflare's Eastern Europe (EEUR) location hint. Cloudflare applies this hint as guidance for where the data is physically placed; on its own it is not a firm residency commitment.

Backups are encrypted with AES-256 before they leave the server. The decryption key is not given to Cloudflare: the key is on our server and, off the server, in an encrypted password vault that only we can access, as a recovery record. Cloudflare stores encrypted data that it cannot decrypt. The app's live database is not copied abroad.

Emails you send to our support address are also processed on systems abroad: incoming mail passes through Cloudflare's email routing service and is stored on Google's Gmail servers, and our replies are sent through Resend. Data processed by Google Sign-In and AdMob is also processed on Google's systems.

Third parties

We do not share data with any ad network, data broker or separate analytics provider beyond the advertising data listed above for AdMob. All production client-server traffic is encrypted with HTTPS/WSS; the Google Mobile Ads SDK also uses TLS for data in transit.

Your rights and deletion requests

You have the right to access your data, to have inaccurate information corrected and to request deletion of the data linked to your account.

Deleting inside the app. The Account section of the settings screen has a Delete account option; it works for both guest and linked accounts. As soon as you confirm, your account on the server and the data linked to it are deleted: profile and scores, chosen username, social account link and stored email address, friend connections and requests, block records, your participation and guesses in match records, and the reports you wrote and those written about you. This cannot be undone. Your username becomes free and can be taken by another player; the device continues with a new guest ID. Other players' match records remain, with your rows removed, until the end of their own retention period. Question reports are not linked to your account, so they cannot be found and deleted in this process; they are deleted automatically at the end of their own retention period.

Requesting by email. If you cannot open the app, write to our email address with:

• for a linked account, the registered email address or the chosen username;
• for a guest account, the displayed Guest_1234 name and roughly when you last played;
• whether your request is for access, correction or deletion.

After verifying the request, we delete the same data as deleting inside the app does and complete the request within 30 days at the latest.

Backups. Deleted data remains in encrypted database backups for at most 35 days; backups are kept only for restoring after a failure and are deleted when they expire.

Children's privacy

The game is not directed at children under 13. We do not knowingly collect personal data from children. If you believe your child has sent us data, you can request deletion at the contact address above.

Reporting inappropriate content

Player names and chat messages are filtered automatically. If you still come across inappropriate content, use Report or Block in the message menu; you can also report it by email.

Changes

If we change the data flow, the retention periods or the providers we use, we update this policy and the store declarations in the same release. The date at the top of this page shows the day the text last changed.