Privacy Policy — Guess Challenge

Last updated: 31 October 2026

This policy is published in Turkish and English. If the two texts differ, the Turkish text prevails.

Who we are

Guess Challenge is developed by Bayram Furkan Kurucan, an individual developer who publishes games under the name Feastek. Feastek is not a company but the name the developer uses; under KVKK (the Turkish Personal Data Protection Law) and the GDPR, the data controller is the developer.

Contact and data deletion requests: support@feastek.com

In short

You can play the game with an automatically created guest account. Signing in with Google, or with Apple in the iOS app, is optional; when you sign in, we keep persistent account data so that you can open the same account on another device, choose a username and use the friends features.

The only ad in the game is a Google AdMob interstitial shown when a match ends or when you leave a match early, and it gives no reward. Ads are requested as non-personalized; the app does not ask for cross-app tracking permission and does not sell data. We do not use first-party behavioral analytics. You can remove the end-of-match ad for a year through Google Play in the Android app and through the App Store in the iOS app; the store handles the payment and no purchase information reaches our server. Room chat is normally temporary: it is deleted when the room closes. A message is kept as evidence only if you report it.

Data we process

All players

A question report is not stored together with your account, display name or username and contains no free text; only the day of the report is recorded, not the time.

The account ID is a randomly generated pseudonymous identifier. The app's account matching does not rely on the Android advertising ID, Apple's IDFA or a device fingerprint. The Android version removes the advertising ID permission; the iOS version does not ask for ATT tracking permission. The AdMob SDK may still process the app- or device-scoped identifiers described below. Removing the app deletes the ID and session data on the device; it does not find and delete the pseudonymous record on the server automatically. You can delete your data on the server immediately from inside the app or use the request process below (see "Your rights and deletion requests").

End-of-match ad

When a match ends, an interstitial ad is shown as the leaderboard opens; if you leave a match early, it is shown as you leave. The ad has no reward and does not turn into any in-game value. To serve ads, measure views and clicks, run diagnostics and prevent fraud, the Google Mobile Ads SDK may send Google your IP address (from which an approximate location can be derived), product interactions such as app launches, taps and video views, performance and diagnostic information, and app- or device-scoped identifiers. According to Google's disclosures for Android and iOS, advertising history, crash logs and performance data may also be processed.

Ads are requested with the npa (non-personalized) option. In regions where it is required, the Google User Messaging Platform consent form is shown; you can reopen your choices from the Ad privacy link on the settings screen. If the age you chose when the game was first opened is under 16, the consent form is not shown and ad requests carry Google's tag for users under the age of consent; in the European Economic Area a child's own consent to ads is not valid. Because the ad has no reward, no ad verification callback is sent to our server and no ad transaction record is kept.

If you buy ad-free play

You can buy a plan that removes the end-of-match ad for a year, through Google Play in the Android app and through the App Store in the iOS app. Payment is made in the store's own window; your card, bank or billing details do not reach the app or us. Google Play processes the payment and your purchase history under the Google Privacy Policy, and the App Store under the Apple Privacy Policy.

The app reads on your device from the store whether the plan is active: on Google Play the product ID, the purchase state and the purchase token; on the App Store the product ID, the purchase date and the refund date, if any. This is used only to remove the ad, to work out the plan's end date on the App Store and to acknowledge the purchase to Google Play; it is not sent to our server and is not linked to your game account. The stores report sales to us in the developer console through sales and earnings reports (such as the product, price, date and country, and on Google Play also the order number). We use these reports only for accounting, tax and refunds, and keep them for as long as tax law requires.

If you sign in with Google

Your password never reaches us. We verify the identity token issued by Google on our server and then store the following data:

Your real name and profile photo on Google are not brought into the game.

If you sign in with Apple

Sign in with Apple is offered only in the iOS app. Your password never reaches us, and we do not ask for your name or email address. We verify the identity token issued by Apple on our server and then store only the following data:

Friends, blocks and reports

• Friend connections, incoming and outgoing requests and the accounts you block are stored to run the social features. When you remove a friend connection or a block, the related record is deleted.
• The last 60 messages of room chat are kept only in the room's memory and are deleted when the room closes. There is no persistent record of ordinary chat.
• If you report a message, the message text, the identifiers of the reporting and reported accounts, the display name, the room code and the time are recorded. This record is kept for 1 year to review abuse and is then deleted automatically; if the reporting or reported account is deleted, the record is deleted at that moment.
• You no longer see new messages from a player you block, and you receive no friend requests or room invites from them. The other player is not told that they have been blocked.

Connection information

To connect to the game server, your IP address technically reaches the server. We do not store the IP address as a persistent profile or as a first-party analytics record. AdMob's processing of the IP address is described separately in the end-of-match ad section above.

When it connects, the app also tells the server which language its interface is set to. The server keeps the language in memory only while the connection lasts and uses it to set up the rooms you play in according to the languages of the players at the table; it does not store the language or show it to other players.

If you email us

When you write to our support address, we process your email address, the name shown in your email, your message and anything you include in order to answer you and to verify deletion or access requests. Incoming mail is forwarded to our support mailbox in Gmail through Cloudflare Email Routing; our replies are sent on behalf of our support address through Resend. Correspondence is kept for 1 year from the last message and then deleted.

Legal bases

We process the data above on the following legal grounds under KVKK and, for players in the European Economic Area and the United Kingdom, the GDPR:

• Providing the game and your account (account ID, display name or username, scores, match records, friends, room chat, sign-in data and the interface language): performance of the contract formed when you accept the Terms of Use (KVKK 5/2-c; GDPR 6/1-b).
• Safety and order in the game (reports, blocks, the abandonment series, the name and chat filter, connection protection and encrypted backups): our legitimate interest in a safe, fair and working game (KVKK 5/2-f; GDPR 6/1-f).
• Question reports: our legitimate interest in correcting questions (KVKK 5/2-f; GDPR 6/1-f).
• End-of-match ad: your consent where the consent form is shown (GDPR 6/1-a), and elsewhere our legitimate interest in funding the free game with non-personalized ads (KVKK 5/2-f; GDPR 6/1-f). You can withdraw your consent at any time from the Ad privacy link on the settings screen; withdrawing does not affect earlier processing.
• Support emails and rights requests: our legitimate interest in answering you and our obligation to handle requests about your data (KVKK 5/2-ç and 5/2-f; GDPR 6/1-c and 6/1-f).

Stored on your device

• Random account ID;
• a signed session token, if you signed in with Google or Apple;
• the fact that the sign-in screen has been passed once;
• the age you chose on first launch (an answer under 13 is not stored);
• when you accepted the Terms of Use;
• the language choice and the sound effects, music and vibration settings;
• the last state of your ad-free plan read from the store, together with the plan's end date on the App Store;
• the active room code and player ID (so that you can return to the room if the connection drops).

This information is kept in the app's local storage and is deleted from the device when you remove the app. The active room code and player ID are deleted automatically when the app is closed. Your choice in the ad consent form is stored on the device by Google's consent tool (User Messaging Platform) itself.

What we do not collect

• Location, contacts, photos, files, camera or microphone;
• ATT permission for cross-app tracking or the Android advertising ID permission;
• crash reports or behavioral analytics in our own systems (the AdMob SDK's own diagnostics are described above).

Where data is kept

The persistent records above are kept in a PostgreSQL database on a server that we rent and operate ourselves in Denizli, Türkiye. The database is reachable only from the app's private network and does not publish any port outside the server. If you play from outside Türkiye, for example from the European Economic Area or the United Kingdom, your data is processed on this server in Türkiye.

Transfers abroad

Backups of the database are stored in Cloudflare R2 object storage, which means the data is transferred abroad. The backup bucket was created with Cloudflare's Eastern Europe (EEUR) location hint. Cloudflare applies this hint as guidance for where the data is physically placed; on its own it is not a firm residency commitment.

Backups are encrypted with AES-256 before they leave the server. The decryption key is not given to Cloudflare: the key is on our server and, off the server, in an encrypted password vault that only we can access, as a recovery record. Cloudflare stores encrypted data that it cannot decrypt. The app's live database is not copied abroad.

Emails you send to our support address are also processed on systems abroad: incoming mail passes through Cloudflare's email routing service and is stored on Google's Gmail servers, and our replies are sent through Resend. Data processed by Google Sign-In, AdMob and Google Play for payments is also processed on Google's systems. The Sign in with Apple request, and payments and purchase history on the App Store, are processed on Apple's systems.

Third parties

We do not share data with any ad network, data broker or separate analytics provider beyond the advertising data listed above for AdMob. All production client-server traffic is encrypted with HTTPS/WSS; the Google Mobile Ads SDK also uses TLS for data in transit.

Your rights and deletion requests

Under Article 11 of KVKK and the GDPR you have the right to:

• learn whether your data is processed, for what purpose, and to whom it is transferred in Türkiye or abroad (see "Third parties"), and get access to it;
• have inaccurate data corrected and the data linked to your account deleted, and have the correction or deletion notified to third parties we transferred the data to;
• ask us to restrict processing, and object to processing based on our legitimate interest;
• receive the data you gave us in a machine-readable format (data portability);
• object to a result to your detriment that arises solely from automated analysis, such as the room restriction that follows the abandonment series;
• claim compensation if you suffer damage because of unlawful processing.

You can also lodge a complaint with a supervisory authority: in Türkiye the Personal Data Protection Authority (KVKK), in the European Economic Area the data protection authority of the country where you live or play, and in the United Kingdom the Information Commissioner's Office.

Deleting inside the app. The Account section of the settings screen has a Delete account option; it works for both guest and linked accounts. As soon as you confirm, your account on the server and the data linked to it are deleted: profile and scores, chosen username, social account link and stored email address, friend connections and requests, block records, your participation and guesses in match records, and the reports you wrote and those written about you. This cannot be undone. Your username becomes free and can be taken by another player; the device continues with a new guest ID. Other players' match records remain, with your rows removed, until the end of their own retention period. Question reports are not linked to your account, so they cannot be found and deleted in this process; they are deleted automatically at the end of their own retention period.

Requesting by email. If you cannot open the app, write to our email address with:

• for a linked account, the registered email address or the chosen username;
• for a guest account, the displayed Guest_1234 name and roughly when you last played;
• which right you want to use (for example access, correction, deletion or a copy of your data).

After verifying a deletion request, we delete the same data as deleting inside the app does. We handle every request free of charge and within 30 days at the latest.

Backups. Deleted data remains in encrypted database backups for at most 35 days; backups are kept only for restoring after a failure and are deleted when they expire.

Children's privacy

The game is not directed at children under 13. The game asks your age when it is first opened and does not connect to our server until an age of 13 or older is chosen; when an age under 13 is chosen, the game does not open and that answer is not stored. The age you choose is stored only on your device and is not sent to us. On the device the age also decides whether the ad consent form may be shown: if it is under 16, the form does not open (see "End-of-match ad"). We do not knowingly collect personal data from children. If you believe your child has sent us data, you can request deletion at the contact address above.

Reporting inappropriate content

Player names and chat messages are filtered automatically. If you still come across inappropriate content, use Report or Block in the message menu; you can also report it by email.

Changes

If we change the data flow, the retention periods or the providers we use, we update this policy and the store declarations in the same release. The date at the top of this page shows the day the text last changed.