Harfika Privacy Policy

Last updated: September 5, 2026 · Terms of Use · Account Deletion · Türkçe

This privacy policy explains what data the Harfika mobile app (the "App") collects when you use it, how that data is used, and what rights you have.

This notice is not blanket consent for all processing. Where consent is required, your choice is requested separately in the relevant screen.

Data controller: Kaan Yaşar Yönetken
Contact: kaanyasaryonetken@gmail.com

1. Data We Collect

Data you provide

• Nickname: shown to other players on leaderboards. You do not need to use your real name, and we recommend that you don't.
• Account information (optional): if you sign in with Apple or Google, we receive only your account ID and email address from your identity provider. Signing in is not required — the game can be played without an account. Linking an account exists so you can restore your progress on a new device.
• Feedback messages (optional): reports and suggestions you send from the in-app feedback screen are stored together with the app version and platform, and are used only to improve the game.

Data collected automatically

• Device identifier: a cryptographically random ID generated by the App (not linked to your name or phone number). It is used to store your progress, coin balance and scores without requiring an account.
• Game data: scores, number of words found, game statistics, achievements, in-game currency (coin) movements, purchased cosmetics. Your nickname, selected cosmetics and competitive scores are shown to other players in the relevant game and leaderboard screens.
• Notification token: if you allow notifications, an anonymous notification address is stored so we can send them to your device.
• Diagnostics: Sentry may process error/crash records, app version and technical device/operating-system information to keep the App stable. Our configuration does not attach your email, nickname, Harfika device ID or IP address to the report.
• Optional usage analytics: only if enabled in Settings, limited app, session and game/ad-result events are sent with app version, platform, a session ID and a one-way install hash. Free text, email, nickname and words found are excluded. This is off by default.
• Advertising identifier (IDFA/AAID): used for personalized advertising only if you allow it (on iOS, via the App Tracking Transparency prompt). Without permission, ads are shown non-personalized.
• Purchase information: if you make an in-app purchase, the transaction is verified through the App Store / Google Play and our purchase infrastructure (RevenueCat). Your card details never reach us.

What we do not collect

We do not collect your real name, phone number, address, GPS/precise location, contacts, photos or microphone recordings. (The optional voice-answer feature in Hex mode uses your operating system's speech recognition service; the App does not store audio and does not send it to our servers.) Our ad provider (Google AdMob) may use approximate region information (country/city level) derived from your connection's IP address when serving ads; this does not mean access to your device's location services.

2. How We Use Data

• To run online features such as leaderboards, the arena and playing with friends
• To store your progress and purchases, and restore them when you change devices
• To prevent cheating and abuse (scores are verified on the server)
• To send notifications, if you allowed them
• To show ads and process in-app purchases
• To measure and improve product usage, if you explicitly opted in

We do not sell your data or use it beyond the purposes above. Harfika does not build its own marketing profile; the ad provider may personalize ads only to the extent covered by your consent.

3. Why We Are Allowed to Process Your Data

• Performance of our agreement with you — providing the game you asked for: accounts, scores, leaderboards, friends, purchases.
• Our legitimate interests — keeping the game fair and stable: cheat prevention, ban enforcement, crash diagnostics.
• Your consent — personalized advertising and optional usage analytics, requested separately through the ad consent screen and, on iOS, App Tracking Transparency. You can withdraw this consent at any time (see section 7).

4. Third-Party Services

The App uses the following service providers (each governed by its own privacy policy):

Account email, nickname and the Harfika device ID are not attached to Sentry reports, and the option not to store the IP address in the report is enabled. A report may contain the error itself, app version and technical device/operating-system information.

Where your data is stored

Your game data is stored on servers of our infrastructure provider Supabase located in the European Union (Frankfurt, Germany). If you are in the EU/EEA, this means your game data stays within the EEA and no third-country transfer is involved in hosting it. The advertising and purchase providers listed above are global services and may process data in other countries under the safeguards described in their own policies.

5. Retention and Deletion

Optional analytics events are retained for no more than 90 days. Turning analytics off immediately clears unsent events stored on the device.

Game data is kept for as long as it is needed to provide the service. There is currently no general "delete all device data after 24 months" rule. Expired private-game rooms are cleaned up regularly; unused push tokens may be removed after 90 days. Orphaned anonymous auth records that are not linked to a device record may be removed after 30 days.

If you linked an Apple or Google account, you can permanently delete your account and all of your data on the server directly from the App. Server-side account and data deletion is one transaction: if a step fails, no partial deletion is committed and you can retry. Local game data on the device is not automatically erased, so the App may continue in guest mode: Settings → Account → "Permanently delete my account and data". You can also request deletion (even if you never linked an account) by emailing kaanyasaryonetken@gmail.com; all data tied to your device identifier will be deleted.

Exception: ban records resulting from rule violations may be kept after account deletion — limited to the random device identifier only — to prevent the ban being evaded with a new record (legitimate interest). This record cannot be linked to your identity and is not used for any other purpose.

6. Children's Privacy

The App is not directed at children under 13 and does not knowingly collect data from them. If we become aware of such data, it is deleted.

7. Your Rights

Under applicable data protection laws (including Türkiye's KVKK, Law No. 6698, and the EU/UK GDPR where it applies to you), you have the right to:

• learn whether your data is processed and request a copy of it;
• have inaccurate data corrected;
• have your data deleted — available directly in the App under Settings → Account;
• object to processing based on legitimate interests, and to ask us to restrict processing while an objection is being reviewed;
• receive the data you provided in a portable, machine-readable form;
• withdraw consent at any time. Usage analytics can be changed under Settings → Legal. Ad consent can be changed from Settings → Ad Privacy Options in the App; tracking permission from iOS Settings → Privacy → Tracking; and notification permission from your system settings. Withdrawing consent does not affect processing that already took place;
• know which third parties your data is shared with (listed in section 4).

To exercise any of these rights, email kaanyasaryonetken@gmail.com. We respond within 30 days.

If you live in the EU/EEA or the United Kingdom, you also have the right to lodge a complaint with your national data protection supervisory authority.

8. Changes

If this policy is updated, the new version is published on this page and the "last updated" date is changed.