PRIVACY & YOUR DATA

Privacy Policy

Last updated: 23 October 2026

Garawell Games Oyun Yazılım A.Ş. (“Garawell”, “we”, “us”, or “our”) develops and operates games and applications and provides the Garawell software development kit (the “Garawell SDK”) used in games and applications.

This Privacy Policy explains what personal information we process, how we obtain and use it, when we share it, how long we retain it, and the choices and rights available to you.

1. Scope and Responsibility

This Privacy Policy applies to:

Games and applications operated by Garawell. Processing carried out by Garawell through the Garawell SDK in games and applications operated by other developers or publishers. Our public websites and communications with visitors and users. Support enquiries and privacy requests relating to these services.

The information processed depends on the game or service, its configuration, the features you use, your device and platform, and your applicable privacy choices. Not every feature or provider described in this policy is used in every game.

Garawell is the data controller for processing whose purposes and means we determine. When another developer or publisher operates a game, that organisation may also be responsible for processing personal information. Its privacy policy describes its own activities.

This policy covers Garawell’s processing and does not replace the privacy policy of another developer, publisher, platform, or independent service provider.

2. Information We Process

2.1 Information you provide

When you contact us, request support, or exercise your privacy rights, we process the information you provide. This may include your name, email address, the content of your message, and information relevant to your enquiry.

To identify the game and records associated with a privacy request, we may process the game name, application identifier, platform, request reference, player ID where available, service-specific identifiers, and contact information included in the request.

2.2 Device, application, and identifier information

Our games and integrated services may process:

Device model, operating system, application version, platform, language, and related technical settings. Network connection information, such as connection type. IP address and approximate location, such as country or region, derived from that address. Player IDs, installation IDs, app-instance IDs, and other identifiers used to distinguish a player, installation, device, or session. Advertising identifiers, such as the Android advertising ID or Apple’s Identifier for Advertisers, where available and permitted by applicable settings, permissions, and law. Consent status, privacy preferences, and related information needed to apply your choices.

A player or installation identifier may be randomly generated and may not reveal your name. Information linked to such an identifier can nevertheless be personal information and is not necessarily anonymous.

2.3 Gameplay and interaction information

Depending on the game and enabled integrations, we may process information about:

App launches, sessions, activity times, and interactions with game features. Level starts and completions, successes and failures, progression, and other gameplay events. Virtual items, virtual currency, rewards, quantities, balances, and in-game transactions.

This information helps us understand how games are used, identify problems, evaluate features, and improve game balance and the player experience.

2.4 Advertising and campaign information

Advertising and measurement services may process information about ad requests, impressions, clicks, video views, rewarded-ad interactions, advertising revenue, and related events.

Attribution services may process information about the campaigns or sources associated with installations and in-game events. Attribution means measuring which advertisement or campaign contributed to an installation or another measured event.

The information involved may include advertising or installation identifiers, IP addresses, device information, campaign information, and relevant app events, subject to applicable privacy choices and requirements.

2.5 Log data, diagnostics, and performance information

To investigate errors and improve reliability, our games may process crash reports, exception details, technical logs, and relevant application state.

Reports may include device and application information, a player or installation identifier, and the time and circumstances of an error.

Depending on the diagnostic features enabled, performance information may include frame rate, memory use, battery level, and low-memory events.

2.6 Purchase information

Where a game offers in-app purchases through the Apple App Store or Google Play, the relevant store processes the payment.

The game may receive product identifiers, transaction identifiers, purchase status, receipts, and entitlement information needed to deliver, verify, or restore purchases.

These store purchases do not require you to provide your full payment-card details directly to Garawell. The relevant store’s privacy policy also applies to its processing.

2.7 Website information and privacy records

Our websites and supporting infrastructure may process IP addresses, browser and device information, requested pages, request times, and technical or security logs.

When you contact us through a website or by email, we process the information you submit.

We may also process records of privacy choices and requests, including information needed to identify the relevant records, apply your choices, respond to your request, and demonstrate compliance with applicable requirements.

When you submit an in-game deletion request, the game sends the available identifiers needed to locate relevant provider records to our privacy-request service. Depending on the integrations, these may include an Adjust device identifier, a Firebase Analytics app-instance identifier, a Crashlytics user identifier, and a GameAnalytics user identifier. The request can also record that an identifier was unavailable.

We store request references, dates, processing outcomes, provider acknowledgements, and any contact email supplied with the request. We use protected request credentials to restrict status access, keyed identifier digests to recognise repeat requests, and keyed network-address digests to limit abuse. A digest or request reference can still be personal information; we do not treat these records as anonymous solely because a direct identifier has been replaced.

3. How We Obtain Information

We obtain information:

Directly from you when you communicate with us or submit a request. Automatically through games, applications, websites, and integrated SDKs. From the platforms, advertising services, measurement services, and other providers involved in delivering the services. From a game’s developer or publisher where relevant to Garawell’s processing, support, or handling of a privacy request.

The sources involved depend on the particular game, service, and features you use.

We process information for the following purposes:

Providing games and their features: operating applications, applying settings and configuration, and delivering requested functionality. Understanding gameplay: analysing sessions, progression, feature interactions, and in-game transactions to improve game design and balance. Advertising: delivering advertisements, measuring ad performance and revenue, and applying advertising preferences. Campaign measurement: understanding installation sources and evaluating the effectiveness of advertising campaigns. Diagnostics and performance: investigating crashes, resolving technical issues, and improving reliability. Purchases: delivering, verifying, and restoring purchased content where available. Support and privacy requests: responding to enquiries, identifying relevant records, and carrying out applicable requests. Security and legal requirements: protecting services, addressing fraud or misuse, maintaining required records, and responding to legally valid requests.

Where data protection law requires a legal basis, the basis depends on the purpose and circumstances:

Consent: for processing that requires your consent, including relevant analytics, personalised advertising, tracking, or non-essential device storage and access. Performance of a contract or steps taken at your request: where processing is necessary to provide a service you request, deliver a purchase, or fulfil another applicable contractual obligation. Legitimate interests: where permitted by law, for purposes such as protecting services, investigating technical problems, handling support, and improving services, subject to your rights and interests. Legal obligations: where processing is necessary to comply with applicable law, including relevant recordkeeping requirements and legally valid requests.

Legitimate interests do not replace consent where consent is required. The applicable legal grounds may differ under local law. You can contact us for information about the grounds relevant to a particular processing activity.

5. Service Providers and Information Sharing

5.1 Integrated services

We use third-party services for advertising, consent management, analytics, attribution, diagnostics, and application configuration.

Depending on the game and its configuration, these may include:

Google AdMob: advertising delivery and measurement. Google Privacy Policy. Google User Messaging Platform (UMP): consent messages and privacy choices. Google Privacy Policy. Google Analytics for Firebase: application and gameplay analytics. Firebase Privacy Information. Firebase Crashlytics: crash reporting and diagnostics. Firebase Privacy Information. Firebase Remote Config: remote application configuration. Firebase Privacy Information. GameAnalytics: gameplay, progression, and in-game economy analytics. GameAnalytics Privacy Notice. Meta / Facebook App Events: application-event and marketing measurement. Meta Privacy Policy. Adjust: installation attribution, campaign measurement, and configured application events. Adjust Privacy Policy. AppLovin MAX, where integrated: advertising mediation, ad delivery, and measurement. AppLovin Privacy Policy.

Where a game offers in-app purchases, Apple or Google also processes purchase-related information under its applicable store terms and privacy policy: Apple and Google.

Providers may process information on our behalf or as independent controllers, depending on their role and the service concerned. Their policies provide additional information about their processing.

The providers and advertising partners involved can vary by game and configuration. Where an applicable consent interface presents a partner list, you can review that list and the choices it offers. You can also contact us to ask which providers are involved in a particular game.

5.2 Games operated by other developers or publishers

Other developers and publishers can integrate the Garawell SDK into their games. Integrations covered by this policy may send information to service-provider accounts managed by Garawell.

Garawell may access and use the resulting information for the purposes described in this policy, subject to applicable privacy choices and legal requirements.

We may share relevant gameplay, analytics, and diagnostic information with the game’s developer or publisher to operate, support, and improve that game.

The developer or publisher may determine aspects of the integration, such as which supported features are enabled and which game events are submitted. Its own privacy policy explains its separate processing activities.

5.3 Other disclosures

We may share relevant information with hosting, communications, security, and professional-service providers supporting our operations.

Our privacy-request service uses hosting and database infrastructure, including Vercel and Neon, to receive, store, and process requests. Access to a game’s published configuration uses our SDK Console infrastructure, including Supabase. Relevant identifiers are sent to the provider concerned where needed to handle a request. Infrastructure providers may also process technical connection and security information.

We may also disclose information where required by law, in response to legally valid requests, or where necessary and legally permitted to protect rights, resolve disputes, and address fraud or security incidents.

Links to provider policies do not replace Garawell’s responsibility for the processing described in this policy.

6. Advertising, Analytics, and Your Choices

Depending on the game, platform, and applicable requirements, in-game privacy settings or consent messages may allow you to manage analytics and advertising choices.

Where a consent form is provided, it may offer choices concerning specific purposes and partners. The available controls can vary between games and regions.

You can also manage tracking permissions and advertising-identifier settings through your device settings. On iOS, tracking that requires Apple’s permission is subject to App Tracking Transparency.

Turning off personalised advertising does not necessarily remove advertisements. You may still receive non-personalised or limited ads. Advertising services may continue to process information for permitted functions such as ad delivery, security, and fraud prevention, subject to applicable law and your choices.

Changing an analytics or advertising preference does not itself submit a deletion request for information previously collected. It also does not disable every function needed to operate a game, such as configuration delivery, purchase handling, or responding to a support request.

In the current in-game deletion flow, the game first collects the available identifiers needed for your request and then turns off its local analytics and personalised-advertising preferences before attempting to send the request. These preferences can remain off if the request cannot be sent. You can change them later through the available privacy controls. This preference change does not prove that every third party has stopped all processing or deleted previously collected information.

Where processing relies on consent, you can withdraw that consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

If you cannot find or use a privacy control, contact us using the details below.

7. Cookies and Local Storage

Our websites and embedded services may use cookies or similar technologies for functionality, security, and measurement where enabled. The technologies used depend on the website and features involved.

You can manage browser cookies through your browser settings and any consent controls provided by the website. Blocking certain cookies may affect functionality.

Games use local storage for information such as progress, settings, generated identifiers, and privacy preferences. Mobile SDK identifiers and local application storage are distinct from browser cookies.

Clearing browser or application storage does not automatically delete information already held by Garawell or service providers.

8. Data Retention

We retain personal information for as long as necessary for the purposes described in this policy, taking account of the information involved, why it is used, applicable legal obligations, and your rights.

There is no single retention period for every category of information or every provider.

In determining retention, we consider:

The period needed to provide the relevant game, service, or requested feature. The period needed to understand gameplay, investigate errors, or resolve a support request. The need to maintain records of privacy choices and requests. Applicable transaction-record requirements and other legal obligations. The time needed to establish, exercise, or defend legal claims. Relevant provider retention settings, deletion procedures, and backup handling.

When information is no longer needed, we delete or anonymise it, subject to lawful retention requirements and the relevant service providers’ deletion processes.

A deletion request may be subject to lawful exceptions, such as retaining records required by law. We can explain the retention criteria relevant to a particular request.

For deletion requests submitted through our in-game request service, the stored request payload, including provider identifiers and contact email, is scheduled for removal at the earlier of 30 days after all provider tasks reach a final recorded outcome or 180 days after receipt. A final recorded outcome may include an identified limitation; it does not necessarily mean every provider has confirmed erasure. A documented retention extension may be authorised once, for up to 90 additional days. Removal is carried out through scheduled maintenance.

Minimised request-handling and audit records are retained separately where needed to document our response, handle outstanding obligations, prevent abuse, or meet legal requirements. These can include the game, request reference, dates, outcomes, and provider evidence. Limited deduplication and security records have separate retention purposes and are not used to resume advertising or analytics. The request-payload schedule does not set the retention period for providers’ own records, support correspondence, or all audit and security records.

Uninstalling a game, clearing local storage, or disabling analytics does not by itself request deletion of information already collected by online services.

9. International Processing

Garawell is based in Türkiye. Our providers operate internationally, so personal information may be processed in Türkiye and other countries, including countries outside your place of residence.

The locations involved depend on the provider, service, and configuration. Those countries may have different data protection laws.

International transfers are subject to applicable legal requirements. Depending on the relevant law and transfer, these requirements may involve an adequacy decision, approved contractual safeguards, or another permitted transfer mechanism.

You can contact us for information about the recipients, locations, and applicable transfer arrangements relevant to your information.

10. Your Privacy Rights

Your rights depend on applicable law and the circumstances of the processing. These rights may be subject to conditions and lawful exceptions.

10.1 Access, correction, deletion, and other rights

Depending on applicable law, you may have the right to:

Learn whether your personal information is processed and obtain information about that processing. Access your personal information and request a copy. Request correction of inaccurate or incomplete information. Request deletion of your personal information. Request restriction of certain processing. Object to processing, including processing based on legitimate interests and direct marketing. Receive certain information in a portable format. Withdraw consent where processing relies on consent. Challenge qualifying decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects, and request the protections provided by applicable law. Complain to the competent data protection authority.

These rights may apply under laws such as the GDPR, UK GDPR, Swiss data protection law, or other applicable local requirements.

10.2 Rights under Türkiye’s data protection law

Where Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”) applies, your rights under Article 11 include:

Learning whether your personal data is processed. Requesting information about processing. Learning the purpose of processing and whether your data is used in accordance with that purpose. Knowing the third parties to whom your data is transferred in Türkiye or abroad. Requesting correction of incomplete or inaccurate data. Requesting deletion or destruction where the conditions provided by applicable law are met. Requesting notification of relevant correction or deletion to recipients where applicable. Objecting to an adverse result arising from analysis exclusively through automated systems. Seeking compensation for damage caused by unlawful processing.

10.3 Additional rights under applicable U.S. privacy laws

Depending on your state of residence and applicable law, you may also have rights concerning:

The categories and sources of personal information collected. The purposes for which information is used and the categories of recipients. Access, correction, deletion, and portability. Opting out of targeted advertising, the sale or sharing of personal information, and certain forms of profiling. The use or disclosure of sensitive personal information where relevant. Submitting requests through an authorised agent. Appealing a decision concerning a privacy request.

Certain advertising-related disclosures may be considered a “sale,” “sharing,” or “targeted advertising” under applicable U.S. privacy laws, even where no money is exchanged.

Where these rights apply, you can use available privacy controls or contact us to make a request. We will not discriminate against you for exercising privacy rights protected by applicable law.

An authorised agent may need to provide evidence of their authority, and we may need to verify the request as permitted by law.

If applicable law gives you a right to appeal a decision concerning your request, you can contact us using the details below and identify the decision you wish to appeal.

11. Data Deletion and Other Privacy Requests

11.1 Request deletion from a game

Where the current Garawell in-game deletion feature is available:

  1. Open the game’s settings and privacy screen.
  2. Select the option to delete your data, provide the contact email requested by the screen, and confirm Send request.
  3. The game sends the request directly to our privacy-request service. You do not need to open a mail app or send an email to submit this in-game deletion request.
  4. Wait for the receipt and request ID. You can return to the privacy screen to refresh the status of the saved request. If sending fails or you are offline, the request may remain saved on that device for a later attempt; it has not been confirmed as received until a server receipt is returned.

The request concerns the identified game, platform, and available identifiers from that installation. It does not automatically cover other games, other devices, or identifiers that are no longer available. Keep the request ID if you need to contact us, but do not share private request credentials.

This feature does not itself reset local game progress, uninstall the game, cancel store subscriptions, or delete an Apple, Google, Facebook, or other third-party account. If the game provides a separate game-account deletion feature, use that feature to request deletion of the account and its associated game data.

11.2 Request deletion without access to the game, or exercise another right

You can contact us at sdk+privacyrequest@garawell.com if you have uninstalled the game, cannot use the in-game feature, want an explanation of a request outcome, or wish to exercise another privacy right.

Please include:

  • The name of the game or service and the platform you used.
  • A description of your request.
  • Your saved request ID or player ID, if available.
  • Contact information so that we can respond.

You do not need to reinstall the game simply to contact us. We may need proportionate additional information to identify the relevant records and verify that the request concerns your information. A player ID or request ID alone does not prove ownership. If the necessary identifiers or a reliable matching record are unavailable, we may be unable to identify some information and will explain the limitation.

Do not send passwords, payment-card information, private request credentials, or unrelated sensitive documents. We do not provide a separate web portal for tracking in-game deletion requests. You can use the in-game status feature where available or contact us for assistance. Other in-game privacy controls may prepare a support email; if a control opens a draft, you must send that email for us to receive it.

11.3 How requests are handled and what the result means

We record the request, identify the relevant services and available identifiers, and process the work that can be performed through configured provider channels. Some work can be submitted automatically; unavailable channels, missing information, access problems, and other exceptions can require further handling. Automatic processing is not available for every provider or every game.

A request being received is not confirmation of deletion. A provider acknowledging a deletion request is also not independent confirmation that it has erased all relevant data. A general in-game status such as processed describes the recorded handling of the request and may include limitations; it is not a guarantee that every third party has verified erasure. Contact us for the outcome and limitations relevant to your request.

Provider-specific limits can include:

  • Adjust: where configured and authorised, we can submit a deletion request using an available Adjust identifier. This does not by itself establish deletion of separate copies held by advertising partners.
  • Firebase Analytics / GA4: where configured and authorised, we can submit a request using an available app-instance identifier. Google’s acknowledgement records submission; provider processing follows Google’s procedures. Separately exported data requires separate handling.
  • Firebase Crashlytics: available per-user deletion requests depend on reports being associated with the user identifier supplied. Reports without a matching user identifier cannot be individually targeted through that route.
  • GameAnalytics: handling depends on the deletion channel available for the relevant service and subscription. We do not represent GameAnalytics deletion as automatically completed merely because we received your request.
  • Meta App Events: Meta does not provide us with a confirmed developer-initiated channel for deleting an individual user’s App Events records from Meta’s systems. You can also use Meta’s own privacy tools for data it controls. Removing a Facebook app connection does not by itself demonstrate erasure of all records held by Meta.
  • AdMob and other advertising services, including AppLovin where used: developer deletion mechanisms depend on the provider and identifier involved. We cannot guarantee deletion of their independently controlled records through our in-game request. Their own privacy policies and user controls also apply.

We handle requests according to applicable law, including its response deadlines, permitted extensions, and exceptions. Where relevant, this involves coordinating with service providers or the game’s developer or publisher. If a request cannot be fulfilled in full, you can contact us for the reasons and available next steps. Request-handling records have the separate retention purposes described in section 8.

For information held separately by another developer, publisher, or independent provider, you may also need to contact that organisation under its own privacy policy. This does not replace our responsibilities for processing carried out by us or on our behalf.

12. Children’s Privacy

Garawell’s games are not directed to children under 13. We do not knowingly collect personal information from children under 13.

Some jurisdictions apply additional age-related protections or require parental consent for particular processing activities.

Games operated by other developers or publishers may have their own audience restrictions and notices. Their privacy policies explain their practices.

If we learn that a child’s personal information has been collected without legally required parental consent, we will promptly delete that information.

If you are a parent or guardian and believe your child has provided personal information through our services, please contact sdk+privacyrequest@garawell.com and identify the relevant game so that we can address the information concerned.

13. Security

We use reasonable technical and organisational measures intended to protect personal information against unauthorised access, disclosure, alteration, loss, or misuse.

However, no method of transmission over the internet or electronic storage can guarantee absolute security.

Please avoid including sensitive information in support messages unless it is necessary for your request.

Our games and websites may contain links to third-party websites, applications, or services.

When you access a separate third-party service, its own terms and privacy policy govern its processing. We encourage you to review those policies before providing information.

We do not control the privacy practices of independent third-party websites or services. This does not remove Garawell’s responsibility for processing carried out by us or on our behalf as described in this policy.

15. Platform Privacy Requirements

We are committed to meeting the applicable privacy and data-protection requirements of Google Play, Apple’s App Store, and Meta.

This includes providing transparent information about data processing, applying relevant consent and privacy requirements, and maintaining methods for users to submit privacy requests.

The stores and platforms may also process information independently under their own privacy policies.

16. Changes to This Policy

We may update this Privacy Policy to reflect changes to our games, services, providers, processing practices, or applicable requirements.

The revised policy will be published on this page with an updated date. Where required, we will provide additional notice or obtain consent before a relevant change takes effect.

17. Contact Us

Garawell Games Oyun Yazılım A.Ş.

Privacy questions and requests: sdk+privacyrequest@garawell.com

General enquiries: info@garawell.com

Website: www.garawell.com