This policy explains how personal data is processed when you use the Zirve mobile game (iPhone and iPad) and this website (the “Service”).
Controller: Mehmet Mutlu (an independent developer based in Türkiye; “Zirve”, “we”). Contact: destek@mm-apps.com. Users in Türkiye can also read the KVKK information notice (Turkish). The rules for using the game are in the Terms of Use; this policy is for your information and needs no agreement.
Summary
- We don't ask who you are. You don't need to give us your name, email, phone number, address, ID number or date of birth to play. We don't access your location, contacts, photos, camera or microphone. We don't collect Apple's advertising identifier (IDFA) ourselves; Google, which serves the ads, may use it only if you tap “Allow” in iOS's tracking permission (Ads).
- Players are stored under random IDs. On first launch a guest account with a random ID is created for you. That ID and the game data linked to it don't contain your name, but in law they still count as personal data (pseudonymous data). This policy describes that data.
- We only process what the game needs: your progress, results, gems, league and friends, purchases; and usage statistics to improve the game.
- We keep data briefly. Each kind of data is kept only as long as its purpose needs (Retention). We don't record your IP address: it is used only in the moment, during the connection, for rate limiting against attacks, and is written neither to our database nor to our server logs.
- We don't sell your data; we never use game data or usage statistics for ad targeting or share them, and we use no third-party analytics or crash-reporting tools.
- Personalised ads only with your permission. Ads only appear when you ask for one. The app asks for iOS's tracking permission once; Google may show personalised ads and use the IDFA only if you tap “Allow” (and, in the EEA, the UK and Switzerland, also consent in Google's form). Otherwise ads are non-personalised. You can change your decision in iOS Settings → Privacy & Security → Tracking.
- In the European Economic Area we only keep usage statistics if you allow it; elsewhere you can turn them off at any time under Profile → Settings → Usage statistics, which also deletes their history.
- You can download a copy of your data and delete your account in the app.
1. Data we process
| Category | Examples | When |
|---|---|---|
| Account | A random user ID. If you sign in with Apple, the user ID Apple creates only for our developer account: we do not ask Apple for your name or email address, and if Apple sends them anyway we delete them without keeping them. Apple itself can match this ID to your Apple Account. | On first launch; at Sign in with Apple |
| Profile | Display name (we recommend a nickname; names containing an email address, phone number or web address are not accepted; change it any time), the outfit and tower look you choose, your invite code. | As you play |
| Game progress | Your current floor, record and when you reached it, camp and chest progress; each floor's result (puzzle type, stars, time left, whether you continued, when you played); a record of floors where time ran out; daily streak; season points and claimed rewards; Daily Tower attempts and times. | After each floor and when the app opens |
| In-game economy | Gem balance and movements (reason earned/spent), your inventory (hints, extra time, streak freezers). | As you earn and spend |
| Social | Your weekly league group and rank, friend connections, the invite code you used, a log of “nudge” and “passed you” notifications (who, to whom, when); the boards you solve in calm mode (puzzle type, board number, when and how long); players you report or block. | When seated in a league; when adding friends |
| Notifications | Your device's push token (Apple Push Notification service). The token is stored only while you allow notifications and removed from our server when you switch them off or don't open the app for 60 days. | When you allow notifications |
| Purchases | The transaction ID, product, price, date, storefront country and currency of in-app purchases. Your card details never reach us; Apple takes the payment. | When you buy |
| Usage statistics | When a session starts and ends, screens you open, onboarding steps, leaving or continuing a floor, ad and store interactions (outcomes only, no payment details), settings changes; device model, iOS version, app version, language and App Store country. We do not keep your IP address, advertising identifier or device identifier. See Usage statistics. | As you play (in the EEA only if you agreed) |
| Diagnostics | Technical reports iOS creates (MetricKit) when the app crashes or hangs: call stacks, error type, device model, iOS and app version. No game content, name or contact details; linked to your account ID. | At the next launch |
| Ads | When you choose to watch a rewarded ad, the device and app information, IP address, ad interactions, (in the EEA/UK/Switzerland) consent choice and, only if you tapped “Allow” in iOS's tracking permission, Apple's advertising identifier (IDFA) processed by Google AdMob. Your tracking-permission answer is kept by iOS on your device. To verify the reward we attach a random single-use ticket to the ad; your account ID is not sent to Google. See Ads. | When an ad loads and plays |
| Technical and security | App version; the public half of a key created on your device to verify the app is genuine Zirve (Apple App Attest; the private key never leaves your device); cheat and abuse flags. We do not record your IP address or device/browser details: your IP address is used only in the moment, during the connection, for rate limiting; it is not written to our database or server logs, and it is removed from sign-in sessions as soon as it is written. Our server's technical logs (for security and debugging) hold request times and error details for at most 7 days. | On every server connection |
| Support emails | If you email us: your email address, your message and any support code you include. Used only to answer your request and keep a record of its outcome. | When you write to us |
Your progress and settings are also stored on your device so you can play offline. Share cards are created on your device and are not sent to us unless you share them. Your calm-mode progress stays on your device; only the solves counted on the weekly list reach the server.
2. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the game, saving your progress and moving it between devices | Account, profile, progress, economy | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Leagues, Daily Tower, seasons, rankings and friends | Profile, progress, social | Performance of a contract |
| Sending notifications (when a friend nudges or passes you) | Push token, social | Performance of a contract (a feature you turn on). Notifications are only sent while you allow them in iOS; switch them off any time in iOS Settings. |
| Verifying purchases, crediting gems and premium, handling refunds and accounting | Purchases, account | Performance of a contract; legal obligation (Art. 6(1)(c); KVKK Art. 5(2)(ç)) |
| Improving the game: understanding through aggregate statistics which floors are hard, where players stop, and how features and the store are used | Usage statistics, game progress, purchase records | In the European Economic Area, your consent (GDPR Art. 6(1)(a)); in the UK, Switzerland and elsewhere, legitimate interest (GDPR/UK GDPR Art. 6(1)(f)); in Türkiye, legitimate interest (KVKK Art. 5(2)(f)). These statistics are never used to decide rewards, league results or prices or offers for you. |
| Fixing crashes and hangs | Diagnostics | Legitimate interest (Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Showing rewarded ads when you ask and verifying the reward | Ad data | Non-personalised ads: performance of a contract (the reward you asked for) and legitimate interest (a free, ad-supported game) (GDPR Art. 6(1)(b), (f); KVKK Art. 5(2)(c), (f)). Personalised ads and the IDFA: your consent (GDPR Art. 6(1)(a); explicit consent under KVKK Art. 5(1)), given by tapping “Allow” in iOS's tracking permission and, in the EEA, the UK and Switzerland, also in Google's consent form. You can withdraw it at any time. |
| Preventing cheating and abuse, security, reviewing inappropriate names and reports | Technical and security, progress, economy, social | Legitimate interest (Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Answering rights requests and support, recording deletions | Support emails, account | Legal obligation; legitimate interest |
We don't use your data for automated decisions based on profiling or to send marketing emails. For personalised ads, Google builds interest-based profiles under its own responsibility, and only if you allowed it. Anti-cheat checks may not count a result; if you disagree, you can write to us.
3. Usage statistics
- Statistics are kept only in our own database (on our server in Türkiye). Records linked to your account are deleted after 90 days; in the long run only daily totals not linked to anyone remain. They are never shared with other companies, never used for ads or tracking, and never used to follow you across other apps or websites.
- European Economic Area (EU countries, Iceland, Liechtenstein, Norway): after the tutorial we ask once, “Share / Don't share”; nothing is recorded until you answer, and nothing if you choose “Don't share”. We tell your region from your App Store country and from what the ad consent form reports; if it can't be told, we treat you as being in a region where we ask.
- Other countries (Türkiye, the UK, Switzerland and elsewhere): statistics are on by default; we tell you so in one line on first launch.
- Everywhere you can switch them off or on under Profile → Settings → Usage statistics. Turning them off stops recording and deletes your past statistics from our server. We keep a record of your choices (when, which text version) for as long as your account exists, to prove consent.
4. Visible to other players
In rankings, other players see your display name, outfit and tower look. In addition:
- Your league group: floors climbed this week and your rank.
- Your friends: your record floor, league and when you last played.
- Daily Tower ranking: floors cleared and your time.
- Weekly calm list: the number of puzzles you solved in calm mode this week.
- Top climbers (“Zirvedekiler”), the all-time top 20 by highest tower floor: your record floor and rank.
Don't use your real name as display name; pick a nickname. The name screen reminds you; names that look like an email address, phone number or web address are not accepted. Inappropriate names may be changed; you can report or block a player. When you share your display name or share cards yourself, they come under the control of the people and platforms you share them with.
5. Service providers and international transfers
We share data only with the providers needed to run the Service, and only as far as their service needs it:
- Güzel Hosting (GNET İnternet Telekomünikasyon A.Ş., Türkiye) — the virtual server service our server and backups run on. The database, authentication, server functions, usage statistics and diagnostics run on this server with software we operate ourselves (open-source Supabase). Backups are encrypted on the server and kept for 30 days in Güzel Hosting's backup storage in Türkiye.
- RevenueCat Inc. (USA) — verification and management of in-app purchases. Only when you make a purchase or tap “Restore purchases” (or an App Store purchase of yours is waiting to complete), RevenueCat receives your random account ID, your purchase details and device information collected by its software (device model, iOS version, language, App Store country, the device identifier Apple gives this app); nothing is sent to RevenueCat for players who don't buy. Store prices are read directly from Apple. and processes them on our behalf under its published terms of service and data processing addendum. Privacy
- Google LLC / Google Ireland Ltd. — AdMob ads and consent management (User Messaging Platform); processes data under its own policy as an independent controller. It uses the IDFA and personalised ads only if you allowed them. Privacy
- Apple Inc. — Sign in with Apple, App Store payments, notification delivery, app verification (App Attest) and Game Center (if you are signed in to Game Center, your record floor, Daily Tower result and achievements are sent to Game Center); an independent controller. Privacy
- GitHub Inc. (USA) — hosting of this website; GitHub processes access logs containing IP addresses under its own policy. The site uses no cookies.
- Email: our support address is hosted on Güzel Hosting's business email service; emails you send us are stored on Güzel Hosting's servers in Türkiye. Our replies are delivered through Güzel Hosting's mail relay provider MailChannels Corporation (Canada; servers in North America): the reply and your email address pass through its servers in transit and are not stored there.
International transfers: our server is in Türkiye. Data sent to RevenueCat (USA) for purchase verification when you buy, to Google when you choose to watch a rewarded ad, and to Apple when you use Apple services is transferred abroad. Emails you send us are stored in Türkiye; our replies to you pass through MailChannels' servers (Canada) in transit. Data sent to Google and Apple is processed as part of your choice to use those services and your own relationship with those companies. We may also disclose data to competent authorities where required by law. You can write to us for more information about these transfers.
Players in the European Economic Area, the UK and Switzerland: the controller and our server are in Türkiye, so your data is processed and stored in Türkiye. There is no EU adequacy decision for Türkiye. The retention periods, security measures and rights in this policy apply to you as well.
Change of server: until 30 October 2026 your data was hosted on Supabase Pte. Ltd.'s infrastructure in Frankfurt, Germany. That project was deleted on 30 October 2026. Our support address was also on Google's Gmail service until 30 October 2026; emails you send after that date are stored at Güzel Hosting in Türkiye.
6. Ads
Ads in Zirve appear only when you ask for one: when you tap “Watch ad” to get a life, continue after time runs out or boost a reward. No ad interrupts play, and ads are limited to content suitable for general audiences.
- Ads are served by Google AdMob. Google processes device and app information, your IP address (including an approximate location derived from it) and ad interactions to show and measure ads and to prevent fraud. We do not collect your location.
- In the EEA, the UK and Switzerland Google's consent form (IAB TCF) is shown after the welcome page on first launch. You can change your choice at any time in the app's privacy options (Profile → Settings). This form is not consent to our usage statistics; we ask for those separately.
- Tracking permission (App Tracking Transparency): after that, iOS's “Allow apps to request to track” prompt is shown once (not at all if you declined Google's form). Only if you tap “Allow”, and in the EEA, the UK and Switzerland also consented in Google's form, may Google show personalised ads and use Apple's advertising identifier (IDFA).
- Otherwise ads are non-personalised and the IDFA is never used. Google still uses the data above to serve, measure and prevent fraud on non-personalised ads, which may be chosen based on approximate location.
- Players under age: if Apple's age information shows you are under the age of consent in your country, the tracking question is never asked, ads are never personalised and Google is told the request is for a user under the age of consent.
- You can change your decision at any time in iOS Settings → Privacy & Security → Tracking. If you turn it off, later ads are non-personalised.
- Our own usage statistics are separate: they are never used for ads or tracking, never shared with Google or anyone else, and contain no advertising identifier.
- How Google uses data: policies.google.com/technologies/partner-sites.
7. Retention and deletion
- We keep game data for as long as your account exists. A guest account that never signed in with Apple and never made a purchase is deleted automatically, with all its game data, after 12 months without any use (the app never connecting to our server).
- Usage statistics are kept for at most 90 days and deleted immediately when you turn them off or delete your account. Daily totals not linked to anyone (e.g. players per day) remain for 13 months.
- Diagnostic reports are kept for 30 days, the notification log for 30 days, ad reward tickets for 30 days, the record of floors where time ran out for 90 days, calm-mode solves for 30 days (weekly counts 90 days). An app verification key is deleted after 12 months without use.
- Your push token is removed if you don't open the app for 60 days. Sign-in sessions keep no IP address or device details; sign-in security records are kept without IP address and email for at most 1 hour.
- Our server's technical logs (request time, error details; no IP address) are kept for at most 7 days and deleted automatically. The source addresses of unauthorised connection attempts to the server (firewall and administrative access logs) are also kept for at most 7 days; these are not game traffic.
- When you delete your account (Profile → Settings → Account → Delete account), your account and the game data linked to it are deleted immediately and leave the encrypted backups within 30 days. Exception: to audit cheating and refunds, gem movements and cheat flags are kept for at most 12 months and purchase events (product, date, country, currency, price, transaction ID) for at most 24 months, with the link to your account removed; then they are deleted or made anonymous. We ask RevenueCat to delete its customer record and, if you signed in with Apple, ask Apple to revoke the app's Sign in with Apple authorization. We record the deletion itself with only a date and a random request number (not your ID) for 3 years. See Delete your account.
- Support emails are kept after the request is closed only as long as needed to show how it was handled, then deleted.
- Your store receipts remain in your Apple account and your Game Center records with Apple.
- Deleting the app only removes data on your device. To delete your guest account on our server, use “Delete account” in the app first, or email us with the support code shown in the app.
8. Security
We take reasonable technical and organisational measures to protect data: data is encrypted in transit with TLS; backups are encrypted on the server; in the database each player can only access their own data (row-level security); usage statistics cannot be accessed directly from outside; sensitive operations such as balances and rewards happen only on the server; only the developer administers the server. Data on your device is protected by your device's own security.
No system is completely secure, and complete security cannot be guaranteed. If we learn of a data breach we act to limit its impact and make the notifications the law requires (to the competent authority and to you, where required).
9. Children
Zirve is a puzzle game anyone can play, but it is not designed specifically for children and is not in the App Store Kids category. We do not ask for your name, email or date of birth; ads are only shown on request and limited to content suitable for general audiences. If we learn that a child under 13 (or a higher age where your country requires it) has given us personal data, we will delete the account. Parents and guardians can contact us at destek@mm-apps.com.
10. Your rights
Under the GDPR (EEA/UK) and related local law (Switzerland), and KVKK (Türkiye), you have the right to access your data and receive a copy, rectify it, erase it, restrict or object to processing, receive it in a portable format and withdraw consent.
Right to object: You can object at any time to processing based on legitimate interest, in particular usage statistics. The easiest way is to switch off Profile → Settings → Usage statistics; recording stops and your past statistics are deleted. If you gave consent, you can withdraw it in the same place. You can withdraw permission for personalised ads in iOS Settings → Privacy & Security → Tracking and in the app's privacy options (Profile → Settings). Withdrawal does not affect the lawfulness of processing before it.
How to make a request: You can get a copy of your data right away under Profile → Settings → Account → Download my data. You can delete your account in the app and change your display name there. For other requests, wherever you are, email us directly at destek@mm-apps.com and include the support code shown in the app (Profile → Settings → Account). The code is only visible on your device and lets us verify the request comes from you; because we don't keep names or emails, we may not be able to find your account any other way. We answer within 30 days, free of charge. You may also lodge a complaint with your local data protection authority or, in Türkiye, the Personal Data Protection Board.
11. Changes
We may update this policy. The current version is always on this page; important changes are also announced in the app and, where required, we ask for your consent again. If we discontinue the Service, we delete data or make it anonymous once it is no longer needed. This policy does not limit your statutory rights.