Privacy Policy

If you don't have time for the long version, here is the summary:

We only process what the game needs to work:

Every category of data is used for a specific purpose and nothing beyond it.

In the European Union, under the GDPR, the processing required to run the game rests on performance of a contract (Art. 6(1)(b)); security, cheat detection and basic performance measurement rest on our legitimate interest (Art. 6(1)(f)). Anything permission-based, such as push notifications, happens only with your consent (Art. 6(1)(a)), which you can withdraw at any time.

In Türkiye, under the KVKK, the same processing relies on the establishment and performance of a contract (Art. 5/2-c) and the legitimate interest of the data controller (Art. 5/2-f), while permission-based processing relies on explicit consent (Art. 5/1).

The free version shows Google AdMob ads between rounds. Because we assume children play GeoClash, we flag every ad request as non-personalised: ads are selected from context, never from a behavioural profile.

Google may process limited technical data about your device (such as IP address, device type and app version) under its own responsibility for ad delivery and fraud prevention. Google's "How Google uses data in advertising" policy describes that processing in detail.

We do not request App Tracking Transparency permission on iOS and we do not use your device's advertising identifier (IDFA) for tracking. Buying "Ad-free" stops ad requests entirely.

Virtual currency, power-up bundles and items such as "Ad-free" are sold through the Apple App Store. Apple runs the entire payment flow; your card details are never passed to us at any point.

We use RevenueCat to verify purchases and restore them across devices. RevenueCat receives your anonymous account identifier, the product code you bought and the receipt information issued by Apple.

A push token is created only when you grant permission, and it is used for duel invitations and streak reminders. We do not send marketing notifications.

You can revoke permission in iOS under Settings > GeoClash > Notifications; the token is then deleted from our records.

We collect crash reports and basic performance measurements to keep the app stable. These logs contain technical details such as device model, operating system version, app version and the screen where the error occurred; they never contain in-game messages or personal content.

We do not sell your data. We share it only with the service providers needed to run the game, and only under contractual limits:

Our service providers may host servers in the European Union and the United States. Transfers outside the EU take place under the European Commission's Standard Contractual Clauses or an equivalent safeguard.

Account and game data are kept for as long as your account is active. An account that is not opened for 24 months is deleted automatically. Crash logs are kept for 90 days, and purchase records for as long as tax law requires (up to 10 years). When you request deletion, your records are permanently removed within 30 days.

GeoClash is designed for all ages and we assume children play it. That is why we never collect direct identifiers such as an email address, phone number or location, never personalise ads, and do not allow free-text chat between players.

If you want a record belonging to your child deleted, simply write to [email protected].

Under the GDPR and the KVKK you have the right to access your data, have it corrected, have it erased, restrict processing, receive your data in a portable format, object to processing based on legitimate interest, and withdraw any consent you gave.

Send your request to [email protected]; we may ask for your recovery code to verify identity, and we reply within 30 days at the latest. If you are unhappy with the outcome, you can complain to the data protection authority in your country (in Türkiye, the Personal Data Protection Authority).

To delete your account and all game data, follow Settings > Account > Delete Account in the game. If you can't reach the app, write to [email protected] with your recovery code and we will complete the request within 30 days.

Data is encrypted in transit with TLS, and server-side access is limited to the team members who need it. No system is entirely without risk, but if an incident affects the security of your data we will notify you within the period required by applicable law.

If we update this policy we will change the date on this page, and for significant changes we will also tell you inside the app.

For anything privacy-related: [email protected]. For general support: [email protected]. Data controller: Senyo Labs.