English · Türkçe

Privacy Policy

Last updated: 15 October 2026

1. Who we are

Pixel Gulp (“the game”) is a mobile game for iOS and Android, made and published by ABDULLAH AKBIYIK YAZILIM HİZMETLERİ (Istanbul, Türkiye) (“we”, “us”). We are the controller of the personal data described here (under Turkey’s Law No. 6698 on the Protection of Personal Data, “KVKK”, the veri sorumlusu). Questions and requests: privacy@akbiyik.dev.

This policy covers the game app and the game server it connects to. Google’s ads come with Google’s own privacy policy (section 3).

2. What we collect and why

2.1 On your phone

• Guest id. The first time the game opens, it makes a random 32-character code. It isn’t derived from your device, your name or anything else about you. Our server recognises your profile by it, so it works like a password: the game never shows it.
• The game also keeps the guest id in the iOS Keychain or Android Block Store. That way your slime comes back if you delete and reinstall the game, or move to a new phone from a backup. On iOS it isn’t synced through iCloud Keychain, but device backups and Quick Start carry it. On Android, Block Store may keep it in your Google backup.
• Your name, your settings and a copy of what the server last reported (level, coins, missions and so on), so the menu can show them before it connects.

2.2 On our server: your game profile

In Online mode, the game sends our server your guest id, your name and your look. The server keeps a profile under the guest id with:

• your name and name tag: you pick the name, the server adds a number (Ali#1223);
• your look (colour, hair, face extra, pattern, trail, name frame, costume);
• your level and XP, coins, and the items you bought or won;
• your progress: daily missions, the daily road and its jars, the season pass, your ranked rank this season, your Element Dynasty and its points, your share in kingdom goals;
• simple statistics: when the profile was created and last used, sessions, matches, lives, slimes eaten, best mass, time played;
• friends: your friends, friend requests and the players you blocked (kept as profile ids, not names);
• fair-play flags (section 2.6).

A profile is only saved once it has something worth keeping (a name tag, XP, a match, a purchase…). In Offline mode the game sends nothing to our server (ads still come from Google, section 3).

2.3 What other players see

• In matches: your name (without the number), your look and how big your slime is. There is no chat, only picture emotes.
• On leaderboards: the top players of the ranked season and your dynasty’s best members, by name and points.
• Your full name tag is how friends find you. Anyone who types it can send you a friend request or a duo invite, and you can block anyone.
• Your friends see whether you are online, in a match, in ranked or offline. Nobody else does.

2.4 The game’s event log (analytics)

Our server writes a log of game events: joining and leaving a match (with your level and your look), each life and match (for example your mass, slimes eaten, what ate you, your place), missions, rewards, purchases, ad revives, shares, friend and duo invite actions, private rooms. Each entry is labelled with a short code made from your guest id by a one-way hash (SHA-256), never with the guest id itself. The log holds no names, no IP addresses and no information about your device. We use it to balance the game, find bugs and see how players get on (for example how many come back the next day).

The server’s technical log (its console output, for troubleshooting) refers to players the same way, by the hashed code and a connection number: never by name or guest id, and without IP addresses.

2.5 Your IP address

Your phone reaches our server over the internet, so the server sees your IP address while you are connected. It uses it only in memory: to limit connections, requests and new profiles per address (against abuse and cheating), and to put two players from the same address into different free-for-all matches. It isn’t stored in your profile or in the event log.

Our server is reached through Cloudflare, a network security and delivery service, which processes IP addresses to deliver and protect the traffic (Cloudflare’s privacy policy). The web server in front of our game server keeps no access log. If a request fails, its error log may record the IP address the request came from; that log is deleted after 14 days.

2.6 Fair play

In ranked matches the server automatically looks for pairs of players who seem to team up (sparing or feeding each other again and again). A flagged pair gains no ranked points from that match (a loss still counts), and each profile counts how often it was flagged. It affects nothing outside ranked.

2.7 Purchases

Coins only buy cosmetics. Your profile keeps your coins and items, and the event log records each purchase (what, how many coins, the price). Coin packs for real money are sold through the App Store (Google Play to follow): the payment goes through Apple, and the game passes Apple’s signed confirmation of the purchase to our server, which checks it and adds the coins. From it we keep a sales record: the transaction number, the pack, the price and currency, the store’s country, test or real, the short code of your profile and the account code the purchase was made for (made from your guest id by the same one-way hash, so it never reveals the id; Apple keeps the same code with the purchase, which is how the game tells it whose purchase it is). If Apple refunds a purchase, Apple’s server tells ours: the sales record and your profile note the refund, and the pack’s coins are taken back from your profile (as many as are left). A refunded purchase never pays again. We never receive your payment details or your Apple account.

2.8 Sharing

The match card is drawn on your phone and you share it yourself; it isn’t uploaded to us. Our server only records that something was shared or a code was copied (what kind, how, and the card’s place and mode).

2.9 What we don’t collect

No email, phone number, real name, contacts, photos, precise location, microphone or camera. There is no sign-in with Apple, Google or social networks. Unity’s analytics and crash reporting are switched off. We don’t sell or rent your data for money.

3. Ads (Google AdMob)

The free game is paid for by ads from Google AdMob (the Google Mobile Ads SDK): one when the game opens, before a match and after you leave one (none in your first two matches, and at most about one every 90 seconds), and an optional rewarded ad that brings you back into the match after you are eaten. Ads are limited to content Google rates PG.

What Google collects

When ads load, Google’s software in the game collects, under Google’s own privacy policy:

• your IP address, which may be used to estimate your approximate location;
• device identifiers: the advertising identifier (on iPhone and iPad only if you allow tracking; on Android unless you delete it) and identifiers limited to this app or developer, such as Android’s app set ID;
• ad data and interactions: the ads you see, taps, video views, app launches;
• diagnostics: crash logs and performance data such as launch time.

Google uses this to show and measure ads, for analytics and to prevent fraud. It is encrypted in transit. See also How Google uses information from sites or apps that use its services and How Google uses cookies and identifiers in advertising. Google decides itself how it uses the data it collects through its ads, as an independent controller under its own terms; that data doesn’t reach us.

Your choices

• EEA, UK and Switzerland: the first time the game opens, Google’s consent form asks whether Google and its ad partners may use your data, including for personalised ads. You can change your answer any time: tap your level at the bottom of the main menu, then Privacy choices (the button appears where the law requires it). Without your consent Google may still show non-personalised or limited ads.
• US states with privacy laws: the same Privacy choices button lets you opt out of the “sale” or “sharing” of your data for personalised ads (section 10).
• iPhone and iPad: the game asks whether it may track you (App Tracking Transparency). If you don’t allow it, the advertising identifier isn’t shared. You can change this any time in Settings › Privacy & Security › Tracking.
• Android: you can reset or delete your advertising ID in your phone’s settings (Settings › Google › Ads, or Settings › Privacy › Ads, depending on the phone).
• Everywhere: My Ad Center shows and controls how Google personalises ads for your Google account.

The rewarded revive check

When you watch the rewarded ad to the end, Google’s server tells ours in a signed message, so that only a finished ad brings you back. The message names your connection by a random one-time code (never your guest id or name) and carries Google’s transaction id and the ad unit. We use it only to grant the revive and record it in the event log. We never give Google your guest id, your name, your name tag or your game profile.

4. Legal bases

We collect your data electronically and automatically, through the app and our server.

GDPR (if you are in the EEA, the UK or Switzerland):

• Your profile, online play, friends and progress: needed to provide the game you asked for (Art. 6(1)(b)).
• The event log, security, limits against abuse, fair play: our legitimate interest in running a working, fair game and improving it (Art. 6(1)(f)).
• Ads: your consent, given in Google’s form, for personalised ads and for storing and reading information on your device for ads (Art. 6(1)(a)). You can withdraw it any time (section 3).
• Records the law makes us keep, such as purchases: legal obligation (Art. 6(1)(c)).

KVKK (Turkey), Article 5: the performance of a contract (5(2)(c)), our legitimate interest (5(2)(f)), a legal obligation (5(2)(ç)), and your explicit consent where it is required (5(1)).

5. Who we share data with

We don’t sell your data for money (for what US state laws call a “sale” or “sharing”, see section 10). We share it only with:

• Google (AdMob), as described in section 3;
• Worldstream B.V., the company hosting our server, in the Netherlands;
• Cloudflare, which carries the connection to our server;
• Apple and Google as app stores, under their own policies, including purchase confirmations once coin packs are sold;
• authorities, where the law requires it.

Other players see what section 2.3 describes.

6. Where data is processed

Our server is in the Netherlands, so if you play from outside the European Union, your data travels abroad to reach it. Google and Cloudflare process data in many countries, including the United States; both take part in the EU–U.S. Data Privacy Framework and use the European Commission’s standard contractual clauses. Transfers from Turkey follow Article 9 of KVKK.

7. How long we keep data

• Your profile: for as long as you play, until you delete it (section 8). If you don’t open the game in Online mode for 2 years, our server deletes it just as if you had deleted it yourself, coins and items (bought ones included) with it. Playing online or opening the game in Online mode counts as a visit.
• Duo invites and online status: only in memory, about a minute and 15 seconds; never saved.
• Sales records (section 2.7): as long as accounting and tax law requires (up to 10 years); they are also what keeps a purchase from paying twice, or a refunded one from paying again.
• The event log: 12 months: the server deletes each day’s entries a year after that day. The technical log: 14 days.
• On your phone: until you delete the game. The guest id in the Keychain or Block Store stays after the game is deleted, so that a reinstall finds your slime, until you delete your data in the game (which replaces it with a new, empty one) or erase the phone and its backups.

8. Deleting your data

In the game (it needs Online mode): tap your level at the bottom of the main menu, then Delete my data, and confirm with Delete. Straight away this:

• deletes your profile from our server: name, name tag, look, level, coins, items, progress, rank, dynasty points and friends. You disappear from your friends’ lists and from leaderboards, and your name tag is free for others;
• gives your phone a new, empty guest id.

It can’t be undone, and your coins and items, bought ones included, are gone. Earlier entries in the event log stay under the hashed code until they are 12 months old; the code no longer leads to anything on your phone.

Deleting the app alone doesn’t delete your profile: that is what lets a reinstall bring your slime back (unless it went unused for 2 years, section 7).

You can also email privacy@akbiyik.dev with your name tag. As there is no login, we may ask you to prove the profile is yours by changing something in the game only its owner can change, such as renaming your slime to a word we give you.

9. Your rights

Under the GDPR you may ask for access to your data, its correction or erasure, a restriction of its use, or a copy in a portable format; object to uses based on our legitimate interest; withdraw your consent at any time; and complain to your data protection authority.

Under KVKK, Article 11, you may learn whether your personal data is processed and request information about it; learn the purpose and whether it is used for it; know the third parties in Turkey or abroad it is transferred to; ask for it to be corrected, deleted or destroyed, and for those third parties to be told; object to a result against you that comes only from automated analysis; and claim compensation for damage from unlawful processing. Send your request to privacy@akbiyik.dev (to apply in writing, ask us there for our postal address); we answer free of charge within 30 days at the latest. You may also complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

Much of this you can do yourself in the game: change your name (tap it in the main menu), change your look (the wardrobe), review your ad choices (Privacy choices) and delete everything (Delete my data).

10. US state privacy rights

If you live in a US state with a consumer privacy law (such as California, Colorado, Connecticut, Oregon, Texas, Utah or Virginia), this section applies to you too. It adds to the rest of this policy.

What we collect

In the categories those laws use, and for the purposes in sections 2 and 3, from you and your phone:

• Identifiers: the guest id, your name and name tag, your IP address; and, collected by Google, the advertising identifier and other device identifiers (section 3).
• Internet or other electronic network activity: how you play (the event log, section 2.4); and, collected by Google, the ads you see and tap.
• Approximate location: estimated by Google from your IP address. We collect no precise location.
• Commercial information: the coins and items you buy or win.

We collect no sensitive personal information as these laws define it. How long we keep each kind of data is in section 7.

“Sale”, “sharing” and targeted advertising

We don’t sell your data for money. But letting Google collect your IP address, the advertising identifier and your ad interactions through the game, so that it can show you personalised ads, may count as “selling” or “sharing” personal information, or as “targeted advertising”, under some of these laws. In the last 12 months, the only personal information we may have “sold” or “shared” in that sense is that ad data (identifiers, internet activity and approximate location), and only with Google, for advertising. You can opt out:

• in the game: tap your level at the bottom of the main menu, then Privacy choices, and turn off the sale or sharing of your personal information;
• on iPhone and iPad, by not allowing tracking; on Android, by deleting your advertising ID (section 3);
• or by emailing us at privacy@akbiyik.dev.

After you opt out, Google restricts how it uses your data for ads in this game: you still see ads, but they aren’t personalised with your data. We don’t knowingly sell or share the personal information of anyone under 16.

Your rights

Depending on your state, you may ask to know what personal information we hold about you and how we use it, get a copy, have it corrected or deleted, and opt out of its sale, sharing or use for targeted advertising. You can delete everything yourself in the game (section 8) and change your name and look there. For anything else, email privacy@akbiyik.dev; as there is no login, we check that the profile is yours the way section 8 describes. We answer within 45 days, or tell you within that time if we need up to 45 more, as the law allows. Someone you authorise in writing may make a request for you.

If we turn your request down, you may appeal by replying to our answer; we decide on an appeal within 45 days. If you disagree with the outcome, you may contact your state’s Attorney General. We won’t treat you differently, for example deny you the game, for using any of these rights.

11. Children

Pixel Gulp isn’t directed at children under 13, and its store listings name an audience of 13 and over. We don’t knowingly collect personal data from children under 13, and we ask nobody for real-world identity data. If you believe a child under 13 has played, delete the profile in the game (section 8) or contact us and we will delete it. Ads are limited to content Google rates PG.

12. Security

The game talks to our server over encrypted connections (TLS). Profiles are stored on a server only we administer. The event log uses hashed codes, and the guest id never appears in any log. No system is perfectly secure: if a breach affects your data, we will notify the authorities and you as the law requires.

13. Changes to this policy

If this policy changes, we will post the new version here and update the date at the top. If a change matters to you, we will tell you in the game or on its store page before it applies.

14. Contact

ABDULLAH AKBIYIK YAZILIM HİZMETLERİ
Istanbul, Türkiye
privacy@akbiyik.dev