SpotDuel Privacy Policy
Last updated: 23 October 2026
1. Controller
SpotDuel is developed and published by Ethem Can Aslan (Ankara, Türkiye), the data controller under the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK). Contact: support@etcas.dev
2. Data we process
| Category | Data | Source |
|---|---|---|
| Identity / account | Device id (for guest login), player id, player name, player tag | The app, automatically |
| Game data | Trophies, league, level, XP, coin and gem balances, owned objects, chests, match results and in-match moves/taps | As you play |
| Social | Friend list, friend requests, blocked players, friendly match invites | Your actions |
| Transactions | Store purchase and refund records (store, product, transaction id, date) | App store and server |
| Security | Match statistics and flags for cheat detection; a salted hash of the IP address to count new accounts (the IP address itself is not stored) | Server |
| Crash reports | Technical details at the time of an error or crash: error message and stack trace, app version, device model, OS version, memory state and a random installation id specific to the app | The app, after the privacy notice is accepted |
| Usage statistics (optional) | Screens opened, tutorial steps, match starts/results, shop views | Only with your consent |
We do not collect your name, e-mail, phone number, location, contacts, photos or advertising id. The game has no ads and no chat.
3. Purposes and legal bases
- Running the game (account, matchmaking, progress, friends, leaderboards): performance of a contract (GDPR Art. 6(1)(b)).
- Processing purchases and refunds, preventing reuse of the same receipt: performance of a contract and legal obligation (GDPR Art. 6(1)(b), (c)).
- Preventing cheating and abuse, security: legitimate interests (GDPR Art. 6(1)(f)).
- Fixing crashes and errors: legitimate interests (GDPR Art. 6(1)(f)). Reports contain no player id, name, IP address or device name.
- Improving the game with usage statistics: consent (GDPR Art. 6(1)(a)). You can withdraw it at any time in Settings → Privacy.
4. Where data is stored and transfers
- The game server and database are hosted in Türkiye (Poyraz Hosting).
- Encrypted daily database backups are kept in Cloudflare R2 storage.
- Crash reports are processed by Sentry (Functional Software, Inc.).
- Purchases are processed by Google Play and the Apple App Store under their own privacy policies.
- Cloudflare's and Sentry's servers may be outside your country. These transfers rely on [Lawyer: safeguards, e.g. standard contractual clauses].
- Your data is never sold or shared for advertising.
5. Retention
- Account data is kept while your account exists.
- Deleting your account (Settings → Delete account) is immediate and permanent: profile, inventory, balances, match history, usage statistics, friendships and leaderboard records are deleted. Your name is not kept in other players' match histories.
- Deleted accounts stay in database backups for at most 14 days, then go with the backups.
- Purchase records are kept without the player id to prevent receipt reuse and for financial obligations ([Lawyer: period, e.g. 10 years]).
- Crash reports are kept for at most 90 days.
- Server logs are kept in size-limited rotating files; older entries are deleted automatically.
6. Your rights (GDPR Art. 15–22, KVKK Art. 11)
You have the right to access, rectify, erase, restrict or object to processing, to data portability and to lodge a complaint.
- A copy of your data: Settings → Privacy → Download my data.
- Erasure: Settings → Delete account. If you cannot open the app: account deletion page.
- Other requests: support@etcas.dev. We answer within 30 days. You may complain to your local data protection authority (in Türkiye: the Personal Data Protection Authority, KVKK).
7. Children
SpotDuel is a puzzle game suitable for everyone; it shows no ads and asks for no identity details. If you are under 13 (or under the age of digital consent in your EU country, up to 16), play with your parent's knowledge and permission; optional usage statistics need your parent's consent. Parents who believe their child's data was processed without permission can ask for the account to be deleted at support@etcas.dev. [Lawyer: age limit and parental consent, together with the age gate in Phase 11.]
8. Changes
If this policy changes materially, a new notice is shown when the app starts.