Privacy Notice and Policy

1. Scope and definitions

This Privacy Notice and Policy (the "Policy") describes how personal data is processed in connection with the Kangu Run mobile application, its server services and the kangurun-game.com website (together, the "Service"). It is issued under Article 10 of the Turkish Personal Data Protection Law No. 6698 (the "Law") and, where applicable, the EU General Data Protection Regulation (the "GDPR").

Terms such as "personal data", "processing", "data subject", "data controller" and "data processor" have the meanings given in the Law. "User" means any natural person who uses the Service, with an account or without one (as a "guest").

The Terms of Use govern the use of the Service and apply together with this Policy.

2. Data controller

The data controller is AKILLIPANDA YAZILIM DANIŞMANLIK VE TİCARET ANONİM ŞİRKETİ (the "Controller"), address: Taşdelen, Sultan Murat Cd. No: 23/3, 34788 Çekmeköy/İstanbul, MERSIS no: 0025111753000001, tax office and no: Sarıgazi 0251117530, registered e-mail (KEP): [email protected], e-mail: [email protected].

3. Categories of personal data

The following personal data may be processed:

• Identity and account data: nickname (username), account ID, account creation date.
• Contact data: e-mail address; when signing in with Google or Apple, the account identifier provided by that provider and, if shared by the provider, the e-mail address.
• Image data: a profile photo the User chooses to upload. No biometric processing (such as face recognition) is performed.
• Game and transaction data: completed runs (line, direction, score, joeys rescued, distance, time), points balance, in-game upgrades, best scores, weekly ranking and duel records.
• Purchase data: App Store or Google Play transaction ID, the Opal pack bought, purchase, consumption and refund dates, the Opal balance and continues paid with Opals. No card or payment details are processed; payment is taken by Apple or Google.
• User requests: reports and blocks concerning other Users, and information provided in support and data subject requests.
• Security data: one-way hashes of session tokens and sign-in codes, IP address, request time and requested path.

When used as a guest, game progress is stored only on the User's device and is not transferred to the Controller's servers. The Service does not process location, contacts, microphone data, advertising identifiers or special categories of personal data, and uses no third-party analytics, tracking or advertising SDKs. For sponsor images within the application, only aggregate display counts that are not linked to any individual are kept.

4. Collection method and legal bases

Personal data is collected electronically, partly by automated means, through information entered by the User, records created by the application during play, information provided by the Google/Apple sign-in services and connections made to the server.

Personal data is processed on the following legal bases (Law Art. 5(2); GDPR Art. 6(1)):

• Performance of a contract: creating and managing the account, storing and synchronising progress, providing leaderboards and duels, displaying the nickname and profile photo.
• Compliance with legal obligations: record-keeping, disclosure and responding to competent authorities as required by law.
• Establishment, exercise or defence of legal claims.
• Legitimate interests of the Controller, provided the data subject's fundamental rights and freedoms are not harmed: security of the Service, detecting and preventing abuse and cheated scores, handling reports, debugging.

Uploading a profile photo is entirely optional; the User may remove it in the application at any time.

5. Purposes of processing

• Verifying the User's identity and sending sign-in codes;
• Storing the account, game progress and in-game upgrades and synchronising them across devices;
• Producing and displaying leaderboards, the weekly competition, duels and player profiles;
• Checking submitted scores against the game rules and removing cheated records;
• Handling reports of inappropriate content and applying blocks;
• Information security, abuse prevention and fixing technical errors;
• Responding to support and data subject requests and meeting legal obligations.

Personal data is not processed for marketing, profiling or automated decision-making and is never sold to third parties.

6. Transfers of personal data

Personal data may be transferred, only for the purposes above and in accordance with Articles 8 and 9 of the Law, to:

• Service providers acting as data processors: the server and database hosting provider (Hetzner Online GmbH; data is stored in data centres in Germany) and the e-mail delivery provider used to send sign-in codes.
• Authentication providers: Google LLC and Apple Inc., only if the User chooses to sign in with them, to verify that sign-in.
• App stores: Apple Inc. and Google LLC, to verify purchases and process refunds. If the User asks Apple for a refund of a purchase, whether the Opals from that purchase were used, the age of the account (as a range) and the account ID are shared with Apple for the assessment of that request.
• Other Users: the nickname, profile photo, scores, ranking and profile statistics (number of runs, best lines, duel record) are visible to other Users by the nature of the Service. The e-mail address is never shared with other Users.
• Competent public authorities and courts, where required by law or upon a lawful request.

Because the servers are located abroad, such transfers are made with one of the appropriate safeguards set out in Article 9 of the Law (standard contractual clauses). Sign-in with Google or Apple takes place at the User's choice and under that provider's own privacy policy.

7. Sign in with Google and Apple

If the User chooses to sign in with Google or Apple, the following applies:

• Data received: the permanent account identifier the provider creates for the User and the e-mail address verified by the provider. The basic profile permission requested by Google sign-in (name, profile picture) is needed only for the sign-in screen to work; the name and profile picture are not stored on our servers. A name shared through Apple sign-in is not stored either.
• Data not accessed: we never access the User's Google or Apple password, contacts, calendar, files or any other data in their account. No access or refresh tokens from the provider are stored; the identity token signed by the provider is used once, only to verify the sign-in.
• Apple "Hide My Email": if the User uses this option, Apple provides a forwarding address ending in @privaterelay.appleid.com instead of the real address, and the Controller only sees that address.
• Limited use: information received from Google and Apple is used only to create the account, recognise the User and send account-related messages (replies to support and data requests). It is not used for advertising, profiling or marketing, is not sold and is not transferred to third parties. Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Disconnecting: the User can remove the connection at any time under Google Account → Security → Third-party connections, or on iPhone under Settings → Apple Account → Sign in with Apple. Removing the connection does not delete the account or its data; to delete them use "Delete account" in the app or the Delete account page.

8. Retention and deletion

• Account and game data are kept for as long as the account is active.
• If the User deletes the account, sign-in identities, e-mail address, nickname, profile photo, runs, progress, duels, reports and blocks are deleted immediately and irreversibly.
• Sign-in codes are valid for at most 10 minutes; session tokens become invalid when they expire or when the User signs out.
• Technical logs are kept for the period required by applicable law or, where no such period applies, for at most 30 days.
• Correspondence concerning support and data subject requests may be kept for the general limitation periods applicable to potential disputes.

Personal data whose retention period has ended is deleted, destroyed or anonymised. Data contained in backups is deleted when the backup cycle completes.

9. Data security

The Controller takes reasonable technical and organisational measures under Article 12 of the Law to prevent unlawful processing of and access to personal data and to safeguard it. Communication between the application and the server is encrypted (HTTPS); session tokens and sign-in codes are stored only as one-way hashes; access rights are restricted.

However, no transmission over the internet or method of electronic storage can be guaranteed to be completely secure. The User is responsible for the security of their device, e-mail account and sign-in methods and for preventing unauthorised access to them. If personal data is obtained by others unlawfully, the Controller notifies the data subject and the Personal Data Protection Board as required by Article 12(5) of the Law.

10. Rights of the data subject

Under Article 11 of the Law (and, where applicable, Articles 15–22 of the GDPR), every data subject has the right to:

• learn whether their personal data is processed;
• request information about such processing;
• learn the purpose of processing and whether the data is used for that purpose;
• know the third parties in Turkey or abroad to whom the data is transferred;
• request correction of incomplete or inaccurate data;
• request deletion or destruction of the data under the conditions of Article 7 of the Law;
• request that correction, deletion or destruction be notified to third parties to whom the data was transferred;
• object to a result against them arising from analysis exclusively by automated systems;
• claim compensation for damage arising from unlawful processing.

Users can change or remove their nickname and profile photo, and delete their account themselves, in the application.

11. How to submit a request

Requests are answered free of charge as soon as possible and at the latest within thirty (30) days; if the action requires an additional cost, the fee set by the Personal Data Protection Board may be charged. If a request is rejected, the answer is found insufficient or no answer is given in time, the data subject may lodge a complaint with the Personal Data Protection Board under Article 14 of the Law (and, where the GDPR applies, with the competent supervisory authority).

Additional information may be requested to verify the requester's identity. Requests whose identity cannot be verified, or made on behalf of another person without authorisation, will not be processed.

12. Children

Creating an account is intended for users aged thirteen (13) or older. Users under thirteen should use the Service only as guests. If the Controller learns that an account belongs to a user under thirteen, the account and its data are deleted. Parents or guardians may send such requests through the channels above.

13. User-shared content and third-party services

Content the User publicly shares as a nickname and profile photo becomes visible to other Users at the User's own choice. To the extent permitted by law, the Controller is not responsible for consequences arising from other Users viewing, capturing or sharing such content outside the Service.

Third parties such as Google, Apple, the App Store, Google Play and e-mail service providers process personal data under their own privacy policies and responsibility. The Controller is not responsible for their processing activities or for the content of websites outside the Service.

14. Limitation of liability

The Controller exercises due care in fulfilling its obligations under this Policy. To the maximum extent permitted by mandatory law, the Controller is not liable for damage resulting from the User's own fault, the User's failure to secure their device or account credentials, unlawful acts of third parties, or force majeure beyond the Controller's control.

This clause does not limit the data subject rights arising from the Law or other mandatory legislation, nor the Controller's liability for intent or gross negligence.

15. Changes and effective date

The Controller may update this Policy to reflect changes in the law or the Service. The current version is published on this page with its update date; material changes are also announced in the application. The Policy takes effect on the date of publication.

In case of any discrepancy between the Turkish version of this Policy and versions in other languages, the Turkish version prevails.