Privacy Policy

This Privacy Policy explains how Tubu Arge (the studio operating under the Erc Games brand) collects, uses, stores and shares personal data when you use Erc Games titles (e.g. Pull the Pin Master, Blok Patlat, Hex Merge) and any other mobile application published under the Erc Games label (collectively, the "App" or "Service"). The policy is designed to be compliant with Türkiye's KVKK (Law no. 6698), the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA / CPRA), and the U.S. Children's Online Privacy Protection Act (COPPA).

Data Controller

This App is developed by Tubu Arge, a Turkish entity. Tubu Arge is the data controller within the meaning of GDPR article 4 and KVKK article 3. Erc Games is a studio brand owned and operated by Tubu Arge and is not a separate legal entity.

• Data controller: Tubu Arge (Türkiye)
• Studio: Erc Games
• Privacy contact: privacy@tubu.io
• Support contact: support@tubu.io
• Website: tubu.io

Data Collected

The data categories below match the iOS PrivacyInfo.xcprivacy manifest and the Google Play Data Safety form one-to-one.

2.1 Device identifiers

• IDFA (Identifier for Advertisers, iOS) — collected only if you answer "Allow" to the App Tracking Transparency (ATT) prompt. Used for ad personalisation and attribution; shared with AppLovin MAX, Singular and Firebase.
• IDFV (Identifier for Vendor, iOS) — collected regardless of ATT; used for fraud prevention, in-app analytics, and crash context.
• GAID / AAID (Google Advertising ID, Android) — used for ad personalisation, attribution and analytics.
• Anonymous device fingerprint — device model, OS version, screen size, language; used for non-personalised fraud prevention.

2.2 Crash and performance data

• Crash logs (stack trace, error type, timestamp)
• Device model and OS version
• App version and build number
• Anonymous session duration (aggregate)

This data is processed anonymously through Firebase Crashlytics.

2.3 Gameplay progress data

• Completed level numbers and star counts
• Virtual goods balances (coins, gems, charm, essence, paint-trail)
• Achievements and weekly mission progress
• Battle Pass tier and XP
• Live ops event participation records

This data is stored on Microsoft PlayFab keyed by an anonymous device identifier. We do not collect your name, email address or phone number; account creation is not required.

2.4 In-app purchase (IAP) records

• Transaction ID (issued by Apple or Google)
• Product ID (e.g. remove_ads, vip_pass_season1)
• Purchase date and amount (local currency)
• Receipt validation data returned by Apple or Google

Purchase records are kept on our backend (Cloudflare Workers + D1) and on Apple's / Google's official IAP infrastructure for fraud prevention, customer support, and legal obligations (invoicing, tax). Your credit-card or banking details are never transmitted to Tubu Arge; payment is handled entirely by Apple App Store / Google Play.

2.5 Event and telemetry data

• Level start / end, success / failure events
• Ad impression, click, completion events
• IAP funnel events (store open, purchase attempt, completion)
• Live ops event start / completion events
• A/B test experiment variant assignments

Telemetry is processed via Firebase Analytics, GameAnalytics and Singular. All events are keyed to an anonymous device identifier and do not contain direct personal identifiers (name, email, phone).

Purposes of Processing

We process the data above only for the following purposes:

• Service delivery — saving your gameplay progress and synchronising it across reinstalls.
• Advertising — showing ads in the free version of the App; personalised or contextual depending on your ATT / UMP choice.
• Analytics — aggregate product metrics (which levels are hard, which features are used).
• Fraud prevention — preventing multi-account reward abuse, IAP refund cycling, bots and cheats.
• IAP validation — server-side verification of Apple / Google receipts to prevent double-spending.
• A/B testing — statistical comparison of game balance, monetisation and UI variants.
• Customer support — responding to tickets at support@tubu.io and restoring lost progress.
• Legal compliance — KVKK, tax, consumer protection, and court orders.

Legal bases (GDPR article 6)

Third-Party Services

The App uses the following third-party SDKs and services:

SDK Identifiers

Mobile apps do not use traditional browser cookies. Instead, the SDKs listed above may create their own device-side identifiers and caches:

• AppLovin SDK Key — for ad requests
• Firebase Installation ID — Crashlytics + Analytics session
• GameAnalytics User ID — persistent anonymous player ID
• Singular Install ID — attribution matching
• PlayFab Anonymous ID — anonymous account mapping

On iOS, all such identifiers are subject to App Tracking Transparency (ATT); if you refuse the tracking prompt they are not used for personalisation. On Android, the Google Mobile Ads UMP SDK collects analogous consent.

Data Retention

• Gameplay progress: retained for as long as your account is active (i.e. up to 18 months since your last session) on PlayFab; data of dormant players is auto-anonymised after 18 months.
• Crash logs: 90 days (Firebase Crashlytics default).
• Analytics events: 14 months on Firebase Analytics and GameAnalytics (aggregate metrics may be retained indefinitely).
• IAP receipts: retained for 10 years per Turkish Tax Procedure Law.
• Support correspondence: 24 months after ticket closure.

Your Rights

GDPR (EU / UK)

• Right of access (art. 15)
• Right to rectification (art. 16)
• Right to erasure ("right to be forgotten", art. 17)
• Right to restriction of processing (art. 18)
• Right to data portability (art. 20)
• Right to object (art. 21)
• Right to lodge a complaint with a supervisory authority (art. 77)

CCPA / CPRA (California)

• Right to know what personal information is collected
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt out of "sale" or "sharing" of personal information — Tubu Arge does not sell personal information for monetary consideration. We may "share" identifiers with ad networks for cross-context behavioural advertising; you can opt out via the ATT prompt or the in-app Settings → Privacy → Limit ad tracking toggle.
• Right to non-discrimination

KVKK (Türkiye)

Article 11 grants the right to information, correction, deletion, objection, and damages. See the Turkish version of this policy for details, or contact privacy@tubu.io.

To exercise any of the above rights, email privacy@tubu.io. We respond within 30 days at no charge.

Data Deletion Request

1. Send an email titled "Data Deletion Request" to privacy@tubu.io.
2. Include your in-app Anonymous ID (found at Settings → Account → Device ID). This ID contains no personal data; it is used only to match your record.
3. All active data is deleted within 30 days; tax / IAP records are destroyed at the end of their statutory retention period.
4. We confirm completion by email.

Children's Privacy

The App is not directed to children under 13. Under COPPA (U.S.) the threshold is 13; under GDPR it is 16 (lowered to 13 in some EU member states); under KVKK the parental-consent threshold is 18.

The App is not listed in Apple App Store's "Made for Kids" category. On Google Play, the age rating is Everyone 12+.

If we learn that we have collected personal data from a child under 13, we delete it immediately. If you believe your child has provided data, contact privacy@tubu.io.

International Transfers

Most third-party providers (Apple, Google, Microsoft, AppLovin, Meta, Singular, GameAnalytics, Cloudflare) operate servers in the U.S. or E.U. This constitutes an international transfer of data from Türkiye. We rely on the following safeguards:

• Signed Data Processing Agreements (DPAs) with Apple, Google and Microsoft.
• EU Commission Standard Contractual Clauses (SCC, 2021/914) for transfers into the EU.
• For transfers to the U.S., the EU–US Data Privacy Framework where applicable, plus SCC and supplementary measures.
• Explicit consent collected via ATT (iOS) / UMP (Android) prompts per KVKK article 9(2).

Changes to this Policy

We may update this policy when adding a new SDK, in response to a legal change, or when shipping a major feature. For material changes:

• The "Effective date" above is updated;
• A one-off in-app notification banner is shown on next launch;
• Continued use of the App after the change constitutes acceptance of the updated policy.

If retroactive expansion of data collection is required, we will request fresh consent.

Effective Date

This policy is effective from 15 May 2026.

Contact

• Data controller: Tubu Arge
• Studio: Erc Games
• Privacy email: privacy@tubu.io
• Support email: support@tubu.io
• Website: tubu.io
• Supervisory authority (Türkiye): Kişisel Verileri Koruma Kurumu — kvkk.gov.tr
• EU / UK: contact your local supervisory authority.
• California: California Privacy Protection Agency (CPPA) — cppa.ca.gov