KVKK Data Protection Notice

Version 2.6 · 2026-09-30

Turkish Data Protection Notice (KVKK)

Last updated: 2026-09-30 — Version 2.6

This notice is given under Article 10 of Turkish Law no. 6698 on the Protection of Personal Data ("KVKK"), which requires a data controller to inform data subjects. It is an information notice, not a consent form: reading it, or continuing to use the app, does not amount to explicit consent to the processing of personal data.

It supplements, and does not replace, the Privacy Policy.

1. Identity of the data controller

The data controller is a natural person, not a legal entity. There is no company name, trade registry record or MERSIS number.

PixoRush is a one-person project and the developer's home address is not published in this document. Send your request to sebocaliskan@hotmail.com; if your request must be submitted in writing, the postal or registered electronic mail address to be used will be provided to you by reply.

2. Categories of personal data processed

No special categories of personal data (KVKK art. 6) are processed. Names, email addresses, telephone numbers, national identity numbers and postal addresses are not collected either.

No location is taken from the device's location services and the app requests no location permission. There are two exceptions: the approximate location the analytics service derives from the IP address (stated above), and the approximate location the ad network (Google AdMob) estimates from the IP address on its own account (section 7 of the Privacy Policy).

3. Purposes of processing

4. Legal grounds (KVKK art. 5)

For players resident in Türkiye, analytics measurement rests on art. 5/2-f (legitimate interests). That balance has to be read together with the fact that the app now contains a switch which stops measurement going forward: turning off Settings > Privacy > Usage Data stops it, and the preference stays on your device and is not sent to us. Section 8 of the Privacy Policy has the detail.

Personalised advertising happens only on iOS and only with your explicit consent (art. 5/1). The previous version stated here that ads were not personalised on any platform; that has changed with this version. On iOS the app shows the operating system's tracking permission (App Tracking Transparency) prompt on first launch. If you allow tracking, your advertising identifier (IDFA) goes to Google AdMob with the ad request and ads may be personalised to your interests; the ground for that processing is the permission you give in that prompt. Declining restricts no feature. You can withdraw the permission at any time in iOS under Settings > Privacy & Security > Tracking; the in-app row Settings > Privacy > Tracking Permission shows the current status and takes you to that setting. On Android every ad request is sent without personalisation. On both platforms, collection of the advertising identifier by the analytics service is switched off, and measurement data is not permitted to be used for ad personalisation. Showing an ad is assessed under art. 5/2-f.

Where explicit consent (art. 5/1) comes in: first, the iOS tracking permission described above; that prompt is shown wherever you are, Türkiye included. Second, players in the European Economic Area, the United Kingdom and Switzerland are shown a separate consent screen at app start, as the law of those countries requires, for analytics measurement and ad serving, and the processing only happens if consent is given (sections 7 and 8 of the Privacy Policy). If you are resident in Türkiye that consent screen is not shown to you; the off switch above is available to you all the same.

Apart from those two, no processing is based on explicit consent: we send no marketing messages. Reading this notice, or accepting the legal documents, is not an explicit consent either.

5. Method of collection

Data is collected electronically through the mobile application, by automated and partly automated means. No data is obtained from third parties.

Part of the analytics data is collected directly from the device by the Google Analytics for Firebase software development kit embedded in the app, and reaches Google without passing through our server. That collection happens only while measurement is on.

On when collection begins: the analytics kit is configured to be disabled as the app launches, on Android and on iOS alike. No automatic event, first open and session start included, is recorded before measurement is turned on. The shortfall accepted on iOS in the previous version (a narrow window on the very first launch) has been closed; if you used that version, you may ask for records created in that interval to be deleted by writing to sebocaliskan@hotmail.com.

Two requests do reach Google before measurement is turned on, and Google sees your IP address in both: the download of the consent screen text shown to players in the European Economic Area, the United Kingdom and Switzerland, and the advertising component asking Google for its own configuration as the app launches. The second is not an ad request; ad requests sit behind the consent described in section 7 of the Privacy Policy.

6. Transfers

Data may be transferred to hosting and content delivery providers, limited to the purposes above. The advertising provider (Google AdMob) processes data on its own account when serving ads. On iOS, if you granted the tracking permission, your advertising identifier (IDFA) is added to the ad request; the request goes to Google, whose servers may be located abroad. Once you withdraw the permission, the identifier is no longer sent. Google may also pass ad request data, under its own policies, to other advertising companies that take part in its ad auction (Privacy Policy, sections 7 and 9).

While measurement is on, analytics data is transferred to Google. As a rule Google Analytics for Firebase processes it on our behalf; where Google's settings for sharing between its own products, or for ad personalisation, are switched on, Google may also process it on its own account. Switching measurement off stops the transfer.

Transfer abroad — stated as it is. For analytics data the transfer abroad is certain: Google Analytics for Firebase offers no regional storage option, and the data is processed in Google's facilities abroad, in practice mostly in the United States.

If you reside in Türkiye, no separate explicit consent is taken from you for that transfer; as set out in section 4, measurement rests on art. 5/2-f (legitimate interest) and the consent screen is not shown to you. We prefer this to a sentence that says "the required conditions are applied" without naming the condition that is being applied.

Stopping the transfer altogether is in your hands and needs no application to us: turning off Settings > Privacy > Usage Data means no measurement data is produced at all, and data that is never produced is never transferred. Section 8 of the Privacy Policy sets out exactly what the switch does.

For hosting and content delivery, transfers are limited to what the service requires and are governed by the contractual terms in force with those providers.

Disclosures to competent public authorities are made only where a legal obligation requires it and to the extent requested.

7. Your rights under KVKK art. 11

You have the right to learn whether your personal data is processed; to request information about it; to learn the purpose of processing and whether the data is used accordingly; to know the third parties, in Türkiye or abroad, to whom it is transferred; to request correction of incomplete or inaccurate data; to request its erasure or destruction; to request that correction and erasure be notified to those third parties; to object to an adverse outcome produced solely by automated analysis; and to claim compensation for damage caused by unlawful processing.

How this applies to the analytics records: deletion and requests for information can be honoured on the analytics side as well. The previous version stated here that, because the app had no switch to stop measurement going forward, a request to halt processing could only be met by deleting existing records; that limit is gone. You stop measurement yourself from Settings > Privacy > Usage Data, no application to us is needed, and the preference stays on your device.

The one request we cannot meet on the analytics side is handing you those records in a machine-readable form: the analytics service offers no user-level export. No such limit applies to the data on our own server. The detail is in section 8 of the Privacy Policy.

8. How to apply, and a limit on identity verification

Send your request to sebocaliskan@hotmail.com. It will be concluded as soon as possible and in any event within thirty days (KVKK art. 13).

Because the app collects no email address, name or telephone number, the only way we can match a request to an account is the username shown in the app and, where possible, your recovery code hint. Without those we cannot verify that the account is yours and cannot act on the request — a restriction that exists to prevent access to another person's data.

If your request is refused, if you find our answer inadequate, or if we fail to reply in time, you may lodge a complaint with the Turkish Personal Data Protection Board (KVKK art. 14).