Privacy Policy

Version 2.6 · 2026-09-30

Privacy Policy

Last updated: 2026-09-30 — Version 2.6

Playing PixoRush requires no email address, no phone number, no password and no social login. There is no sign-in screen. The only thing we ask you for is the username shown on the leaderboard.

1. Who is responsible

PixoRush is developed and published by an independent developer acting as an individual — a natural person, not a company. There is no studio, publisher or other legal entity behind it. That individual is the data controller for the purposes of this policy.

PixoRush is a one-person project and the developer's home address is not published in this document. Send your request to sebocaliskan@hotmail.com; if your request must be submitted in writing, the postal or registered electronic mail address to be used will be provided to you by reply.

2. How your account works

The first time you open the app, a random installation identifier is generated on your device and an anonymous account is created on our server and tied to it. This identifier is not a persistent hardware identifier: no IMEI, MAC address, serial number or advertising identifier (IDFA/AAID) is used to create your account, and none of them is sent to our server. (How the advertising identifier relates to the ad network is described in section 7.) Deleting and reinstalling the app produces a new identifier. On iOS the system keychain keeps an app's stored sign-in data even after the app is deleted, so on the first launch of a new installation the app erases whatever an earlier installation left there before it creates the new identifier.

Your account is therefore bound to your device. If you change devices, or delete and reinstall the app, the only way back into your account is your recovery code.

If you do not save your recovery code, your account, progress, badges and coin balance are permanently lost. We cannot restore it for you, because we hold no other information that could identify you — no email, no phone number, no name. This is the unavoidable consequence of a design that collects as little as possible about you.

The recovery code itself is never stored. We keep only an irreversible hash of it and a short hint made of its first characters.

3. Data we process

4. Data we do not process

We do not collect the following, and the app never requests these permissions:

Two exceptions about location: for as long as it is running, the analytics service described in section 8 derives an approximate location at country, region and city level from your IP address, and the advertising component described in section 7 estimates an approximate (coarse) location from your IP address on Google's own account. Neither comes from your device's location services and neither is street-level, but both are location information all the same, and we are not hiding them from you. Turning measurement off stops the analytics derivation; the advertising component's estimate does not depend on that switch.

About the advertising identifier: neither Android's resettable advertising ID (AAID) nor the iOS advertising identifier (IDFA) is collected by the analytics service; that collection is switched off in the app's configuration on both platforms. What the ad network does on its own side — including the tracking permission on iOS — is set out in section 7.

The images in the game come from public-domain and CC0 photo archives and from open-access museum collections. You cannot upload your own photographs, so no image of yours is ever collected.

5. Purposes

6. Legal bases

Ads are personalised only if you allow it. This is the most important change from the previous version, and it deserves to be stated plainly: the previous version said that ads were not personalised on any platform. On iOS the app now shows the operating system's tracking permission (App Tracking Transparency) prompt. If you allow tracking, your advertising identifier (IDFA) is added to ad requests and ads are requested as personalised; if you do not, ads stay non-personalised. On Android every ad request is sent as a non-personalised request. On both platforms, collection of the advertising identifier by the analytics service, and any use of measurement data for ad personalisation, are switched off in the app. Section 7 has the detail.

What we do ask consent for, and why: in the European Economic Area, the United Kingdom and Switzerland, storing and reading data on your device requires consent, and both measurement and an ad request do exactly that. That is why the consent screen appears there, and your answer genuinely changes what happens (sections 7 and 8). On iOS, wherever you are, whether your advertising identifier is used to personalise ads depends on your answer to the tracking permission prompt (section 7). Apart from those two, no processing of ours relies on consent: we send no marketing messages and we build no advertising profile on our side.

Accepting these documents is a condition of using the service; it is not a consent to personal data processing. Consent is taken only on the separate screen described above and in the tracking permission prompt on iOS, and only for the processing named there.

7. Advertising

PixoRush is free and supported by ads. Ads are served by Google AdMob: a banner at the bottom of the game screen, an interstitial between levels, and an entirely optional rewarded video (to earn a life or a hint).

There are no in-app purchases. The app contains no paid products, no subscriptions and no payment screen, and no payment is ever taken from you; for that reason we process no payment or purchase information either.

When an ad is shown, Google processes data on its own account (the ad request, device and network information, and ad interaction; on iOS, if you granted the tracking permission, your advertising identifier). That data does not reach our server. The only record we keep is the reward confirmation for a rewarded video.

Diagnostic and location data from the advertising component. According to the data disclosure Google publishes for AdMob, the advertising software development kit also collects two kinds of data and sends them to Google:

Google states that it uses this data for advertising, measurement and fraud prevention. This data does not reach our server; we do not see it, and we do not link it to your account, your username or your identity. The Usage Data switch in section 8 does not stop this collection.

Ad personalisation — by platform:

Changing the tracking permission (iOS): You can change your answer at any time in iOS under Settings > Privacy & Security > Tracking. The in-app row Settings > Privacy > Tracking Permission shows the current status. If you have not answered the prompt yet (for example, it closed without a decision), tapping the row shows the prompt again; once you have answered, it opens the app's page in iOS Settings. After you answer, the app does not show the prompt again; the change is made in iOS Settings. If you withdraw the permission, later ad requests go out non-personalised again. If "Allow Apps to Request to Track" is turned off on your device, the prompt never appears and the permission counts as not given.

Consent (European Economic Area, United Kingdom and Switzerland): Players in those regions are shown a consent screen when the app first starts, presented through Google's certified consent platform. Whether the screen appears at all is decided by that platform on the basis of where you are; if you are in a country where consent is not required — Türkiye, for instance — you see no screen. The European Economic Area covers the EU countries plus Iceland, Liechtenstein and Norway.

Google's advertising partners, and the wording of the consent screen. The consent screen uses Google's standard text for the advertising industry's consent framework (IAB Transparency and Consent Framework). It gives the number of advertising partners and links to their list. If you consent there, the partners you allow may receive data from an ad request through Google's ad auction — device and network information, the approximate location estimated from your IP address, ad interactions and, on iOS if you granted the tracking permission, your advertising identifier — in order to bid on, show and measure ads. Outside those regions, too, Google may pass ad request data to other advertising companies that take part in its ad auction, under Google's own policies. The standard text also says that partners "may use precise geolocation data". iOS and Android give an app's components the device's location only after a location permission, and this app never asks for one; no precise location is therefore available to anyone through this app. The only location in an ad request is the approximate one estimated from your IP address.

If you want to change your answer later, you can reopen the same screen in the app under Settings > Privacy > Ads & Data Consent. That row appears only where the consent platform requires a permanent option to be offered; where it does not, no row that does nothing shows up in your settings.

The advertising identifier on Android: Collection of the system's resettable advertising ID (AAID) by the analytics service is switched off in the app; that identifier is no longer present in the measurement data. To be straight with you, though: the ad network may still reach that identifier while it fills an ad request. In a non-personalised request the identifier is not used to choose ads for you; it is used to cap how often you see the same ad, to prevent fraud and to report the impression. It never reaches our server and is not stored in our database.

On Android you can still reset or delete your advertising ID under Settings > Google > Ads. Because ads on Android are not personalised in the first place, this will not change the ads you see — but it is a control you hold, and we say so.

We never pass your username to any ad network and we build no advertising profile on our side. We should also say this plainly: the analytics service in section 8 is Google's too, and while measurement is on, a summary of gameplay and ad events goes there. We do not use that data for ad targeting, and the app does not allow measurement data to be used for ad personalisation; the settings that govern sharing between Google's own products sit on Google's side.

8. Analytics and crash reporting

Analytics is connected, but conditional. The app uses Google Analytics for Firebase. Measurement data goes from your device straight to Google; it does not pass through our server. This section sets out which events we send, what information they carry, and how you stop measurement.

Measurement depends on two conditions being met together:

  1. 1. Consent must allow it. If you are in the European Economic Area, the United Kingdom or Switzerland, you must have agreed on the consent screen described in section 7. Outside those regions consent is not required and the condition counts as met — but it is the consent platform that tells us so. If the platform cannot be reached at all (first launch with no internet connection, for instance), the app does not assume that consent is unnecessary: until an answer arrives the most restrictive behaviour applies and measurement stays off everywhere, Türkiye included. It is retried on the next launch.
  2. 2. You must not have switched it off. The Settings > Privacy > Usage Data switch exists for every player in every country and is on by default.

If either answer is no, no measurement takes place.

What the switch actually does: the moment you turn it off, the app tells the analytics service to stop collecting and writes every measurement consent signal as "not granted". No further events are sent. The preference is stored on your device, survives closing and reopening the app, and is never sent to our server — so not even the fact that you used this setting reaches us.

What the switch does not stop — we list these so that we are not making a promise the switch cannot keep:

What is collected before consent:

Measurement starts switched off on both platforms. The analytics service is configured to be disabled as the app launches, on Android and on iOS alike, so no automatic event — not first open, not session start — is sent before you have seen the consent screen. Measurement only turns on once both conditions above are satisfied.

An earlier version disclosed a gap here, and it has been closed. Up to version 2.1 this paragraph said that a narrow measurement window remained on the very first launch on iOS, because the counterpart of the Android "disabled from the outset" setting had not been added. That setting has been added and the window is now closed on both platforms. If you used an earlier version and want any first records created in that window deleted, write to sebocaliskan@hotmail.com.

Two requests do reach Google before the consent screen, and we list them because your IP address is visible in both:

There is no crash reporting. Crashlytics, or any comparable crash reporting service, is not part of the app; if the app crashes, no crash report, error message or stack trace reaches us — we hold no technical detail about where the fault occurred. The analytics service may record an unexpected shutdown as a counting signal; such a record carries only the fact that the app closed, never the content of the fault. The diagnostic data the advertising component sends to Google on its own account (section 7) is a separate matter; it does not reach us either.

Why we measure: We have no other way of seeing which level players get stuck on, where they stop playing and which flow is broken. The purpose is to fix the game, not to target advertising at you.

Events we send:

Level events also carry six technical counter fields: drag count, merge count, multi-merge count, largest merge, zoom changes and previews. Those fields are sent as zero every time today, because nothing in the app ever increments the counters — so we are not in fact collecting that detail of your play. We list them anyway so the account here is complete.

Your anonymous account identifier, generated by our server, is attached to these events. It contains no name, email address or telephone number, but it is a persistent identifier tied to your account, which means the records held by the analytics service are linked together as the records of one account.

What the service collects on its own — our code does not send these; Google's software development kit collects them directly:

How much of section 12 we can deliver on the analytics side: We would rather not promise a right we cannot honour, so we keep separating the two — but the line has moved, because the off switch now exists.

Send your requests to sebocaliskan@hotmail.com.

Where it is processed: Google Analytics for Firebase offers no regional storage option. The data may be processed in any country where Google or its agents maintain facilities — in practice mostly the United States. That is an international transfer, and section 10 covers it.

How long it is kept: User-level measurement records are kept for at most 14 months under the retention options Google offers; when that period ends, identifiers such as the account identifier and the installation identifier are deleted. Aggregate totals broken down by day, country or app version — how many people played, for instance — may remain longer; those totals cannot be traced back to an individual player.

If you delete your account: The records on our server are deleted as described in section 13. The analytics records sit outside that flow; the identifiers there are deleted when the retention period above expires. If you want them removed sooner, write to sebocaliskan@hotmail.com.

On the server, technical application logs are kept so that faults can be diagnosed.

If the scope of measurement changes, or a further analytics or crash reporting service is added, this section will be updated, the version number of this document will be increased, and you will be notified in the app.

9. Who we share data with

The same protection for your data. We share data only with parties whose terms oblige them to give it the same or equal protection as described in this policy: Google under the data protection terms that apply to AdMob and to Google Analytics for Firebase, the hosting provider under its data processing terms, and advertising companies that bid through Google under Google's policies and, in the regions above, the rules of the consent framework.

We do not sell your data, do not rent it for advertising and do not share it with data brokers.

Disclosures to public authorities are made only where a legal obligation requires it and to the extent requested.

10. International transfers

Our providers may operate servers outside your country. Where that happens, the transfer relies on the safeguards required by applicable law.

For analytics data this is certain. Google Analytics for Firebase offers no regional storage option, so the measurement data in section 8 is processed in Google's facilities abroad — in practice mostly the United States.

Ad requests also go to Google's servers, which may be located abroad. On iOS, if you granted the tracking permission, the request includes your advertising identifier (IDFA); once you withdraw the permission, the identifier is no longer sent (section 7).

11. Retention

12. Your rights

You may ask whether we process your personal data, ask for information about it, ask for correction or erasure, ask us to restrict processing, ask for a copy of your data, and object to processing. If you live in Türkiye, the detail of your rights under Law no. 6698 is set out in the KVKK notice.

One exception remains, for the analytics records: of the rights above, portability cannot be honoured for the records held by Google Analytics for Firebase — that service offers no user-level, machine-readable export. Objection and restriction of processing can now be honoured: you stop measurement yourself from Settings > Privacy > Usage Data, without having to apply to us. Section 8 has the detail. No limit at all applies to the data on our own server.

Send requests to sebocaliskan@hotmail.com.

A limit on identity verification: Because we hold no email address or name for you, the only way we can match a request to an account is the username shown in the app and, if possible, your recovery code hint. Without those we cannot verify that an account is yours and cannot act on the request — a restriction that exists to stop anyone else from reaching your data.

13. Deleting your account

You can delete your account in the app under Settings > Account > Delete My Account. If you cannot open the app, see https://caliskangames.com/pixorush/account-deletion or write to sebocaliskan@hotmail.com.

Once you confirm, your account is suspended, all your sessions are revoked and a 7-day grace period begins, during which you can cancel from the same menu. When it ends, your username, game progress, coin balance, badges, device links, session tokens and recovery code are deleted, and you drop out of the overall ranking.

Some records are not deleted but kept with the link to your identity broken: your level results and best times (so that the leaderboards stay consistent, without your username), the coin ledger (so that abuse can still be investigated) and your legal acceptance records (as proof of which text you accepted and when). The account those records stay attached to no longer holds a username, device information or a recovery code.

The analytics measurement records described in section 8 sit outside this flow: they are held by Google rather than on our server, and the identifiers there are deleted when their own retention period expires.

Deletion cannot be undone: your account, your progress and any unspent coin balance cannot be brought back.

14. Children

PixoRush is not designed for children under 13 and is not marketed to them. It is not a Kids Category app.

If we learn that we have processed the data of a child under 13, we delete the account and the associated records. A parent or guardian who notices such a case can simply write to sebocaliskan@hotmail.com.

15. Security

Traffic between the app and the server is encrypted in transit. Recovery codes are stored only as irreversible hashes. Session tokens are short-lived and are all revoked when a deletion is requested. Request rates are limited to prevent abuse.

No system can promise absolute security; a serious breach we identify will be notified as required by law.

16. Changes

When this policy changes, the version number is increased. For a significant change you are notified in the app and asked to accept the new version.

17. Contact

sebocaliskan@hotmail.com