Privacy Policy for Sultan's Gambit

Effective Date: December 15, 2024
Last Updated: July 23, 2026

1. Introduction

Welcome to Sultan's Gambit! This privacy policy explains how we collect, use, and protect your information when you use our mobile game (available on Google Play for Android).

Developer: Furkan Cakmaktepe (Freelance Game Developer)
Contact: barrierefix@gmail.com
Data Protection Officer: barrierefix@gmail.com

2. Information We Collect

2.1 Account Information

Email address (for account creation, login, and communication)
Player display name (chosen by you, visible to other players)
User ID (unique identifier generated by our system)
Account authentication tokens (for secure login sessions)
Profile information (avatar selection, preferences)

2.2 Game Data

Game progress and statistics (level, experience points, rank, match history)
Card collection and deck configurations (owned cards, deck compositions, deck names)
In-game currency balances (Akçe, Elmas virtual currencies)
Purchase history (in-app purchases, bundle acquisitions, transaction records)
Matchmaking data (preferences, queue times, match results, win/loss records)
Game session data (play duration, features used, game actions taken)
Social features (friend list, friend requests, match invitations)

2.3 Device and Technical Information

Device identifiers (for technical support and crash reporting)
Device information (type, model, manufacturer)
Operating system (type and version)
Screen resolution and device capabilities
Network connectivity information (connection type, IP address)
App performance data (loading times, frame rates, error logs)
Crash reports (stack traces, device state at time of crash)

2.4 Usage Analytics and Behavioral Data

Game feature usage patterns (which features you use most, navigation paths)
Session analytics (duration, frequency, time of day, play patterns)
Gameplay behavior (card play patterns, strategic decisions, reaction times)
Performance metrics (app responsiveness, load times, error rates)
User interaction data (taps, gestures, menu usage)
Monetization analytics (purchase behavior, bundle viewing, pricing response)

2.5 Communication Data

Support communications (help requests, bug reports, feedback)
Marketing preferences (consent status, communication preferences)
Survey responses (feedback, ratings, suggestions)

3. How We Use Your Information

3.1 Core Game Services

Provide game functionality (enable gameplay, save progress, manage accounts)
Synchronize data across devices (cloud save, cross-device progression)
Enable multiplayer features (matchmaking, friend system, competitions)
Process transactions (in-app purchases, virtual currency management)
Prevent fraud (detect suspicious activity, protect against cheating)
Provide customer support (resolve issues, respond to inquiries)

3.2 Performance and Improvement

Analyze app performance (identify bugs, optimize loading times, fix crashes)
Understand user behavior (improve game balance, enhance user experience)
Develop new features (based on usage patterns and player feedback)
A/B testing (test new features, optimize user interface design)
Quality assurance (monitor game stability, identify technical issues)

3.3 Communication and Marketing

Send service communications (account updates, security alerts, policy changes)
Provide customer support (respond to help requests, technical assistance)
Marketing communications (with your explicit consent only)
Community engagement (tournaments, events, announcements)

3.4 Legal and Security

Comply with legal obligations (respond to legal requests, regulatory compliance)
Protect our rights (enforce terms of service, investigate violations)
Ensure security (prevent unauthorized access, detect malicious activity)
Maintain service integrity (prevent cheating, ensure fair play)

4. Third-Party Services and Data Sharing

We do not sell, trade, or rent your personal information to third parties. However, we use several third-party services that may process your data:

4.1 Firebase Services (Google LLC)

What we use:

Firebase Authentication (secure login, account management)
Cloud Firestore (game data storage, real-time synchronization)
Firebase Crashlytics (crash reporting, performance monitoring)
Firebase Performance Monitoring (app performance tracking)
Firebase Analytics (usage analytics, player behavior insights)

Data shared: User IDs, email addresses, game progress, device information, usage analytics, crash reports
Privacy Policy: https://policies.google.com/privacy

4.2 Google Sign-In

Purpose: Alternative authentication method
Data shared: Email address, basic profile information (name, profile picture)
Privacy Policy: https://policies.google.com/privacy

4.3 Google Play Store

Purpose: Process in-app purchases and app distribution
Data shared: Purchase information, app usage statistics
Privacy Policy: https://policies.google.com/privacy

4.4 Content Delivery Networks (CDNs)

Purpose: Deliver game assets and improve loading times
Data shared: IP address, device information
Examples: Vercel, Cloudflare

4.5 Legal Requirements

We may share information when required by law, legal process, or to:

Protect our rights or the safety of users
Investigate fraud or security issues
In connection with a business transfer or merger

5. Data Storage and Security

5.1 Storage Location

Primary storage: Firebase servers (Google Cloud Platform)
Geographic location: Europe (europe-west3 - Frankfurt) and other global regions
Encryption: All data is encrypted in transit (TLS/SSL) and at rest (AES-256)
Backup systems: Regular automated backups with encryption

5.2 Security Measures

Industry-standard encryption protocols (TLS 1.3, AES-256)
Regular security audits and vulnerability assessments
Access controls (limited team access, two-factor authentication)
Secure authentication systems (OAuth 2.0, JWT tokens)
Monitoring systems (intrusion detection, anomaly monitoring)
Data breach response procedures (incident response plan, user notification)

5.3 Data Retention

We retain your information for as long as necessary to provide our services:

Account data: Until account deletion (with 30-day grace period)
Game progress: Until account deletion
Analytics data: Maximum 26 months (anonymized after 14 months)
Support communications: Maximum 3 years
Crash reports: Maximum 12 months
Financial records: 7 years (legal requirement)

6. Your Rights and Choices

6.1 Account Management

Access: View and download your account information and data
Update: Modify your account information, preferences, and settings
Delete: Request complete account and data deletion (see our Account Deletion page)
Export: Download your game data in a portable format
Portability: Transfer your data to another service (where technically feasible)

6.2 Communication Preferences

Opt-out: Unsubscribe from promotional communications
Notification settings: Control push notifications and email preferences
Marketing consent: Manage marketing communication preferences
Frequency controls: Adjust communication frequency

6.3 Data Subject Rights (GDPR - EU Users)

If you are in the European Union, you have additional rights:

Right of access: Obtain information about processing and a copy of your data
Right of rectification: Request correction of inaccurate personal data
Right of erasure: Request deletion of your personal data ("right to be forgotten")
Right to data portability: Receive your data in a machine-readable format
Right to object: Object to processing based on legitimate interests
Right to restrict processing: Request limitation of processing in certain circumstances
Rights related to automated decision-making: Protection against purely automated decisions

6.4 California Privacy Rights (CCPA - California Users)

California residents have additional rights:

Right to know: What personal information is collected and how it's used
Right to delete: Request deletion of personal information
Right to opt-out: Opt-out of the sale of personal information (we don't sell data)
Right to non-discrimination: Not be discriminated against for exercising privacy rights

6.5 How to Exercise Your Rights

Email: barrierefix@gmail.com
In-game support: Settings → Help & Support → Privacy Request
Response time: We will respond within 30 days (GDPR) or 45 days (CCPA)

7. Children's Privacy

Age Restriction: Sultan's Gambit is intended for users 13 years of age and older.
Child Protection: We do not knowingly collect personal information from children under 13.

Discovery Protocol: If we discover that a child under 13 has provided personal information, we will:

Delete the information immediately
Terminate the account
Notify parents/guardians if contact information is available

Parental Controls: Parents can contact us to review, update, or delete their child's information.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your own:

Safeguards: We use appropriate safeguards for international transfers
Standard Contractual Clauses: We use EU-approved clauses for transfers outside the EU
Adequacy Decisions: We transfer to countries with adequate protection levels
Your Rights: International transfers don't diminish your privacy rights

9. Cookies and Tracking Technologies

9.1 Local Storage and On-Device Data

Game data: Store game progress locally for offline functionality
Settings: Save user preferences and configuration
Cache data: Improve loading times and performance
Authentication: Securely store session tokens to keep you signed in

9.2 Your Choices

Analytics opt-out: Opt-out of analytics tracking through game settings
Clearing data: Clear locally stored data through your device or by uninstalling the app

10. Third-Party Links and Services

Sultan's Gambit may contain links to external websites or services:

No control: We don't control third-party privacy practices
Review policies: We encourage you to review their privacy policies
No responsibility: We're not responsible for third-party data practices
User discretion: Use external services at your own discretion

11. Virtual Items and Monetization

11.1 Card Bundle System

Sultan's Gambit features predetermined card bundles with transparent contents:

No randomization: All bundle contents are predetermined and disclosed before purchase
Transparent system: Players know exactly which cards they're purchasing
No gambling: No random chance elements or loot box mechanics
Fair pricing: All bundles clearly display contents and pricing

11.2 In-Game Purchases

Virtual goods: All purchases are for virtual items with no real-world value
Transaction records: All purchase history is maintained for your records
Refund policy: Refunds handled according to Google Play policies
Fraud prevention: We monitor for suspicious purchasing activity

12. Data Breach Notification

In the event of a data security incident:

Investigation: We will investigate and assess the scope immediately
Notification timeline: Users will be notified within 72 hours (or as required by law)
Information provided: Nature of breach, affected data, steps taken, recommended actions
Regulatory notification: Authorities will be notified as legally required
Remediation: We will take immediate steps to secure data and prevent future incidents

13. Updates to This Policy

We may update this privacy policy from time to time:

Notification methods: Prominent notice on this page, email notification (if you've provided an email), and/or an in-game notification banner
Effective date: Changes take effect 30 days after notification
Material changes: Significant changes will require your renewed consent
Version history: Previous versions available upon request

14. Contact Information

14.1 General Privacy Questions

Email: barrierefix@gmail.com
Subject line: "Privacy Policy Inquiry"
Response time: Within 5 business days

14.2 Data Protection Officer

Email: barrierefix@gmail.com
Subject line: "Data Protection Officer"
For: GDPR-related requests, data protection concerns

14.3 Business Address

Meuschelstraße 60, 90408 Nürnberg, Germany

14.4 Supervisory Authority (EU)

If you're unsatisfied with our response, you can contact your local data protection authority.

15. Legal Basis for Processing (GDPR)

We process your personal data based on:

Contract performance: To provide game services you've requested
Legitimate interests: To improve our services, prevent fraud, ensure security
Consent: For marketing communications and non-essential analytics
Legal obligations: To comply with applicable laws and regulations

16. Automated Decision-Making

We may use automated systems for:

Fraud detection: Automated systems monitor for suspicious activity
Content moderation: Automated filters for inappropriate content
Matchmaking: Algorithms to match players of similar skill levels
Your rights: You can request human review of automated decisions affecting you

By using Sultan's Gambit, you acknowledge that you have read, understood, and agree to this privacy policy.

This policy is available in multiple languages. In case of conflicts, the English version prevails.