Privacy Policy
Last updated 29 October 2026
Who we are
CinemaXOX is made and run by Yunusemre Yıkılmaz, an individual developer, who decides how your data is used (the "data controller" under the GDPR and Turkey's Law No. 6698 on the Protection of Personal Data, KVKK). Contact: yeyikilmaz@gmail.com · Çamlıca Mahallesi, Nazlı Sokak No: 10, Nilüfer, Bursa, Türkiye.
What we collect
- Account: a username you choose, a random account id, and, if you sign in with Apple or Google, an anonymous identifier from that provider. Never your password, and no e-mail address unless you share one with us.
- Game data: matches and their results, scores, level, coins, collected cards, jokers, Daily Grid guesses, friends, invites, blocks and the reports you file.
- Purchases: which product you bought, when, and the store’s transaction id. Payment details stay with Apple or Google.
- Technical: your IP address and request details in server logs, kept briefly for security and to stop abuse.
- Crash reports: when the app or server fails, the error, the screen or match it happened in, your device model, OS and app version, and your random account id. No username, e-mail or messages.
- Usage analytics, only if you turn them on (Settings → Privacy → Analytics, off by default): events such as match started and finished or joker used, with your random account id and device model, OS and app version.
- Daily Grid reminders, if you turn them on, are scheduled on your device; nothing about them is sent to us.
Why, and on what basis
- To run the game and your account (performance of our contract with you).
- To keep play fair and safe: anti-cheat, rate limits, moderation of usernames and reports (our legitimate interest).
- To fix crashes (our legitimate interest).
- To learn which features players use, through analytics (your consent, which you can withdraw at any time with the same switch).
- To keep purchase records for as long as tax law requires (legal obligation).
We do not sell or share your personal data for cross-context behavioural advertising, and we don’t build advertising profiles.
Who processes it for us
- Hetzner Online GmbH: Server hosting: the game server, database and backups (Germany (EU)).
- Apple Inc. / Google LLC: Sign in with Apple or Google, app distribution and in-app purchases (USA / Ireland).
- Wikimedia Foundation, Inc.: Actor photos, loaded by the app from Wikimedia Commons (your device connects to it directly) (USA).
- Functional Software, Inc. (Sentry): Crash and error reports (USA / EU).
- PostHog Inc.: Usage analytics, only if you turn them on (EU (Frankfurt)).
- RevenueCat, Inc.: Checking store purchases and subscriptions (your random account id and the purchase record) (USA) — once this is added to the game.
- Google LLC (AdMob): Rewarded ads you choose to watch, with the consent choices you make (USA / Ireland) — once this is added to the game.
Some of them are outside the EEA and Turkey. Those transfers rely on the European Commission’s Standard Contractual Clauses or adequacy decisions, and for Turkey on the standard contracts announced by the Personal Data Protection Board under KVKK Art. 9.
What other players see
Your username and level, your moves in a match, and your rank and score on the leaderboard. A player you invite sees your username with the invite.
How long we keep it
- Account and game data: until you delete your account.
- Backups: deleted data disappears from our database backups within 30 days.
- Server logs: rotated automatically and kept only briefly.
- Crash reports: 90 days. Analytics events: up to 12 months.
- Purchase records: as long as tax law requires, even after the account is deleted.
Your rights
You can download all your data (Profile → Download my data), change your username, and delete your account with everything in it (Profile → Delete account). You also have the right to access, correct, restrict or object to the processing of your data, to data portability, and to withdraw consent, under the GDPR, KVKK Art. 11 and the privacy laws of US states such as California. Write to yeyikilmaz@gmail.com; we answer within 30 days. You may also complain to your data protection authority, or in Turkey to the Personal Data Protection Board (KVKK Kurulu).
Children
CinemaXOX is not meant for children under 13, and we don’t knowingly collect their data. Where local law sets a higher age for consent, players below it need a parent’s permission. If you believe a child under 13 has an account, write to us and we will delete it.
Security
Connections to our server are encrypted (HTTPS), your session is a signed token kept in your device’s secure storage, and the database is backed up every night. No system is perfectly safe; if a breach puts your data at risk, we will tell you and the authorities as the law requires.
Changes
When this policy changes, the date above changes with it, and significant changes are announced in the app.