Privacy Policy
The data controller is Ahmet ÇINAR (Polimelo, Türkiye). This notice explains Syncron’s own processing. Playing without registering does not make all data anonymous: a guest account identifier can also be linked to your progress and requests.
Publisher and data requests
Ahmet ÇINAR · Polimelo · Türkiye
Support and data-request email: [email protected]
In-game Support1. Data and purposes
We obtain data from you when you play, sign in, submit a level or send support/feedback; automatically from your browser/SDK and game server; and from the sign-in provider if you choose Google sign-in. Not every feature is available in every edition.
| Data | Use |
|---|---|
| UID-bound terms/notice version, document language, acceptance and notice-link presentation times; server recording time in verified profiles | Record actual acceptance and manage required version renewals. Guest records are local; verified-account records sync. Presenting information does not prove reading or consent to processing. A previous unversioned timestamp is not new acceptance. |
| Account identifier (UID), guest/registered status, sign-in provider; email, name/tag and verification information for registered accounts | Sign-in, session, account/profile and progress sync. Passwords are processed by Firebase Authentication, not stored in gameplay records. |
| Level/version, stars, XP, completion/skipping; moves for validating the daily puzzle; daily results/streaks; reward transactions | Save progress, grant stars/XP/rewards and unlock levels. Adventure results are calculated on your device; only level, version, stars and status are sent. Daily puzzle moves are validated on our server. Hint usage is not sent. Per-level aggregate statistics that do not identify anyone (number of players completing/skipping, star distribution) are derived from these progress records. |
| Name/tag, badges, friend relationships, submitted levels and creator information | Community features on the web and moderation. Friends work only for accounts with a verified email, via exact-tag search; your friends and people you send requests to see your name, tag, player ID (UID) and showcase badges. You can block players or end a friendship. If a level you submit is published after administrator approval, its name, notes and your name/tag are visible to other players. Global and daily rankings are disabled in the first release; your account email is not shown to other players. |
| Like/difficulty vote and selected quit reason, level/version/time and a pseudonymous identifier linkable to the account | Receive optional level feedback, manage duplicate responses and assess level quality/difficulty. These responses remain available even though automatic telemetry is disabled. |
| Anonymous level statistics: outcome (completed/skipped/left), whether it was a first attempt, hint types used, restart and duration ranges | Improving levels. This information is only added to weekly per-level totals without storing identity; no individual records are kept. To prevent fake or repeated contributions, requests pass session and app verification, and a keyed hash of the account ID is kept for at most two weeks and then deleted so that an account counts once per level per week (at most once per outcome type). Because a week’s totals for a rarely played level may reflect a single player, only authorised administrators see these numbers and we do not match them with other records. It is on by default; you can turn it off in Settings. |
| Support subject/message, account/email/name/tag, replies, status and administrator notes | Respond to issues or data requests, resolve them and protect rights where necessary. Do not send sensitive information or passwords. |
| Network/IP information, hashed IP in security events, User-Agent, UID, event/time; transaction/audit and minimal server error records | Deliver requests, prevent cheating/abuse, secure the service and resolve failures. Hashing an IP or using a UID does not by itself anonymise data. |
2. Disabled analytics and separate choices
Our GA4, per-player gameplay telemetry/event funnel and automatic client diagnostics are disabled for the initial release. You are not asked to consent to them; opening the game or accepting terms does not enable them. Past events are not accumulated for transmission after a later opt-in. Anonymous level statistics (table above) are separate: they are weekly totals that contain no identity and can be turned off in Settings.
Any future optional processing will require prior information and, where required, separate choices that default to off. Refusal will not block the core game and consent can be withdrawn. Erasing past data on request and stopping future collection are different operations.
3. Providers, recipients and platform differences
Google/Firebase Authentication handles sign-in and guest identity; Firestore/Functions handle profiles, content and support. Cloudflare Workers/D1 handle game validation, progress, feedback and security records; R2 hosts backups/archives. Access for administration is limited to authorised persons. Data may be supplied to legally competent authorities in response to lawful requests.
When configured, Firebase App Check/reCAPTCHA Enterprise processes network/device information and verification tokens for security. The code can initiate it on the first server request on the website and on approximately 5% of page loads on portals. External Google Fonts requests on the website may also transmit network data such as IP and browser information to Google. These are separate from GA4.
When you play through a portal (e.g. CrazyGames), the portal may separately process data through its SDK, advertising partners and preference tools. In the first release, the CrazyGames build of Syncron makes no ad calls. Non-personalised ads do not mean that all identifiers or processing disappear. A portal advertising choice is not permission for our analytics. External sign-in and editor/profile/social screens are not offered on portals; guest progress, daily play, support and feedback may be available.
If support email notifications are enabled, Resend may receive the recipient email/name, ticket link/subject and an excerpt of a reply. Activation for the initial release has not been confirmed; this is not used for marketing email. With purchases/donations disabled, a payment provider is not presented as an active processing operation for the initial release.
4. International processing
Google/Firebase, Cloudflare and portal infrastructure may process data outside Türkiye. A database being in a European region does not mean all authentication, security, support and log processing occurs only there. Providers’ own processing and subprocessors may also be involved.
Applicable transfer mechanisms, actual contracts and service scope must be verified during release preparation. This draft does not claim that standard clauses have been signed, an adequacy decision applies or required notifications have been made. A general account checkbox or reading this notice is not by itself a safeguard for ongoing international transfers. Applicable safeguard information and how to request a copy will be completed before publication.
5. Retention and deletion
Data should not be kept longer than its purpose and applicable obligations require. The periods below are current code cleanup thresholds, not guarantees of deletion in a closed browser or of successful live cleanup jobs. Retention/deletion arrangements for categories without fixed periods must be completed before publication.
| Category | Current period/criterion |
|---|---|
| Registered account, progress, daily results/streaks, rewards and community records | Account/feature need and deletion process; no general automatic time limit. Adventure solution move sequences are not retained. |
| Guest and unverified-email accounts | Guest cleanup threshold: 30 days; an eligibility-dependent 14-day process for unverified email. The latter can detach email sign-in and preserve guest progress rather than delete the whole account. |
| Level vote and quit reason | 13-month cleanup threshold from vote update or quit-reason creation. Pseudonymous links and historical erasure require separate review. |
| Anonymous level statistics | Weekly totals containing no identity may be kept indefinitely. The repeat-prevention hash is deleted after at most two weeks. |
| Security and audit | 30 days for security events. Audit records move to an archive after 90 days and are automatically erased from it after 275 days (about one year in total). |
| Support messages, administrator notes and backups | Open requests are kept until resolved; closed requests are deleted in a yearly manual review one year after closing. Account deletion clears email, name, subject, message text, administrator notes and the UID on messages; the request record (UID, category, date) remains as evidence of the deletion request. Application backups are pruned after 12 weeks and automatically erased from the archive after at most 100 days. Providers’ own internal backups follow their own periods. |
| Historical analytics | Automatic analytics are disabled; historical telemetry and client error records were erased before release. Any earlier Analytics Engine events remain with the provider for at most 3 months. |
6. A short explanation for younger players
We may use a game identifier to remember your stars and completed levels. We may also keep a level vote or support message you send us. Our automatic gameplay analytics are off. Do not put your real address, phone number, password or school details in messages. If something is wrong, you can contact Support with a trusted adult.
Syncron is a general-audience puzzle game; it is not designed or marketed for children. We do not ask for age, so data collection is kept minimal for everyone, automatic analytics are off and rankings are disabled. Friends and level submission require an account with a verified email and are not offered on portals. If we learn that a player under 13 uses an account without parental consent, we delete the account and related data. Parents/legal representatives can make data requests; we verify the relevant account and authority securely.
7. Your rights and security
Legal grounds are mapped to purposes on the KVKK page. Where GDPR applies, grounds considered are Art. 6(1)(b) for necessary account/game services, Art. 6(1)(f) subject to balancing for proportionate security, voluntary level evaluation and anonymous level statistics, Art. 6(1)(c) for legal obligations and Art. 6(1)(a) for future optional purposes requiring consent. Without information necessary for a requested feature, that feature may be unavailable; feedback is not mandatory.
Depending on applicable law, you may have rights to access, information/copies, correction, erasure, restriction, objection and, where applicable, portability. You can withdraw consent for consent-based processing; withdrawal does not retrospectively invalidate earlier lawful processing. KVKK rights and request details are on the KVKK page. You retain the right to complain to the competent data protection authority.
Where GDPR applies, requests normally receive a response within one month. Any extension of up to two further months needed due to complexity/number of requests is communicated with reasons within the first month. The 30-day KVKK response period and procedure are on the KVKK page. We use authentication and access controls; no internet service can guarantee absolute security. Do not send passwords or sign-in tokens. You will not be penalised for exercising your rights.
We do not sell personal data or share it for targeted advertising; Syncron does not build advertising profiles. Portal advertising processing is subject to its own notice. Daily puzzle validation and security checks are automated; ask Support to review questionable restrictions.