This policy describes what data the Karo game collects, why, and for how long. It is short because the game collects little.
Playing as a guest requires no personal information: no email, no phone number, no real name is requested or stored. An account is created on your device and you can play.
If you choose to link your account to a sign-in provider (Apple, Google, Facebook or Game Center), the game receives an identifier for you and, if the provider supplies them, your name, a verified email address and a profile photo. Linking exists for one reason: so you keep your progress when you change devices.
Game Center. If you are signed in to Game Center on your iPhone or iPad, the game uses it automatically to sign you in or to link your guest account, so your progress follows you to a new device. We store only the Game Center player identifier Apple gives this developer (the "team player ID"); Game Center provides no email address or photo. Your Game Center nickname may be used as your display name, shortened and filtered the same way. You can sign out of Game Center in iOS Settings at any time.
Facebook. Facebook sign-in opens Facebook's own website in a system browser window; your Facebook password never reaches the game. We ask only for your public profile and receive your Facebook ID for this app, your name and your profile photo. We do not ask for your email address or your friends list. The game does not include the Facebook SDK, so we send Facebook no data about how you use the game. You can remove the game's access at any time in Facebook → Settings → Apps and websites; to delete the data we hold, see Delete account.
Your name in the game. On a linked account your display name comes from the name your provider supplies, shortened to your first name and the initial of your last name (for example "Alex S."), and it is shown to the players you meet. It is refreshed each time you sign in; you cannot edit it in the game. If the provider supplies no name, or one we cannot show, you get a generated name such as "M48213". Guests always get a generated name.
Your photo. If your provider supplies a profile photo (Google and Facebook do; Apple does not), our server downloads a small copy at sign-in, stores it and shows it as your avatar to the players you meet and on the leaderboard. The provider's photo address is not stored or passed on. The copy is replaced at each sign-in and deleted with your account.
| Data | Why | Retention |
|---|---|---|
| Display name, player tag, avatar choice, profile photo copy (linked accounts) | So your opponent can recognise you | Until the account is deleted |
| Device fingerprint (a random identifier) | Limiting accounts per device (abuse prevention) | Until the account is deleted |
| Sign-in provider identifier | Only if you linked an account — so you can sign back in | Until the account is deleted |
| Email address | Only if you linked an account and the provider reported the address as verified. Single purpose: noticing that the same person opened a second account with a different provider (which would split your progress). We do not send you email. | Until the account is deleted |
| Game history: moves, scores, results | The game itself, replay and rating | Until the account is deleted |
| Rating and progression data (LP, league, streak) | Progression and fair matchmaking | Until the account is deleted |
| Notification address (push token), time zone, notification preferences | Only if you allowed notifications — "your turn" alerts and quiet hours | Until you revoke permission or delete the app |
| Usage log: on which days and how many times you opened the app, that day's first and last activity time, approximate time spent in the app, app version and platform (iOS/Android), approximate location derived from your IP address (country and city; the IP address itself is not stored in this log) | Understanding how and where the app is used, and support (which version you are on) | 90 days |
| Session records and IP address | Security: detecting stolen sessions and rate-limiting abuse | Session lifetime + at most 90 days |
Store link (/get) clicks: day, the campaign label in the link, device type (e.g. iPhone, Windows), browser or in-app browser (e.g. Safari, Instagram) and the country and city derived from the IP address. An anonymous counter; the browser string and IP address are not stored. To tell repeat visits apart, an irreversible salted hash of the IP address and browser string is kept |
Measuring which promotion works | Counter indefinitely (not personal data); hash 26 hours |
| Blocks and reports | Harassment prevention; report notes are read only by moderators | Kept as a moderation record after the report is closed |
Your data is not sold. Sharing happens only where the game needs it:
In the app: Settings → Delete account. After the request there is a 30-day recovery window during which signing back in restores the account. After that the account and its data are permanently deleted. Guest accounts can be deleted the same way; because a guest account is recognised only on its device, a deleted guest account cannot be recovered.
Withdrawing consent. You can turn notifications off in the game's notification settings or in iOS Settings at any time, and unlink your sign-in provider by deleting the account. On an Apple-linked account you can also stop using Sign in with Apple from your Apple ID settings.
If you cannot access the app: account deletion page.
One deliberate exception: game records belong to two people. Deleting your account does not erase your opponent's history — your name is replaced with an anonymous label there.
The game is not directed at users under 13 and does not knowingly collect data from that age group.
Questions and data requests: support@kiraslab.com
Operator: Canberk Özdemir (individual developer) · Jurisdiction: Türkiye