Privacy Policy

1. Who we are

Tonbuk ("Tonbuk", "we", "us") is a casual game app: XOX, Memory and Block, played against the computer or online against other players, with friends and chat. Tonbuk is operated by ZOBUT GAMES TEKNOLOJI LIMITED SIRKETI (Türkiye), the data controller for the personal data described in this policy.

If you have any question about your data, write to support@tonbuk.com.

2. What we collect

• Account. If you sign in with Google: your Google account e-mail address and a user ID from Firebase Authentication. If you play as a guest: only a random user ID, no e-mail address. We never receive your Google password.
• Profile. The username you choose (guests get a generated one), the avatar you pick from our list, your gender if you choose to give it (optional), your app language, and a player code we generate (TB·XXXXXX) so that friends can add you. If you used an earlier version of Tonbuk, a profile photo you uploaded then stays with your account until you delete it.
• Games and progress. Your game rights ("lives"), online wins and losses, game statistics, your daily bonus streak, and records of your online matches (players, moves, boards, scores and results). Games against the computer are kept only on your device.
• Friends and safety. Your friends and friend requests, the players you block, the reports you send (the reason and the optional note you write) and reports other players send about you.
• Messages. The chat messages you send to friends and when they were sent and read, the "typing…" indicator, the chats you mute, and the reactions, ready-made phrases and texts you send during online matches.
• Notifications. If notifications are on: your device's Firebase Cloud Messaging token, your platform and app language.
• Purchases. If you subscribe to Tonbuk VIP: the Google Play purchase token, order ID, product, subscription status and expiry date. Payment is handled entirely by Google Play; we never see your card or bank details.
• Technical data. For each sign-in session we record the IP address, the platform and when the session was last used. Our web server also keeps standard access logs (IP address, time, requested address, app or browser type) for security and troubleshooting.
• Crash reports and usage statistics. Firebase Crashlytics collects crash reports (device model, operating system and app version, and the state of the app when it crashed). Firebase Analytics collects usage events (for example which screens are opened and which games are played), device and app information and approximate region. We do not link them to your e-mail address.
• Support. If you write to us: your message, your e-mail address and anything else you choose to send.

We do not collect your precise location, contacts, photos or files, and we do not use your microphone, camera or advertising ID.

3. How we use it

• To run your account: sign you in, keep your progress and let you continue on another device with the same Google account.
• To run online play: match you with other players, run each match on our servers (moves, timers and results), use one life per match and record wins and losses.
• To run friends and chat: let players add you with your player code, show your friends your username, avatar, online status and last seen time, deliver messages and game invitations, and send the notifications you allowed.
• To provide VIP: verify your purchases with Google Play, give the VIP features and the lives of each payment, and take back the lives of a refunded payment.
• To keep Tonbuk safe: mask blocked words in names and messages, apply daily limits, handle reports and suspend accounts that break our rules. When you report a player, our moderators can see the recent messages between you and that player to review the report.
• To improve Tonbuk: understand which features are used and find and fix crashes.
• To answer you and comply with the law: reply to support requests, keep accounting records and respond to lawful requests.

Messages are stored on our servers so that they can be delivered and shown on your devices; they are not end-to-end encrypted. Our team accesses them only when needed to handle a report, to investigate abuse or a security problem, or when the law requires it.

Legal bases (for example under the GDPR and the Turkish Personal Data Protection Law No. 6698, "KVKK"): performing our contract with you (account, games, friends, chat and VIP), our legitimate interests (safety, preventing abuse, security logs, improving the app), your consent (notifications) and our legal obligations (accounting records, lawful requests).

4. What other players see

• Players you meet online: your username, avatar, online wins, and the reactions and messages you send in that match.
• Anyone with your player code: your username and avatar, so that they can send you a friend request. Players cannot find you by name.
• Your friends: your username, avatar, online status and last seen time, your game invitations and the messages you send them.

Tonbuk has no public profile pages on the web.

5. Service providers

These providers process data for us or under their own privacy policies:

• Google Firebase: Authentication (Google and guest sign-in), Cloud Messaging (notifications), Crashlytics (crash reports) and Analytics (usage statistics).
• Google Sign-In: optional sign-in with your Google account.
• Google Play: subscription payments, and the Google Play Developer API we use to verify purchases.
• Our hosting provider: the servers that run Tonbuk and store its database.

You can read Google's privacy policy at policies.google.com/privacy.

6. Sharing

We do not sell personal data, do not share it with data brokers and do not show ads. We share personal data only with the service providers above as far as they need it, with other players as described in section 4, when the law requires it or to protect the rights and safety of our users and others, and with a buyer or successor if Tonbuk is sold or merged, in which case this policy continues to apply.

7. How long we keep it

• Account, profile, progress, friends and messages: as long as your account exists. They are deleted when you delete your account.
• Deleted chats: deleting a chat removes it only for you; the other person keeps their copy until one of you deletes their account.
• Reactions and texts in online matches: 2 days.
• Reports: as long as the account of the reporter or the reported player exists.
• Sign-in sessions: until you sign out or delete your account. Sessions that are not used for 180 days expire.
• Purchase records: kept after account deletion for as long as accounting and tax law requires (typically up to 10 years) and to handle refunds and disputes.
• Ban records: if we ban an account for breaking our rules, we keep its internal ID and the reason, also after the account is deleted.
• Server access logs: for a limited period for security and troubleshooting, then deleted.
• Crash reports and usage statistics: kept by Firebase in pseudonymous form for up to 14 months.
• Support e-mails: up to 24 months after the last message.

Guest accounts are kept like any other account. A guest account cannot be recovered after you sign out of it or uninstall the app, so delete it in the app first if you do not want it kept, or link it to Google to keep your progress.

8. Your choices and rights

• Edit your profile: Settings › Edit profile.
• Notifications: turn them on or off in Settings › Notifications or in your device settings, and mute a single chat from its menu.
• Block and report: from a player's card or from the chat menu.
• Delete your account: Settings › Delete account deletes your account and its data immediately. If you cannot use the app, see how to delete your account. Deleting your account does not cancel a subscription; cancel it in Google Play.
• Access, correction, a copy of your data, objection and restriction: write to support@tonbuk.com from the e-mail address of your account (for a guest account, include your player code). We answer within 30 days.
• Users in Türkiye have the rights listed in Article 11 of the KVKK, including learning whether their data is processed, asking for information, correction or deletion, objecting to results produced by automated processing and claiming compensation for damage. Send requests to the same address.
• Complaints: you can complain to your data protection authority: in Türkiye the Personal Data Protection Authority (KVKK), in the EU or the UK your local supervisory authority.

9. Children

Tonbuk is not directed to children under 13. You must be at least 13 years old to use Tonbuk, or older if the law of your country requires it, and users under 18 need the permission of a parent or guardian. If you believe a child under 13 has created an account, write to support@tonbuk.com and we will delete it.

10. Security

The app talks to our servers only over encrypted connections (HTTPS). Sign-in sessions use random keys that are stored on our servers only as hashes and end when you sign out. We limit access to our servers and database to the people who need it. No system is perfectly secure; if a breach affects your data, we will inform you and the authorities as the law requires.

11. International transfers

Our servers and our service providers may process data outside your country, including in Türkiye, the European Union and the United States. Where the law requires it, we rely on the safeguards offered by our providers, such as standard contractual clauses.

12. Changes

We may update this policy. The date at the top shows the latest version, and we announce important changes in the app.

13. Contact

ZOBUT GAMES TEKNOLOJI LIMITED SIRKETI · support@tonbuk.com · tonbuk.com