Privacy Policy

Effective date: 2 November 2026 · Version 5

This policy explains what information the mobile game Sand Fit: Block Puzzle (the “Game”) collects, why, who it is shared with, and the choices you have. The Game is published by Ömer Faruk Gürün, using the name Gurun Studio (Türkiye), referred to as “we”. Contact: 1omerfarukgurun@gmail.com.

1. Summary

• The Game has no sign-in screen. We do not ask for your name, email address, phone number, contacts, photos or precise location.
• Your progress, coins, boosters and purchases are stored on your device and backed up to a cloud save under a random, pseudonymous player ID. Restoration depends on the platform and available credentials and is not guaranteed. Settings stay on your device.
• The Game shows ads through Google AdMob and uses Google Firebase for the cloud save, analytics and crash reports.
• The Game uses the Meta SDK to measure our Instagram and Facebook ads. Its activation is controlled by the Google consent status. Older releases enable automatic app-event logging, which can include purchase events in addition to installs and launches.
• Purchases are processed by Google Play or the Apple App Store. We never see your payment details.

2. Information we collect

The Game and its SDKs process the following categories. A random identifier can still be personal data: it can be associated with an installation, purchases or saved progress. We do not receive your full payment-card details.

Settings such as sound, vibration and language are stored only on your device. The cloud save holds no email address or other contact detail; client access is restricted by Firestore rules to the authenticated owner of the player ID. Authorised service administrators can also access data for support, security and deletion requests. On Android the Game signs in to Google Play Games silently when you use it, so the same save is found again after a reinstall; if you do not use Play Games, removing the Game also removes the ID from the device and a reinstall starts a new save.

3. Advertising, notifications and choices

If you are in the European Economic Area, the United Kingdom or Switzerland, the Game asks for your consent before personalised ads are shown, using Google’s consent form, which also lists Google’s advertising partners. If you do not consent, ads may be non-personalised, limited, or unavailable, depending on the consent state and Google's requirements. In versions that display “Ad privacy choices” in Settings, that button reopens Google's privacy-options form when required. Earlier versions do not include that button; device-level controls and the contact address remain available.

iOS: the Game asks for permission to track (App Tracking Transparency). Your device’s advertising identifier (IDFA) is used by AdMob and Meta only if you allow it. You can change this at any time in iOS Settings → Privacy & Security → Tracking.

Android: you can reset or delete your advertising ID in your device settings (Settings → Privacy → Ads, or Google → Ads).

Personalised ads involve automated profiling by Google based on the advertising data described above. We do not make any decisions about you that have legal or similarly significant effects. Buying Remove Ads removes the ads shown between levels; ads you choose to watch for rewards remain available.

Local reminders: with your device permission where required, the Game schedules notifications on the device. It stores recent play times, last-session time and permission-prompt history locally. It does not use Firebase Cloud Messaging or a remote push-token service. Notification permission/opening events, reward-calendar use, rescue results and thermal-state events may be included in Firebase Analytics. You can disable notifications in your device settings.

Reading is not consent: accepting the Terms or acknowledging this notice does not itself grant advertising, analytics or tracking consent. ATT concerns cross-app tracking; Google UMP concerns supported advertising privacy messages. Neither is a blanket consent for every SDK. Released versions currently have no separate in-game Firebase Analytics or Crashlytics opt-out; contact us about your rights and choices.

4. Legal bases

Where the GDPR or Türkiye’s Personal Data Protection Law No. 6698 (KVKK) applies, the data controller is Ömer Faruk Gürün (Gurun Studio). Data is collected automatically through the Game and the services listed above, and we process it:

• to perform our agreement with you: providing the Game and purchases (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c));
• for our legitimate interests: security, fraud prevention, crash reporting, improving the Game, where those interests are not overridden by your rights and the applicable law permits that basis (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f));
• to comply with legal obligations, for example tax and consumer law records of purchases (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç));
• with your consent where the law requires it: personalised advertising and, on iOS, tracking (GDPR Art. 6(1)(a); KVKK Art. 5(1)). You can withdraw consent at any time; this does not affect processing that happened before.

5. Who we share data with

We do not sell your personal data for money. Data is disclosed to the following providers, under the terms that apply to each service. A provider may act as our processor for some operations and as an independent controller for others; its own privacy notice describes those uses:

• Google LLC and its affiliates: Firebase (Authentication, Cloud Firestore, Analytics, Crashlytics, Remote Config), Google Play Games Services, AdMob and the User Messaging Platform, and Google Play Billing.
• Apple Inc. (iOS only): App Store purchases.
• Meta Platforms: advertising measurement and the SDK data described above.
• Unity Technologies: Unity IAP purchase processing, technical data and transaction reporting.
• GitHub: hosting this website through GitHub Pages.

More information:

• Firebase privacy information
• How Google uses information from apps that use its services
• Google Privacy Policy
• Apple Privacy Policy
• Meta Privacy Policy (app events and advertising measurement)
• Unity player privacy information and Unity IAP terms
• GitHub Privacy Statement

We may also disclose information if required by law or by a court or authority, or where needed to protect the rights and safety of our players or ourselves. If the Game is transferred to another publisher (for example in a sale or a publishing agreement), the data described here may be transferred with it; the new publisher must keep protecting it, and this policy will be updated to name them.

6. International transfers

Google, Meta, Unity, Apple and GitHub may process data in the United States, the European Economic Area and other countries. Applicable provider terms describe their processing locations and transfer mechanisms, which may include Standard Contractual Clauses or participation in a recognised data-protection framework. The applicable safeguard depends on the provider, the parties and your jurisdiction; use of an SDK is not by itself proof that all transfer requirements are satisfied. Contact us for information about the recipients and safeguards relevant to your request. Mandatory rights under the GDPR, UK law and Article 9 of the KVKK are not waived by using the Game or acknowledging this notice.

7. Retention

• Progress and settings stay on your device until you uninstall the Game or clear its data.
• The cloud save and authentication record are retained to provide restoration until their deletion is requested or the service is ended. The current implementation does not automatically delete inactive saves after 24 months.
• User/event-level Analytics data follows the Google Analytics property's configured retention period. In the standard service this is generally 2 or 14 months; new activity can reset user-level retention. Aggregated reports are not subject to the same retention limit.
• Firebase states that removal of crash reports and associated identifiers from live/backup systems begins after 90 days; this is not a promise of complete erasure on day 90.
• Support emails are kept as long as needed to handle your request.
• The Game keeps recent delivery transaction IDs locally to avoid duplicate rewards. Store and Unity records follow their applicable retention terms; legally required records may be retained where necessary. Advertising and SDK service records follow the relevant provider's retention and deletion rules.

8. Your rights and choices

• Delete your data: uninstalling the Game (or clearing its data in your device settings) deletes the progress and settings on your device. To also delete the cloud save, email us the Player ID shown at the bottom of the Game’s settings window; we normally respond and act on valid requests within 30 days, subject to applicable law and identity verification. Requests cover the cloud-save document and associated Firebase Authentication record, not merely the local app. Provider backup deletion may take longer under their published schedules. Deletion cannot be undone.
• Other requests: email us. Depending on where you live, you have the right to:
  • know whether we process your data, and get access to it and a copy of it;
  • have inaccurate data corrected, and have your data deleted;
  • restrict or object to processing, including processing based on our legitimate interests;
  • receive your data in a portable format (data portability);
  • withdraw your consent at any time;
  • know the purposes of processing and the third parties, in Türkiye or abroad, to whom your data is transferred, and ask that corrections or deletions be passed on to them;
  • object to a result against you that arises only from automated processing;
  • claim compensation for damage caused by unlawful processing.
  These rights include your rights under Article 11 of the KVKK. We normally answer within 30 days; where the applicable law permits a longer period or a fee for exceptional requests, we will explain it. The Player ID identifies your cloud save; it does not necessarily identify your Analytics, Crashlytics, advertising or Unity records. Additional identifiers or provider-specific procedures may be needed. We do not promise that a device model and installation date uniquely identify every SDK record.
• Ads: on iOS turn tracking off in iOS Settings; on Android reset or delete your advertising ID.
• US state privacy rights: we do not sell personal information for money. Personalised advertising may count as “sharing” under some US state laws; use the applicable privacy-options form when available and contact us. Turning off tracking (iOS) or deleting your advertising ID (Android) limits those identifiers but does not necessarily stop all SDK data processing.
• Complaints: you can complain to your local data protection authority (in Türkiye: the Personal Data Protection Authority, KVKK; in the EU: the authority of your country).

9. Children

The Game is intended for a general audience aged 13 and over and is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided data, contact us and we will delete it.

10. Security

Data is transmitted over encrypted connections. No system is completely secure; if a data breach affects your personal data, we will inform you and the competent authorities as the law requires.

11. Our website

We do not add advertising trackers, analytics scripts or our own cookies to this static website. It is hosted by GitHub Pages; GitHub receives technical connection information such as your IP address and browser/request information under its own privacy statement. Links to stores, providers and email services take you to services with their own privacy terms.

12. Changes and acknowledgement

The date and version above identify this notice. We will notify players of material changes where required. Versions supporting the updated legal notice show a separate update message when the required acknowledgement revision increases. Earlier released versions cannot be made to display a new notice merely by editing this website; an app update may be needed. Acknowledgement is recorded locally with its revision and time and is separate from any consent required for a particular processing purpose.