Privacy notice

1. Who is responsible for your data

The controller for the data described here is LUDATOR Interactive (ludator.com). Contact for all privacy questions and requests: info@ludator.com.

2. What we process and why

• Guest account. When you open the game, Firebase Authentication creates an anonymous account identified by a random ID, and your browser keeps you signed in. Your game progress is stored in this account. It is needed to provide the game you asked for (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• E-mail account (optional). If you save your account with an e-mail address, we process the address and a password to sign you in, verify the address and reset the password. Firebase Authentication stores the password only as a secure hash. Legal basis: providing the service (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Game progress. Level, XP, achievements, weapon mastery, the daily streak and challenge, your records, and for every career run its mode, loadout, score, fruit, shots, hits, duration and reward. The server checks each run before it saves the reward. Legal basis: providing the service (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Leaderboard (optional). A leaderboard name you choose and, if you turn on the public leaderboard, your best score in each mode are shown to everyone. Your e-mail address is never shown. Legal basis: your consent, which you withdraw by turning the setting off; your public scores are then removed (GDPR Art. 6(1)(a); KVKK Art. 5(1)).
• Usage statistics. Page loads, game starts, engine load failures, run starts and completions, run report actions, interface errors, device type and language are added to our own anonymous daily totals. Your account stores activity days and a daily event budget. These game counters are separate from Google Analytics. Legal basis: our legitimate interest in improving the game (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)). Turn statistics off in Player account to object and delete the stored days.
• Security and moderation. The server keeps a log of account events (first visit, at most one access entry per hour, registration, profile and score changes, completed runs) and of administrators' actions with their reasons. It is used to prevent cheating and abuse and to correct mistakes. Legal basis: our legitimate interest in a fair and secure game (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• Connection data. When you load the site or the game talks to the server, our provider Google processes technical data such as your IP address, your browser type and the time of the request to deliver the service and protect it, for example in server request logs. We do not use this data to build profiles. Legal basis: our legitimate interest in a working, secure service (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• Google Analytics. Only after you allow it, Google Analytics receives public page paths, referrer paths, language, device/browser information, a pseudonymous cookie identifier and game events (starts, results, score, duration and menu actions). Google processes connection information when receiving these requests. We do not send account IDs, email addresses, leaderboard names, passwords, URL queries or fragments. Advertising storage, ad personalisation and Google signals are disabled in our tag configuration. Legal basis: your consent. Account statistics opt-out also stops Google Analytics; opting into game counters does not give Google permission.

Giving an e-mail address or a leaderboard name is not required; without them you play as a guest. We make no automated decisions about you that have legal or similarly significant effects.

3. Storage in your browser

The game uses local storage and IndexedDB for sign-in, language, settings, loadout, records and unsent results. Google Analytics loads no script and sets no analytics cookie until you allow it. Its _ga cookies and this browser’s analytics choice expire after at most 180 days. Rejecting or withdrawing permission stops collection and removes the site’s analytics cookies. Clearing browser data removes the saved choice; no permission is then assumed. Deleting an account removes game progress and does not erase Google’s previously collected pseudonymous analytics.

4. Who receives data

• Google. Google Firebase provides Authentication, Cloud Firestore, Cloud Functions and Hosting. With your separate permission, Google Analytics processes pseudonymous visit and game-event data. Search Console reports Google Search performance; linking it to Analytics does not send player account details.
• Other players. They see your leaderboard name and best scores only if you turn on the public leaderboard.
• LUDATOR Interactive. Authorised staff can see account and game data in the administration console to help players and moderate the leaderboard.

We do not sell data and do not share it with advertisers.

5. Where the data is stored

The game's database (Cloud Firestore, multi-region nam5) and its server functions (us-central1) are located in the United States; sign-in and hosting run on Google's global infrastructure. Data from Turkey, the EU, the EEA and other countries is therefore transferred to the United States. For transfers from the EU and the EEA, Google provides the European Commission's standard contractual clauses, and Google LLC is certified under the EU-U.S. Data Privacy Framework.

6. How long we keep data

• Account and game data. Account data, game progress, run records and your leaderboard entries are kept as long as the account exists. Guest and e-mail accounts are not deleted automatically; you can delete yours at any time.
• Statistics. The days stored in your account are kept until you turn statistics off or delete the account. Anonymous daily totals, which identify no one, are kept.
• Security log. Entries about your own actions are deleted with your account. Administrators' actions concerning an account and the record of its deletion are kept so that moderation decisions can be explained; they contain the account's random ID and the details of the action, never your e-mail address.
• Connection data. Kept in Google's request logs for Google's standard log retention period.
• Browser storage. Kept until you delete the account or clear your browser data.

Our anonymous game totals are retained. Google Analytics user and event data follow the property’s configured retention period; aggregated Google reports can remain longer. Withdrawing permission stops future collection and does not delete data Google already received.

7. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict its processing, to receive it in a portable format and to object to processing based on legitimate interest (Articles 15 to 21). Under KVKK Article 11 you can also learn whether and for what purpose your data is processed and to whom it is transferred, ask for corrections and deletions to be passed on to recipients, object to a result that is to your detriment and based solely on automated analysis, and claim compensation for damage caused by unlawful processing. You can withdraw consent at any time; this does not affect processing before the withdrawal.

In the game: delete your account and its data in the Player account section (“Delete my account and its data”), change or remove your leaderboard name, and turn the public leaderboard or the statistics off. For anything else, write to info@ludator.com and name the account's e-mail address or leaderboard name so that we can find it. We answer within the legal deadlines: one month under the GDPR and 30 days at the latest under KVKK Article 13.

You can also complain to a data protection authority, for example the authority of your country of residence in the EU or, in Turkey, the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) after applying to us (KVKK Article 14).

You can withdraw Google Analytics permission at any time using Google Analytics settings on the game menu or weapon pages. For an analytics erasure request, contact info@ludator.com; Google’s browser identifier, rather than your game account, identifies that data.

8. Children

The game asks for no age and can be played as a guest without personal details. If you are younger than the age at which your country lets you agree to online services yourself (between 13 and 16 in the EU), ask a parent or guardian before you save an account with an e-mail address. Parents can ask us at info@ludator.com to delete a child's data.

9. Changes to this notice

We update this notice when the way the game processes data changes. The date at the top shows the current version.