Privacy Policy

Last updated:

Grido XI is a football trivia game. This policy explains exactly what the app stores, where it goes, who can see it and what you can do about it. It is written against the app's actual data flows, not a template.

Who is responsible

Grido XI is made and run by Aydın Sarıcan, an individual developer based in Türkiye. He is the controller of the personal data described here, and "we" in this policy means him. There is no company behind the game, no data protection officer and no office or representative in the EU or the UK. The way to reach us is e-mail: aydnsrcn@gmail.com. We answer every privacy request within 30 days.

The short version

You do not have to sign up, and there is no password. You never type your name or anything else about yourself. The game can be played offline; the online part adds leaderboards, challenges, live matches, the daily reward, daily quests and a cloud copy of your progress.

When there is no account on the device, the app opens with a welcome screen and three choices: continue with Apple, continue with Google, or play as a guest. A guest gets an anonymous account. Signing in is optional: it ties your game account to that Apple or Google account so that your progress survives a new phone, and a guest can do it later. With Google we then hold an e-mail address; the app asks Apple for neither your name nor your e-mail address (see "Linked accounts" below).

The app never asks for your location, your contacts, your photos or permission to track you, and it does not use your advertising identifier. It does not follow you across other companies' apps or websites. It shows ads from Google AdMob and sends usage and crash information to Google's Firebase services. In the UK, the EEA and Switzerland that information is sent only if you agree in the consent form, and in Türkiye only if you say yes when the app asks. One switch in Settings turns it off in every region. Both are explained below, including what Google learns from your IP address.

What is stored on your device

Your progress lives on your device: solved grids, streak, unlocked cards, level, badges, personal bests, settings and reminders. The device also keeps:

  • the last nickname, flag, coin balance, streak freezes, match record, daily reward status and daily quest status it read from the server, so they can be shown when you are offline, and the rank the leaderboard last showed you, so that it can tell you how far you moved, as well as the highest level and the longest streak (in days) for which the server has already answered a reward request, so that the app does not ask again;
  • scores that are waiting to be sent, rounds that are waiting to be sent for the daily quests (each with the answers you got right in it), and the answer reports you made;
  • which live match you are in and the last few matches you chose to leave (their identifiers), so that the app can take you back to a match that is still running;
  • your answer to the consent form, stored by Google's consent tool, the app's own note of whether measurement was allowed the last time it checked, and the country of your App Store as the app last read it, which it uses to tell whether it has to ask you about measurement itself (see "Analytics, crash reports and other Firebase services");
  • whether the Share diagnostics and usage data switch is on, whether you have already chosen how to play on the welcome screen, the version of our terms you last saw, so that the app can tell you when they change, and the counters behind the ad rules: rewarded videos watched today, live matches finished, matches since the last ad and the time of that ad, so that two match ads are at least three minutes apart;
  • the sign-in key of your account, in the iOS keychain, and, if you signed in with Google, the session that Google's sign-in library keeps on the device. iOS can keep keychain items after an app is deleted, so reinstalling the game on the same device may bring the same account back.

Reminders are optional local notifications that the app schedules on your device. There are five kinds, each with its own switch in Settings: today's grid, a streak about to end, the daily reward, quests about to end and a new day in the archive. The app works out when to show them from values it already holds, such as the daily reward and daily quest status it last read from the server. Nothing about them is sent to our server. If analytics is on, it counts your answer to the iOS permission question and nothing else about them.

What is stored on our server

Your account is created when you make your choice on the welcome screen; a guest who chooses while offline gets it the next time the app is opened with a connection. The account is a random identifier. A guest account is an anonymous account: it is not tied to your Apple Account, your e-mail or your phone number. If you continue with Apple or Google, or link one of them later, the account is tied to that sign-in, and with Apple a token is stored for it (see "Linked accounts" below).

Against that identifier we store:

  • Your nickname. It is built from a fixed word list: an adjective, a football position, a language and a number our server assigns. Guests get one at random; linked accounts can pick the words. You never type it, so it cannot contain your real name.
  • Your country, if you choose one. It is shown as a flag next to your nickname. It is what you pick in Settings → Account, not your location, and you can remove it at any time.
  • Your shirt, if you design one. The abstract shirt shown next to your nickname: a pattern, two colours and a number, picked from fixed lists. It is never a photo.
  • A cloud copy of your progress: unlocked cards with the date each one was unlocked and the cell where you first found it, game statistics (badges included), your streak, your shirt design and the badges you chose for your showcase.
  • Your progress summary: level, experience, card count, and the club you picked as your favourite.
  • Daily grid scores: which day and difficulty you played, how many cells you solved, the points you earned, and the players you named in each cell. The answers are stored because the score is calculated on the server from them.
  • Challenge results: the score you posted to a challenge you or a friend started.
  • Live matches (Live 1v1 and 3-2-1-!): who played, the picks and answers of each player, wrong answers, timeouts, the result and your rating. In Live 1v1 the server also records when a player leaves the app during a match. A match played in a private room is stored in the same way, together with the room code and the fact that it was private.
  • Wrong room codes: to slow down the guessing of room codes, the server keeps one small record for your account from the moment you enter a code that matches no room: how many unknown codes you entered in a row and the time of the last one. It is deleted the next time you join a room. The app cannot read it.
  • Reactions: in a live match against another player you can send your opponent one of six preset emoji, during the match and for one minute after it ends. There is no free text and no chat. A reaction is delivered to the opponent in that match only and is not saved, neither with your account nor with the match. To keep anyone from sending more than one reaction every three seconds, the server keeps a single value for your account: the time of your most recent reaction, without the emoji, the match or the opponent. Each new reaction overwrites it, and once it is more than an hour old the server deletes it the next time another player sends a reaction. The app cannot read it. Sending a reaction also writes one row to a table of our hosting provider's real-time service (the match, the emoji and which of the two players sent it, with no account identifier); the server deletes that row in the same step.
  • Reported answers: when you tap "This should count", we store which player and which two categories, with the dataset and app version, so the dataset can be corrected.
  • Daily quests: the state of today's quests: which rewards you claimed, whether you opened the bonus chest, and the one swap you used. Your progress is not stored. The server works it out each time from what it already holds: daily scores, challenge results and live matches. The solo modes needed something new: when a round of Time Attack, Survival, Unlimited or Career Path ends, the app sends the answers you got right in it (for each one, the player and two categories that player fits). It does so after every such round, whatever the day's quests are; a round played offline waits on the device and is sent later. The server checks the answers against its answer key and keeps only counts for the round: how many were valid and how many were not, with the mode, the day and a random identifier of the round. The answers themselves are not stored, and the counts are kept for seven days.
  • Coin balance and history: how many coins and streak freezes you have and how each coin movement happened, including each daily reward you claimed, each daily quest reward and bonus chest, each level reward and streak reward, each rewarded ad that paid out and each thing you spent coins on. For the daily reward we also keep how many you have claimed and the day of the last one. For level and streak rewards the app sends your level and your longest streak in days, both already part of your progress; the server pays each reward once per account and, for a streak reward, counts the days for which it holds a daily score of yours.

Like any server, ours receives your IP address with every request. We do not use it to locate you. Our sign-in system keeps the IP address and device description of your current session with your account, and may keep a log of sign-in events (account created, session renewed, account linked) with the IP address. Our hosting provider also keeps short-lived request logs.

What other players can see: your nickname, flag, shirt, favourite club, level, rating, match record and scores, on leaderboards, in challenges and in matches. In a live match your opponent sees your moves as you make them, the reactions you send and, in Live 1v1, whether you left the app during your turn. A private room changes nothing about that: the invitation you share contains only the room code, and whoever has the code can join that one room, until the match starts or the code runs out after ten minutes. The answers behind your daily score, your answer reports, your daily quests, your coin history and anything about a linked account are not shown to other players.

Linked accounts

Signing in is optional. There are two sign-in methods, Apple and Google, and two moments to use one: on the welcome screen (Apple's own button or "Continue with Google"), or later, in Settings → Account or (as a guest) on the Profile tab. An account with a sign-in is what the app calls a linked account, whichever way it got there. The two moments do not work the same way. On the welcome screen, if that Apple or Google account already has a game account, that account opens, so a player who changed phones carries on where they left off; if it has none, a new game account tied to it is created. Linking later adds the sign-in to the account you are already playing with: the account stays the same and nothing is moved.

In both cases Apple's or Google's own sign-in window opens, and that company tells our server who you are in a signed answer. Our sign-in system stores what the answer contains with your account, except a name and a profile picture address. From Google: the Google account identifier and the e-mail address. Google also sends the name and profile picture address set on that Google account; our server removes both before the account record is written, so that record holds neither. From Apple: the identifier Apple creates for you with this developer, and whatever else Apple puts in its answer. The app asks Apple for neither your name nor your e-mail address, so the answer should contain neither; if it does contain an e-mail address, that address is stored in the same way as Google's and you will see it in your export file. We use these details only to let you sign in to the same game account on another device. The app never shows them, we do not e-mail you, and we do not pass them on to anyone else. Apple and Google handle the sign-in itself under their own privacy policies (apple.com/legal/privacy, policies.google.com/privacy).

For an Apple sign-in one more thing is stored. Each time you sign in or link with Apple, the app passes Apple's one-time authorization code to our server, which exchanges it with Apple for a refresh token and stores that token with your account identifier. The token has one use: asking Apple to revoke the sign-in when you delete your account. Only our server can read it. The app cannot, so it is not in your export file, and it is deleted with the account.

One account per player. If you link an Apple or Google account that already has a game account, the app does not keep both: it asks which one you want to keep and says what the other choice deletes. "Switch to my previous account" opens the earlier account and then deletes the guest account on this phone, with its progress, from the server. "Keep the progress on this phone" asks you to confirm once more, then deletes the earlier account with its career, scores and nickname, and ties the sign-in to the account on this phone. Cancelling changes nothing. Two limits: only a guest account is deleted when you switch away from it, an account that already has another sign-in stays on the server; and if tying the sign-in fails after the earlier account has been deleted, the app tells you so and you can link again.

Sign out appears in Settings → Account once the account has a sign-in. It keeps the account on the server and removes the progress from this phone; the app returns to the welcome screen, and continuing with the same Apple or Google account opens the account again. Deleting the account removes the sign-in from our server, with the e-mail address, the Apple token and the other details, and asks Apple to revoke an Apple sign-in; "How long we keep it" says what happens if that request fails. The app has no button that removes only the sign-in; if you want that, e-mail us.

Analytics, crash reports and other Firebase services

We use Google's Firebase services to see how the game is used and to find out when it breaks. None of them is linked to your game account, and none is used for advertising. They share a random identifier that Firebase creates for each installation of the app. Google also sees your IP address, from which it derives a rough location such as your country.

  • Analytics (Google Analytics for Firebase) records which screens are opened and game events, for example that a grid was finished, a mode was started or a purchase was made (which product and its price). For reactions it records that one was sent, which of the six and in which live mode, and that an opponent was muted, never the match or the opponent. It never includes your nickname, your account or the players you name. In the UK, the EEA and Switzerland it stays off until you agree to measurement in the consent form. In Türkiye it stays off until you say yes to the question the app asks you itself (described below). Everywhere else it is on from the first launch. In every region it stops when you turn off the switch described below.
  • Crash reports (Firebase Crashlytics) follow the same rule as Analytics: off in the UK, the EEA and Switzerland until you agree to measurement in the consent form, off in Türkiye until you say yes to the app's question, on from the first launch everywhere else, and off in every region when the switch described below is off. While they are off, a crash is still recorded on your device. That record is sent only if reports are later allowed (you agree in the consent form or say yes to the app's question, or, outside Türkiye, Google's consent tool answers that no consent is needed where you are), and it is deleted if you refuse in the consent form, say no to the app's question or turn the switch off. A report contains the device model, the iOS version, the app version, the installation identifier, the technical state of the app at that moment and where in the code it crashed or an operation failed. It contains nothing you typed.
  • Performance measurements (Firebase Performance Monitoring) follow the same rule as Analytics: off in the UK, the EEA and Switzerland until you agree to measurement in the consent form, off in Türkiye until you say yes to the app's question, on from the first launch everywhere else, and off in every region when the switch described below is off. They record how long the app takes to start, how long its network requests take and to which server address they go, and how long four steps take (opening the dataset, finding a live opponent, loading the store, completing a purchase).
  • Remote settings (Firebase Remote Config). At launch the app asks Firebase for its current settings, for example whether a live mode is paused, an update is required or our terms have a new version.
  • Announcements (Firebase Cloud Messaging), only if you have allowed notifications. The push address Apple gives the app is passed to Firebase so that an announcement can reach your device. We do not store it on our own server and cannot tell whose device it is.

Share diagnostics and usage data in Settings → Privacy is one switch for Analytics, crash reports and performance measurements, in every region. Outside Türkiye it is on by default and it can only turn things off: while it is off, all three stay off and crash reports still waiting on the device are discarded; while it is on, all three still wait for your agreement where the consent form applies, so it never replaces your answer in that form. In Türkiye it starts off and is itself your answer, as the next paragraph explains. It does not affect ads. Remote settings have no switch in the app. You can object to them by e-mail (see "Your rights"), and deleting the app stops them.

In Türkiye the app asks you itself. Where the country of your App Store or the region set on your device is Türkiye, there is no consent form, and Analytics, crash reports and performance measurements start switched off. Once there is an account on the device, the app asks you whether it may send them: a yes and a no of equal weight, neither chosen in advance, with a link to this policy. Your answer sets the switch, and you can change it there at any time. If you close the question without answering, nothing is sent and the app asks again the next time it is started. A crash recorded before you answer waits on the device: it is sent if you say yes and discarded if you say no.

Advertising

The app shows ads through Google AdMob: an optional video you can choose to watch for coins, and an ad after some finished live matches (Live 1v1 and 3-2-1-!). Pro and Remove Ads turn the match ad off; the coin video is always optional.

  • We request non-personalised ads everywhere, whatever you answer in the consent form. The app never asks for permission to track you, so your advertising identifier is not available to Google or to us.
  • To show, limit, count and protect ads from fraud, Google receives technical information from your device: your IP address (from which it estimates a rough location), device model, operating system version, how you interact with the ad, and an identifier that works only inside the apps of our AdMob account. According to Google, that identifier cannot be used to link what you do here to other developers' apps. Google decides for itself how it uses this data, as described at policies.google.com/technologies/partner-sites.
  • In the UK, the EEA and Switzerland the app asks for your consent through Google's consent form before any ad is requested. You can change your choice at any time under Privacy options in Settings → About. That row appears only in the countries where Google's consent form applies.
  • Everywhere else, Türkiye included, there is no consent form, and ads are requested from the first launch. The question the app asks in Türkiye is about measurement only.

Purchases

Pro and Remove Ads are bought through Apple. We never see your payment details, your name or your Apple Account. Apple processes the purchase under its own privacy policy (apple.com/legal/privacy). Coins are not sold.

To check which purchases you have, the app uses RevenueCat (RevenueCat, Inc., United States), a service that verifies App Store purchases on our behalf. Each time the app starts or comes back to the foreground, when the store opens, when you buy something and when you restore purchases, the app contacts RevenueCat. It sends a random identifier that the RevenueCat library creates on this device, the app and system version and the country of your store and, when there is a purchase to check, Apple's signed purchase record (which product, price, currency and dates). RevenueCat sees your IP address when the app connects. It does not receive your game account, nickname, e-mail address or Apple Account, so the purchase record is tied neither to your name nor to your game account. We store nothing about purchases on our own server. If analytics is on, the purchase is also counted there as described above.

RevenueCat processes this data on our instructions, in the United States, under its data processing addendum, which includes the European Commission's standard contractual clauses (revenuecat.com/dpa), and its privacy policy (revenuecat.com/privacy). It keeps purchase records while our account with it exists. Deleting your game account does not reach them, because they are not linked to it; if you want them erased, e-mail us the order ID from Apple's purchase receipt and we will have them deleted.

Game Center

Game Center is Apple's gaming service. It is optional, and nothing in the game requires it. Game Center is off in the game until you choose to sign in to it there. After that, while you are signed in to Game Center on your device, the app sends Apple, under your Game Center account, your daily score and the rating our server verified, for Apple's leaderboards, and an achievement for each badge you earn. On those leaderboards other players see the name and picture of your Game Center profile, as Apple shows them, not your Grido XI nickname. The scores of your Game Center friends are read from Apple and shown on your device; they go no further.

Nothing about Game Center reaches our server or our analytics: not your Game Center player ID, not your alias, not your friends. Apple processes what the app sends under its own privacy policy (apple.com/legal/privacy). You control Game Center in iOS Settings, under Game Center: sign out there and the app sends nothing to it.

Where the football data comes from

Player and club information is derived from Wikidata (CC0). The app does not contact any third-party data service while you play.

Where the law asks for a legal basis (for example the GDPR in the EEA and the UK), these are ours:

  • Account and gameplay data (the account, nickname, country, shirt, favourite club, progress summary, coins, daily reward, daily quests with the answers sent to be checked): to provide the game you asked for. Basis: performance of our contract with you, the Terms of Use.
  • Leaderboards, challenges and live matches: to run the online features you use, private rooms and reactions included (contract). Checking scores on the server and removing forged results rests on our legitimate interest in fair play. The record of wrong room codes rests on our legitimate interest in keeping rooms from being guessed, and the time of your most recent reaction on our legitimate interest in keeping reactions from being used to pester an opponent.
  • Cloud copy of your progress: to bring your progress back after a reinstall or on a new phone (contract).
  • Signing in with Apple or Google: only at your request, to let you open the same account on another device (contract). The token stored for an Apple sign-in serves only to have that sign-in revoked at Apple when the account is deleted.
  • Remote settings: to keep the app working and to be able to switch off a broken feature. Basis: our legitimate interest in a stable and secure app.
  • Analytics, crash reports and performance measurements: your consent in the UK, the EEA and Switzerland, given in the consent form, and in Türkiye, given in your answer to the app's question. Elsewhere, our legitimate interest in understanding how the game is used, how well it runs and where it breaks; there, the switch in Settings → Privacy is the way to object.
  • Ads: your consent in the UK, the EEA and Switzerland. Elsewhere, our legitimate interest in funding a free game with non-personalised ads. Counting a rewarded video so that you get your coins is part of the contract.
  • Purchases: to give you what you bought (contract).
  • Game Center: to post your scores and achievements there, only while you are signed in to Game Center on your device (contract). Signing out of Game Center in iOS Settings stops it.
  • Answer reports: our legitimate interest in correcting the football dataset, after you choose to send a report.
  • Announcements: your permission for notifications in iOS, which you can withdraw in iOS Settings.
  • Privacy requests and legal duties: our legal obligations.

You do not have to give us anything. The country, the shirt, signing in with Apple or Google, answer reports and notifications are all optional. Playing as a guest asks nothing of you, but it does create an anonymous account as soon as the device is online. After you sign out or delete your account, the app returns to the welcome screen and creates no account until you choose again. In one case it does not ask: if the sign-in key on the device is missing or no longer accepted after you have made your choice (for example because the account was deleted from another phone), the app opens a new, empty guest account by itself. Only a device that stays offline plays with no account at all.

Rating and matchmaking are calculated automatically. They are part of the game and have no legal or similar effect on you.

Who receives your data, and where it goes

  • Supabase (Supabase Pte. Ltd.) hosts our server and database and acts on our instructions. The database is in Frankfurt, Germany.
  • Google runs Firebase and Google Analytics on our instructions. For AdMob ads and for Google sign-in, Google decides on its own how the data is used.
  • Apple handles the purchases, delivers notifications, distributes the app and runs Sign in with Apple and Game Center, under its own responsibility. For an Apple sign-in our server also contacts Apple itself: to exchange the authorization code for the token and, when you delete the account, to ask Apple to revoke the sign-in.
  • RevenueCat (RevenueCat, Inc.) verifies purchases on our instructions, in the United States (see "Purchases").
  • Other players see what is listed under "What is stored on our server".

Nobody else receives your data, unless a law or a court order obliges us to hand it over.

Your data does not stay in one country. The database is in Germany, but Supabase's terms allow it and its subcontractors to process data in other countries where they operate, such as the United States and Singapore. Google processes Firebase, Analytics and AdMob data on its worldwide infrastructure, including in the United States. The developer is based in Türkiye and works with the data from there. Özgü Ataseven, also based in Türkiye, works on the game with him and has the same access. The Google accounts that run Firebase and AdMob are in Özgü Ataseven's name, so the two of them are jointly responsible for the data that goes to those services (see "Analytics, crash reports and other Firebase services" and "Advertising"). Everything else is decided by the developer alone. They have agreed that he answers every privacy request, at the e-mail address in this policy; you can use your rights against either of them.

The safeguards are those of the providers. Supabase's data processing terms include the European Commission's standard contractual clauses and the UK addendum (supabase.com/legal/dpa). Google states that Google LLC is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. framework (policies.google.com/privacy/frameworks). Its terms for Firebase, Analytics and ads rely on that certification or on standard contractual clauses (firebase.google.com/terms/data-processing-terms, business.safety.google/adsprocessorterms, business.safety.google/adscontrollerterms). The European Commission has not issued an adequacy decision for Türkiye or for Singapore. You can ask us by e-mail for more detail about any of these safeguards.

Your rights

Wherever you live, you can:

  • See and take your data (access and portability). Export my data in Settings → Account produces a single file. From our server it contains your whole profile (nickname choice, country, shirt, level, rating, match record, coin balance, streak freezes), what our sign-in system holds for your account (the record it kept of what Apple or Google sent when you signed in; for Google that includes the e-mail address, but not the name or profile picture address, which are removed before the record is written), your linked sign-in methods, the cloud copy, daily scores, challenge results, your Live 1v1 and 3-2-1-! match records (the other player appears only as "opponent"), answer reports, coin history, the state of your daily reward and your daily quests (sections "daily_quests" and "quest_runs": the state of today's quests and the per-round counts). From this device it contains the game's own storage: progress, settings, challenges, scores and rounds waiting to be sent, the last values read from the server, ad counters and your answer to the consent form. It does not contain the answers behind the daily scores you have already sent, sign-in sessions and the sign-in event log, the token stored for an Apple sign-in, the record of wrong room codes (the app can read none of these), anything held by Google (analytics, crash reports, performance measurements, ad data) or your purchases, which Apple holds and of which RevenueCat keeps the records described under "Purchases". The file lists these gaps itself. For the first two, or for anything else, e-mail us. The file does not contain the time of your most recent reaction either, because the app cannot read it. Nor does it contain what Apple holds in Game Center.
  • Correct it (rectification). You can change your country, shirt and favourite club in the app, and your nickname words once your account is linked. For anything else, e-mail us.
  • Delete it (erasure). Delete account in Settings → Account works at once and is not a request form. "How long we keep it" below says what it removes and what it cannot. Reset progress in Settings clears your cards, level, badges and streak, on the device and in the cloud copy, and keeps the account.
  • Withdraw consent. Where the consent form applies, change your answer under Privacy options in Settings → About. Turning off Share diagnostics and usage data in Settings → Privacy has the same effect for analytics, crash reports and performance measurements, and in Türkiye it is how you withdraw the yes you gave to the app's question. Notifications are switched off in iOS Settings. Withdrawing does not make what happened before unlawful.
  • Object, or ask us to restrict a use. You can object to anything we do on the basis of a legitimate interest: remote settings; analytics, crash reports and performance measurements outside the consent regions and Türkiye; ads outside the consent regions; fair-play checks, the record of wrong room codes, the time of your most recent reaction and answer reports. For analytics, crash reports and performance measurements you do not need to write to us: turn off Share diagnostics and usage data in Settings → Privacy and all three stop, in every region. For the rest, e-mail us and say what you object to. To be honest about the limits: Firebase data is not linked to your account, so we usually cannot pick out what your device already sent, and remote settings can only be stopped by deleting the app.
  • Complain. You can complain to the data protection authority where you live or work: in the EEA your national authority, in the UK the Information Commissioner's Office, in Switzerland the Federal Data Protection and Information Commissioner. We would like to hear from you first, but in those places you do not have to ask us first.

For requests by e-mail, write to aydnsrcn@gmail.com. We do not know who you are, so tell us the account identifier from your export file (the "id" field under "account"). A nickname is not enough, because it is public and anyone could quote it. Requests are free, and we answer within 30 days.

Türkiye. Under Article 11 of the Personal Data Protection Law (KVKK) you can learn whether your data is processed, ask for information about it, learn its purpose and whether it is used for that purpose, learn the third parties it is transferred to in Türkiye or abroad, have it corrected, erased or destroyed, have those changes passed on to third parties, object to a result that comes only from automated analysis, and claim compensation for damage from unlawful processing. Apply to us first by e-mail; if we refuse, or you are not satisfied with the answer, or we do not answer within 30 days, you can complain to the Personal Data Protection Board. The other points of the notice that law requires are under "Players in Türkiye" below.

Other countries. Your local law, for example the LGPD in Brazil or Quebec's privacy law, may give you similar or further rights. The tools above and our e-mail address are open to everyone, and we handle every request in the same way wherever you live.

How long we keep it

  • Your account and everything attached to it stays on our server until you delete the account, or until you choose to keep another account in its place when linking (see "Linked accounts"). Nothing happens to inactive accounts: they are kept until they are deleted, and deletion is always available in the app and by e-mail.
  • Daily quests, private rooms and reactions are kept for a shorter time. The per-round counts stay for seven days: the server deletes older ones the next time the app sends a round. The quest state holds a single day and is overwritten the first time you claim or swap on a later day. The record of wrong room codes is deleted the next time you join a room. A room that nobody joined is deleted when you close it; if the app was closed first, the server's clean-up deletes it later. A reaction is not kept at all; the time of your most recent one is overwritten by the next and deleted once it is more than an hour old, the next time another player sends a reaction.
  • Delete account removes from our database, at once: the account, nickname, country, shirt, progress summary, cloud copy, daily scores with their answers, challenge results, the live matches you played, answer reports, coin balance and history, your daily reward state, your daily quest state and per-round counts, the record of wrong room codes, the time of your most recent reaction, and a linked sign-in with its e-mail address and other details, the token stored for an Apple sign-in included. It cannot be undone. On this device it clears your cards, level, badges and streak, your shirt design and showcase, your challenges and answer reports, the scores and rounds that were waiting to be sent, and the copies of your nickname, flag, coin balance, streak freezes, match record, daily reward status, daily quest status and leaderboard rank, with the count of rewarded videos watched today. It also signs the device out, out of Google's sign-in library as well if you used Google, and returns the app to the welcome screen, where no new account exists until you choose one, resets the analytics data kept on the device and deletes the Firebase installation identifier, so that Firebase starts with a new one if the app needs it again. Your settings (the favourite club among them), personal bests and some other local game data stay on the device until you delete the app.
  • What Delete account does not remove: data that is not tied to your account. Google keeps crash reports for 90 days and performance data for up to 60 days. Analytics events are kept for 14 months. Ad data is kept by Google under its own rules. A sign-in event log, where one is kept, is not cleared by the button; if you want it erased, e-mail us. The hosting provider's request logs and backups, where they exist, expire on the provider's own schedule.
  • Sign in with Apple, on Apple's side. If the account has an Apple sign-in, Delete account first asks Apple to revoke it, so that Grido XI is no longer connected to your Apple Account, and then deletes the account, the stored token included. If the request to Apple fails, or no token could be stored when you signed in, the account is deleted all the same and Grido XI may stay listed in your Apple Account under "Sign in with Apple" until you remove it there (iPhone Settings → your name → Sign in with Apple; on earlier iOS versions the list is one level further down, in the sign-in and security settings). That entry holds nothing about the game. One case is different on purpose: keeping this phone's progress over an earlier account (see "Linked accounts") deletes the earlier account without revoking, because the same Apple sign-in is then tied to the account you keep.
  • Purchases are held by Apple under your Apple Account. Deleting the game account does not touch them and does not cancel a Pro subscription: cancel that in your App Store settings.
  • Game Center scores and achievements are held by Apple under your Game Center account. Deleting the game account does not remove them; you manage them with Apple, in your Game Center profile.
  • RevenueCat's purchase records stay while our account with RevenueCat exists, and are erased on request (see "Purchases").
  • E-mails you send us stay in our mailbox for as long as we need to deal with your request and to be able to show later that we did.

Players in Türkiye

If you play from Türkiye, this section is the information notice required by Article 10 of the Personal Data Protection Law (KVKK). It is short on purpose: each point says where in this policy the detail is.

  • Data controller: Aydın Sarıcan, a natural person living in Türkiye (see "Who is responsible" and "Contact").
  • Purposes: running the game and its online features, keeping play fair, showing the ads that fund the game, measuring how the game is used and where it breaks, delivering purchases and answering your requests. "Why we use your data, and on what legal basis" lists them one by one.
  • Who receives your data, and why: Supabase (hosting of our server and database), Google (Firebase, AdMob ads and Google sign-in), Apple (purchases, notifications, Sign in with Apple and, if you use it, Game Center) and RevenueCat (verifying purchases); other players see what "What is stored on our server" lists. All four companies are outside Türkiye, so your data goes abroad: to Germany, where the database is, and to the other countries where they process data, the United States among them. The detail is under "Who receives your data, and where it goes". The safeguards described there are the providers' own terms.
  • How it is collected, and on what legal ground: by automated means, through the app: from what you do in the game, from what the app and the services built into it send by themselves and, if you sign in, from Apple or Google. The grounds are those listed under "Why we use your data, and on what legal basis". In the words of Article 5 of the KVKK they are: the performance of a contract (Article 5(2)(c)), a legal obligation (5(2)(ç)), our legitimate interests (5(2)(f)) and your explicit consent (5(1)). In Türkiye, explicit consent is the ground for analytics, crash reports and performance measurements (your answer to the app's question) and for announcements (the iOS notification permission); ads rest on our legitimate interest.
  • Your rights: those of Article 11 of the KVKK. "Your rights" lists them and says how to apply to us and how to complain to the Personal Data Protection Board.

Children

The game is not directed at children under 13, and we do not knowingly collect data from them. The app never asks your age, whether you play as a guest or sign in, so we cannot check it.

In some countries the age at which you can agree to the use of your data yourself is higher: in the EEA it varies from 13 to 16 depending on the country. If you are below that age where you live, a parent or guardian should answer the consent form, or in Türkiye the app's own question, and decide about the online features with you. A parent or guardian who wants a child's account removed can use Delete account on the child's device or e-mail us.

Changes

The date at the top shows when this policy last changed. If it changes in a way that affects what we store or who receives it, we will say so before the change takes effect: in the app, with a notice titled "We updated our terms" that opens both texts, or in its App Store update notes.

Contact

Aydın Sarıcan, Türkiye. E-mail: aydnsrcn@gmail.com