Privacy Policy

Duel of Bubbles is the app covered by this policy. It describes the account and game services operated for the Android app com.badefteknoloji.duelofbubbles.

Operator and data controller: Badef Teknoloji. For contact, privacy questions and personal-data requests, email efficienza@gmail.com. You can also submit an account-deletion request through our public request form; no app installation is required.

Information we process

• Accounts and sign-in: a server-assigned User ID, display name, optional avatar, language and country settings. Guest sign-in uses a random installation identifier and secret stored on the device; the server stores a hash of the secret. Google Sign-In provides a verified Google account identifier and may provide email, display name and avatar. We do not ask for or store a Google password.
• Gameplay: Ranked match participation, moves, scores, results and completed match events; Career trophies and league, Season points and qualification, daily rewards and leaderboard standing. This information is needed to run server-authoritative matches, preserve opponents’ results and prevent duplicate awards.
• Device and updates: app/version, platform and random installation IDs used for mobile-version policy, update events and troubleshooting. Device or network IP may appear in authentication and operational/security logs. Optional push notifications use a device push token registered with Azure Notification Hubs and the applicable platform push provider.
• Referrals: invite identifiers, link-open and attribution events, and eligible-match/reward records. On supported Android installs, an invite code can be read from Google Play Install Referrer. We use these records to attribute invites, apply anti-abuse rules and award rewards exactly once.
• Operations: account activity and app events, performance and failure diagnostics, administrative changes and security/audit records. A public deletion request contains the contact email and any account-identifying details or note that the requester chooses to provide.
• Support: when you create a support request, we process the category, subject, description, messages, optional selected screenshots and limited troubleshooting context (app version, update/runtime, platform, device model, OS version, language and an optional match reference). Screenshots are selected through the system picker without access to your entire photo library. They are re-encoded to remove image metadata and stored in private Azure Blob Storage, accessible only through authorized backend requests. Do not include passwords or other sensitive credentials in your request.

Why and with whom

We use the information above to authenticate accounts, operate matches and progression, send requested game notifications, process referrals, deliver app updates, prevent abuse and investigate incidents. The app uses Google Sign-In and Google Play services for Android sign-in, installation referral and in-app updates; Firebase Cloud Messaging for Android push delivery; Microsoft Azure App Service, PostgreSQL, SignalR and Notification Hubs for backend, storage, realtime play and notifications; and Expo/EAS Update for app updates. These providers process the information necessary for their respective functions under their own service terms. We do not use these integrations as a reason to keep deleted account credentials.

Optional Meta advertising measurement

Availability: Meta App Events measurement is supported in Android releases that include this integration and a configured Meta Client Token. Production support does not turn measurement on by default: it runs only after you explicitly allow it. Updating this policy does not update an installed app or enable measurement by itself. The following explains the optional feature and the controls that apply when it is available in your installed version.

Purpose and recipient: with your permission, this integration sends app measurement information to Meta, the provider of Facebook and Instagram, to help attribute supported app installations, measure app activations and evaluate the performance of our advertising. This is separate from the account, gameplay and operational information we process to run the game. It does not add advertisements or purchases inside the game.

According to the Meta information supplied for this integration, the identified recipient is Meta Platforms Ireland Limited. The international-processing information below describes the countries and contractual safeguards communicated for this integration.

• Measurement information: app activation events and supported installation-attribution information. Associated information can include SDK-generated installation identifiers and event/session context, app and SDK versions, device and operating-system information, language or time-zone settings, and available installation-referral context. Meta receives the network IP address with SDK requests.
• Current limits: Android Advertising ID collection is disabled in our configuration. This does not make IP addresses or SDK-generated identifiers anonymous. We do not pass game-account identifiers, display names, email addresses, Google sign-in tokens, Guest credentials or push tokens to this integration. We have not added custom Ranked, profile, trophy or purchase events.
• Meta's processing: Meta receives and processes the measurement information under its applicable terms and privacy practices, not solely under our backend's account-data rules. See the Meta Privacy Policy and Meta Business Tools Terms for information about its processing and available controls.

Your choice: this feature is off by default and requires an affirmative choice in a separate in-app notice. The notice is offered after a successful Guest or Google sign-in, or restoration of an existing session, when the home screen is displayed. Signing in, accepting general terms, or granting notification permission is not permission for Meta measurement. Choosing Not now, or leaving the notice without agreeing, does not grant permission and does not prevent you from playing.

You can grant or withdraw permission in Profile → Settings → Meta ad measurement. The choice is stored locally for this app installation, with the notice version and choice timestamp. The SDK permission itself is not synchronized as a game-account setting: a permission on one installation does not enable measurement on another, and the server cannot grant permission. Changing your preference replaces the previous choice record rather than creating a consent-history archive. The local choice record is removed when you uninstall the app or clear its app data; it is excluded from Android backup. A recorded acceptance or refusal is not requested again on each opening. Signing out or deleting a game account does not itself reset this separate installation preference.

First-party permission-status reporting: app versions that support permission-status reporting also send the latest local choice (allowed, declined, or not yet decided), notice version, choice timestamp, observation time, application version and build environment to our authenticated backend. We associate this last-reported status with the signed-in game account and a hashed installation identifier so authorized administrators can monitor permission settings. This includes refusals and undecided states; it is not a Meta advertising event and is not sent to Meta. Game-account identifiers and names are not added to Meta SDK events by this feature. Reports are sent after sign-in, when the local choice changes, and periodically on a later foreground visit; network failures are retried without preventing play or withdrawal. An account switch replaces the installation's account association. Only the latest report per installation/build environment is kept, until replaced or removed with the associated game account. We do not maintain a separate server-side archive of historical Meta permission decisions or retain such an archive for ten years. Clearing app data or uninstalling does not notify our backend, so a last-reported status may remain until account deletion; old or missing reports are not proof of a current permission. A report is not proof that Meta received an event. Older app versions do not report this information.

Withdrawing permission: turning the setting off stops subsequent activity by this integration's SDK. It cannot recall information already sent or in transit, and it does not automatically delete records already held by Meta. Separately, deleting a game account removes the account-linked data managed by our backend as described below; it does not automatically erase Meta-held measurement records or the SDK's local event queue. The 180-day and 90-day periods below apply to the specific records named there, not to Meta-held measurement data. We do not promise a fixed automatic deletion period for Meta-held records or the SDK-managed event queue in this integration.

Meta event-data retention: the information supplied by Meta for this integration describes a general retention period of 24 months (two years) for event data used for advertising optimization and reporting, subject to Meta's applicable terms and privacy practices. This is not a guarantee that every Meta-held record, report or copy is automatically erased at exactly 24 months. It is not the retention period for our local permission record, other game-service data or the SDK-managed local event queue.

For privacy questions or access, correction, withdrawal or deletion requests concerning this feature, email efficienza@gmail.com and state that your request concerns Meta advertising measurement. For game-account deletion, our public request form is also available. We may need to verify the request and distinguish information we hold from information held by Meta. Meta's privacy policy also describes its own rights and request channels. Withdrawing permission is separate from requesting deletion of information previously processed.

International processing: measurement information may be processed by Meta outside your country of residence. The Meta information supplied for this integration identifies processing in Ireland and the United States and refers to Standard Contractual Clauses (SCCs) as contractual transfer safeguards. These are supplied descriptions, not a statement that processing is limited to those countries or that Badef Teknoloji has executed or notified a Turkish KVKK standard contract. EU SCCs and the Turkish KVKK standard contract are distinct instruments. An in-app permission choice does not by itself establish that every international-transfer requirement has been met. Updating this policy does not enable production measurement or certify compliance with the applicable privacy, age-related and international-transfer requirements, including the requirements relevant to users in Türkiye, Brazil and Mexico.

Security

App-to-server requests use HTTPS. Guest secrets and session tokens are kept in device secure storage where supported; the server stores credential/token hashes rather than their plaintext values. Server-side access is limited by account authorization and administrative permissions. No online service can guarantee absolute security.

Retention and account deletion

Open Profile → Settings → Delete Account in the app to delete a Guest or Google-linked account. If you cannot use the app, submit a request at https://duelofbubbles.com/delete-account. We verify ownership before acting on an unauthenticated web request; a player name or email alone cannot authorize deletion.

Deletion immediately disables access and removes profile details, Google link, refresh tokens, Guest secret hash, Career/Season progression, leaderboard presence, account-linked analytics held by our backend, daily reward state and device/push registrations. Completed matches may remain to protect opponents’ scores, but the deleted participant is shown as “Deleted Player” without the former name, avatar or account link. Already-awarded referral/reward entries may remain as non-personal, randomly anonymized ledger records so rewards are not paid again. This non-personal ledger and anonymized match history may be retained for gameplay integrity.

Minimal security, fraud and abuse audit records needed after deletion are retained for at most 180 days, then automatically removed. A revoked Guest installation marker used to reject credential reuse is removed on the same schedule; the Guest secret hash is erased when deletion completes. For web deletion requests, supplied contact email and other personal request content are removed 90 days after completion or rejection. The request ID, status and completion timestamp may remain without contact details. Pending requests retain supplied information while being processed.

Other active-account gameplay and service data are kept while needed to provide the game and satisfy applicable obligations; no fixed general retention period is asserted here. You may request account deletion as described above.

Support request text, technical context, messages and attachment references are removed when account deletion completes. Attachment files become inaccessible immediately and are queued for deletion from private storage, with retry handling for temporary storage failures. A short operational grace period handles uploads already in flight; it is not a new support-history retention period. We do not introduce a separate fixed retention period for active-account support requests.

Children and privacy questions

The app does not currently verify a player's age. A parent or guardian seeking deletion of a child's account can use the same request form or contact efficienza@gmail.com; we will verify authority before acting. Use that email address for other privacy questions or requests, including access or correction where applicable. We may need additional verification to protect the account from unauthorized requests.