1. Introduction
This Privacy Policy explains how Ali Demir (“we”, “us”) collects, uses, and shares information when you use the CLASH mobile application and related services.
2. Information we collect
- Account: When you sign in with Google or Apple, we receive your email (if the provider shares it), a unique user ID, display name, and username tag.
- Gameplay: Scores, streaks, room participation, and statistics for leaderboards and game features.
- Social: Friend connections, friend requests, group challenge membership, and challenge scores (if you use these features).
- Purchases: Apple or Google processes payment. We use RevenueCat to validate purchases and store entitlements (e.g. star packs and the CLASH Pro subscription). We do not receive your full card number.
- Analytics: PostHog (EU-hosted by default) for usage, funnels, and product improvement. When signed in, events may be linked to your user ID.
- Ads (banner & rewarded): Google AdMob may collect device and ad interaction data, including the device advertising identifier (IDFA on iOS / GAID on Android). On iOS this happens only after you allow tracking via App Tracking Transparency (ATT); if you decline, ads are served in non-personalized mode. See Tracking & ad personalization.
- Technical: Security and debugging logs; our hosting provider may process IP address and device information in server logs.
- On your device: Authentication tokens in secure storage (Keychain/Keystore); a temporary offline queue until you reconnect.
3. Why we use your data
To run the game and your account (contract); security (legitimate interest); analytics and ads where required (consent or legitimate interest); purchase records (contract and legal obligation).
Tracking & ad personalization
CLASH serves ads through Google AdMob in two formats: banner ads on calm screens and optional rewarded video ads. On iOS we ask for your permission via App Tracking Transparency (ATT) before requesting personalized ads; on Android the equivalent choice is captured through Google’s consent tool (UMP). If you do not allow tracking, ads are requested in non-personalized mode.
When personalized ads are allowed, AdMob may process the device advertising identifier (IDFA/GAID), device information, and ad interaction data for ad delivery, measurement, and fraud prevention. Apple classifies this as data used to track you across other companies’ apps and websites. You can change your choice at any time in your device settings (iOS: Settings → Privacy & Security → Tracking; Android: Ads settings).
4. Third-party services
We use Supabase (auth and database), PostHog (analytics), RevenueCat (in-app purchases), Google (Remote Config and AdMob), and Apple & Google (sign-in and store billing). We do not use Firebase Analytics or Adapty.
Their privacy policies: Supabase · PostHog · RevenueCat · Google · Apple
5. Retention
Account and gameplay data are kept until you delete your account. Purchase audit logs are retained up to 90 days, then deleted or anonymized. Analytics data is kept for up to 12 months, with periodic cleanup. Server logs follow our hosting provider’s policy.
6. Your rights
Depending on your location (including the EEA, UK, and Türkiye under KVKK), you may have the right to access, correct, delete, restrict, object to processing, and data portability. Contact ali@demir.pro. You may lodge a complaint with your supervisory authority.
7. Account deletion
You can delete your account in the app via Settings → Delete account (guest sessions: Delete my data). This removes your profile and related data on our servers and triggers deletion or anonymization with RevenueCat and PostHog where applicable. You can also request deletion by email and read the full steps on our account deletion page.
8. Children
CLASH is not directed to children under 13. We do not knowingly collect personal information from children under 13. Registration requires confirming you are 13 or older.
9. International transfers
Our database is hosted by Supabase in eu-central-1 (Frankfurt, EU). Analytics are processed by PostHog on EU infrastructure (eu.i.posthog.com). Where data is transferred outside your country, we rely on appropriate safeguards (e.g. Standard Contractual Clauses, vendor DPAs) as required by KVKK Article 9 and GDPR Chapter V.
10. Security
We use encrypted token storage, database row-level security, and TLS for data in transit.
11. Changes
We may update this policy. We will post the new date at the top and, for material changes, notify you via the app or store listing.
12. Contact
Ali Demir
ali@demir.pro