Palmslide

Palmslide — Privacy Policy

Version: 1.0
Effective date: 17 October 2026
Türkçe sürüm: https://palmslide.kratsonline.com/gizlilik

This policy explains which personal data is processed when you play the Palmslide mobile game (the "Game"), by whom, why and for how long. The Game is published under the name "KRATS YAZILIM" by Hatice Gücük – KRATS YAZILIM FAALİYETLERİ (sole proprietorship) (Section 2). Players in Turkey can also read our separate KVKK Disclosure Notice (in Turkish): https://palmslide.kratsonline.com/kvkk


1. In short


2. Data controller and contact

The data controller is:

Hatice Gücük – KRATS YAZILIM FAALİYETLERİ (sole proprietorship) (publisher name in the stores: KRATS YAZILIM), established in Turkey
Address: Akarca Mah. 313 Sk. Dimlioğulları Apt. No: 18/1 B Blok Kat: 3 Daire: 8, Anamur / Mersin
E-mail: support@kratsonline.com
Registered e-mail (KEP): hatice.gucuk@hs03.kep.tr
Web: https://kratsonline.com

For any privacy question or request, write to support@kratsonline.com.


3. What data we process and why

Connections. Whenever the Game contacts the servers of Google (AdMob, the consent tool, Firebase) or RevenueCat, those servers receive your device's IP address, as with any internet connection. How each provider uses it is described below.

3.1 The save file on your device

The Game keeps your progress in a save file on your device. It contains, for example: the level you have reached, your star and coin balances, completed cafe tasks and the variants you picked, your "remove ads" status, ad frequency counters, the transaction numbers of recently processed purchases (so the same purchase is never granted twice), your daily reward streak, when you last played (for the return bonus), whether your free hint and free "Remove" have been used, when the starter pack was offered, which prompts have already been shown (review request, notification permission), the number of consecutive losses on the current level, tutorial progress, and your settings (music, sound effects, vibration, reduced motion, language).

The save file is not uploaded and we do not keep a copy. Gameplay events and some values derived from your progress are sent to Firebase Analytics as described in Section 3.3. We do not offer cloud saves. Your device's own backup or transfer features (for example iCloud backup, Google backup or device-to-device transfer) may include the save file; this is under your control and we have no access to it. If no such backup is restored, deleting the Game, clearing its app data or switching devices erases your progress, and we cannot recover it. (Permanent purchases such as ad removal come back with "Restore purchases"; see the Terms of Use.)

The Game shows rewarded ads (for example "+1 life" or "double your coins"), interstitial ads and, if enabled, banner ads. Ads are served by Google AdMob. Because Google also processes data for its own purposes within AdMob, Google is an independent data controller for that data.

According to Google, the Google Mobile Ads SDK automatically collects:

Google uses and shares this data for advertising, analytics and fraud prevention; this can include the advertising technology providers that Google works with (Section 6). The data is encrypted in transit using TLS. Details: How Google uses information from sites or apps that use its services — https://policies.google.com/technologies/partner-sites and the Google Privacy Policy — https://policies.google.com/privacy

Consent tool (UMP): The Game asks Google's User Messaging Platform (UMP) whether a consent form is required in your region. This request is made for every player, in every country; Google's servers receive your IP address and use it to determine your region. For players in the EEA, the UK and Switzerland, a consent form is then shown after the first three levels and the cafe introduction are finished. Your answer is stored on your device and decides whether information may be stored on or read from your device for ads and whether ads may be personalised. If you do not consent, you may see non-personalised ads or "limited ads", which Google serves with restricted data use.

We do not mark the Game as directed at children; the Game is intended for players aged 13 and over.

Our AdMob account is linked to our Firebase project, so ad impressions and ad revenue appear in our Firebase Analytics reports.

3.3 Usage analytics — Google Analytics for Firebase

We use Google Analytics for Firebase to understand how the Game is played (for example which level is hard, where players stop playing, how often ad offers are accepted) and to improve the Game accordingly. For this service Google acts as a data processor working on our behalf and on our instructions.

Data processed:

We do not enable the Google signals feature or demographics/interests reports. Analytics data is encrypted in transit using TLS.

Before you answer the consent form, and if you refuse (EEA, UK and Switzerland): In these regions, analytics storage and the advertising settings start as "denied" when you first open the Game and stay that way until you answer the consent form, which appears after the first levels and the cafe introduction. While they are denied, Firebase Analytics does not store or read the app instance ID and does not use the advertising ID, but it still sends events without device or user identifiers (together with technical connection data such as the IP address and general device information), which Google uses to produce aggregate measurements and modelled statistics for us. If you consent, these settings are switched to "granted" (Google's "consent mode" settings: analytics storage, ad storage, ad user data, ad personalisation). How analytics works in Turkey and other countries is explained in Section 5.

Analytics switch: In every region you can turn usage analytics off completely under Settings > Privacy options (Section 5). While it is off, the Game sends no analytics data to Firebase.

3.4 Crash reports — Firebase Crashlytics

When the Game crashes or an error occurs, we use Firebase Crashlytics (Google as data processor) to find and fix the problem. Data processed: the stack trace and app state at the time of the error or crash; device information such as device model and operating system; the IP address of the connection; the Crashlytics installation UUID and the Firebase installation ID, to count the affected installations; a short log of game events before the error ("breadcrumbs" from Analytics, only while analytics is allowed); and technical keys and log lines we add for debugging (for example which screen or level was open). We do not add your name or contact details to these technical records.

Crashlytics works from the first launch, before any consent choice, because crashes can happen at any time. For this it stores the identifiers above on your device.

3.5 Remote settings — Firebase Remote Config

We use Firebase Remote Config (Google as data processor) so that we can tune the Game's economy and ad numbers (for example reward amounts or interstitial frequency) without releasing a new version. Remote Config uses the Firebase installation ID (created by the Firebase Installations service and stored on your device), the IP address of the connection and the following information: country code, language code, time zone, operating system version, app ID and package name, SDK version. While analytics is allowed, \1 Remote Config is also used to tell you that a very old version of the Game must be updated (required or recommended version).

Remote Config and Firebase Installations work from the first launch, before any consent choice, so that the Game starts with the current settings.

3.6 In-app purchases — App Store, Google Play and RevenueCat

Payment is taken by Apple (App Store) or Google (Google Play), which collect it directly from you and process it as independent data controllers under their own privacy policies. We never see your card or payment details. The stores provide us with transaction information such as transaction number, product, date, price, currency and country; the Google Play Console may show limited order information for order management, refunds and tax purposes.

We use RevenueCat, Inc. to verify your purchases, deliver what you bought (coins, ad removal), prevent the same purchase from being processed twice and restore your "remove ads" right after a reinstall. RevenueCat acts as our data processor.

Data processed by RevenueCat:

We do not enable RevenueCat's attribution integrations that collect advertising identifiers. We do not use RevenueCat's Firebase integration; RevenueCat does not forward your purchase information to our Google Analytics project.

RevenueCat privacy policy: https://www.revenuecat.com/privacy

3.7 Support ID

The Settings screen shows a support ID that you can copy. It is the same value as your RevenueCat App User ID: normally the Firebase app instance ID, otherwise the anonymous ID generated by RevenueCat (Section 3.6). The value may change, for example after a reinstall; the current value is always the one shown in Settings.

If you share this ID when writing to us, we can find your purchase record at RevenueCat and, if the ID is your Firebase app instance ID, the Analytics data linked to it. We cannot use it to find crash reports, remote-settings data or ad data held by Google (Section 10 explains what we can and cannot do). The ID does not reveal your name, but because it singles out the installation on your device it counts as personal data.

3.8 When you write to us

When you e-mail us for support, we process your e-mail address, the content of your message, any attachments and the support ID you share, to answer your request and, if needed, to find your records. Our e-mail is hosted by Google LLC (Google Workspace), which stores these e-mails on our behalf (Section 6).

3.9 Notifications

The Game can show two kinds of reminder notifications: when your daily reward is ready, and when you have not played for a few days ("Your cafe is waiting"). These notifications are scheduled on your device; we do not use a notification server, and neither the content of the notifications nor your permission answer is sent to us. They are not advertising or promotional messages. On iPhone and iPad, and on Android 13 and later, the Game asks for your permission at a calm moment after level 5, following a short explanation screen; if you decline, it does not ask again on its own. On older Android versions notifications are on by default. You can turn them off under Settings > Notifications in the Game or in your device settings.

3.10 Server time for the daily reward

To prevent the daily reward from being abused by changing the device clock, the Game sends a single HTTPS request (HTTP HEAD) to our website kratsonline.com and reads the Date header (date and time) of the response. The request carries no data about you; only the time is taken from the response. Like any web request, it lets our web server see the IP address of the connection and the user agent of the Game's HTTP client; we do not use these to identify or track players. How long the server's access logs keep them is stated in Section 8. This request goes only to the provider that hosts our website (Section 6), not to Google, RevenueCat or any other third party.

3.11 Review request

After you win a level, the Game may ask you to rate it in the store (at most once per version). The request uses the system dialog of Apple or Google Play, which the store operator runs; the Game does not learn the rating or review you give, and the store operator processes your data under its own privacy policy.

3.12 Data we do not process

We do not process precise location, contacts, photos, camera, microphone, health data or any other special categories of personal data. The Game has no chat, user profiles or interaction between players.


Turkish Law No. 6698 on the Protection of Personal Data (KVKK) applies. For players in the EEA, the UK and Switzerland, the General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection also apply; the table gives the GDPR article numbers.

PurposeKVKKGDPR (EEA/UK/Switzerland)
Running the Game, storing progress on the deviceArt. 5(2)(c) (performance of a contract)Art. 6(1)(b)
Verifying, delivering and restoring purchases; using the App User ID / support ID as the purchase identifierArt. 5(2)(c)Art. 6(1)(b)
Preventing purchase fraud; defending against legal claimsArt. 5(2)(e) and Art. 5(2)(f) (legitimate interest)Art. 6(1)(f)
Crash and error reports (Crashlytics), from the first launchArt. 5(2)(f)Art. 6(1)(f)
Remote settings (Remote Config, Firebase Installations), from the first launchArt. 5(2)(f)Art. 6(1)(f)
Reading the server time so that the daily reward is granted on the right day (Section 3.10)Art. 5(2)(f)Art. 6(1)(f)
Checking whether a consent form is required (UMP) and keeping a record of your choicesArt. 5(2)(ç) and Art. 5(2)(f)Art. 6(1)(c) and Art. 6(1)(f)
Showing ads (keeping the Game free), non-personalised/limited adsArt. 5(2)(f)Art. 6(1)(f); storing or reading information on your device for these ads only with your consent in the form (otherwise limited ads)
Personalised ads; use of the advertising IDArt. 5(2)(f) (legitimate interest, Section 5)Art. 6(1)(a) (consent, UMP form)
Usage analytics (Analytics)Art. 5(2)(f) (legitimate interest, Section 5)Art. 6(1)(a) (consent, UMP form); measurement without identifiers before or without consent (Section 3.3): Art. 6(1)(f)
Answering support requestsArt. 5(2)(c) and Art. 5(2)(f)Art. 6(1)(b) and Art. 6(1)(f)
Handling your privacy requests, including the identity details in a formal KVKK applicationArt. 5(2)(ç)Art. 6(1)(c)
Legal obligations, requests from competent authoritiesArt. 5(2)(ç)Art. 6(1)(c)

Our legitimate interest is keeping the Game working, secure and balanced, fixing bugs, measuring how the Game is used in aggregate, and showing ads so that the Game can stay free. The data involved is technical and gameplay data without your name or contact details.

What you can do about this processing: You can turn usage analytics off at any time (Section 5). Crash reports and remote settings are needed to keep the Game working and cannot be switched off for a single installation; if you do not want them, you can stop using the Game and delete it. You can also write to us (Section 10), and we will tell you what we can stop for your installation.

Your right to object (EEA, UK and Switzerland). Where we rely on legitimate interest (GDPR Art. 6(1)(f)), you have the right to object to that processing at any time, on grounds relating to your particular situation. Write to support@kratsonline.com, if possible with your support ID. We will then stop that processing for your installation, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. For crash reports and remote settings, which we cannot switch off for a single installation, this may mean that the only way to stop the processing is to delete the Game; we will tell you if that is the case.

Making purchases is optional; if you make a purchase, the related data is necessary to perform the contract. Providing any other data is not a statutory or contractual requirement.


The first minutes belong to the game: no ads, consent form or tracking prompt appear until the first three levels and the cafe introduction are finished. Crash reports and remote settings work from the first launch (Sections 3.4 and 3.5); how analytics works before you answer is explained in Section 3.3 and point 3 below. After that:

  1. EEA, UK and Switzerland: the Google UMP consent form is shown. Personalised ads, and the storing and reading of identifiers on your device for ads and analytics, are used only if you consent. Before you answer, and if you refuse, Analytics works only without identifiers (Section 3.3).
  2. iPhone and iPad: a short explanation screen is shown first, followed by Apple's tracking permission prompt (App Tracking Transparency). If you do not allow it, your advertising identifier (IDFA) is not shared with the Game.
  3. Turkey and other countries: In these countries Google's consent form is not shown and the Game does not show its own consent screen. Personalised ads and usage analytics are based on our legitimate interest (KVKK Art. 5(2)(f)). You can turn analytics off at any time with the switch below and block the use of the advertising ID with the device settings below.

To change your choices or withdraw your consent:

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.


6. Who we share data with

RecipientRolePurpose
Google — AdMob and the consent tool (UMP): Google LLC (USA) and its affiliates; Google Ireland Limited for users in the EEA and Switzerland; Google LLC for users in the UKIndependent controllerServing and measuring ads, consent management, fraud prevention
Advertising technology providers that Google works with (in the EEA, the UK and Switzerland, those listed in the consent form)Independent controllers; they receive data through Google under Google's policiesServing and measuring ads, fraud prevention
Google — Firebase (Analytics, Crashlytics, Remote Config, Installations)ProcessorAnalytics, crash reports, remote settings
RevenueCat, Inc. (USA) and its sub-processorsProcessorPurchase verification, delivery, restore
Vercel Inc., the provider that hosts the kratsonline.com websiteProcessorAnswering the server time request (Section 3.10), web server logs
Google LLC (Google Workspace) (United States and other countries where Google operates data centres), e-mail hostingProcessorReceiving and storing support e-mails
Our professional advisers (for example lawyers, accountants, auditors)Bound by professional secrecy or a confidentiality agreementOnly as needed for legal, tax or audit matters
Competent public authorities and courts—Only where there is a legal obligation

Apple and Google, as store operators, collect payment data directly from you as independent controllers (Section 3.6); this is not a transfer by us.

If the Game changes hands: if we transfer the Game to another company (for example in a sale or merger), the data needed to continue the Game and honour your purchases (such as purchase records at RevenueCat) may pass to that company. It will either continue to apply this policy or inform you of its own.

Protection by recipients: The service providers acting on our behalf (Google for Firebase, RevenueCat and our e-mail provider) are bound by data processing terms to process the data only on our instructions and to protect it at a level at least equal to that described in this policy. Google, as an independent controller for AdMob, is bound by the Google Ads Controller-Controller Data Protection Terms to protect the personal data it receives from the Game at a level equal to that described in this policy and required by law; the advertising technology providers it works with are bound by Google's policies.

We share personal data only with the recipients and in the situations described in this section.


7. International transfers

Our service providers process data on servers in various countries outside Turkey and the EEA, mainly in the USA.

We are established in Turkey. The European Commission has not adopted an adequacy decision for Turkey. When you write to us, and when we use our service providers' dashboards (for example to look up a purchase record), your data is processed in Turkey. For players in the EEA, the UK and Switzerland, the GDPR (or its UK and Swiss equivalents) applies to that processing directly, because we offer the Game to you.


8. Retention

DataPeriod
Save file and consent choices on the deviceOn your device until you delete the Game or clear its app data
Firebase Analytics user-level and event-level data2 months; aggregated reports that contain no identifiers may be kept longer
Crashlytics crash records and related identifiers90 days, after which Google starts removing them from live and backup systems
Firebase installation IDs (Remote Config, Crashlytics)Firebase keeps an installation ID until we ask it, through its interface, to delete that ID; after such a request Google removes it from live and backup systems within 180 days. We do not delete installation IDs routinely and cannot find your device's installation ID from your support ID, so in practice they are kept for as long as we use Firebase
RevenueCat purchase recordsFor as long as the Game is offered, so that your purchases can be restored; deleted at your request; if we stop using RevenueCat, within 30 days under its contract (subject to its backup practices)
AdMob dataUnder Google's own policy. Google states that it anonymises advertising data in server logs by removing part of the IP address after 9 months and cookie information after 18 months
Web server access log (server time request, Section 3.10)at most 30 days
Support correspondence and records of privacy requests2 years from the closing of the request

When the period ends, the data is deleted, destroyed or anonymised. If there is a dispute or a legal obligation, the relevant data may be kept for as long as that requires.


9. Children

The Game is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you are below the age at which you can consent to digital services on your own in your country (in the EEA this age is between 13 and 16 depending on the country), ask a parent or guardian to make the privacy choices for you. If you believe that data of a child under 13 is being processed, write to support@kratsonline.com with the support ID from the Game's Settings screen. We will delete the data we can find with it (Section 10) and explain what else can be done, such as deleting the Game and resetting the device's advertising ID.


10. Your rights

Under KVKK (Art. 11) you have the right to: learn whether your personal data is processed; request information if it is; learn the purpose of processing and whether the data is used in line with that purpose; know the third parties in Turkey or abroad to whom the data is transferred; request correction of incomplete or inaccurate data; request deletion or destruction under the conditions of KVKK Art. 7; request that such corrections and deletions be notified to the third parties to whom the data was transferred; object to a result against you that arises from analysis exclusively by automated systems; and claim compensation if you suffer damage from unlawful processing.

Under the GDPR (EEA/UK/Switzerland) you also have the right to access, rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interest (see the box in Section 4), and to withdraw your consent at any time.

How to make a request: write to support@kratsonline.com and, if possible, include the support ID from the Settings screen. Because there is no account system, this ID is the only way we can link a request to data held by our service providers. The formal application methods under KVKK (written application, KEP, secure electronic signature) are described in the KVKK Disclosure Notice.

What the support ID lets us do:

Response time and fees: We answer your request within 30 days at the latest; for requests under the GDPR, within one month of receipt where that is earlier. Under the GDPR this period may be extended by two further months where necessary; if we extend it, we will tell you. Requests are free of charge. Under KVKK, a fee under the Personal Data Protection Board's tariff may be charged only if answering involves an additional cost (for example a written reply of more than ten pages, or a reply on a data carrier); under the GDPR, only for manifestly unfounded or excessive requests.

Right to complain: In Turkey you can complain to the Personal Data Protection Board (https://www.kvkk.gov.tr); under KVKK you must apply to us first. In the EEA you can complain to the data protection authority of the country where you live or work, in the UK to the Information Commissioner's Office (ICO), and in Switzerland to the Federal Data Protection and Information Commissioner (FDPIC).

What you can do yourself: deleting the Game erases all game data on the device. You can turn analytics off and delete or reset your advertising ID (Section 5).


11. Security

Our service providers encrypt data in transit (TLS/HTTPS). We keep access to our service provider accounts limited and use two-step verification. No system is completely secure, so we cannot guarantee absolute security; if a data breach occurs, we will notify the competent authority and you as required by law.


12. Automated decision-making, profiling and "Do Not Track"

We do not make automated decisions about you that produce legal or similarly significant effects. Personalised ads may be based on profiles that Google builds from your interests, when you consent or to the extent you allow it.

The Game is an app and does not receive browser "Do Not Track" signals; you can control analytics and ad tracking with the settings in Section 5.


13. Changes

We may update this policy. We will announce significant changes in the Game or on the store page. The current version is always on this page; the effective date at the top shows the latest change.


14. Contact

Hatice Gücük – KRATS YAZILIM FAALİYETLERİ (sole proprietorship) (publisher name in the stores: KRATS YAZILIM)
Akarca Mah. 313 Sk. Dimlioğulları Apt. No: 18/1 B Blok Kat: 3 Daire: 8, Anamur / Mersin
support@kratsonline.com