1. Scope and data controller
This policy explains how the Kodaman mobile game (iOS and Android), the browser version of the game and the kodaman.io website (together, the “Service”) handle your personal data. It serves as our privacy notice under the EU/UK General Data Protection Regulation (“GDPR”) and as the information notice under Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”).
Data controller: Basa Games
Address: [Company address — to be added in site settings]
Email: [email protected]
2. In short
- Kodaman has no accounts, emails or passwords. The game recognises you by a random ID created on your device.
- We do not access your precise location, contacts, photos, camera or microphone.
- We use your data to run the game, back up your progress, improve the game and prevent abuse.
- We do not sell your personal data.
- The game only has rewarded ads (Google AdMob) that you choose to watch; where required, we ask for your ad consent.
- You can ask us to delete your data at any time: Data deletion.
3. What we collect
Your data is collected electronically through the game and the website, mostly automatically.
3.1. Identifiers
- Device ID: a random ID the app generates on first launch and stores on your device. It is not a hardware ID (IMEI, serial number, MAC address, etc.) or an advertising ID. Uninstalling the app removes it.
- Installation and session IDs: random IDs that tell which installation and play session statistics belong to.
- Session key: a secret that lets your device talk to our server securely. The server only stores a one-way hash of it.
3.2. Device and app information
Platform (iOS/Android/web); app, build and game package version; device brand and model; operating system and version; phone/tablet and physical device/emulator; screen size and pixel density; device language and region setting; time zone and UTC offset; memory class (low/mid/high); network type (Wi-Fi/mobile); install and first-open dates; session count and last open time; notification permission status and ad consent status. In the browser version we also receive a shortened version of your browser’s user agent.
3.3. IP address and approximate location
Our server receives and stores your device’s IP address with each connection. We use ipinfo.io once to look up your approximate location (country, region and city) from your IP address. Its response may include network information such as your internet provider and a city-level approximate location. We never collect your precise location via GPS or any other method.
3.4. Game data and statistics
- The player name you choose in the game.
- Game statistics: level, era/HQ stage, game day, in-game cash, net worth, lifetime earnings and active play time.
- In-game events: session start/end and duration, tap counts, upgrades and purchases made with in-game money, level-ups, unlocks, completed tasks, rewarded ads watched, notifications opened and similar events, with their times. These go only to our own server; we do not use a third-party analytics tool (such as Firebase Analytics).
3.5. Cloud backup and transfer codes
So you don’t lose your game, your full game save (including your player name and progress) is regularly backed up to our server. Up to 10 older copies are kept so a bad upload can be undone. Transfer codes you create to move your game to another device are valid for 24 hours and can be used once.
3.6. Notifications
If you allow notifications, the notification token (FCM token) issued by Firebase Cloud Messaging (Google) is stored on our server and used to send you game notifications. You can turn notifications off in your device settings at any time.
3.7. What you send us
When you use the support or data deletion form or email us: your name, email address, topic, message, player name (if you give it), page language, IP address and browser information.
3.8. Stored on your device
Your game save, settings, a queue of in-game statistics waiting to be sent and your in-game feedback are stored on your device (in the browser version, in the browser’s local storage). The in-game feedback form stays on your device and is not sent to us.
4. What we don’t collect
- Precise (GPS) location, contacts, photos, camera or microphone data.
- Hardware identifiers (IMEI, serial number, MAC address).
- We do not collect or store your advertising ID (IDFA/Android advertising ID) ourselves (see Ads).
- Payment details. The game currently has no real-money purchases; if they are added later, payments are processed by Apple or Google and we never see your card details.
5. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the game, saving your progress, cloud backup and moving between devices | Identifiers, game data, cloud backup | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Security, preventing cheating and abuse, debugging | Identifiers, IP address, device information | Legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Improving the game: understanding which parts players enjoy or find hard; aggregate statistics (daily players, country and device breakdowns, etc.) | Device information, approximate location, game statistics and events | Legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Sending notifications (e.g. announcements, reminders for players who haven’t played in a while) | Notification token, language, platform, country, last open | The notification permission you grant on your device; legitimate interests |
| Showing rewarded ads | Ad consent status (ad-related data is processed by Google) | Consent where required (GDPR Art. 6(1)(a)); otherwise legitimate interests |
| Answering support and data requests | Contact details and your message | Legitimate interests; exercising rights; legal obligation (KVKK Art. 5(2)(ç)) |
| Legal obligations and possible disputes | Limited data as needed | Legal obligation; establishing, exercising or defending legal claims |
We do not use your data for automated decisions that produce legal or similarly significant effects on you.
6. Ads and consent
The game only has rewarded ads: you choose to watch an ad in exchange for a bonus. Ads are served by Google AdMob. In regions where it is required, such as the European Economic Area, the United Kingdom and Switzerland, Google’s consent tool (UMP) asks for your ad and data choices before any ads. To change your choice later, use the privacy options in the app (in versions that offer them) or contact us.
Google may process device information, your IP address and (on Android) your advertising ID to serve and measure ads and to prevent fraud, under its own policies and according to your consent choices. On iOS we do not request App Tracking Transparency permission, so the advertising identifier (IDFA) is not used. The advertising ID is not sent to or stored by us. Learn more: How Google uses information from sites or apps that use its services. On Android you can reset or delete your advertising ID in your device settings.
8. International transfers
Google, ipinfo.io and Cloudflare may process data outside Türkiye and the European Economic Area (e.g. in the United States). These transfers rely on appropriate safeguards such as the standard contractual clauses offered by the providers and the other conditions set by GDPR Chapter V and KVKK Art. 9.
9. Retention
- Game, device and statistics data: for as long as you play. Data for devices that have not connected for 24 months is deleted or anonymised.
- Cloud backup: the current save and up to 10 older copies; all deleted on a deletion request.
- Transfer codes: valid for 24 hours.
- Support messages: up to 2 years after your request is resolved.
- Deletion requests: 3 years, so we can show the request was carried out.
- Aggregate statistics: kept indefinitely in anonymous form that cannot be linked to anyone.
When a retention period ends, the data is deleted, destroyed or anonymised.
10. Security
Traffic between the app and our server is encrypted (HTTPS); session keys are stored only as hashes; access to data is limited to authorised people. No method is 100% secure, but we take reasonable technical and organisational measures to protect your data.
11. Your rights (GDPR and KVKK)
Depending on where you live, you have the right to access your data, have it corrected, have it deleted, restrict its processing, receive it in a portable format, object to processing based on legitimate interests and withdraw consent at any time. Under KVKK Art. 11 you also have the right to learn whether your data is processed and for what purpose, to know the third parties it is transferred to in Türkiye or abroad, to have corrections and deletions notified to them, to object to a result against you arising solely from automated analysis, and to claim compensation for damage caused by unlawful processing.
Send your request to [email protected] or use the support form. Including your in-game player name and platform helps us find your records. We respond free of charge within 30 days at the latest. If you are not satisfied, you can complain to your local data protection authority or to Türkiye’s Personal Data Protection Authority (KVKK).
12. Deleting your data
In the game, Me › Settings › Reset game erases your progress on your device. To have the data on our servers deleted, use the Data deletion page. Requests are completed within 30 days.
13. Children
Kodaman is designed for players aged 13 and over and is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe your child has given us data, contact us at [email protected] and we will delete it.
14. This website and cookies
kodaman.io uses no advertising or analytics cookies. Only a strictly necessary security cookie (CSRF) is used to protect the forms. For security, our servers may keep the IP address and browser information of each visit in short-lived technical logs.
15. Changes
We may update this policy from time to time. The current version is always on this page, with its effective date at the top. We will also announce important changes in the game.
16. Contact
Basa Games
[Company address — to be added in site settings]
[email protected] · Support & contact