Smash Tour Privacy Policy

Last updated: 2026-11-04

Smash Tour is a physics puzzle game for children and adults. This policy explains what personal information the game uses, why and on what legal basis, who receives it, how long it is kept and the choices and rights you have. We keep it short and plain on purpose, so that parents and players can read it. For players in Türkiye it is also the privacy notice required by Article 10 of the Personal Data Protection Law No. 6698 (KVKK).

Who we are

The data controller is SmashTour ("we"). Smash Tour is published under the developer name "esperancajk" on the app stores.

• Address: Beşiktaş, Istanbul, Türkiye
• Email: support@esperancajk.com

The short version

• You do not need an account, a name, an email address or a phone number to play.
• The game asks for your year of birth once, before ads can appear. We do not store the year; your device only keeps whether you are treated as a child (under 16) or an adult.
• Children never see personalized ads. They see only ads chosen from what is on the screen (contextual ads), their advertising ID is not used, and they are never asked for tracking permission.
• Personalized ads are shown only to adults who allow them: through Google's consent screen in the European Economic Area, the United Kingdom and Switzerland, and through Apple's tracking permission on iPhone and iPad. In Türkiye ads are not personalized unless we have your explicit consent.
• We do not sell your information.

How we collect it

The game collects personal information automatically while you play: it talks to our servers and to the software development kits (SDKs) of the providers listed below. You enter your year of birth on the game's age screen yourself. If you email us, we receive what you write.

What we use, why and on what legal basis

For players in Türkiye the legal bases are those of KVKK Article 5: performing our contract with you (5/2-c), a legal obligation (5/2-ç), establishing, exercising or defending a right (5/2-e), our legitimate interests where they do not harm your fundamental rights (5/2-f), and your explicit consent (5/1). We do not process special categories of personal data.

• Game data: a random player ID and an installation ID created when you first play; your progress, in-game coins and items, rewards for ads you chose to watch, the app version, device platform (Android or iOS), language, and when the account was created and last seen. Purpose: to run the game and keep your progress. Basis: contract.
• Session and security data: your IP address when the game talks to our servers, a session record (IP address and the app's generic user agent, which does not name the device model), request counters, and a risk score that rises with suspicious reward or progress records. Purpose: to protect the game and its economy from cheating and abuse. Basis: legitimate interests. The risk score is only for our review; it never triggers an automatic penalty on its own.
• Purchase records: the product, store, transaction number, date, refund status and the purchase details RevenueCat verifies with the store. We never receive your card details; Apple or Google take the payment. Purpose: to deliver, restore and refund what you buy. Basis: contract; keeping the records: legal obligation and the defense of rights.
• Your age band: whether you are treated as a child (under 16) or an adult, derived from the year you enter. It stays on your device and reaches our ad partners only as a "child" or "adult" flag. We never store the year of birth itself and do not ask again. Purpose: to keep children away from personalized ads and tracking. Basis: legal obligation and legitimate interests.
• Your privacy choices: your consent choices and, on iOS, whether you were already asked about tracking; kept on your device. Basis: legal obligation.
• Advertising data: to show ads, our ad partners receive device and app information (such as device model, operating system, language and an approximate location derived from the IP address) and information about ads shown and tapped. Purpose: to show the ads that keep the game free and to prevent ad fraud. Basis: legitimate interests. For adults who allow it, they may also use the device's advertising ID (Android advertising ID, or Apple's IDFA after you allow tracking) to personalize ads; the basis for that is your consent. For children, the advertising ID is not shared and ads are not personalized.
• Google Play Games (Android, adults only): after the first 20 levels, adults on Android are signed in to Google Play Games so that achievements and leaderboard scores are saved; Google then shares your Play Games player ID and gamer name with the game. Basis: contract. You can manage or delete your Play Games profile in the Google Play Games app. Children are not signed in to Google Play Games by the game.
• Diagnostics: crash and error reports: what went wrong in the game's code, the device model, operating system, app version, the level being played, warning and error log lines, and an approximate location derived from the IP address, which is not stored. Reports are linked to a random installation ID and to your player ID, so that we can count how many players a problem affects and find the reports of a player who contacts us. They do not include your name, contact details, IP address or your device's name. Purpose: to fix problems. Basis: legitimate interests.
• Support emails: your email address and message when you write to us. Purpose: to answer you. Basis: contract; for privacy requests, legal obligation.

We do not collect your precise location, contacts, photos, camera, microphone or messages. The game has no place where players share content.

Children

Smash Tour is made to be enjoyed by children. We designed it so that a child can play without giving us any personal information beyond what is needed to run the game:

• Until the age question is answered, and for everyone who may be under 16, the game treats the player as a child.
• For children, ads are contextual only and rated for a general audience; no advertising ID is used, no behavioral advertising or remarketing takes place, and no tracking permission is requested.
• Children are never shown a consent screen for personalized ads; our consent provider is told that the player is under the age of consent.
• Children are not signed in to Google Play Games.
• Information collected from children is used only to run the game, keep it secure and show non-personalized ads.

If you are a parent or guardian and want to know what we hold about your child, or want it deleted, contact us at support@esperancajk.com.

Who receives it

We share information only with the providers and partners below, and only as far as the purposes above require. Providers that process it on our behalf act only on our instructions; independent partners also apply their own privacy policies to what they collect.

• Supabase, Inc. (game servers and database; a US company, data stored in the European Union, Ireland): game, session, security and purchase data. On our behalf. supabase.com/privacy
• RevenueCat, Inc. (purchase verification; United States): player ID, purchase and store receipt details, app and device information, IP address. The game connects to RevenueCat at every launch to check your purchases; no advertising ID is sent. On our behalf. revenuecat.com/privacy
• Functional Software, Inc. (Sentry) (crash reports; a US company, reports stored in the European Union, Germany): diagnostics. On our behalf. sentry.io/privacy
• Unity Technologies (Unity LevelPlay / ironSource ad mediation and Unity Ads; United States and other countries): advertising data. Independent partner. unity.com/legal/privacy-policy and unity.com/legal/game-player-and-app-user-privacy-policy
• Google (AdMob ads, the User Messaging Platform consent screen, Google Play Games and Google Play payments; United States and Ireland): advertising, consent, Play Games and payment data. Independent partner. policies.google.com/privacy
• Apple (App Store payments and the tracking permission; United States and Ireland): payment and tracking permission data. Independent partner. apple.com/legal/privacy
• Cloudflare, Inc. (hosting of this website and of our admin console; a US company, global network): your IP address and browser information when you visit the site; game data shown in the admin console, while in transit. On our behalf. cloudflare.com/privacypolicy
• Public authorities, only where the law requires it.

International transfers

All of the providers above are outside Türkiye, so your information is transferred to the European Union (Ireland and Germany) and to other countries, including the United States (KVKK Article 9). Transfers to providers that act on our behalf take place under their data processing agreements; independent partners handle what they collect under their own terms and privacy policies. For players in Europe the transfers rely on the European Commission's standard contractual clauses.

How long we keep it

• Game data and purchase summaries: while your account exists. They are deleted at once when you use Settings > Delete my data or ask us to delete them.
• Session records (including the IP address), request counters and ad reward records: deleted with your account; expired request counters earlier.
• System logs of our hosting provider (including IP addresses): at most 7 days.
• Crash reports: deleted automatically after 30 days.
• Purchase transaction records (on our servers and at RevenueCat): kept for the period tax and commercial law requires, at most 10 years, even if you ask us to delete your data.
• Support emails: at most 2 years after your request is closed.
• Information on your device (save file, age band, privacy choices): until you uninstall the game or use Settings > Delete my data.
• Ad partners and Google Play Games: as stated in their own privacy policies.

Information past its period is deleted or anonymized.

Your rights and choices

• Change ad choices: Settings > Privacy choices (where available), the iOS setting "Allow Apps to Request to Track", or your device's ad settings on Android.
• Delete your data: in the game under Settings > Delete my data, or by emailing support@esperancajk.com. Because there is no account, include the player ID shown in the game's Settings so we delete the right data.
• Depending on where you live (for example under the GDPR in Europe or KVKK in Türkiye), you also have the right to access, correct, delete, export or object to the use of your information, to learn who received it, to object to a result reached solely by automated processing, and to complain to your data protection authority (in Türkiye, the Personal Data Protection Board). Write to the address or email above; we answer free of charge within 30 days.

Changes

If we change this policy, we will update the date above and, for important changes, tell you in the game.

Contact

SmashTour (esperancajk) — Beşiktaş, Istanbul, Türkiye — support@esperancajk.com