Legal

Privacy Policy

This policy covers the Kıvılcım: Kendi Dünyanı Kur app (version 3.0.0 of the Kıvılcım app on the App Store and Google Play) and the www.kivilcim.app website.

Last updated: 30 September 2026 (version 2026-09-30)

1Scope and data controller

The data controller is the individual developer of Kıvılcım (there is no company yet). The only contact address for all privacy requests is destek@kivilcim.app.

Accounts from the previous Kıvılcım app are a separate system and are not migrated to this version. To delete data from that app, see Delete account. The app is for ages 16 and up and is not distributed in the EU.

2Data stored with your account

You sign up with email and password (Firebase Authentication, Google). The app never saves your password; Firebase Authentication manages it. To run the service we store:

Your email address and user ID
Your world name, the pieces you chose and your optional notes (up to 120 characters)
Your contribution dates and sharing preference
The 16+ age statement you gave at sign-up and the policy version you accepted
Reports you made and accounts you blocked
Your theme entitlements and a purchase verification record (a hash of the store transaction ID). Card details never reach us; Apple or Google takes the payment.

Your latest world and your language, text size and motion settings are also cached on your device.

3Private and shared worlds

Your world is private by default. If you turn on sharing, your world name, pieces and notes appear on Explore only after a human moderator approves them. Your email is never shown. Turning sharing off removes your world from Explore.

4Crash reports and this website

When the app crashes, Firebase Crashlytics sends a crash report so we can fix the problem: device model, OS version and error log. Crash reports are kept for 90 days.

This website uses Vercel Web Analytics, which uses no cookies, does not identify you and only produces aggregated page-view counts. The site has no ads or tracking tools.

5What we don’t do

There is no chat, no matching, no location, no ads and no tracking SDKs. The app does not ask for location, contacts, camera or microphone access. Your data is not sold and is not used for advertising.

6Service providers (processors)

Google — Firebase Authentication (accounts and passwords), Cloud Firestore (world and account data), Firebase Crashlytics (crash reports).
Vercel — hosts the app’s API in the Frankfurt (fra1) region; this website and Vercel Web Analytics also run on Vercel.
Apple (App Store) and Google (Google Play) — take and process payments for themes and decide on refunds.

7Purposes and legal basis

We process data to create and protect your account, keep your world across devices, publish the sharing you choose after moderation, keep the community safe (reports and blocks), verify and restore purchases, fix crashes and answer support requests — on the basis of performing our contract with you, legal obligations and legitimate interests.

8Retention

Account data: for as long as your account exists; deleted immediately when you delete your account.
Server logs: at most 30 days.
Crash reports: 90 days.
Purchase verification record: kept without any link to your account after deletion, so the same store account can restore themes on a new account and receipts cannot be reused.

9Deletion

In the app, go to Settings → Delete my account and content, re-enter your password and confirm. Deletion takes effect immediately: your account, world, notes, shares, reports and blocks are deleted. For details and for data from the previous app, see Delete account.

10Your rights and contact

To access, correct or delete your data, or to object to processing, write to destek@kivilcim.app. Turkish data-protection law (KVKK) rights are described in the KVKK notice (Turkish). If this policy changes, the new version is published on this page with its date.