Sahil Martıları — Privacy Policy
Version: 1.0
Effective date: 1 November 2026
Türkçe sürüm: https://marti.kratsonline.com/gizlilik
This policy explains which personal data is processed when you play the Sahil Martıları mobile game (English store name: "Place the Gulls: Logic Puzzle"; the "Game"), by whom, why and for how long. The Game is published under the name "KRATS YAZILIM" by Hatice Gücük – KRATS YAZILIM FAALİYETLERİ (sole proprietorship) (Section 2). Players in Turkey can also read our separate KVKK Disclosure Notice (in Turkish): https://marti.kratsonline.com/kvkk
1. In short
- You do not need an account. The Game has no accounts, no sign-in, no cloud saves and no chat. The Game never asks for your name, e-mail address or phone number.
- Your save file stays on your device. It is not uploaded and we do not keep a copy. When analytics is allowed, gameplay events and some values derived from your progress (for example the level number, solving time, number of hints used and your daily puzzle streak) are sent to Firebase Analytics (Section 3.3).
- The Game is free and supported by ads. Ads are served by Google AdMob, which may use device identifiers such as the advertising ID for this purpose. The Game has no in-app purchases.
- To improve the Game and fix bugs, we use Google Firebase services (Analytics, Crashlytics, Remote Config).
- You are in control. You can turn usage analytics off at any time, in every region, with the Usage analytics switch on the Game's Home screen. Ads and analytics start only after the consent step, which runs when you first tap Play for level 1. In the European Economic Area (EEA), the United Kingdom (UK) and Switzerland we ask for your consent for ads and analytics, and you can change your answer with the Privacy options button on the Game's Home screen; on iPhone and iPad, Apple's tracking permission prompt is shown (Section 5).
- The Game is not directed at children under 13 (Section 9).
2. Data controller and contact
The data controller is:
Hatice Gücük – KRATS YAZILIM FAALİYETLERİ (sole proprietorship) (publisher name in the stores: KRATS YAZILIM), established in Turkey
Address: Akarca Mah. 313 Sk. Dimlioğulları Apt. No: 18/1 B Blok Kat: 3 Daire: 8, Anamur / Mersin
E-mail: support@kratsonline.com
Registered e-mail (KEP): hatice.gucuk@hs03.kep.tr
Web: https://kratsonline.com
For any privacy question or request, write to support@kratsonline.com.
3. What data we process and why
Connections. Whenever the Game contacts Google's servers (AdMob, the consent tool, Firebase), those servers receive your device's IP address, as with any internet connection. How Google uses it is described below. The Game does not connect to any server that we operate.
3.1 The save file on your device
The Game keeps your progress in a save file on your device. It contains, for example: the level you have reached and your number of attempts on it, the number of hints you have left, your boards in progress (the level's and the daily puzzle's), your daily puzzle streak (the last day you solved, the number of days in a row and your best streak), interstitial frequency counters (the time of the last interstitial and the number of levels completed since), whether the consent step has run and whether your last consent answer allows analytics, whether the first-launch event has been sent, how many times and on which day the daily puzzle reminder question was last asked, and your settings (sound, vibration, the usage analytics switch, the reminder switch). The daily puzzle is chosen by your device's date; the Game does not connect to any server for this.
The save file is not uploaded and we do not keep a copy. When analytics is allowed, gameplay events and some values derived from your progress are sent to Firebase Analytics as described in Section 3.3. We do not offer cloud saves. Your device's own backup or transfer features (for example iCloud backup, Google backup or device-to-device transfer) may include the save file; this is under your control and we have no access to it. If no such backup is restored, deleting the Game, clearing its app data or switching devices erases your progress, and we cannot recover it.
3.2 Ads — Google AdMob and Google's consent tool (UMP)
The Game shows two kinds of ads: rewarded ads (when your free hints have run out, only if you choose to watch one, in exchange for a hint) and interstitial ads (when you move on to the next level after winning one; not in the first levels, and with the current setting only after level 6). No banner ads are shown. Ads are served by Google AdMob. Because Google also processes data for its own purposes within AdMob, Google is an independent data controller for that data.
According to Google, the Google Mobile Ads SDK automatically collects:
- IP address — which may be used to estimate the general location of the device (not its precise location);
- Product interactions — such as app launches, taps and video views;
- Diagnostic information — the performance of the app and the SDK (such as launch time, hang rate and energy usage);
- Device identifiers — on Android, the advertising ID, the app set ID and, if applicable, other identifiers related to signed-in accounts on the device; on iOS, the advertising identifier (IDFA) if you allow it, and device identifiers bound to the app or developer;
- on iOS, also information about the ads you have seen.
Google uses and shares this data for advertising, analytics and fraud prevention; this can include the advertising technology providers that Google works with (Section 6). The data is encrypted in transit using TLS. Details: How Google uses information from sites or apps that use its services — https://policies.google.com/technologies/partner-sites and the Google Privacy Policy — https://policies.google.com/privacy
Consent tool (UMP): The Game asks Google's User Messaging Platform (UMP) whether a consent form is required in your region. This request is made for every player, in every country: first when you first tap Play for level 1, then in the background when you open the Game again later. Google's servers receive your IP address and use it to determine your region. For players in the EEA, the UK and Switzerland, a consent form is then shown before level 1 starts. Your answer is stored on your device and decides whether information may be stored on or read from your device for ads and analytics and whether ads may be personalised. If you do not consent, you may see non-personalised ads or "limited ads", which Google serves with restricted data use.
We do not mark the Game as directed at children; the Game is intended for players aged 13 and over.
Our AdMob account is linked to our Firebase project, so ad impressions and ad revenue appear in our Firebase Analytics reports.
3.3 Usage analytics — Google Analytics for Firebase
We use Google Analytics for Firebase to understand how the Game is played (for example which level is hard, where players stop playing, how often hints and ad offers are used) and to improve the Game accordingly. For this service Google acts as a data processor working on our behalf and on our instructions.
Data processed:
- App instance ID — a random identifier assigned to the installation of the Game on your device. It is not associated with your name or contact details and is not shown in the Game.
- Advertising ID — the advertising ID on Android; on iOS, the IDFA only if you allowed tracking.
- Approximate location — derived at country/city level from your IP address.
- Device and app information — such as device model, operating system version, device language and app version.
- Automatic events — first open, sessions and screen views.
- Game events — the first launch of the Game on an installation (once, when analytics is switched on for the first time); the result of the consent step (the outcome of the consent form and, on iPhone and iPad, your tracking permission answer); level start and result (level number, success, duration, attempt number, number of hints used); tutorial steps and finishing the tutorial; each hint (the kind of hint, the logic rule it is based on, the level number); daily puzzle start and result (day number, success, duration, number of hints used, streak); the reminder question being shown and your answer (allowed, declined or not now) and opening the Game from a reminder (Section 3.7); ad offers, impressions and rewards (ad format, placement). We do not set user properties.
We do not enable the Google signals feature or demographics/interests reports. Analytics data is encrypted in transit using TLS.
Analytics is off before the consent step. The Game starts with Firebase Analytics collection switched off, and Google's "consent mode" settings (analytics storage, ad storage, ad user data, ad personalisation) start as "denied" in every country. Firebase Analytics sends no data at all until an answer given in the consent step allows analytics; no measurement without identifiers takes place either. After that, while the Usage analytics switch is on:
- EEA, UK and Switzerland: analytics is switched on only if you allow storing and reading information on your device in the consent form, and the consent mode settings change to "granted" according to your answer in the form. If you do not consent, Firebase Analytics sends no data at all. If you later withdraw your consent under Privacy options (Section 5), collection stops.
- Turkey and other countries: no consent form is required in these regions, so analytics is switched on after the consent step and the consent mode settings become "granted" (Section 5).
If your region cannot be determined during the consent step (for example because there is no internet connection), analytics stays off until your region is determined on a later launch.
Analytics switch: In every region you can turn usage analytics off completely with the Usage analytics: on / off switch at the bottom of the Game's Home screen (Section 5). The switch is on by default. While it is off, the Game sends no analytics data to Firebase; collection stops as soon as you turn the switch off. When you turn it back on, analytics resumes only if your consent answer allows analytics. The switch does not affect ads, crash reports or remote settings.
3.4 Crash reports — Firebase Crashlytics
When the Game crashes or an error occurs, we use Firebase Crashlytics (Google as data processor) to find and fix the problem. Data processed: the stack trace and app state at the time of the error or crash; device information such as device model and operating system; the IP address of the connection; the Crashlytics installation UUID and the Firebase installation ID, to count the affected installations; and a short log of game events before the error ("breadcrumbs" from Analytics, only while analytics is allowed). We do not add your name or contact details to these technical records.
Crashlytics works from the first launch, before any consent choice, because crashes can happen at any time. For this it stores the identifiers above on your device.
3.5 Remote settings — Firebase Remote Config
We use Firebase Remote Config (Google as data processor) so that we can tune the Game's hint and ad numbers (for example the number of free hints at the start, the number of hints earned with one rewarded ad, or interstitial frequency) without releasing a new version. Remote Config uses the Firebase installation ID (created by the Firebase Installations service and stored on your device), the IP address of the connection and the following information: country code, language code, time zone, operating system version, app ID and package name, SDK version. While analytics is allowed, settings can also be targeted by Analytics data (for example the time of first open).
Remote Config and Firebase Installations work from the first launch, before any consent choice, so that the Game starts with the current settings.
3.6 When you write to us
When you e-mail us for support, we process your e-mail address, the content of your message and any attachments to answer your request. Our e-mail is hosted by Google LLC (Google Workspace), which stores these e-mails on our behalf (Section 6).
3.7 Notifications
The Game can show one kind of reminder notification: in the evening (19:00 local time), "Today's puzzle is ready", on a day when you have not solved the daily puzzle yet. These notifications are scheduled on your device; we do not use a notification server, the Game creates no notification identifier (push token) and sends none to us, and the content of the notifications is not sent to us. They are not advertising or promotional messages. When you solve the daily puzzle for the first time, the Game asks with a short question ("Remind you of tomorrow's puzzle?") whether you want reminders; only if you answer "Yes" does your device's notification permission window appear on iPhone and iPad and on Android 13 and later (older Android versions have no such window). If you answer "Not now", the Game asks once more at the earliest a week later and then not again on its own; if you decline in your device's permission window, it does not ask again on its own. At most one notification is shown per day, and the notifications stop if you do not open the Game for three days. You can turn reminders off at any time with Reminder: on / off on the Game's home screen or in your device settings. Your reminder choice and when the question was asked are kept in the save file (Section 3.1); when analytics is allowed, the question being shown, your answer and opening the Game from a reminder are sent to Firebase Analytics as gameplay events (Section 3.3).
3.8 Data we do not process
We do not process precise location, contacts, photos, camera, microphone, health data or any other special categories of personal data. Because the Game has no in-app purchases, we do not process payment details either. The Game has no chat, user profiles, user content or interaction between players.
4. Legal bases
Turkish Law No. 6698 on the Protection of Personal Data (KVKK) applies. For players in the EEA, the UK and Switzerland, the General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection also apply; the table gives the GDPR article numbers.
| Purpose | KVKK | GDPR (EEA/UK/Switzerland) |
|---|---|---|
| Running the Game, storing progress on the device, scheduling the reminders you asked for on the device | Art. 5(2)(c) (performance of a contract) | Art. 6(1)(b) |
| Defending against legal claims | Art. 5(2)(e) and Art. 5(2)(f) (legitimate interest) | Art. 6(1)(f) |
| Crash and error reports (Crashlytics), from the first launch | Art. 5(2)(f) | Art. 6(1)(f) |
| Remote settings (Remote Config, Firebase Installations), from the first launch | Art. 5(2)(f) | Art. 6(1)(f) |
| Checking whether a consent form is required (UMP) and keeping a record of your choices | Art. 5(2)(ç) and Art. 5(2)(f) | Art. 6(1)(c) and Art. 6(1)(f) |
| Showing ads (keeping the Game free), non-personalised/limited ads | Art. 5(2)(f) | Art. 6(1)(f); storing or reading information on your device for these ads only with your consent in the form (otherwise limited ads) |
| Personalised ads; use of the advertising ID | Art. 5(2)(f) (legitimate interest, Section 5) | Art. 6(1)(a) (consent, UMP form) |
| Usage analytics (Analytics) | Art. 5(2)(f) (legitimate interest, Section 5) | Art. 6(1)(a) (consent, UMP form; no data at all is sent before or without consent, Section 3.3) |
| Answering support requests | Art. 5(2)(c) and Art. 5(2)(f) | Art. 6(1)(b) and Art. 6(1)(f) |
| Handling your privacy requests, including the identity details in a formal KVKK application | Art. 5(2)(ç) | Art. 6(1)(c) |
| Legal obligations, requests from competent authorities | Art. 5(2)(ç) | Art. 6(1)(c) |
Our legitimate interest is keeping the Game working, secure and balanced, fixing bugs, measuring how the Game is used in aggregate and showing ads so that the Game can stay free. The data involved is technical and gameplay data without your name or contact details.
What you can do about this processing: You can turn usage analytics off at any time, in every region, with the Usage analytics switch (Section 5). In the EEA, the UK and Switzerland, usage analytics and personalised ads also take place only with your consent, and you can withdraw it at any time under Privacy options; in every region you can block the use of the advertising ID with your device settings (Section 5). Crash reports and remote settings are needed to keep the Game working and cannot be switched off for a single installation; if you do not want them, you can stop using the Game and delete it. You can also write to us (Section 10).
Your right to object (EEA, UK and Switzerland). Where we rely on legitimate interest (GDPR Art. 6(1)(f)), you have the right to object to that processing at any time, on grounds relating to your particular situation. Write to support@kratsonline.com. We will then stop that processing, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. Because the Game has no account and no support ID, and crash reports, remote settings and ad requests cannot be switched off for a single installation, this may mean that the only way to stop the processing is to delete the Game; we will tell you if that is the case.
The Game has no purchases. Providing personal data is not a statutory or contractual requirement.
5. Consent, Apple's tracking permission (ATT) and changing your choices
The consent step below runs once, when you first tap Play for level 1, before the level starts (on iPhone and iPad together with the tracking prompt). Before this step no ads at all are shown and no data is sent to Firebase Analytics (Section 3.3); crash reports and remote settings work from the first launch (Sections 3.4 and 3.5). On later launches the Game refreshes the status of your answer with Google's consent tool in the background. The consent step:
- EEA, UK and Switzerland: the Google UMP consent form is shown. Personalised ads, the storing and reading of identifiers on your device for ads and analytics, and usage analytics are used only if you consent. If you do not consent, Firebase Analytics sends no data at all (Section 3.3).
- iPhone and iPad: a short explanation screen is shown first, followed by Apple's tracking permission prompt (App Tracking Transparency). If you do not allow it, your advertising identifier (IDFA) is not shared with the Game.
- Turkey and other countries: In these countries Google's consent form is not shown and the Game does not show its own consent screen. Personalised ads and usage analytics are based on our legitimate interest (KVKK Art. 5(2)(f)). You can turn analytics off at any time with the Usage analytics switch below and block the use of the advertising ID with the device settings below.
To change your choices or withdraw your consent:
- In the Game — the Usage analytics switch at the bottom of the Home screen (available in every region): tapping Usage analytics: on / off turns Firebase Analytics collection off or on for your installation at any time. Collection stops as soon as you turn it off; when you turn it back on, analytics starts only if your consent answer allows analytics.
- In the Game — the Privacy options button on the Home screen: where a consent form is required in your region (EEA, UK and Switzerland), this button appears on the Game's Home screen and reopens the consent form, so that you can change your answer or withdraw your consent. If you withdraw the consent you gave for analytics, Firebase Analytics stops collecting data.
- iPhone/iPad: turn off tracking for the Game under Settings > Privacy & Security > Tracking.
- Android: delete or reset your advertising ID under Google > Ads in your device settings.
- Google ad settings: https://myadcenter.google.com
Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
6. Who we share data with
| Recipient | Role | Purpose |
|---|---|---|
| Google — AdMob and the consent tool (UMP): Google LLC (USA) and its affiliates; Google Ireland Limited for users in the EEA and Switzerland; Google LLC for users in the UK | Independent controller | Serving and measuring ads, consent management, fraud prevention |
| Advertising technology providers that Google works with (in the EEA, the UK and Switzerland, those listed in the consent form) | Independent controllers; they receive data through Google under Google's policies | Serving and measuring ads, fraud prevention |
| Google — Firebase (Analytics, Crashlytics, Remote Config, Installations) | Processor | Analytics, crash reports, remote settings |
| Google LLC (Google Workspace) (United States and other countries where Google operates data centres), e-mail hosting | Processor | Receiving and storing support e-mails |
| Our professional advisers (for example lawyers, accountants, auditors) | Bound by professional secrecy or a confidentiality agreement | Only as needed for legal, tax or audit matters |
| Competent public authorities and courts | — | Only where there is a legal obligation |
If the Game changes hands: if we transfer the Game to another company (for example in a sale or merger), the data needed to continue the Game may pass to that company. It will either continue to apply this policy or inform you of its own.
Protection by recipients: The service providers acting on our behalf (Google for Firebase and our e-mail provider) are bound by data processing terms to process the data only on our instructions and to protect it at a level at least equal to that described in this policy. Google, as an independent controller for AdMob, is bound by the Google Ads Controller-Controller Data Protection Terms to protect the personal data it receives from the Game at a level equal to that described in this policy and required by law; the advertising technology providers it works with are bound by Google's policies.
We share personal data only with the recipients and in the situations described in this section.
7. International transfers
Our service providers process data on servers in various countries outside Turkey and the EEA, mainly in the USA.
We are established in Turkey. The European Commission has not adopted an adequacy decision for Turkey. When you write to us, and when we use our service providers' dashboards (for example to look at crash reports), your data is processed in Turkey. For players in the EEA, the UK and Switzerland, the GDPR (or its UK and Swiss equivalents) applies to that processing directly, because we offer the Game to you.
- Transfers from the EEA/UK/Switzerland to the USA: Google LLC is certified under the EU–U.S. Data Privacy Framework, its UK Extension and the Swiss–U.S. Data Privacy Framework, and also uses the European Commission's standard contractual clauses. Our e-mail provider: EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses (Google Workspace data processing terms)
- Copy of the safeguards: you can obtain a copy of the safeguards mentioned here (for example the standard contractual clauses) by writing to support@kratsonline.com.
8. Retention
| Data | Period |
|---|---|
| Save file, consent choices and scheduled reminders on the device | On your device until you delete the Game or clear its app data; a scheduled reminder is removed when it is shown, when you open the Game or when you turn the reminder off |
| Firebase Analytics user-level and event-level data | 2 months; aggregated reports that contain no identifiers may be kept longer |
| Crashlytics crash records and related identifiers | 90 days, after which Google starts removing them from live and backup systems |
| Firebase installation IDs (Remote Config, Crashlytics) | Firebase keeps an installation ID until we ask it, through its interface, to delete that ID; after such a request Google removes it from live and backup systems within 180 days. We do not delete installation IDs routinely and cannot find your device's installation ID (it is not shown in the Game), so in practice they are kept for as long as we use Firebase |
| AdMob data | Under Google's own policy. Google states that it anonymises advertising data in server logs by removing part of the IP address after 9 months and cookie information after 18 months |
| Support correspondence and records of privacy requests | 2 years from the closing of the request |
When the period ends, the data is deleted, destroyed or anonymised. If there is a dispute or a legal obligation, the relevant data may be kept for as long as that requires.
9. Children
The Game is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you are below the age at which you can consent to digital services on your own in your country (in the EEA this age is between 13 and 16 depending on the country), ask a parent or guardian to make the privacy choices for you. If you believe that data of a child under 13 is being processed, write to support@kratsonline.com. Because the Game has no account and no support ID, we cannot find and delete data held by our service providers for a single installation (Section 10); we will explain what else can be done, such as turning the Usage analytics switch off, deleting the Game and resetting the device's advertising ID.
10. Your rights
Under KVKK (Art. 11) you have the right to: learn whether your personal data is processed; request information if it is; learn the purpose of processing and whether the data is used in line with that purpose; know the third parties in Turkey or abroad to whom the data is transferred; request correction of incomplete or inaccurate data; request deletion or destruction under the conditions of KVKK Art. 7; request that such corrections and deletions be notified to the third parties to whom the data was transferred; object to a result against you that arises from analysis exclusively by automated systems; and claim compensation if you suffer damage from unlawful processing.
Under the GDPR (EEA/UK/Switzerland) you also have the right to access, rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interest (see the box in Section 4), and to withdraw your consent at any time.
How to make a request: write to support@kratsonline.com. The formal application methods under KVKK (written application, KEP, secure electronic signature) are described in the KVKK Disclosure Notice.
What we can do without an account or a support ID:
- We cannot find: the Game has no account system and does not show a support ID. The data held by our service providers (Firebase Analytics, Crashlytics and Remote Config data, and the data Google holds for ads as an independent controller) is linked not to your name or e-mail address but to identifiers that are assigned at random to the installation on your device and are not shown in the Game. We therefore cannot link a request to this data: we cannot find it for you, give you a copy of it or delete it individually. If you make such a request, we will explain this to you and tell you when the data is deleted automatically (Section 8) and what you can do yourself (below).
- We can: find the e-mails you sent us and the records of your privacy requests, and handle your requests about them under the retention rules in Section 8. For ad data, use Google's tools (https://myadcenter.google.com), and reset or delete your device's advertising ID.
Response time and fees: We answer your request within 30 days at the latest; for requests under the GDPR, within one month of receipt where that is earlier. Under the GDPR this period may be extended by two further months where necessary; if we extend it, we will tell you. Requests are free of charge. Under KVKK, a fee under the Personal Data Protection Board's tariff may be charged only if answering involves an additional cost (for example a written reply of more than ten pages, or a reply on a data carrier); under the GDPR, only for manifestly unfounded or excessive requests.
Right to complain: In Turkey you can complain to the Personal Data Protection Board (https://www.kvkk.gov.tr); under KVKK you must apply to us first. In the EEA you can complain to the data protection authority of the country where you live or work, in the UK to the Information Commissioner's Office (ICO), and in Switzerland to the Federal Data Protection and Information Commissioner (FDPIC).
What you can do yourself: deleting the Game erases all game data on the device. In every region you can turn analytics off with the Usage analytics switch, delete or reset your advertising ID and, on iPhone and iPad, turn off tracking; in the EEA, the UK and Switzerland you can also withdraw your consent under Privacy options (Section 5).
11. Security
Our service providers encrypt data in transit (TLS/HTTPS). We keep access to our service provider accounts limited and use two-step verification. No system is completely secure, so we cannot guarantee absolute security; if a data breach occurs, we will notify the competent authority and you as required by law.
12. Automated decision-making, profiling and "Do Not Track"
We do not make automated decisions about you that produce legal or similarly significant effects. Personalised ads may be based on profiles that Google builds from your interests, when you consent or to the extent you allow it.
The Game is an app and does not receive browser "Do Not Track" signals; you can control analytics and ad tracking with the settings in Section 5.
13. Changes
We may update this policy. We will announce significant changes in the Game or on the store page. The current version is always on this page; the effective date at the top shows the latest change.
14. Contact
Hatice Gücük – KRATS YAZILIM FAALİYETLERİ (sole proprietorship) (publisher name in the stores: KRATS YAZILIM)
Akarca Mah. 313 Sk. Dimlioğulları Apt. No: 18/1 B Blok Kat: 3 Daire: 8, Anamur / Mersin
support@kratsonline.com