KVKK Information Notice
This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") to explain how personal data is processed in the Dreamy Room mobile app and website. It is an English translation for convenience; the Turkish version is the legally binding text. More detail is in our Privacy Policy.
Dreamy Room has no accounts, and game data (rooms, progress, settings, age range, privacy choices) is stored only on your device; it is not transferred to us or to any server. The information below covers the limited data that leaves the device.
1. Data controller
Deniz Şengül (individual developer) Address: sent free of charge on request to support@denizsengul.com Email: support@denizsengul.com
2. Categories of personal data
| Category | Data | From whom |
|---|---|---|
| Online identifiers | Firebase Authentication anonymous technical ID (no name or email), Firebase installation ID, analytics app-instance identifier; app-scoped identifiers of the ad SDKs | All users who use the app online |
| Contact | Email address (only if you write to us) | People who write to us |
| Age range | On the device: 2–4, 5–7, 8–10, 11–17, 18+ or unknown (no birth date). Only a coarse age group / ad segment (child, teen, adult) leaves the device, for analytics, and ad requests receive only a "child-directed" or "under-age" signal | All users |
| Customer transaction | If analytics is on: trial / subscription started event (product type), store purchase events (product, price, currency) and whether Premium is active. Subscription status is checked with the store on the device; we receive no receipts or transaction identifiers | Users who make a purchase |
| Legal transaction | KVKK and other data subject requests and our answers | People who apply |
| Transaction security | App Check results (valid for at most 7 days); IP address kept briefly by Google at anonymous sign-in; website access logs | Users of the app and the website |
| Usage and device data (analytics) | In-app events, device model, operating system and app version, language, approximate region | Users with analytics on (in the EEA, the UK and Switzerland only if switched on) |
| Advertising data | Ad impressions and interactions, technical device data, general location derived from the IP address; advertising identifier only for adults who give explicit consent | Users of the free version |
| Notification data | Push token (held by Google) and topic subscriptions (all, language, age segment) | Users who allow notifications |
No special categories of personal data are processed. We do not collect names, birth dates, phone numbers, addresses, precise location, contacts, photos, voice, hardware identifiers, game progress or purchase receipts.
3. Purposes and legal grounds
| Purpose | Legal ground (KVKK Art. 5) |
|---|---|
| Providing the game; running Firebase services such as remote settings and notifications securely | Art. 5(2)(c) — directly related to the establishment or performance of a contract; Art. 5(2)(f) legitimate interest |
| Verifying Premium with the store on the device and restoring it | Art. 5(2)(c) performance of a contract |
| Age-appropriate experience and protection of children (UI, content, ad treatment) | Art. 5(2)(ç) legal obligation; Art. 5(2)(f) legitimate interest |
| Information and transaction security, preventing fraud and abuse | Art. 5(2)(f) legitimate interest; Art. 5(2)(ç) legal obligation (KVKK Art. 12) |
| Aggregated analytics to improve the game | Art. 5(2)(f) legitimate interest (analytics can always be switched off in the Parent Area) |
| Funding the free version with non-personalized ads | Art. 5(2)(f) legitimate interest |
| Personalized ads for adults | Art. 5(1) explicit consent (18+ only) |
| Push notifications | Art. 5(1) explicit consent (given by the parent or guardian for children and teenagers) |
| Answering data subject requests, informing competent authorities | Art. 5(2)(ç) legal obligation; Art. 5(2)(e) establishment, exercise or protection of a right |
Explicit consent is requested with a separate text (Consent Texts) and can be withdrawn in the app at any time. Refusing consent never prevents use of the game. For children, explicit consent is given by the parent or guardian. Your choices are stored only on your device.
4. Transfers of personal data
Within Turkey: personal data may be transferred to competent public authorities and courts only on request, to comply with legal obligations or to establish, exercise or protect a right (Art. 8(2)).
Abroad: we have no server of our own; the app's technical infrastructure and the ad services are provided by service providers located abroad, so personal data is transferred abroad:
| Recipient | Role | Purpose |
|---|---|---|
| Google LLC / Google Ireland Ltd. — Firebase Authentication (anonymous sign-in only; US), Firebase Installations, Remote Config, Cloud Messaging, App Check, Google Analytics for Firebase, Firebase Hosting (global, including the US) | Data processor | Anonymous technical ID, remote settings, notifications, app integrity, analytics, website hosting |
| Google (AdMob) | Advertising provider; independent controller for some purposes | Serving and measuring ads, fraud prevention |
| Unity Technologies (Unity Ads; United States and other countries) | Ad network bidding through AdMob mediation on Android; independent controller | Serving and measuring ads, fraud prevention |
| Apple Inc. / Apple Distribution International | Independent controller (App Store, payments, Apple Account); service provider for push delivery and device attestation | Selling and verifying subscriptions, delivering notifications, app integrity |
| Google LLC / Google Ireland Ltd. — Google Play | Independent controller (Google Play, payments, Google Account) | Selling and verifying subscriptions, Play Integrity |
As there is no adequacy decision of the Personal Data Protection Board for these countries, transfers abroad are made under KVKK Art. 9 by signing the standard contracts announced by the Board with the recipients and notifying the Personal Data Protection Authority within five business days of signature, or on the basis of another appropriate safeguard or exception provided in Art. 9.
5. Method of collection
Personal data is collected electronically, by fully or partly automated means, through the mobile app (age screen, Parent Area, choice screens and in-game actions), the software development kits integrated in the app (Firebase, Google Mobile Ads, Unity Ads on Android), Apple's and Google's store and payment services, our website and email.
6. Retention
Personal data is kept for as long as necessary for the purpose for which it is processed and is then deleted, destroyed or anonymized. Main periods: game data on the device until Delete data is used or the app is removed; event-level analytics data 2 months; App Check tokens at most 7 days; support correspondence at most 2 years after the request is closed; the anonymous technical ID and the Firebase installation ID under Google's Firebase retention terms. All periods are listed in section 9 of the Privacy Policy.
7. Your rights under KVKK Art. 11
By applying to the data controller you have the right to:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether it is used in line with that purpose,
- know the third parties in Turkey or abroad to whom it is transferred,
- request correction if it is incomplete or inaccurate,
- request its deletion or destruction under the conditions of KVKK Art. 7,
- request that actions under (5) and (6) be notified to third parties to whom it was transferred,
- object to a result against you arising exclusively from analysis by automated systems,
- claim compensation for damage caused by unlawful processing.
8. How to apply
You can exercise your rights in line with the Communiqué on the Procedures and Principles of Application to the Data Controller in any of these ways:
- In the app: Parent Area → Your data → Delete data deletes all data on the device and resets the anonymous technical ID; analytics and notifications can be switched off in the Parent Area. These actions happen on the device, so no further identity information is needed.
- By email: from an email address that you have previously given us and that is recorded in our system (for example the address you have corresponded with us from), to support@denizsengul.com.
- With a secure electronic signature or mobile signature: by sending your signed application to support@denizsengul.com.
- In writing: a signed letter delivered in person or by post to our postal address; our postal address is sent free of charge on request to support@denizsengul.com.
Written applications must include, as required by the Communiqué: name, surname and signature (if written); for Turkish citizens the T.R. identity number, for foreigners nationality and passport number or identity number if any; residential or business address for notifications; email address, telephone or fax number for notifications, if any; and the subject of the request. If you apply on behalf of a child, include information showing that you are the parent or guardian; do not send unnecessary personal details about the child. We process your request only as far as needed to verify your identity and answer it. Because the data held on servers is linked only to random identifiers, if we cannot match your request to specific data we will tell you so, with reasons.
Your request will be concluded free of charge as soon as possible and within thirty days at the latest, depending on its nature. If the action requires an additional cost, the fee in the tariff set by the Communiqué may be charged. If your request is rejected, you find the answer insufficient or it is not answered in time, you can file a complaint with the Personal Data Protection Board within thirty days of learning the answer and in any case within sixty days of the application date (KVKK Art. 14).