Privacy Policy

Version 2.0.0 · Effective date: 6 October 2026

This Privacy Policy explains how the Dreamy Room game ("the app") and its website handle personal data. Dreamy Room is a room-decorating game that is played by children, teenagers and adults. We have designed it to collect as little data as possible, and we have written this policy in plain language. The Turkish version of this policy is the primary version for the purposes of Turkish law (KVKK); if the two versions differ, the Turkish version prevails to the extent permitted by law.

At a glance

• There are no accounts. The game has no sign-up, no sign-in and never asks for an email address. We never ask for a child's name, birth date, photo, phone number, address or location.
• Your game data stays on your device. Rooms, progress, settings and privacy choices are stored only on your device; we do not keep them on our own server or in any cloud service.
• We only ask for an age range (2–4, 5–7, 8–10, 11–17, 18+ or "Prefer not to say"), never a birth date. We use it to adapt the game and to protect younger players.
• No personalized ads for anyone under 18 or of unknown age. Children and teenagers only see non-personalized, child-appropriate (G-rated) ads, and we never ask them for tracking permission. Adults see personalized ads only if they agree.
• No chat, no social features, no public profiles. Room pictures you save or share never leave your device unless you share them yourself.
• You are in control. In the Parent Area, a parent can switch off analytics, personalized ads and notifications and delete all game data on the device. Premium subscribers see no ads.

1. Who is responsible for your data

The data controller is Deniz Şengül, an individual developer established in Turkey ("we", "us").

• Postal address: sent free of charge on request to support@denizsengul.com
• Email: support@denizsengul.com
• Representative in the EU / UK (GDPR Art. 27, where required): none appointed; requests from the EU and the UK can be sent to the email address above

We have not appointed a data protection officer because we are not legally required to. You can contact us directly about any privacy question.

2. What this policy covers

This policy covers the Dreamy Room app on iOS and Android and its web pages at https://denizsengul.com/apps/dreamyroom/ and the identical mirror at https://ds-dreamyroom-prod.web.app (including the data deletion and support pages). It does not cover the App Store, Google Play, Apple or Google accounts or any other service that has its own privacy policy, even if you reach it from our app.

3. How the app is designed for children

Dreamy Room is a mixed-audience app: its main audience is children aged about 2–10, but teenagers and adults play it too. Because of this:

• The first screen asks a neutral age question. It does not encourage anyone to pick a particular answer, and "Prefer not to say" is always available. If no answer is given, we treat the player as a child.
• Only the age range is kept, and only on the device. Analytics only receives a coarse age group (section 4.4); ad requests never receive the age, only a "child-directed" or "under-age" signal (section 4.5).
• Purchases, settings, privacy controls, sharing, links that leave the app and notification permission for children are inside the Parent Area, which is protected by a parental gate (a task that young children cannot easily complete). The app shows the Premium offer at a few moments (after the first setup, after the first finished room and from time to time, at most once a day); it can always be closed, and for players under 18 or of unknown age, buying requires passing the parental gate. A parental gate is not proof of age and it is not, by itself, parental consent under privacy laws; where we need a parent's consent, we ask the parent to make a separate choice behind the gate.
• There is no chat, no messaging, no friends list, no public profile and no user-generated content visible to other people.
• We do not use precise location, contacts, camera or microphone. The app asks for photo library access only to save a picture of your room when you tap "Save", and only with your permission.
• We follow high-privacy defaults: personalized advertising, promotional messages and (where the law requires consent) analytics are off unless the right person turns them on, and we do not use design tricks ("nudges") to push anyone to share more data, play longer or buy something.

4. What data we process

4.1 Data that stays on your device

The following is stored only on your device and is not sent to us or to any server: game progress (rooms, items, collection, stars, coins, stickers), settings (sound, music, haptics, language, reduced motion), the selected age range, your privacy choices (analytics, ad personalization and notification choices, and the version of the notice that was acknowledged), the result of the last Premium check, the schedule of local reminders and any room pictures you save.

Because this data is never sent to us, we cannot access it or restore it for you. If your device's own backup feature is on (iCloud Backup or a computer backup on iOS; backup to your Google account and transfer to a new device on Android), game progress and room pictures may be included in that backup; such backups are between you and Apple or Google, are managed in your device settings, and we have no access to them. On Android, the anonymous technical ID, subscription information, push token and ad choices are excluded from the backup. You can delete it with Parent Area → Your data → Delete data or by deleting the app (pictures you saved to your photo library stay there until you delete them). Details: Delete your data.

4.2 Anonymous technical ID

The first time the app goes online, it silently creates a random technical ID through Firebase Authentication anonymous sign-in, without asking you for anything. The ID contains no name, email address or other contact details, and it is not an account. Firebase Authentication stores the ID with the dates it was created and last used; Google briefly logs the IP address at sign-in to prevent abuse. We do not keep any game data, profile or consent record linked to this ID on a server.

When Delete data is used in the Parent Area, the app deletes this ID from Firebase Authentication (together with the push token and the Analytics app-instance ID) and creates a new random one.

4.3 Premium and purchases

Payments are handled entirely by Apple (App Store) or Google (Google Play), which are independent controllers for payments. We never receive card or bank details. The app checks whether Premium is active by asking the store directly on your device. It does not send purchase receipts, transaction identifiers or purchase tokens to any server, and we do not store them; the device keeps only the result of the last check (whether Premium is active, which plan, and when to check again).

If analytics is on (section 4.4), an event records that a trial or subscription started, with the type of product (monthly / yearly); Google Analytics may also record store purchase events (product, price, currency) automatically. None of this is linked to your name, email address or store account.

4.4 Analytics

We use Google Analytics for Firebase to understand, in aggregate, how the game is used and where it can be improved (for example: how many players finish the tutorial or complete a room, whether the subscription screen is clear). Events we record are: app open, tutorial completed, room started / completed, item selected / placed, room score, item unlocked, collection opened, subscription screen opened, trial / subscription started, ad impression (ad network, format, placement and estimated ad revenue), rewarded ad completed, and data on the device deleted. In addition, three coarse player-level properties are sent: age group, ad segment (child, teen or adult) and whether Premium is active.

• Events contain no names, email addresses, free text or user IDs; the app only allows predefined events and parameters to be sent. They are linked to a random app-instance identifier generated by the Analytics software; we do not send the anonymous technical ID (section 4.2) to Analytics.
• Google Analytics also receives automatic events such as first open and session start, and technical information such as device model, operating system and app version, language, and an approximate region derived from the IP address. Google does not give us IP addresses.
• Collection of advertising identifiers (IDFA / AAID) by Analytics is switched off for all users, the ad-related consent signals in Analytics are set to "denied" for everyone, and analytics data is not used for ad personalization for anyone.
• In the EEA, the UK and Switzerland, and when the device region cannot be determined, analytics is off by default and only runs if an adult (for children and teenagers, the parent, behind the parental gate) switches on Parent Area → Privacy → Anonymous usage statistics. In other regions (including Turkey) it is on by default and can be switched off at any time with the same switch.
• Event-level analytics data is kept for 2 months and then deleted by Google; we only keep aggregated, non-personal reports after that.

We do not use any crash-reporting or diagnostics SDK in this version of the app.

4.5 Advertising

The free version shows ads served by Google AdMob; on Android, Unity Ads also bids through AdMob mediation. How ads work, what "personalized" means and how to change your choices is explained in detail in our Tracking & Ads notice. In short:

To deliver and measure ads and to prevent ad fraud, AdMob and Unity Ads process technical data such as the IP address (used to estimate a general location), device and app information and ad interactions, as described in their own policies. Both receive the child-directed, under-age or consent signal so that they apply the correct protections.

4.6 Notifications

• Local reminders (for example "Your daily challenge is ready") are scheduled on the device and never pass through a server. They never contain personal data, are not sent between 20:00 and 09:00 (device time), and are limited to at most one per day and four per week.
• Push notifications are sent through Firebase Cloud Messaging only if the right person has agreed in the app and allowed notifications in the system settings. For children and teenagers, a parent decides behind the parental gate. We do not store your device's push token ourselves; Firebase Cloud Messaging holds it to deliver messages. The device is subscribed only to general groups ("topics"): all players, the app language and the age segment (child, teen or adult). Children and teenagers never receive promotional or advertising messages by push.
• You can turn notifications off at any time in the app (Parent Area → Notifications) or in your device settings. Turning them off in the app removes the topic subscriptions and deletes the push token.

4.7 Remote settings and security

• Firebase Remote Config lets us change game settings (for example ad frequency limits or whether a feature is on) without updating the app. For this, technical information such as the Firebase installation ID, app version, platform, country and language is sent to Google.
• Firebase App Check asks Apple (App Attest / DeviceCheck) or Google (Play Integrity) to confirm that requests come from the genuine app on a genuine device. These attestation tokens are valid for at most 7 days and we do not store them.

4.8 When you contact us

If you email us, we process your email address, the content of your message and any information you choose to give us, in order to answer you. Please do not send us a child's personal details.

4.9 Our website

Our website does not use cookies, browser storage, analytics, advertising or social media plugins. Our hosting providers (Google / Firebase Hosting for the ds-dreamyroom-prod.web.app mirror) process technical data such as your IP address to deliver the pages and protect them from abuse.

4.10 What we do not collect

We do not collect names, email addresses (unless you write to us), passwords, birth dates, phone numbers, postal addresses of players, precise location, contacts, photos or videos, voice, camera data, IMEI or other hardware identifiers, game progress or purchase receipts, and we do not collect advertising identifiers from anyone under 18 or of unknown age. We do not process special categories of personal data (such as health data).

5. Why we use data and our legal grounds

You can withdraw consent at any time in the app, without affecting processing that took place before. Not consenting never blocks the game: it works the same way without personalized ads, notifications or analytics. Your choices are stored only on your device, so after data is deleted or the app is removed they return to their default (most protective) values.

6. Children's privacy

We do not knowingly collect more personal information from children than is needed to run the game safely. In particular:

• Nobody creates an account in Dreamy Room. No game data about children is sent to us or to a server.
• The only identifiers used for children are random identifiers that support the internal operations of the app (the anonymous technical ID, the Firebase installation ID, the analytics app-instance identifier and app-scoped identifiers of the ad SDKs). We use them only for these internal operations: running the game and adjusting it remotely, protecting the app's integrity and security, measuring usage in aggregate to improve the game, showing contextual (non-personalized) ads, limiting how often ads are shown and preventing ad fraud.
• We make sure these identifiers are not used for anything else by: the child-directed or under-age signal on ad requests; not sending advertising identifiers (IDFA / AAID) and never asking for tracking permission on iOS; switching off advertising ID collection and ad personalization signals in Analytics; sending no user ID to Analytics and allowing only predefined events; and using only ad networks certified for children's apps. We do not build profiles of children and do not use their data for behavioral advertising.
• We do not sell or rent children's personal information, and we do not disclose it to third parties other than the service providers that run the app for us and the ad partners in section 7. If we ever wanted to disclose a child's personal information to a third party for any other purpose, we would first ask for the parent's separate consent, as required by the US Children's Online Privacy Protection Act (COPPA) Rule as amended in 2025 (compliance required from 22 April 2026).
• Push notifications for children require a parent's opt-in behind the parental gate, and children never receive promotional pushes.
• Retention: we keep children's data only as long as described in section 9, which is our written data retention policy.
• Parents' rights: a parent or guardian can at any time review the data held about their child, have it deleted and refuse further collection. All data on the device can be deleted with Parent Area → Your data → Delete data; analytics can be switched off in Parent Area → Privacy and notifications in Parent Area → Notifications, and removing the app stops all collection. You can also email us at support@denizsengul.com. We will take reasonable steps to confirm that the request comes from the parent or guardian before acting on it.

For players in the EU and the UK we follow the GDPR rules on children (Art. 8) and the principles of the UK Age Appropriate Design Code: best interests of the child, high-privacy settings by default, no profiling by default, no nudge techniques, no precise location and age-appropriate explanations. In Turkey, where KVKK requires explicit consent, a child's consent is given by the parent or guardian.

7. Who receives data

We do not sell personal data. We share it only with:

Other ad networks (mediation): ads are served through Google AdMob, which may let other ad networks bid to show an ad. For players of every age we only allow networks certified under Google Play's Families Self-Certified Ads SDK Program; they receive the same child-directed, under-age or consent signals and act under their own privacy policies. Each network is listed in the Tracking & Ads notice before it is switched on.

If the app is ever transferred to another owner, your data may be transferred as part of that transaction; the new owner would have to respect this policy, and we would tell you in advance.

8. International transfers

We have no server or database of our own. All of our service providers are located abroad: Firebase Authentication processes data only in data centers in the United States; the other Firebase services (Installations, Remote Config, Cloud Messaging, App Check, Analytics, Hosting) are global services and may process data in the United States and other countries where Google and its sub-processors operate. Google AdMob, Unity, Apple and Google Play process data in their own global infrastructure.

• From Turkey (KVKK Art. 9): as there is no adequacy decision of the Personal Data Protection Board for the destination countries, personal data is transferred abroad on the basis of the standard contracts published by the Board, signed with the recipients and notified to the Personal Data Protection Authority within five business days of signature, or on another appropriate safeguard or exception permitted by Art. 9.
• From the EEA, the UK and Switzerland: transfers to countries without an adequacy decision rely on the European Commission's Standard Contractual Clauses (and the UK / Swiss equivalents) included in our providers' data processing terms, or on the EU–US Data Privacy Framework where the recipient is certified. As the controller, we access this data (for example analytics reports) from Turkey.

You can ask us for more information about these safeguards at support@denizsengul.com.

9. How long we keep data (retention policy)

Google removes data deleted from Firebase services from its live and backup systems within the periods it publishes (at most 180 days).

10. Your rights

Depending on where you live, you (or, for a child, the parent or guardian) have the following rights.

Under KVKK (Turkey, Art. 11) you can: learn whether your personal data is processed; request information about it; learn the purpose of processing and whether it is used accordingly; know the third parties in Turkey or abroad to whom it is transferred; ask for incomplete or inaccurate data to be corrected; ask for it to be deleted or destroyed under Art. 7; ask for corrections and deletions to be notified to recipients; object to a result against you arising exclusively from automated analysis; and claim compensation for damage caused by unlawful processing. See our KVKK Information Notice for how to apply.

Under the GDPR / UK GDPR you can: access your data; have it corrected; have it erased; restrict processing; receive it in a portable format; object to processing based on legitimate interests; withdraw consent at any time; and lodge a complaint with a supervisory authority (for example the data protection authority where you live or work, or the UK ICO).

US residents: we do not sell personal information, and we do not share personal information of anyone under 18 for cross-context behavioral advertising. You can contact us to exercise any rights your state law gives you.

How to exercise your rights

1. In the app: Parent Area → Your data → Delete data (deletes all game data on the device and resets the anonymous technical ID); Parent Area → Privacy (analytics and ad choices) and Parent Area → Notifications. See Delete your data.
2. By email: support@denizsengul.com — for requests to access, learn about, correct, delete or object to analytics or other data. Please tell us which platform you use, and do not send us a child's personal details.
3. By post: our postal address is sent free of charge on request to support@denizsengul.com.

We answer within 30 days (KVKK) and within one month under the GDPR (which can be extended by two further months for complex requests; we will tell you if so). Requests are free of charge unless the law allows a fee for unusually costly requests. We may need to confirm your identity, or that you are the child's parent or guardian, before acting. Because we do not know your name or contact details and the data held on servers is linked only to random identifiers, we may not be able to match an email request to specific data (GDPR Art. 11); if so, we will explain this and point you to the deletion and opt-out options in the app. Game data on your device never reaches us, so only you can see and delete it.

11. How we protect data

• We have no server of our own and no database holding game data; game data is never sent to us.
• All connections between the app and Google, Apple and Unity services are encrypted (HTTPS/TLS).
• Firebase App Check helps ensure that only the genuine app can use our Firebase resources.
• Only predefined events and non-identifying values can be sent to Analytics; parameters containing free text or personal data are rejected by the app.
• Access to the Firebase and advertising consoles is limited to the controller and protected with strong authentication.
• We maintain a written information security program and review it at least once a year.

If a personal data breach occurs, we will notify the Turkish Personal Data Protection Board within 72 hours and the affected people as soon as possible as required by KVKK, and the competent authorities and people as required by the GDPR and other applicable laws.

12. Changes to this policy

Each version of this policy has a version number and an effective date, shown at the top of the page. If we make a material change, we will tell you in the app before it takes effect and, where the law requires it, ask for consent (from the parent, for children) again. Previous versions are available on request.

13. Contact

Deniz Şengül — Email: support@denizsengul.com — Postal address: sent free of charge on request to support@denizsengul.com

If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, www.kvkk.gov.tr) or to the supervisory authority in your country.