Privacy Policy

1. Introduction and Data Controller

This Privacy Policy ("Policy") has been prepared to explain the conditions under which the personal data of people ("you", "User") who use the mobile application "Hain Aramızda" (internationally titled "Who is Hain") (the "App"), developed and published by Global360 Studio ("we", "us", "Company" or "Developer"), is collected, processed, stored and protected.

This Policy applies to all versions of the App downloaded from the App Store, to all content, features and services offered inside the App, and to support processes relating to the App.

By downloading, installing or using the App you are deemed to have read and understood the practices described in this Policy. If you do not accept this Policy, please do not use the App and remove it from your device.

Data controller details under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"):

• Data controller: Global360 Studio
• Website: https://global360.studio
• Contact: the contact channels published on global360.studio

2. Summary: The Key Points

The details are set out in the sections below, but the most important points are:

• The App is a "pass-and-play" party game played together on a single device. NO membership, account, e-mail address, phone number or registration of any kind is required to play.
• The player names you enter and the settings you choose are stored ONLY ON YOUR OWN DEVICE; they are NOT SENT to us or to any server.
• We operate no server of our own; your game data is never transferred to any environment we could access.
• In-app purchases and subscriptions are handled entirely through Apple's App Store infrastructure; your credit card details never reach us in any form.
• The free version of the App may use third-party advertising technologies; these technologies may process limited device data (see Sections 5 and 6).
• When you delete the App from your device, all game data stored on the device is deleted as well.

3. Data Collected and Processed

3.1. Data you enter directly, stored only on your device

For the App to work, the following data is kept in your device's local storage (inside the app sandbox):

• a) Player names: the player names you enter on the game setup screen. These names do not have to be real names; you may use nicknames. If you enter no name, the App uses default labels such as "Player 1", "Player 2".
• b) Game settings: sound effect and music preferences, discussion time, visibility of traitor information, the selected app language and similar configuration preferences.
• c) Purchase state flags: flags indicating whether purchases such as the ad-free experience or a category pack have been activated on the device.

This data is not transmitted to us, cannot be viewed by us, is not uploaded to any server and is not shared with third parties. The security of this data is provided by your device's operating system security mechanisms (the app sandbox).

3.2. Data processed through the Apple App Store

When you make an in-app purchase or take out a subscription, the payment transaction is carried out entirely by Apple. In this context:

• a) Your payment and billing details (card number, bank details, etc.) are processed ONLY by Apple; this information is never transmitted to us and cannot be seen by us.
• b) For the purpose of validating a purchase, Apple provides the App only with anonymous transaction validation information (receipt validation).
• c) For information on how Apple processes your personal data, please review the Apple Privacy Policy: https://www.apple.com/legal/privacy/

3.3. Data that may be processed through advertising technologies

Third-party ad networks may be used in the free (ad-supported) version of the App. Limited to the purposes of serving ads and preventing fraud, ad networks may process the following types of data:

• a) Device information: device model, operating system version, screen resolution, language and region setting, time zone.
• b) App information: app version, ad impression and click interactions.
• c) Network information: IP address (may be used to infer approximate geographic location; sensitive/precise location data is NOT COLLECTED).
• d) Advertising identifiers: the Apple Advertising Identifier (IDFA) is processed only if you GIVE EXPRESS PERMISSION within the App Tracking Transparency framework ("Allow the App to Track You"). If you do not grant permission, ads are shown without personalisation (contextually); you can carry on using the App exactly as before.

Ad networks process this data under their own privacy policies, acting in their own capacity as data controller/data processor. When you purchase an ad-free experience subscription, no ads are displayed inside the App and the advertising-related data processing activities described in this section cease as far as the App is concerned.

3.4. Data we do NOT collect

In the interests of transparency, we state explicitly that the App does NOT COLLECT the following data:

• Full name, national identity number, e-mail address, phone number (there is no account system)
• Precise location (GPS) data
• Contacts, photos, camera or microphone data
• Health data, biometric data
• Social media account information
• Browser history
• What you say during play or the content of the games you play (the game is played entirely on the device and in the physical room)

4. Purposes of Processing and Legal Grounds

The limited data that is processed is processed for the following purposes and on the legal grounds set out in Article 5 of the KVKK:

• a) Providing the core functions of the App (storing player names and settings on the device) — performance of a contract (KVKK Art. 5/2-c).
• b) Validating and maintaining purchases and subscriptions — performance of a contract (KVKK Art. 5/2-c).
• c) Financing the service through advertising in the free version — legitimate interest (KVKK Art. 5/2-f); and, for personalised ads, explicit consent (ATT permission) (KVKK Art. 5/1).
• d) Fulfilling legal obligations — where expressly provided for by law (KVKK Art. 5/2-a) and legal obligation (KVKK Art. 5/2-ç).

Your data is not processed for purposes other than those stated above; it is not subject to processes such as profiling, credit scoring or automated decision-making.

5. Sharing with Third Parties

5.1. We DO NOT SELL your data, we do not rent it out and we do not transfer it to third parties for marketing purposes.

5.2. Limited data processing activities are carried out only by the following parties:

• a) Apple Inc.: App distribution, payment transactions, subscription management.
• b) Ad network providers: only in the free version, limited to the scope described in Section 3.3.

5.3. Legal requirements: where competent public authorities and judicial bodies make duly formed requests under applicable legislation, information may be shared limited to the scope of the relevant request. However, as explained above, since we hold no server records belonging to our users, the data that could be shared is extremely limited.

6. Advertising Identifier (IDFA) and Tracking Permission

6.1. On iOS 14.5 and later, your express permission is requested under Apple's App Tracking Transparency framework before the App can track you across apps and websites owned by other companies.

6.2. Granting this permission is entirely optional. If you do not grant it:

• No function of the App is restricted.
• Ads continue to be shown without personalisation.

6.3. You can withdraw the permission you granted at any time from Settings > Privacy & Security > Tracking on your device.

7. Retention and Deletion of Data

7.1. Data stored on the device (player names, settings, purchase flags) remains on your device unless you delete it or remove the App.

7.2. When you remove the App from your device, all data the App stored on the device is permanently deleted by the operating system. We hold NO backup of this data; deletion cannot be undone.

7.3. You can change or delete player names from within the App at any time.

7.4. Your subscription records are linked to your Apple account and are subject to Apple's retention policies.

8. Children's Privacy

8.1. The App is a social party game aimed at a general audience and does not knowingly collect personal data from children under the age of 13.

8.2. As the App has no account system, the identity of no user — children included — can be known to us.

8.3. If you are a parent or guardian and believe your child has provided personal data to us, please contact us; if such data is identified it will be deleted immediately.

8.4. As purchases are handled through the Apple account, parents can supervise their children's purchases using Apple's Family Sharing and Ask to Buy features.

9. Data Security

9.1. Data is stored on your device, isolated from access by other applications by the iOS app sandbox architecture.

9.2. As we host no user data on any server of our own, the risk of a server-originated data breach is minimal as far as the App is concerned.

9.3. The security of your device (device passcode, up-to-date operating system, etc.) is your responsibility; no liability is accepted for third parties who gain physical or remote access to your device reaching the data held on it.

10. International Transfers

10.1. As on-device game data is not transferred anywhere, it is not subject to any transfer abroad.

10.2. The infrastructure of Apple and of ad network providers may be located abroad. If you use these services, the limited data processing activities carried out under those providers' own privacy policies may take place abroad. The ATT permission you grant for personalised advertising constitutes explicit consent for transfers within this scope.

11. Your Rights under the KVKK

Under Article 11 of the KVKK, by applying to the data controller you have the right to:

• a) learn whether your personal data is being processed,
• b) request information about it if it has been processed,
• c) learn the purpose of processing and whether the data is used in line with that purpose,
• ç) know the third parties to whom the data is transferred, in Turkey or abroad,
• d) request correction if it has been processed incompletely or incorrectly,
• e) request its erasure or destruction within the conditions provided for in Article 7 of the KVKK,
• f) request that operations carried out under subparagraphs (d) and (e) be notified to third parties to whom the data has been transferred,
• g) object to an outcome arising against you as a result of analysis carried out exclusively by automated systems,
• ğ) claim compensation for damage suffered as a result of unlawful processing.

You can submit your requests through the contact channels published on global360.studio. Depending on their nature, requests are concluded free of charge within a maximum of 30 (thirty) days. Your right to lodge a complaint with the Turkish Personal Data Protection Board is also reserved.

Important note: because your game data exists only on your own device, you can carry out deletion/correction of that data yourself, directly within the App or by removing the App.

12. European Union (GDPR) and Other Regions

12.1. If you are located in the European Economic Area, the United Kingdom or Switzerland, you have rights of access, rectification, erasure, restriction of processing, data portability and objection. The legal bases for our processing activities are explained in Section 4. Your right to lodge a complaint with your local supervisory authority is reserved.

12.2. For residents of California (USA): we DO NOT SELL your personal information, and transfers falling within "sharing" (cross-context behavioral advertising) can only occur at ad network level if you grant ATT permission; you can withdraw that permission at any time.

12.3. Your rights arising from local data protection legislation in force in other countries are reserved.

13. Changes to this Policy

13.1. We may update this Policy from time to time. For significant changes, the current text is published on this page, accessible from within the App, and the "Last updated" date is revised.

13.2. Changes take effect the moment they are published. Continuing to use the App after a change means you accept the current Policy.

13.3. In the event of a conflict between translations of the Policy into other languages and the Turkish text, the Turkish text prevails, without prejudice to the mandatory provisions of the relevant jurisdiction.

14. Contact

For any question, request or application regarding this Policy or the processing of your personal data:

• Global360 Studio
• Web: https://global360.studio