Privacy Policy

1. Who we are and scope

Space Games Labs is a mobile game development studio located in Istanbul, Türkiye. We make free-to-play mobile puzzle games, starting with Merge Lock!, and distribute them through the Apple App Store and Google Play. We are the data controller, and you can reach us at support@spaceailabs.ai.

This policy covers every game we publish on iOS and Android, our website at https://spacegameslabs.com, and your support conversations with us. It does not cover the App Store, Google Play or the partners in section 7, which have their own policies.

Our games are played without an account: progress is stored on your device, and we do not ask for your name, e-mail address or phone number. If a future update adds optional features such as cloud save, leaderboards or events, we will explain the change in the game before you opt in and update this policy.

We follow the Turkish Personal Data Protection Law No. 6698 (KVKK), our home law, the EU and UK GDPR for players in the European Economic Area (EEA) and the United Kingdom (UK), and the California Consumer Privacy Act (CCPA/CPRA) for California residents.

2. Data we collect

2.1 Data you give us

When you write to support, we receive your e-mail address, your message and any attachments. If you join a test programme through TestFlight or Google Play, we hold the e-mail address used to invite you and the tester identifier the store assigns.

2.2 Data collected automatically

When you play, the game and its built-in software development kits (SDKs) collect the device, gameplay and crash data in the table below, plus an approximate country derived from your IP address and, in games that show ads and only where you allow it, your advertising identifier (see section 4).

2.3 Data from the app stores and partners

When you buy something, Apple or Google processes the payment and sends us a transaction record (identifier, product, price, currency, time and refund status); we never receive your card number, bank details or billing address.

We do not collect precise location, contacts, photos, microphone or camera data, health data or special categories of personal data.

3. Why we use it and legal bases

KVKK Article 5 and GDPR Article 6 require a lawful basis for each use of personal data. Ours are:

• Contract (KVKK Article 5(2)(c), GDPR Article 6(1)(b)): running the game, saving your progress, delivering and restoring purchases and answering support requests, all necessary to perform our agreement with you under our Terms & Conditions.
• Legitimate interests (KVKK Article 5(2)(f), GDPR Article 6(1)(f)): analytics and crash logs to balance levels, fix bugs and plan updates; device and installation data to detect cheating, fraud and abuse; non-personalised ads to fund free games. You can object at any time (see section 12).
• Consent (KVKK Article 5(1), GDPR Article 6(1)(a)): personalised ads using your advertising identifier, requested through the Apple App Tracking Transparency prompt or an in-game consent screen. You can withdraw consent at any time without affecting earlier processing.
• Legal obligation (KVKK Article 5(2)(a) and 5(2)(ç), GDPR Article 6(1)(c)): keeping purchase and accounting records as Turkish tax and commercial law requires, answering lawful requests from authorities and honouring your privacy rights.

We make no solely automated decisions with legal or similarly significant effects on you.

4. Advertising and advertising identifiers

Some of our games are free because they show ads; where a game shows no ads, this section does not apply. Ads come from third-party ad networks integrated into the game, such as Google AdMob or Unity Ads.

To serve an ad, a network receives basic device data (model, operating system, language, IP address and the region derived from it) and how the ad performed. With your permission it also receives your advertising identifier to select more relevant ads, cap repeats and measure campaigns; without it, ads are chosen by context rather than by you.

4.1 iOS: App Tracking Transparency

Apple's App Tracking Transparency (ATT) prompt controls access to the Identifier for Advertisers (IDFA). Our games ask before any ad network can read it; if you choose "Ask App Not to Track", ads are not personalised. You can change your answer at any time under Settings, Privacy & Security, Tracking.

4.2 Android: Advertising ID and consent

Where the law requires it, including in the EEA and the UK, our games show a consent screen (Google's User Messaging Platform or an equivalent) before personalised ads appear; you can decline and revisit your choice in the game's settings. You can also reset or delete your Google Advertising ID under Settings, Google, Ads.

We use the advertising identifier only for advertising and ad measurement and never combine it with support data.

5. Analytics and crash reporting

Where a game uses them, we rely on analytics and crash-reporting services from Google (Firebase-type analytics and crash reporting) and Unity Technologies (our game engine and its related services) to see, in aggregate, which levels are too hard, where players stop, how long sessions last and which devices crash.

These services use an anonymous installation ID created when the app is first opened; it resets if you reinstall the game and is never your name, e-mail or phone number. Crash reports capture the app's technical state at the moment it closed, not the content of your messages, other apps or files.

Our website runs no analytics scripts. Cloudflare, which hosts it, keeps standard server logs for security, as explained in our Cookies Policy.

6. In-app purchases

Where a game offers in-app purchases (for example, removing ads or bundles of hints), the purchase is made through the App Store or Google Play. Apple or Google collects your payment details, charges you and issues the receipt under its own terms and refund rules.

We use the purchase record to deliver what you bought, restore purchases on a new device, handle refund and support requests, detect fraud and keep the accounting records Turkish law requires. Refunds are handled by the store where you bought the item.

7. Who we share data with

We share personal data only with the companies that help us run our games and website, with the app stores and where the law requires it. We do not sell personal data in the ordinary meaning of the word.

7.1 Service providers and partners

• Apple: App Store distribution, payments, TestFlight and the diagnostics you choose to share with developers.
• Google: Google Play distribution and payments; Firebase-type analytics and crash reporting where used; ads where a game shows them.
• Unity Technologies: the game engine and related services such as analytics, diagnostics and ad mediation where used.
• Cloudflare: website hosting, content delivery and protection against attacks.
• Ad networks: selecting, delivering and measuring ads in games that show them.

Partners may use the data only to provide their service to us, except where they act as independent controllers under their own policies (Apple and Google for store transactions, ad networks for their advertising profiles).

7.2 Other disclosures

We may also disclose personal data when a court, regulator or law enforcement authority requires it, or to enforce our Terms, investigate fraud or security incidents, or protect the rights and safety of our players and others; to our accountants, lawyers and auditors under confidentiality; and in a merger, acquisition, financing or sale of our games or assets, where the recipient is bound by this policy or you are told of any material change first.

7.3 A note for California residents

Under the CPRA, disclosing your advertising identifier and device data to ad networks for personalised ads may count as "sharing" for cross-context behavioural advertising; you can opt out as described in section 4. We do not sell personal data as the CPRA defines it, and we do not knowingly sell or share the personal data of anyone under 16.

8. International transfers

Our partners run their servers in several countries, most often the United States and the European Union, so your data may be processed outside Türkiye, the EEA and the UK. When that happens, we protect the transfer:

• Players in the EEA and the UK: the European Commission's Standard Contractual Clauses (with the UK Addendum) in our partner agreements, adequacy decisions where they exist, and the EU-US Data Privacy Framework where a partner is certified.
• Players in Türkiye: under KVKK Article 9, an adequacy decision of the Personal Data Protection Board, standard contracts or written undertakings approved by the Board, or, failing these, your explicit consent, requested in the game where needed.

Ask us for details of the safeguard used for a specific transfer.

9. Retention

We keep personal data only as long as its purpose requires, then delete or anonymise it. Typical periods are:

Fully anonymised data may be kept indefinitely; where a legal claim requires it, we may keep specific records for longer.

10. Security

We protect personal data with technical and organisational measures appropriate to the risk: TLS encryption in transit, access to analytics, crash-reporting and store dashboards limited to the people who need it and protected by strong authentication, partners with recognised certifications such as ISO 27001 or SOC 2, and no storage of payment card data.

No system is perfectly secure. If a breach is likely to put your rights at risk, we will notify the relevant authority and, where the law requires it, you, without undue delay. If you find a vulnerability in a game or on our website, tell us at support@spaceailabs.ai.

11. Children

Our games are made for general audiences and are not directed to children under 13, or under the higher age at which the law where you live requires parental consent (for example, 16 in parts of the European Union). We do not knowingly collect personal data from children below that age, show them personalised ads, or sell or share their data.

If you are a parent or guardian and believe a child under that age has given us personal data, write to support@spaceailabs.ai; we will delete it promptly and ask our partners to do the same.

12. Your rights

12.1 KVKK Article 11 (Türkiye)

You have the right to:

• learn whether we process your personal data and, if so, request information about it;
• learn the purpose of processing and whether the data is used in line with it;
• know the third parties, in Türkiye or abroad, to whom the data is transferred;
• request correction of incomplete or inaccurate data;
• request deletion or destruction under the conditions in KVKK Article 7;
• have corrections and deletions notified to third parties who received the data;
• object to a result to your detriment arising exclusively from automated analysis;
• claim compensation for damage caused by unlawful processing.

12.2 GDPR and UK GDPR (EEA and UK)

You may access your data and receive a copy, have it corrected or erased, restrict processing, receive the data you provided in a portable format, object to processing based on legitimate interests (including profiling) and withdraw consent at any time.

12.3 California

You may know what personal data we collect, use, disclose and share, delete or correct it, opt out of its sale or sharing, limit the use of sensitive personal data (we collect none) and not be discriminated against for exercising these rights. To opt out of sharing, use the choices in section 4 or e-mail us; an authorised agent may act for you with proof of authority.

12.4 How to exercise your rights

E-mail support@spaceailabs.ai with the subject "Privacy request", naming the game, the right you are exercising and, if you can, the installation or transaction identifier from the game's settings or store receipt; because our games have no accounts, we may be unable to find your data without it. We may ask you to verify your identity. We respond within 30 days at the latest, and requests are free unless manifestly unfounded or excessive.

12.5 Complaints

If you are not satisfied with our answer, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) in Türkiye, your local data protection authority in the EEA or the Information Commissioner's Office (ICO) in the UK.

13. Changes to this policy

We will update this policy when our games, our partners or the law change. The current version is always at https://spacegameslabs.com/privacy. We will announce material changes in the game or on our website before they take effect and ask for consent again where it is required; minor changes take effect when published.

14. Contact

Space Games Labs, Istanbul, Türkiye, is the controller responsible for this policy. For any privacy question, request or complaint, e-mail support@spaceailabs.ai, our only contact channel.

This policy is governed by the laws of the Republic of Türkiye, and the courts and enforcement offices of Istanbul, Türkiye have jurisdiction over disputes arising from it, without affecting any mandatory consumer or data protection rights you have under the law of the country where you live.