Privacy Policy

Data controller

The data controller is Okan Can Bolayır, Baslik Sokak No 1, Nisbetiye, 34340 Besiktas/Istanbul, Turkiye. For privacy questions and requests write to privacy@lootmastergame.com.

Playing on your device and online features

When you play without online features, your save stays on your device and is not sent to us.

When you use online features (a server account, guilds and guild chat, the Arena, leaderboards and purchase verification), the data below is processed on our game server.

Data we process

Account and device ID

• What: your account number, a random device ID created by the game on your device, a one-way hash of the device secret, and the times your account was created and last signed in. We do not use the advertising ID (IDFA or GAID).
• Why: to sign you in and link your account to your device. Legal basis: performance of our contract with you (KVKK art. 5/2-c, GDPR art. 6/1-b).

Game data

• What: your progress, items, currencies and in-game mail, your age group, your privacy choices, and your monthly spending total (used for the spending limit for players under 18).
• Why: to run the game and to protect younger players. Legal basis: performance of our contract and compliance with our legal obligations (KVKK art. 5/2-c and 5/2-ç, GDPR art. 6/1-b and 6/1-c).

Game activity log

• What: the game actions you take (for example opening a chest) and their results and times.
• Why: to prevent cheating and abuse, find errors and help you when you contact support. Legal basis: our legitimate interests (KVKK art. 5/2-f, GDPR art. 6/1-f).

Guilds and chat

• What: guild names and descriptions, guild membership and contributions, chat messages, reports you send, the players you block, and moderation actions such as a chat mute.
• Who sees it: anyone can see guild names and descriptions. Your chat messages are seen by your guild members. Messages pass through a word filter. Players under 13, and players who have not chosen an age group, cannot write in chat.
• Why: to provide guilds and chat and to keep chat safe (handling reports, stopping harassment). Legal basis: performance of our contract and our legitimate interests (KVKK art. 5/2-c and 5/2-f, GDPR art. 6/1-b and 6/1-f).

Arena and leaderboards

• What: a player tag made from your account (not your real name), your Arena rating, wins and losses, Power, highest stage and your defending hero's equipment. Other players can see these.
• Why: to match you with opponents and show rankings. Legal basis: performance of our contract (KVKK art. 5/2-c, GDPR art. 6/1-b).

Purchases

• What: the store (Apple or Google), transaction number, product, reference price, date and refund status. Your payment details (such as your card) stay with Apple or Google and never reach us.
• Why: to deliver what you bought, handle refunds and keep the records that tax law requires. Legal basis: performance of our contract and compliance with our legal obligations (KVKK art. 5/2-c and 5/2-ç, GDPR art. 6/1-b and 6/1-c).

Connection data

• What: your IP address and the time and address of each request to our server.
• Why: to keep the server secure and running and to limit abuse. Legal basis: our legitimate interests (KVKK art. 5/2-f, GDPR art. 6/1-f). We do not work out your location from your IP address.

Data that stays on your device

• Your save, its backups and your settings are kept on your device.
• Only if you allow it (players aged 16 and over), the game keeps a log of game events on your device to help us balance the game. This log is not sent to us. You can withdraw your permission at any time in Settings » Privacy choices.

Support messages

• If you email us, we process your email address and your message to answer you. Legal basis: our legitimate interests and, for requests about your rights, our legal obligations.

Data we do not collect

• Your name, phone number or postal address, or your email address unless you write to us.
• Your location, contacts, photos, camera or microphone.
• The advertising ID. We use no advertising, analytics, tracking or crash reporting tools and we do not track you across other apps or websites.
• Your payment card details.

Who we share data with

• Our hosting provider, DigitalOcean, LLC, which runs our servers in Germany (Frankfurt). It acts as a data processor and only on our instructions.
• Cloudflare, Inc.: runs the DNS of our domain and hosts our web pages, protects connections to the game server against attacks (it processes your IP address to do this) and forwards emails you send us to our inbox. It acts as a data processor.
• Apple and Google: we ask their stores to confirm your purchases. Their own privacy policies apply to the payments they process.
• Other players: guild names and descriptions, your chat messages (to your guild), and your Arena tag and results.
• Authorities, when the law requires it.

We do not sell your data and we do not use it for advertising.

International transfers

Our servers are in Germany (Frankfurt). If this is outside Türkiye, your data is transferred under the safeguards of KVKK art. 9, such as the standard contracts announced by the Personal Data Protection Board. For players in the EU, transfers rely on the safeguards in Chapter V of the GDPR.

How long we keep data

• Account, game data, activity log, guild and Arena data: until you delete your account.
• Chat: your guild shows only its latest messages. Our moderation copy of your messages is kept until you delete your account.
• Purchase records: when you delete your account they are separated from it, made anonymous and kept for the period required by tax and accounting law.
• Server access logs (IP address): up to 14 days.
• Backups: deleted data drops out of our backups within 14 days at the latest.
• A record that an account was deleted (the account number and the time) is kept to prove the deletion.

Deleting your account and data

You can delete your data at any time in the game: Settings » Account » Delete my data. If you have an online account, it is deleted from our server too. If you cannot open the game, follow the steps on Delete your account.

Children

When it first starts, the game asks for your age group, with no answer selected in advance. For players under 13, writing in chat and the optional event log are off and a monthly spending limit applies. Players under 18 also have a monthly spending limit. Players under 16 are not asked for optional permissions.

If you are a parent and want information about your child's data or want it deleted, write to privacy@lootmastergame.com.

Your rights

Under KVKK art. 11 and the GDPR you have the right to know whether your data is processed, to get information about it and a copy of it, to have it corrected or deleted, to object to or restrict its processing, to data portability and to withdraw your consent.

Send your request to privacy@lootmastergame.com or in writing to Baslik Sokak No 1, Nisbetiye, 34340 Besiktas/Istanbul, Turkiye. So that we can find your account, include the Player ID shown in Settings. We answer within 30 days at the latest.

You can also complain to the Personal Data Protection Board in Türkiye or to the data protection authority of your country in the EU.

Security

The connection between the game and our server is encrypted (HTTPS and WSS). The device secret is stored on the server only as a one-way hash. Administrative access is limited and logged. If a data breach happens, we notify the authority and the affected players within the legal time limits.

Changes to this policy

If we change this policy, we publish the new version with a new effective date on this page and announce important changes in the game.

Contact

Okan Can Bolayır, Baslik Sokak No 1, Nisbetiye, 34340 Besiktas/Istanbul, Turkiye. Email: privacy@lootmastergame.com. For help with the game see Support.