Privacy Policy

What we don't collect: We don't ask for access to your location (GPS), contacts, photos, camera or microphone. Your card and payment details never reach us. The App has no separate analytics (usage tracking) tool. We do not sell your personal data.

• Data controller: [DOLDUR: Veri sorumlusunun adı soyadı veya şirket unvanı]
• Address: [DOLDUR: Tebligat adresi]
• Email: miracakkoyun@clueboundapp.com
• Website: https://clueboundapp.com

Account information

• Your email address, display name, username and the user ID (UID) assigned to you.
• If you sign up with email and password, your password is stored by Firebase Authentication; we cannot see it.
• Sign in with Google: the name, email address and profile photo link that Google shares.
• Sign in with Apple: the name and email address that Apple shares, or Apple's relay address if you use "Hide My Email".
• Technical data processed by Firebase during sign-in for security purposes (e.g. IP address, browser/device information).

Profile and gameplay data

• The preset avatar you choose (there is no photo upload) and your app language.
• Country code: estimated from your device's language/region setting, not your location, and shown as a flag on your profile.
• Statistics such as level, XP, rank, streak, number of stories solved, success rate and best time; the date you last played.
• Your game sessions: the questions you ask and the answers you receive, your solution attempts and match scores, the hints you use, your score and time.
• Your scores and display name are used on the leaderboards.

User content and community

• Stories you write (title, text, solution, hints, red herrings, key facts), your comments and likes, who you follow and who follows you.
• In multiplayer rooms: room details, your display name, avatar and country code, the questions you ask in the room and the scores.
• Reports you submit (reason and an optional note) and reports made about you.
• In-app notifications (e.g. "X followed you").

Feedback and contact

• If you send feedback from within the App: your message, its type (bug/feature/comment), your email address, display name, app version, platform, device model, operating system version and device language.
• If you email us: your email address and the content of our correspondence.

Device, notification and technical data

• Your notification token (Firebase Cloud Messaging token) and notification preferences.
• Crash and error reports (Firebase Crashlytics): error logs, device model, operating system and app version, and a Crashlytics installation ID. Your name, email and user ID are not added to these reports.
• To prevent abuse: the time of your last question and account restriction (ban) details; your user ID and the operation performed in server logs.

Purchase data

• Your Premium status, subscription product, expiry date and store transaction details. Subscriptions are managed through RevenueCat, linked to your Firebase user ID.
• Payments are taken by Apple or Google; your card details are never passed to us or to RevenueCat.

Advertising data (free version)

• Google AdMob processes your device's advertising ID (Android Advertising ID, or the iOS IDFA if you allow it), IP address (including inferring approximate location), device and app information and ad interactions in order to show and measure ads and prevent fraud.
• Where required, Google's consent form (UMP) is shown before ads and your choice is stored. Premium users don't see ads.

Data that stays on your device

Settings such as sound, haptics, language and notification toggles, and whether you've seen the intro screens, are stored only on your device and are removed when you uninstall the App.

Your personal data is collected electronically and automatically through the App and our servers, and processed for the following purposes on the legal bases set out in KVKK Article 5 (and the corresponding GDPR Article 6 bases):

You can't create an account or use the App without providing your account information. You can use the App without consenting to notifications or personalised ads.

We're moving our AI to Anthropic's Claude. Until the move is complete, the requests described below are sent to Google's Gemini API. Once it is complete, the same requests will be sent to the Claude API of Anthropic, PBC (USA); the types of data sent will not change, and we will update this policy. Anthropic does not use data sent through its API to train its models by default.

Cluebound's AI narrator currently runs on Google's Gemini model (Gemini API). Requests are not sent directly from your device; they go through Firebase Cloud Functions on our servers. Gemini is used for four tasks:

• Answering questions: it answers your question with "Yes", "No" or "Irrelevant".
• Scoring solutions: it scores how closely the meaning of your solution matches the story's actual solution.
• Writing hints: it writes a new hint once the author's hints have run out.
• Content moderation: it checks story titles, story text and comments for inappropriate content before they're published.

What is sent to Gemini: the text of your question or solution attempt, the recent question-and-answer history of that game, the story's text, solution and hints, and the text being checked for moderation.

What is not sent: your name, username, email address, user ID and device details are not included in these requests. Even so, we recommend that you don't type your own personal information into free-text fields.

Gemini's answers are generated automatically and can sometimes be wrong. If a moderation decision looks wrong, contact us at miracakkoyun@clueboundapp.com. AI decisions alone do not produce legal effects concerning your account; account restrictions are applied by an administrator.

Google processes data sent to the Gemini API under its Gemini API Additional Terms of Service. [DOLDUR: Is the Gemini API used on the paid tier? On the free tier Google may use submitted content to improve its products; on the paid tier it does not. Update this sentence accordingly.]

We share personal data with the following recipients only as far as needed to provide the service:

What other users can see

Cluebound is a community app. The following is visible to other users in the App: your display name, username, avatar, country flag, rank, level and profile statistics, follower/following counts, the stories and comments you publish, your leaderboard scores and the questions you ask in multiplayer rooms. If you signed in with Google, your Google profile photo may also appear on room screens.

Our service providers' servers are located outside Turkey. Our server operations (Cloud Functions) run in Google's data centre in Belgium, in the European Union (europe-west1). Database location: [DOLDUR: Firestore database region, shown in Firebase Console → Firestore → Settings]. Google, RevenueCat and Vercel may also process data in other countries, including the United States.

These transfers are made under KVKK Article 9. [DOLDUR: Legal basis for the transfer, e.g. KVKK standard contracts signed with the relevant providers and their notification to the Turkish Personal Data Protection Authority.] For users in the European Economic Area, transfers rely on the EU Standard Contractual Clauses offered by the providers.

When these periods end or the reason for processing no longer applies, your data is deleted, destroyed or anonymised. Information we are legally required to keep is retained until that obligation ends.

Under KVKK Article 11 you have the right to:

• find out whether your personal data is processed and, if so, request information about it;
• learn the purpose of processing and whether data is used in line with that purpose;
• know the third parties in Turkey or abroad to whom data is transferred;
• have incomplete or inaccurate data corrected;
• request deletion or destruction of your data under the conditions of KVKK Article 7;
• request that corrections and deletions be notified to third parties to whom the data was transferred;
• object to an outcome against you that results exclusively from automated analysis;
• claim compensation if you suffer damage due to unlawful processing.

Send your request from the email address registered in the App to miracakkoyun@clueboundapp.com, or in writing to [DOLDUR: Tebligat adresi]. Requests are answered free of charge within 30 days at the latest. We may ask for additional information to verify your identity. If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Board.

Users in the European Economic Area

Under the GDPR you have the rights of access, rectification, erasure, restriction of processing, data portability and objection, and you can withdraw consent at any time for processing based on consent. You also have the right to lodge a complaint with the data protection authority in your country.

• Notifications: turn individual notification types off in the App under Settings → Notifications, or turn all notifications off in your device settings.
• Ads: on Android, delete or reset your advertising ID under Settings → Google → Ads. On iOS, turn off app tracking under Settings → Privacy & Security → Tracking. Premium subscribers don't see ads.
• Account and data: delete your account in the App or request deletion by email. Details: Account & Data Deletion.

Cluebound is not designed for children under 13, and we don't knowingly collect data from children under 13. If you become aware that a child under 13 has created an account, write to miracakkoyun@clueboundapp.com and we'll delete the account and its data.

Your data is transmitted over encrypted connections (HTTPS/TLS). Database access is limited by security rules that ensure users can only access data they're authorised to. Secret keys for the AI and payment services are stored server-side, not on your device. No system is completely secure; if a data breach occurs, we will notify affected users and the authorities as required by law.

clueboundapp.com is a static information site: it uses no cookies, analytics, ads or forms, and its fonts are served from our own host. Vercel, which hosts the site, may process access logs (IP address, browser details, requested page) to deliver and secure the site.

We may update this policy as the App or the law changes. The current version is always on this page, and the date at the top changes. We'll announce significant changes in the App or by email.

For any question about this policy or your personal data: miracakkoyun@clueboundapp.com