Apexx · Privacy Policy
1. Who we are
Apexx is a drift-duel game for Android. The person who runs the game and is the data controller (KVKK "veri sorumlusu"; GDPR "controller"):
- Kerem Serhat Gökceoğlu (developer name on Google Play: ECELA)
- Contact: support@ecelagames.com
This policy covers the Android app, its servers and the pages at https://apexx.ecelagames.com. It is also our notice under Article 10 of Turkish Law No. 6698 (KVKK) and Article 13 of the GDPR for players in the EU/UK.
2. In short
- We do not ask for your name, e-mail or phone number to play. On first launch a guest account is created for you, with a generated driver name such as "Sürücü12345" (Turkish phones) or "Driver12345" (other languages).
- You can link the account to Google or Google Play Games so it survives a phone change. Linking is required to buy anything.
- Your driver name and plate are visible to other players. Do not choose a name or plate that reveals who you are.
- There is no chat; only four preset emotes. We do not ask for location, contacts, camera, microphone or photos.
- We do not sell personal data. The game shows optional rewarded video ads (Google AdMob): you see one only when you tap an ad button; there are no banners and no pop-up ads. The ad software receives your phone's advertising ID and other device data (see 3 rows 15–16, and 12).
- You can delete your account in the game or on the web: it waits 14 days, and you can cancel (CANCEL) during that time.
3. What data we process
| # | Data | When it arises | Purpose | Legal basis (KVKK art. 5/2 · GDPR art. 6) |
|---|---|---|---|---|
| 1 | Account identifiers: a random player ID; the user ID of the sign-in provider (Google Firebase Authentication); sign-in type (guest / Play Games / Google) | First launch; when you link | Run the account, recognise you, restore the account on a new phone | Performance of a contract (c) · 6(1)(b) |
| 2 | Linked Google account details: if you link Google, your e-mail address and profile name stay with Google's sign-in service (Firebase); our database does not store your e-mail | When you link | Verification, account recovery, purchase security, deletion from the web | (c) · 6(1)(b) |
| 3 | Driver name and plate: generated "Sürücü" or "Driver" (by phone language) + digits, changeable (3–16 characters; the plate has at most 11 letters/digits). Selected car, cosmetics | At account creation; when you change them | Your identity shown to other players; matchmaking, rankings, friends | (c) · 6(1)(b) |
| 4 | Game progress: Credits / Prisms / Charge balances and the wallet ledger, garage (cars, parts, upgrades, cosmetics), Capsules, level, daily-gift streak, missions, achievements, season and Season Pass progress, league and a hidden skill rating | As you play | Provide the game, grant rewards, balance matchmaking | (c) · 6(1)(b) |
| 5 | Race data: duel results and times, stars/points, rematches; your steering commands during a duel (sent to the referee server); the command record of a practice run (uploaded for record verification) | When you race | Run the duel, verify results, prevent cheating, record lists | (c) · (f) · 6(1)(b),(f) |
| 6 | Rankings and records: weekly 50-player groups, song record lists; your name, plate, car and time/score appear on the list | When you enter a ranking | The competitive feature | (c) · 6(1)(b) |
| 7 | Social: friend list, requests and invites, your head-to-head score with each friend, your blocked players, players you met in the last 30 days, online status shown to your friends | If you add a friend / block | Friend duels | (c) · 6(1)(b) |
| 8 | Purchase records: product, amount and currency, date, Google Play order number, purchase token (stored encrypted), refund status. We never see card or payment details; Google Play takes the payment | When you buy | Deliver what you bought, refunds and fraud checks, accounting/tax retention duty | (c), (ç) · 6(1)(b),(c) |
| 9 | Mail: system notices, reward and compensation letters | When the game sends one | Deliver rewards and notices | (c) · 6(1)(b) |
| 10 | Technical and crash records: a random install ID (not linked to your account), app version, platform (Android), device model, the screen you were on, error type and a shortened, scrubbed error trace; named events such as "an ad failed to load" (no player ID). E-mail addresses, keys and addresses are removed on the device and again on the server | When an error occurs; when the app closes abnormally | Keep the game working, find bugs | Legitimate interest (f) · 6(1)(f) |
| 11 | Server and network logs: the IP address and time of a request, for rate limiting and security; debug logs (scanned so they carry no keys or e-mail addresses) | Every connection | Security, abuse prevention, outage detection | (f) · 6(1)(f) |
| 12 | Support messages: whatever you write when you e-mail us | If you write | Solve your problem | (c)/(f) · 6(1)(b)/(f) |
| 13 | Player reports: if you report someone with REPORT: the reported player's ID, the reason (name, plate, harassing emotes, cheating, other), the duel ID if there is one, what the reported name and plate said at that moment, and the time. There is no free text; the reported player does not see who reported | When you press REPORT | Prevent abuse, harassment and cheating; user-content moderation | (f) · 6(1)(f) |
| 14 | Data that stays on your phone: settings, offline cache, practice records and personal ghosts, the install ID | As you play | Make the game work | On your device; not sent to us (exceptions: 5 and 10) |
| 15 | Ad records on our server: when you tap a rewarded-ad button our server makes an ad ticket: your player ID, what the ad is for (Charge, Capsule wait or Credits ×2), the day, its state and time. When Google confirms the ad was watched (server-side verification), Google's server sends our server a signed message with a one-time transaction ID, the ad unit and a time; we keep that record without your player ID. We hand your player ID to AdMob only as the "user ID" of the ticket so the confirmation can be matched to it: no name, e-mail or other game data goes with it. Club members take the reward without a video and make no ad request | When you tap an ad button | Give the reward once and only if the ad was watched; enforce the daily limits; fraud prevention | (c) · (f) · 6(1)(b),(f) |
| 16 | Data the ad software collects (Google AdMob): the Google Mobile Ads SDK inside the game collects and sends to Google your phone's advertising ID (unless you deleted it, see 12), IP address and the approximate location derived from it, device and app information (model, Android version, language, app name and version) and ad performance data (ad loaded, shown, clicked, closed, reward earned). Google handles this under its own privacy policy as an independent controller. We do not receive this data and never see your advertising ID | While the ad software runs: it starts in the background once you are online, and an ad is shown only when you tap | Show and measure ads, limit repeats, prevent ad fraud, fund the game | Legitimate interest (f) · 6(1)(f) |
We do not collect: real name, date of birth, phone number, address, GPS location, contacts, photos, microphone, camera, files, SMS. Unity's analytics and crash services are switched off. There is no free-text chat. The only places where an advertising ID or an IP-based approximate location is involved are rows 11 (our own server logs) and 16 (the ad software, which sends it to Google).
Known limit: a guest account's identity lives only on your phone. If you lose the phone and never linked the account, we cannot recover it.
4. How others see you
- Your opponent: when a duel is matched, your driver name, plate, car, league band and tier are shown to your opponent. During a race you can send one of four preset emotes; emotes are not stored (the server only counts them).
- Rankings and record lists: name, plate, car, time/score.
- Search: anyone who types your name exactly can find you and send a friend request (there is no partial search; players who block each other cannot find each other). Your friends can see whether you are online and when you were last seen.
- You stay in control: you can change your name (the first change is free, later ones cost in-game currency), block players and mute emotes (Settings → BLOCKED PLAYERS). Inappropriate driver names and plates are filtered (the same blocklist); a name or plate that breaks the rules can be reset. You can report an inappropriate player in the game with REPORT (section 3, row 13).
5. AI opponents and automated processing
- AI opponents may be used in matchmaking (details: Terms of Use). They are not real people; in duels against them only your data is created. They are not built from other players' personal data or race recordings.
- Matchmaking uses a hidden skill rating (Glicko-2) and your car's class. It is used only to pair players in the game and has no legal or similarly significant effect.
- Anti-cheat: your race records are replayed on the server to verify them. A suspicious race may not count; decisions such as restricting an account are made by a person.
6. Who we share data with
We do not sell personal data, and we do not give advertisers your game data (driver name, plate, progress, purchases). The following are service providers that process data on our behalf, plus the ad provider described in section 12:
| Provider | For | Where |
|---|---|---|
| Google (Firebase Authentication, Google Play Games, Google Play Billing and Play Console) | Sign-in, account linking, payments and purchase verification, Play's crash/ANR statistics | Worldwide, including the US |
| Cloudflare | Our servers (API, race server, scheduled jobs), race-evidence storage, network protection and rate limiting | Servers in Europe (Eastern Europe region); traffic passes through Cloudflare's global network |
| PlanetScale (on Amazon Web Services) | Database (accounts, progress, ledger) | Frankfurt, Germany |
| Google AdMob (Google Mobile Ads SDK; rewarded ads and server-side verification) | Show the rewarded ads you ask for; confirm to our server that an ad was watched (section 12) | Worldwide, including the US |
For Play, Play Games and AdMob, Google also acts as an independent controller under its own privacy policy. For crash reporting we may later add a provider (Sentry, EU region, IP address off); the table will be updated.
Also: (a) other players, as described in 4; (b) public authorities where required by law; (c) a successor in a business transfer (bound by this policy).
7. Transfers outside Türkiye / the EEA
Some providers are outside Türkiye; your data is transferred abroad. Under KVKK art. 9 this relies on appropriate safeguards (standard contract) and, where required, notification to the Board. For players in the EU/UK, GDPR chapter V safeguards apply (standard contractual clauses / the Data Privacy Framework). Our race and database servers are in Europe.
8. How long we keep it
| Data | Retention |
|---|---|
| Account, profile, progress, wallet, garage, social, rankings | While the account is open; deleted 14 days after a deletion request (section 9) |
| Wallet ledger (Credits / Prisms movements) | On deletion your identity is removed and replaced by a random code that cannot be matched to you; the rows stay for economy totals |
| Duel results | Kept because they are also your opponent's record; your row shows "DELETED DRIVER" |
| Practice-run command records (record verification) | 90 days; deleted with the account if you delete it |
| Technical/crash records (by install ID) | 90 days |
| An unclaimed-reward letter until claimed; claimed/read notices 30 days; never-opened notices 60 days | |
| Purchase records (order number, product, amount, date) | 5 years after the end of the year of purchase (Turkish Tax Procedure Law art. 253). They remain after account deletion because of a legal duty |
| Record of the deletion itself (time stamp and a digest code of your ID) | At least 3 years (KVKK Deletion Regulation art. 7) |
| Support and complaint messages (player reports included) | 1 year; if you delete your account your ID is replaced by a random code and the text stays until the year is over |
| Ad tickets on our server (row 15) | While the account is open; deleted with the account (section 9). The one-time transaction record from Google carries no player ID or other personal data and stays |
| Data the ad software sends to Google (row 16) | Google's own retention, under its privacy policy; we cannot delete it. Deleting your account does not change it; you can delete your advertising ID (section 12) |
| Server / network logs (Cloudflare) | Short-lived (days); the length of Cloudflare's log window |
| Database backups | Drop out on their own; at most 30 days |
| Guest account that is not used at all for 12 months | The server deletes it by itself (through the normal deletion: a 14-day wait, CANCEL possible). Accounts linked to Google or Play Games are never touched |
When a period ends the data is deleted, destroyed or made unable to identify anyone.
9. Deleting your account
Two ways:
- In the game: Home → the gear in the top bar → SETTINGS → bottom ACCOUNT section → DELETE ACCOUNT → press and hold "HOLD TO DELETE" for 2 seconds. Works for every account type; a guest account can only be deleted here.
- On the web:
https://apexx.ecelagames.com/delete-account(Turkish:https://apexx.ecelagames.com/hesap-sil). If you linked your account to Google, sign in with the same Google account and delete; you do not need your phone. If you sign in with Play Games, your Play Games identity cannot be verified on the web; delete in the game. If you cannot reach the game at all, write to support@ecelagames.com; if we can verify the account is yours we start the request (we do not delete an account we cannot verify).
How it works: the account closes at once (duels, shop and rewards stop). It then waits 14 days; if you press CANCEL the account reopens exactly as it was. When the time is up, a job that runs once a day deletes the account. During the wait your name may still appear on ranking lists; it leaves them when the deletion completes.
Deleted: your account and sign-in record (including the user at the sign-in provider); your driver name, plate, garage, cars, cosmetics; your league, ranking, season, mission and race records; the race evidence you uploaded; your identity in purchase records and the provider receipt; your identity in wallet movements; your ad tickets; practice records on your phone (cleared the first time you open the game after deletion).
Kept: (1) the legally required purchase record (order number, product, amount, date; it carries no name or account ID, but the order number can match your purchase in Google's records — so we do not treat it as unidentifiable); (2) the record of the deletion (≥ 3 years); (3) your opponents' duel records ("DELETED DRIVER"); (4) support messages (under a random code); (5) backups until they expire.
Purchased virtual currency and items on a deleted account are not refunded; refunds follow Google Play's rules separately (Terms of Use).
10. Your rights
Under KVKK art. 11 — and, for players in the EU/UK, GDPR arts. 15–22 — you can ask: whether your data is processed; for information; the purpose and whether it is used accordingly; who it is transferred to; correction of incomplete or wrong data; deletion/destruction; that these are notified to recipients; restriction or objection; compensation for loss caused by unlawful processing; (GDPR) data portability.
How: write to support@ecelagames.com (subject: "Personal data request"). We answer within 30 days at the latest, normally free of charge. To verify you we may ask for your driver name, plate and (if any) linked Google account; never send a password.
Complaints: if you are not satisfied you can complain to the Turkish Personal Data Protection Board (KVKK art. 14; kvkk.gov.tr). Players in the EU/UK can complain to their local data-protection authority.
11. Security
Connections are encrypted (https/wss); store builds of the game refuse unencrypted connections. Purchase tokens are stored encrypted; the identifier we send to Google to bind a purchase to your account is a one-way value derived from your player ID. Only the authorised operator can open the admin panel, and its actions are logged. No system is perfect; if a breach occurs we notify the authority and affected people as required (KVKK art. 12/5, GDPR arts. 33–34).
12. Ads (optional rewarded ads)
What you see. Apexx has rewarded video ads only, and only if you choose to watch one: for example the WATCH AD button on the out-of-Charge screen (+Charge) and the ad button that shortens the wait by 60 min on a Capsule screen. Daily limits are shown on the button. There are no banners, no pop-up (interstitial) ads and no ads during a race. Nothing in the game needs an ad: Charge also refills with time or Prisms. Club members take the same rewards without a video.
Who. The ads come from Google AdMob (the Google Mobile Ads SDK in the game). Google receives the data in section 3, row 16, and acts as an independent controller under Google's privacy policy (policies.google.com/privacy; how Google uses data from apps that use its services: policies.google.com/technologies/partner-sites).
How the reward is checked. After the video, AdMob's server sends a signed confirmation ("server-side verification") to our server; only then does our server give the reward, once. If you close the ad early, or the confirmation does not arrive, no reward is given. Row 15 lists what we store.
How ads are requested. For everyone: non-personalised (ad personalisation is switched off), treated as ads for players aged 16–17 (AdMob's "teen" setting) with a maximum content rating of "Teen", and the game is not directed at children (section 13). Non-personalised ads still use device identifiers such as the advertising ID for limiting repeats, measuring ads and preventing fraud. The ad software starts in the background once you are online, before you tap any ad button; no ad is shown until you tap.
Your advertising ID and choices. You can delete or reset the advertising ID in your phone's settings (on most phones: Settings → Privacy → Ads, or Settings → Google → Ads; the menu name differs by maker): after deleting it, apps receive an empty ID. You can also simply never tap an ad button. For Google's own controls see adssettings.google.com.
Where the game is offered. For now the game is distributed in Türkiye only. Before it is offered in the EEA, the United Kingdom or Switzerland we will show Google's consent prompt before any ad request and update this policy.
Updates. The Google Play "Data safety" form and this policy describe the same data; a new ad type or ad provider changes both before it ships.
13. Children
Apexx is designed for people aged 16 and over and is not directed at anyone under 16; we do not knowingly collect their personal data. The ads in the game are not aimed at children and are requested in the teen setting described in section 12. If we learn that someone under 16 has an account we delete it; if you think this happened, write to support@ecelagames.com. Players under 18 should use the game with a parent's or guardian's permission; purchases require a parent's or guardian's permission (Terms of Use).
14. Our web pages
Pages at https://apexx.ecelagames.com use no cookies or trackers. On the account-deletion page, Google's sign-in component (gstatic.com) is loaded only when you press the Google sign-in button; the session is not stored in your browser and ends when you close the page.
15. Changes
We may update this policy. For significant changes we show a one-time notice in the game; the current version is always at this address. Version and effective date are above.
16. Contact
support@ecelagames.com · Controller: Kerem Serhat Gökceoğlu (ECELA)