This policy explains which data is processed when you play the Padelburgh mobile game (the "Game"), why, and what your rights are. It serves as the privacy notice under the EU General Data Protection Regulation ("GDPR") and the Turkish Personal Data Protection Law No. 6698 ("KVKK"). It covers Padelburgh only; Novaurion's website and other products have their own policies.

Data controller: Novaurion Yazılım ve Teknoloji ("Novaurion", "we")
İzmir Teknopark, B2 R&D Building, Gülbahçe Mah. Gülbahçe Cad. No: 1/48 İç Kapı No: 4, Urla / İzmir, Türkiye · info@novaurion.com

1. In short

2. Data that stays on your device

The following never leaves your phone and never reaches us:

• Game save: your club's name, colour and crest; your buildings, courts, in-game money, gems, statistics and badges. Kept in the app's own storage.
• Language preference: Turkish or English.
• Ad preference: your yes/no answer to personalized ads. It is passed to the ad network only as a "consent given / not given" signal (section 4).
• In-game event log: timestamps of in-game moments (e.g. "first court opened"), used to review game balance on the device.

You can reset this data with New Game, or remove it completely by uninstalling the app.

3. Online clubs (Explore)

In the Explore section you can visit sample clubs. Viewing other players' clubs and sharing your own is currently switched off. When it is switched on, it will run on Unity Technologies' Unity Gaming Services ("UGS") and process:

• Anonymous player ID: a random ID generated by UGS, not linked to your name or email.
• Club card: club name, colour, crest, number of courts, matches played and badges. Other players see it in the Explore list.
• Club save: your club's layout and progress (with in-game money and debt removed). Other players can only view your club.
• Technical connection data: such as your IP address when connecting to the server, processed by Unity to provide the service.

About your club name: you type it yourself and, once the feature is on, other players can see it. Don't put your name, surname or other personal information in your club name.

When this feature is switched on, we will update this policy and its effective date.

4. Ads

The Game shows optional rewarded ads: an ad only plays when you tap a button to watch it, and you get an in-game reward in return. There are no forced ads.

• Who serves them: Unity Technologies' LevelPlay ad service and the connected ad network ironSource Ads.
• Data processed: advertising ID (Android Advertising ID; on iOS the IDFA only with your permission), IP address and the approximate location derived from it, device information (model, operating system, language), and ad interactions (impressions, clicks, views).
• Purposes: delivering and measuring ads and preventing fraud; if you allow it, choosing ads based on your interests.
• Your consent: the first time you open the Game we ask "Shall we show ads that suit you?". If you say no, rewarded ads still work but are not personalized. You can change your answer at any time with the ADS button in the main menu.
• How the ad network processes data: Unity Game Player and App User Privacy Policy.

5. In-app purchases

The Game offers optional gem packs. Payment is taken by the app store (Google Play, App Store) under its own terms; your card details never reach us or our service provider.

• Service provider: RevenueCat, Inc. (USA), which validates and records purchases on our behalf as our processor.
• Data processed: a random, anonymous user ID created by RevenueCat; purchase history (product, date, price, currency, the store's transaction ID); device and app information (model, operating system, app version, country) and IP address.
• Purposes: validating purchases, granting gems, completing an interrupted purchase later, preventing fraud.

6. Store and platform data

The store you downloaded the Game from (Google Play, App Store) processes data such as downloads and crash reports under its own policies and only gives us aggregated, anonymous statistics.

7. Purposes and legal bases

• Running the Game and storing your progress: GDPR Art. 6(1)(b); KVKK Art. 5/2-c (performance of a contract).
• Validating purchases and granting gems: GDPR Art. 6(1)(b); KVKK Art. 5/2-c. Keeping purchase records: GDPR Art. 6(1)(c); KVKK Art. 5/2-ç.
• Personalized ads: your consent (GDPR Art. 6(1)(a); KVKK Art. 5/1). Showing and measuring non-personalized rewarded ads and preventing fraud: GDPR Art. 6(1)(f); KVKK Art. 5/2-f (legitimate interest).
• Publishing and visiting online clubs (once switched on): GDPR Art. 6(1)(b); KVKK Art. 5/2-c.
• Security, preventing abuse, removing inappropriate club names, fixing bugs: GDPR Art. 6(1)(f); KVKK Art. 5/2-f (legitimate interest).
• Legal obligations: GDPR Art. 6(1)(c); KVKK Art. 5/2-ç.

8. Sharing

• Unity Technologies and its affiliates (LevelPlay, ironSource Ads): process the data in section 4 to serve rewarded ads. If you allowed personalized ads, the ad network also uses this data to choose ads under its own privacy policy.
• RevenueCat, Inc.: a service provider validating purchases on our behalf and instructions.
• Unity Technologies and its affiliates, Unity Gaming Services (once online clubs are on): a service provider processing data on our behalf and instructions.
• Other players: only the club card and club save described in section 3.
• Authorities: where required by law.

These providers' servers may be outside Türkiye (in the US and/or the EU); transfers follow the applicable rules of the GDPR (e.g. standard contractual clauses) and KVKK Art. 9. We don't sell your data.

9. Retention

• Data on your device: until you delete it (New Game or uninstalling).
• Purchase records: for as long as legal record-keeping obligations require.
• Ad data: for the periods set out in the ad network's own privacy policy.
• Online club data: deleted on request; clubs that haven't connected for 24 months may be deleted.

10. Children

The Game is designed for players aged 13 and over and is not directed to children. We do not knowingly collect personal data from children under 13. For any request about your child, email info@novaurion.com.

11. Your rights

Under GDPR Arts. 15–22 and KVKK Art. 11 you can ask whether your data is processed, access it, learn its purpose and recipients, have it corrected or erased, have recipients notified, object to processing or to a decision based solely on automated processing, receive your data in a portable format, and claim compensation for damage.

Send requests to info@novaurion.com; if you want your online club deleted, include your club's name. We reply within 30 days. You can also complain to your local data protection authority (in Türkiye, the Personal Data Protection Board).

12. Security

Connections to the server are encrypted (HTTPS). The copy shown to other players contains no in-game money or debt. Access to server data is restricted.

13. Changes

When we update this policy we change the date above and publish the new version at the same address; we announce important changes in the Game.