Privacy Policy

Last updated: 15 November 2026

This policy explains which personal data Combo Rivals (the Android app and play.comborivals.com) processes, why and how, how long we keep it, and what your rights are.

1. Who is responsible

Murat Yıldırım
Contact: comborivals@gmail.com

2. In short

• You can play Practice without an account. Your Practice games (moves, score) are not sent to the server; they stay on your device.
• If you signed in before, the menu connects to the server and sends your session token to show that you are signed in.
• Online matches need Google sign-in. We do not store your e-mail address or your real name. Other players only see your nick.
• The game has no ads and no analytics. We do not sell your data.
• You can delete your account in the app at any time.

3. What we store

Your account

• Your Google account id: a fixed number Google gives your account. We use it to recognise you the next time you sign in.
• Your nick, when it last changed, how many times it changed, and when the account was created.
• Nick history: every nick pick, change and admin reset (old and new nick, who made it, when).
• Ban and moderation records: the action (ban, unban, nick reset), when a ban ends, the reason the admin wrote, and when the action happened.

Your sign-in sessions

• A hash of the session token. The token itself stays only on your device.
• When the session was created, last used and when it expires.
• A session expires 180 days after it was last used. An account has at most 10 sessions.

Online matches

• For every finished match: when it started and ended, the number that sets the piece sequence (seed), and the result.
• For every player: nick, score, when the score was reached, the moves, whether the player was connected at the end, and which account played.
• Moves are kept so the server can compute the score and check for cheating.

On your device (not on the server)

• The session token.
• If a match is running: the match id and your seat token, so you can return to the same match if the app closes.

Briefly, in memory only

• Your IP address is kept in the server's memory for a short time, to limit very frequent sign-in attempts. It is never written to the database or the server log.

What we do not store

• E-mail address, real name, profile picture, location, contacts or advertising id.

4. How we collect it

We collect your data through the app and the website, electronically and by automated means:

• When you sign in with Google: from the identity data Google sends, we keep only the account id.
• When you pick or change your nick.
• When you play online: your moves are sent to the server, and the server computes your score.

Ban and moderation records are created electronically with the admin tool on the server, when an admin takes an action. If you e-mail us, you send that e-mail yourself.

5. Why we use it, and on what legal basis

• Creating your account, running online matches, computing your score, sending it to your opponent and deciding the winner. Legal basis: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Preventing cheating and abuse, nick and ban rules, server security and backups. Legal basis: legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• Answering e-mails you send us and requests under the GDPR or KVKK. Legal basis: legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) and a legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).

6. How long we keep it

• Account data: as long as your account exists.
• Sessions: when you sign out, that device's session is deleted. Unused sessions are deleted after 180 days.
• When you delete your account:
  • Deleted at once: the account, the sessions on every device, the nick history and the moderation records.
  • What remains: finished matches keep their scores and moves, under the name "Deleted player" and without any link to your account.
• Backups: daily database backups are kept for 14 days (on the server and in the copies on the controller's computer). A deleted account is gone from the backups within 14 days at the latest.
• Server log: 30 days. Some lines contain user ids and nicks.
• E-mails you send us: 1 year after your request is closed.

7. Who we share it with

• Other players: your nick, and your score during a match.
• Niobe Hosting: the game server and the database run on this provider's server in Turkey.
• Google: for sign-in and e-mail. Details below, under "Transfers outside Turkey".

We do not sell your data and do not use it for advertising.

8. Transfers outside Turkey

In the two cases below, your data is processed by Google, whose servers may be outside Turkey:

• Google sign-in: sign-in goes through Google, and during sign-in Google processes data under its own privacy policy. On the web version, when you open the sign-in screen, the sign-in button is loaded from Google's servers and stays on the page until you close the tab. In the Android app, sign-in goes through Google Play services on your phone.
• Gmail: if you write to comborivals@gmail.com, your e-mail address and your message are kept in that mailbox in Google's Gmail service.

9. Your rights

You can ask us:

• whether we process your data, and for a copy of it;
• why we process it;
• who we have shared it with, in Turkey or abroad;
• to correct it;
• to delete it;
• to tell the people we shared it with about a correction or deletion.

You can also object to processing based on legitimate interests, and to a result of automated processing that goes against you.

Write to comborivals@gmail.com. We answer free of charge within 30 days.

We do not store your e-mail address, so we may not be able to check that an e-mail really comes from the owner of an account. In that case we will point you to the way to do it in the app; for example, account deletion is done in the app.

You can complain to a data protection authority: in Turkey the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), in the EU the authority of your country.

10. Deleting your account

In the app: Menu → Account → Delete account. Details, and what to do if you cannot use the app: Account deletion page

11. Children

Combo Rivals is for players aged 13 and over. If we learn that an account belongs to someone under 13, we delete it.

12. Changes

If we change this policy, we publish the new version on this page and update the "last updated" date.