Privacy Policy
Harfçi is a word game with a short privacy promise: we show no ads, we do not track you outside the store, and we never sell your data. Everything we process is listed below, item by item.
Last updated: 3 September 2026
1.In short
This policy serves both as a privacy notice under the EU General Data Protection Regulation (GDPR) and as an information notice under Turkey's Personal Data Protection Law No. 6698 (KVKK).
2.Who is responsible
The data controller is Lumio Studio. For any question, request or complaint the single contact address is contact@lumiostudio.co.
3.Data we process
Playing requires an account. The table below lists every category of data we collect, where it comes from, and why we process it.
| Data category | Where it comes from | Why we process it |
|---|---|---|
| Account identifier (user id), email address, display name, profile image if there is one | Comes from the provider when you sign in with Google or Apple | Creating your account and keeping you signed in |
| Game progress: solved questions, scores, streaks, achievements, leaderboard entry | Created as you play | Carrying your progress across devices and showing leaderboards |
| Multiplayer room data: room code, players in the room, answers and round results | Created when you join a room | Running the room live and deciding the result |
| Friend list and friend requests | Created when you add someone | Showing your friends and letting you play against them |
| Question generator prompt: the topic you type or say out loud | Only when you use the question generator | Preparing questions on the topic you asked for |
| Device and diagnostic data: app version, operating system version, device model, crash reports | Collected automatically while the app runs | Finding bugs and keeping the app working |
| Subscription status and purchase validation | When you buy Premium | Unlocking and maintaining Premium access |
We never see or store your password. Google and Apple run the sign in and pass us only the identifier, email address and display name for your account. Your payment card details never reach us either.
4.What we use it for
- Creating your account, keeping you signed in, and preserving your progress when you change devices.
- Running solo play, multiplayer rooms, the daily challenge and the leaderboards.
- Delivering friend requests and showing your friend list.
- Preparing new questions from a topic you typed or spoke, when you ask for them.
- Keeping the service safe by blocking abuse and forged requests.
- Finding and fixing crashes and bugs.
- Unlocking, validating and maintaining a Premium subscription.
- Answering you when you write to support.
5.Legal bases
Under GDPR we rely on Article 6(1)(b), performance of a contract, to provide the game to you; Article 6(1)(f), legitimate interests, for security, debugging and abuse prevention; and Article 6(1)(a), consent, for optional device permissions such as the microphone.
Under KVKK we rely on Article 5(2)(c), direct connection to the conclusion and performance of a contract; Article 5(2)(ç), compliance with a legal obligation; and Article 5(2)(f), legitimate interests. Device permissions rely on your explicit consent, given at the moment you grant them.
6.Our service providers
A small number of providers keep the game running. Each acts as a processor, works only on our instructions, and receives only what is listed here.
| Provider | What it is used for | What reaches it |
|---|---|---|
| Google (Firebase Authentication) | Sign in with Google and Sign in with Apple | Account identifier, email address, display name |
| Google (Cloud Firestore) | Profile, progress, leaderboard and friend records | Account identifier and game data |
| Google (Firebase Realtime Database) | Live state of multiplayer rooms | Room code, player names, answers and round results |
| Google (Firebase App Check) | Blocking forged and automated requests | A device signal that proves the app is genuine |
| Google (Gemini model through Firebase AI Logic) | The optional question generator | Only the topic text you typed or spoke |
| Adapty | Managing subscription status and validating purchases | An anonymous subscriber identifier and subscription status |
| Apple and Google (the app stores) | Taking payment and managing the subscription | Payment details stay with the store and never reach us |
7.International transfers
The providers above operate servers outside Turkey and outside the European Economic Area, so your data may be processed abroad. Transfers are made under data processing agreements and standard contractual clauses, in line with the GDPR rules on international transfers and with Article 9 of the KVKK.
8.Microphone and speech recognition
The app may ask for microphone and speech recognition permission. It exists for one thing only: if you would rather say a topic to the question generator than type it, your speech is turned into text. We do not record audio otherwise, we do not listen in the background, and we do not store audio files. The transcribed topic is sent to our provider so questions can be prepared. You can withdraw the permission at any time in your device settings, and the rest of the game works fully without it.
9.No ads, no tracking, no selling
- There is no advertising network in the app. We show no banners, no interstitials and no rewarded video.
- We do not read your advertising identifier and we do not track you across other apps or websites.
- We do not sell, rent or share your personal data for advertising.
- We do not use your profile for marketing profiling.
10.How long we keep it
We keep the data attached to your account for as long as the account exists. When you delete your account we permanently erase it and the game data attached to it within 30 days at the latest. Multiplayer room records clear themselves shortly after a game ends. Diagnostic and crash records are kept for the provider's retention period and are not matched to your identity. Records we are legally required to keep are held only for that period and only for that purpose.
The full deletion steps are on the delete account page.
11.Security
Data is encrypted in transit. Access to account data is restricted by rules so that you can only reach records belonging to your own account, and requests to our servers are verified as coming from the genuine app. No system is completely secure, so we also recommend you keep the sign in method that protects your account safe.
12.Children
Harfçi is not directed at children. We do not knowingly collect data from anyone under 13. If we learn that we have, we delete it without delay. As a parent or guardian you can report this to us at contact@lumiostudio.co.
13.Your rights
Under GDPR
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. Where processing is based on consent you may withdraw it at any time, which does not affect the lawfulness of processing carried out before the withdrawal. You also have the right to lodge a complaint with your supervisory authority.
Under KVKK
Article 11 gives you the right to learn whether your data is processed, to request information about it, to learn the purpose and whether it is used accordingly, to know the third parties it is transferred to at home or abroad, to have it corrected if incomplete or wrong, to request its erasure or destruction, to have those actions notified to the parties it was transferred to, to object to a result reached solely by automated analysis, and to claim compensation if unlawful processing caused you damage.
Making a request
Send your request to contact@lumiostudio.co. After we verify your identity we will conclude it within 30 days at the latest.
14.Changes
When we update this policy we change the last updated date above. If a change is significant we will also tell you inside the app.